Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About manjunathmeti
manjunathmeti
Champion
Member since:
09-29-2015
07-09-2026
Community Statistics
| Posts | 963 |
| Solutions | 231 |
| Karma Given | 27 |
| Karma Received | 323 |
| Member Since | 09-29-2015 |
Activity Feed
- Posted Re: Splunk ITSI - create service & Glass Table, KPI on Dashboards & Visualizations. 05-15-2026 02:14 AM
- Got Karma for Re: Searching/Listing down all Installed App Usage, to find how which is the least used app.. 01-14-2026 12:29 AM
- Got Karma for Should you add the configurations in limits.conf on universal forwarder OR indexer servers?. 11-12-2025 08:50 AM
- Got Karma for Re: Why are app icons only visible to users with the admin role?. 05-12-2025 10:23 PM
- Got Karma for Re: Are booleans in .conf files case sensitive?. 03-13-2025 10:14 AM
- Got Karma for Re: How to only include an input token in search if it has a value. 01-09-2025 05:44 AM
- Got Karma for Re: Searching/Listing down all Installed App Usage, to find how which is the least used app.. 11-05-2024 02:24 PM
- Got Karma for Re: How to use props.conf to parse json file in splunk. 10-31-2024 01:27 PM
- Posted Re: splunk didn't ingested all json-objects on Getting Data In. 08-24-2024 08:28 PM
- Got Karma for Re: Invalid end point for ServiceNow integration. 07-24-2024 09:58 PM
- Posted Re: Invalid end point for ServiceNow integration on Other Usage. 07-24-2024 09:37 PM
- Got Karma for Re: Invalid end point for ServiceNow integration. 07-24-2024 08:53 PM
- Posted Re: Invalid end point for ServiceNow integration on Other Usage. 07-24-2024 08:05 PM
- Posted Re: how to display multiple fields in one lookup command from one csv file on Splunk Search. 07-24-2024 08:01 PM
- Posted Re: need help on REX command on Reporting. 07-15-2024 11:12 PM
- Got Karma for Re: local.meta stanzas. 07-12-2024 08:11 AM
- Posted Re: Failed to parse timestamp in psv file on Getting Data In. 07-12-2024 02:06 AM
- Got Karma for Re: getting ip range lookup. 07-12-2024 12:06 AM
- Posted Re: getting ip range lookup on Splunk Search. 07-11-2024 10:23 PM
- Got Karma for Re: common fields. 07-11-2024 10:17 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-15-2026
02:14 AM
You can start with the free courses from Splunk: https://education.splunk.com/Saba/Web_spf/NA10P2PRD105/guestapp/ledetail/cours000000000017281 https://education.splunk.com/Saba/Web_spf/NA10P2PRD105/guestapp/ledetail/cours000000000020430 Best way to learn is install Splunk and ITSI on your own machine and refer to Splunk documentation: https://help.splunk.com/en/splunk-it-service-intelligence/splunk-it-service-intelligence and learn. Upvote if this helps.
... View more
08-24-2024
08:28 PM
hi @a101755, Try adding below configs in input monitors in inputs.conf. crcSalt = <SOURCE>
initCrcLength = 2048
... View more
07-24-2024
09:37 PM
1 Karma
The link was just for reference, usually, you need to deploy an app or integration in Service Now first so that the add-on on Splunk integrates with Service Now.
... View more
07-24-2024
08:05 PM
1 Karma
Hi @KeithH, Did you configure Service Now to integrate with your Splunk? If not, you can refer to this: https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/ConfigureServiceNowtointegratewithSplunkEnterprise.
... View more
07-24-2024
08:01 PM
hi @Bracha, Try with OUTPUT. If the OUTPUTNEW clause is specified, the lookup is not performed for events in which the output fields already exist in the events. If the OUTPU T clause is specified, the output lookup fields overwrite existing fields in the events.
... View more
07-15-2024
11:12 PM
| rex \"orderId\":\"(<?orderId>[\w\-]+)\" | rex \"errorCode\":\"(<?errorCode>\w+)\"
... View more
07-12-2024
02:06 AM
Hi @the_sigma, Try these configs: [ psv ]
CHARSET=UTF-8
INDEXED_EXTRACTIONS=PSV
SHOULD_LINEMERGE=false
category=Structured
description=Pipe-separated value format.
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=14
TIME_FORMAT=%d%m%Y%H%M%S
... View more
07-11-2024
10:23 PM
1 Karma
Hi @alberto-sirt, As @bowesmana said you need to use a lookup definition instead of querying the lookup file itself. You can refer to this example: https://docs.splunk.com/Documentation/Splunk/9.2.2/Knowledge/Addfieldmatchingrulestoyourlookupconfiguration#Example_of_using_match_type_for_IPv6_CIDR_match.
... View more
07-11-2024
10:14 PM
1 Karma
Hi @Siddharthnegi , You can use this query, this works if the field Hostname is there in both the lookups. | inputlookup first_lookup where ([| inputlookup second_lookup | fields Hostname])
... View more
06-05-2024
11:45 PM
Check splunkd.log and splunkd_ui_access.log for any errors/warnings.
