cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
manjunathmeti
SplunkTrust
Member since: ‎09-29-2015
‎09-04-2023
Community Statistics
Posts 952
Solutions 229
Karma Given 27
Karma Received 299
Member Since ‎09-29-2015
Activity Feed
Topics I've Started
View All

Re: How to use props.conf to parse json file in sp...

by SplunkTrust in Getting Data In
‎09-03-2023 10:51 PM
‎09-03-2023 10:51 PM
hi @camellia, You need to configure these in the forwarder not on the indexer servers. Also,  KV_MODE = json is search time configuration, not index-time configuration. Set INDEXED_EXTRACTIONS = JSON for your sourcetype in props.conf. Deploy props.conf and transforms.conf in your forwarder. [itsd] DATETIME_CONFIG = CURRENT INDEXED_EXTRACTIONS = JSON LINE_BREAKER = ([\r\n]+) category = Structured disabled = false pulldown_type = true TRANSFORMS-null1 = replace_null TRANSFORMS-null2 = replace_null1   ... View more

Re: extract new fields

by SplunkTrust in Splunk Enterprise Security
‎09-03-2023 10:44 PM
‎09-03-2023 10:44 PM
hi @lucky, Try this: | rex "\-(PUT|GET|POST|DELETE)(?<url>[\/A-z]+).*Responsecode=(?<ResponseCode>\d+)" Sample query: | makeresults | eval _raw="message: INFO [nio-8443-exce-8] b. b. b.filter.loggingvontextfilter c.c.c.c.l.cc.f.loggingcintextfil=ter.post process(Loggingcintextfilter.java\"201)-PUT/actatarr/halt/liveness||||||||||||METRIC|--|Responsecode=400|Response Time=0" | rex "\-(PUT|GET|POST|DELETE)(?<url>[\/A-z]+).*Responsecode=(?<ResponseCode>\d+)" ... View more

Re: Dashboard dropdown filter search query and ass...

by SplunkTrust in Dashboards & Visualizations
‎08-27-2023 08:58 PM
‎08-27-2023 08:58 PM
You must have field values in all these fields app, sts, bookingReference and cal for the events with field mtd contains PATCH/GET values ... View more

Re: Splunk Memory limit configuration

by SplunkTrust in Deployment Architecture
‎08-27-2023 08:54 PM
‎08-27-2023 08:54 PM
This is not supported natively in Universal Forwarder now. You could do this at OS/user levels. There will be negative impacts on performance if the forwarder workload requires memory more than the specified limit. But you can optimize the forwarder workload, check this: https://community.splunk.com/t5/Getting-Data-In/Is-there-a-way-set-CPU-and-Memory-consumption-for-splunkd/m-p/315912/highlight/true  ... View more

Re: Dashboard dropdown filter search query and ass...

by SplunkTrust in Dashboards & Visualizations
‎08-27-2023 08:38 PM
‎08-27-2023 08:38 PM
Try putting * in quotes. app=BP* sts=* | table at,req.bookingReference,app,mtd,cid,sts,dur,rsc,cal,req.offerOptionCode | rename req.bookingReference as bookingReference, req.offerOptionCode as offerOptionCode| search app="*" mtd="*" sts="*" bookingReference="*" cal="*" | sort by at asc ... View more

Re: Issues with TIME_ROMAT Field in props.conf fil...

by SplunkTrust in Security
‎08-27-2023 08:34 PM
1 Karma
‎08-27-2023 08:34 PM
1 Karma
@SplunkDash , Your time prefix needs to change. Also, don't set MAX_TIMESTAMP_LOOKAHEAD if your timestamp is in the text following the end of the TIME_PREFIX regex match. Try this: [sourcetype] SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+) TIME_PREFIX=.+\|[\d\.]+\|\d+\|\| TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N # MAX_TIMESTAMP_LOOKAHEAD=30 TRUNCATE=2500   ... View more

Re: Extracting fields from HTML event

by SplunkTrust in Splunk Enterprise
‎04-18-2023 05:20 AM
‎04-18-2023 05:20 AM
hi @bmanikya , Try this query: | rex max_match=0 "\<TD\>(?<Cluster>[\w\s]+)\<\/TD\>\<TD\>(?<BlockSize>\d+)\<\/TD\>" | eval zip=mvzip(Cluster, BlockSize) | mvexpand zip | eval zip=split(zip, ","), Cluster=mvindex(zip, 0), BlockSize=mvindex(zip, 1)   Testing sample: | makeresults | eval _raw="<HTML><BODY><TABLE border=\"1\"><TH style=background-color:#00FFFF>Cluster</TH><TH style=background-color:#00FFFF>BlockSize</TH> <TR bgcolor=#ABEBC6><TD>GCS E1</TD><TD>41008</TD></TR><TR bgcolor=#ABEBC6><TD>VPay E1</TD><TD>18994</TD></TR><TR bgcolor=#ABEBC6><TD>Cadence E1</TD><TD>35345</TD></TR><TR bgcolor=#ABEBC6><TD>GCODS E1</TD><TD>3312</TD></TR><TR bgcolor=#ABEBC6><TD>EDMS E1</TD><TD>3715</TD></TR><TR bgcolor=#ABEBC6><TD>Nemo E1</TD><TD>3366332</TD></TR></TABLE></BODY></HTML>" | rex max_match=0 "\<TD\>(?<Cluster>[\w\s]+)\<\/TD\>\<TD\>(?<BlockSize>\d+)\<\/TD\>" | eval zip=mvzip(Cluster, BlockSize) | mvexpand zip | eval zip=split(zip, ","), Cluster=mvindex(zip, 0), BlockSize=mvindex(zip, 1)     ... View more

Re: How to speed up Splunk query that uses appendc...

by SplunkTrust in Splunk Search
‎04-18-2023 05:12 AM
1 Karma
‎04-18-2023 05:12 AM
1 Karma
Thank you 🙂 ... View more

Re: How to speed up Splunk query that uses appendc...

by SplunkTrust in Splunk Search
‎04-18-2023 03:12 AM
1 Karma
‎04-18-2023 03:12 AM
1 Karma
hi @POR160893, You can move where command in the main search, | inputlookup user_identities.csv where L6MgrName="John Doe" AND NOT businessemail="dellteam" AND businessemail="*" | eval copy=mvrange(0,3) | mvexpand copy | eval rnd=random() | sort 0 rnd | fields - copy rnd | rex field=businessemail "(?<businessemail>[^@]+)@[^.]+\.com" | eval businessemail=replace(businessemail, "\.", " ") | fields businessemail ... View more

Re: How to extract matched data from different ind...

by SplunkTrust in Splunk Search
‎04-17-2023 11:53 PM
‎04-17-2023 11:53 PM
Try this: index= x source= xtype | spath application | search application= x app " saved note" RCVD | rex field=" actionid"=(?<actionid>.*)", | rex field =log " manid=(?<mandid>.*?)", | rex field=log "bid=(?<bid>.*" | rex field= log " state=(?<state>.*" | eval starttime=_time | table _time,bid,mandid,actionid,state | apppend [ index=y sourcetype=yytype source=y "VALIDATION SUCESS" " msg got" | rex field =msg " manid\:(?<mandid>.*?)", | rex field=msg "actionid"\:(?<actionid>.*" | table _time manid actionid | eval endtime=_time ] | stats values(*) as * by mandid | eval duration=endtime-starttime ... View more

Re: How to extract matched data from different ind...

by SplunkTrust in Splunk Search
‎04-17-2023 11:28 PM
‎04-17-2023 11:28 PM
hi @Sekhar, You can join both queries using append and stats. index= x source= xtype | spath application | search application= x app " saved note" RCVD | rex field=" actionid"=(?<actionid>.*)", | rex field =log " manid=(?<mandid>.*?)", | rex field=log "bid=(?<bid>.*" | rex field= log " state=(?<state>.*" | table _time bid,mandid,actionid,state | apppend [ index=y sourcetype=yytype source=y "VALIDATION SUCESS" " msg got" | rex field =msg " manid\:(?<mandid>.*?)", | rex field=msg "actionid"\:(?<actionid>.*" | table _time manid actionid ] | stats values(*) as * by mandid, actionid ... View more

Re: Use wildcard in Multi fields in lookup table

by SplunkTrust in Alerting
‎04-17-2023 11:19 PM
‎04-17-2023 11:19 PM
hi @Erfan, This is working for me, make sure your file contains data in the below format. There should not be any space b/w fields and values. src,dst,protocol,user,whitelisted 192.168.10.1,120.18.97.6,*,*,true 192.168.10.5,*,*,*,true *,*,https,bob,true    ... View more

Re: Rex field extraction

by SplunkTrust in Splunk Search
‎04-17-2023 11:04 PM
‎04-17-2023 11:04 PM
hi @chanhee1 , Try this: Updating the answer with @ITWhisperer regex.     | makeresults | eval query="SELECT /*4/18 test */ DRTA_SEQ\r\n FROM DATA_REQ_LIST\r\n WHERE DATE < TO_DATE('2023-04-18 06:00:00', 'YYYY-MM-DD HH24:MI:SS')\r\n" | append [| makeresults | eval query=" with my_index as (\n select index_name from ALL_indexes where table_owner = :1 \n /* test select index_name from CHAN_indexes where table_owner = :schema_name and table_name in ( :[*object_names] )\n *//* test select * from Chanlist */"] | rex max_match=0 field=query "\/\*\s?(?<test>.+)(?>\*\/)" | mvexpand test     ... View more

Re: Is there a better way to install the universal...

by SplunkTrust in Installation
‎04-12-2023 10:42 PM
‎04-12-2023 10:42 PM
You are following the recommended way. Check if you've met prerequisites mentioned: https://docs.splunk.com/Documentation/Splunk/9.0.4/Installation/InstallonWindowsviathecommandline#Prerequisites_to_installing_Splunk_Enterprise_on_Windows ... View more

Re: I am not able to delete users from can_delete ...

by SplunkTrust in Splunk Cloud Platform
‎04-12-2023 10:19 PM
‎04-12-2023 10:19 PM
hi @Dany-Abou-Asali, Role can_delete might be inherited in the role(s) that these users belong to. Share the authorize.conf. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎09-04-2023 02:14 AM
Karma given to