... View more
06-05-2024
11:40 PM
1 Karma
You can refresh the Splunk configurations without restarting by running the URL: https://SPLUNK_DEPLOYMENT_SERVER:8000/debug/refresh
... View more
09-03-2023
10:51 PM
1 Karma
hi @camellia, You need to configure these in the forwarder not on the indexer servers. Also, KV_MODE = json is search time configuration, not index-time configuration. Set INDEXED_EXTRACTIONS = JSON for your sourcetype in props.conf. Deploy props.conf and transforms.conf in your forwarder. [itsd]
DATETIME_CONFIG = CURRENT
INDEXED_EXTRACTIONS = JSON
LINE_BREAKER = ([\r\n]+)
category = Structured
disabled = false
pulldown_type = true
TRANSFORMS-null1 = replace_null
TRANSFORMS-null2 = replace_null1
... View more
09-03-2023
10:44 PM
hi @lucky, Try this: | rex "\-(PUT|GET|POST|DELETE)(?<url>[\/A-z]+).*Responsecode=(?<ResponseCode>\d+)" Sample query: | makeresults | eval _raw="message: INFO [nio-8443-exce-8] b. b. b.filter.loggingvontextfilter c.c.c.c.l.cc.f.loggingcintextfil=ter.post process(Loggingcintextfilter.java\"201)-PUT/actatarr/halt/liveness||||||||||||METRIC|--|Responsecode=400|Response Time=0" | rex "\-(PUT|GET|POST|DELETE)(?<url>[\/A-z]+).*Responsecode=(?<ResponseCode>\d+)"
... View more
08-27-2023
08:58 PM
You must have field values in all these fields app, sts, bookingReference and cal for the events with field mtd contains PATCH/GET values
... View more
08-27-2023
08:54 PM
This is not supported natively in Universal Forwarder now. You could do this at OS/user levels. There will be negative impacts on performance if the forwarder workload requires memory more than the specified limit. But you can optimize the forwarder workload, check this: https://community.splunk.com/t5/Getting-Data-In/Is-there-a-way-set-CPU-and-Memory-consumption-for-splunkd/m-p/315912/highlight/true
... View more
08-27-2023
08:38 PM
Try putting * in quotes. app=BP* sts=* | table at,req.bookingReference,app,mtd,cid,sts,dur,rsc,cal,req.offerOptionCode | rename req.bookingReference as bookingReference, req.offerOptionCode as offerOptionCode| search app="*" mtd="*" sts="*" bookingReference="*" cal="*" | sort by at asc
... View more
08-27-2023
08:34 PM
1 Karma
@SplunkDash , Your time prefix needs to change. Also, don't set MAX_TIMESTAMP_LOOKAHEAD if your timestamp is in the text following the end of the TIME_PREFIX regex match. Try this: [sourcetype]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)
TIME_PREFIX=.+\|[\d\.]+\|\d+\|\|
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N
# MAX_TIMESTAMP_LOOKAHEAD=30
TRUNCATE=2500
... View more
04-18-2023
05:20 AM
hi @bmanikya , Try this query: | rex max_match=0 "\<TD\>(?<Cluster>[\w\s]+)\<\/TD\>\<TD\>(?<BlockSize>\d+)\<\/TD\>"
| eval zip=mvzip(Cluster, BlockSize)
| mvexpand zip
| eval zip=split(zip, ","), Cluster=mvindex(zip, 0), BlockSize=mvindex(zip, 1) Testing sample: | makeresults
| eval _raw="<HTML><BODY><TABLE border=\"1\"><TH style=background-color:#00FFFF>Cluster</TH><TH style=background-color:#00FFFF>BlockSize</TH> <TR bgcolor=#ABEBC6><TD>GCS E1</TD><TD>41008</TD></TR><TR bgcolor=#ABEBC6><TD>VPay E1</TD><TD>18994</TD></TR><TR bgcolor=#ABEBC6><TD>Cadence E1</TD><TD>35345</TD></TR><TR bgcolor=#ABEBC6><TD>GCODS E1</TD><TD>3312</TD></TR><TR bgcolor=#ABEBC6><TD>EDMS E1</TD><TD>3715</TD></TR><TR bgcolor=#ABEBC6><TD>Nemo E1</TD><TD>3366332</TD></TR></TABLE></BODY></HTML>"
| rex max_match=0 "\<TD\>(?<Cluster>[\w\s]+)\<\/TD\>\<TD\>(?<BlockSize>\d+)\<\/TD\>"
| eval zip=mvzip(Cluster, BlockSize)
| mvexpand zip
| eval zip=split(zip, ","), Cluster=mvindex(zip, 0), BlockSize=mvindex(zip, 1)
... View more
04-18-2023
05:12 AM
1 Karma
Thank you 🙂
... View more
04-18-2023
03:12 AM
1 Karma
hi @POR160893, You can move where command in the main search, | inputlookup user_identities.csv where L6MgrName="John Doe" AND NOT businessemail="dellteam" AND businessemail="*"
| eval copy=mvrange(0,3)
| mvexpand copy
| eval rnd=random()
| sort 0 rnd
| fields - copy rnd
| rex field=businessemail "(?<businessemail>[^@]+)@[^.]+\.com"
| eval businessemail=replace(businessemail, "\.", " ")
| fields businessemail
... View more
04-17-2023
11:53 PM
Try this: index= x source= xtype | spath application | search application= x app " saved note" RCVD | rex field=" actionid"=(?<actionid>.*)", | rex field =log " manid=(?<mandid>.*?)", | rex field=log "bid=(?<bid>.*" | rex field= log " state=(?<state>.*" | eval starttime=_time | table _time,bid,mandid,actionid,state | apppend [
index=y sourcetype=yytype source=y "VALIDATION SUCESS" " msg got" | rex field =msg " manid\:(?<mandid>.*?)", | rex field=msg "actionid"\:(?<actionid>.*" | table _time manid actionid | eval endtime=_time ] | stats values(*) as * by mandid | eval duration=endtime-starttime
... View more
04-17-2023
11:28 PM
hi @Sekhar, You can join both queries using append and stats. index= x source= xtype | spath application | search application= x app " saved note" RCVD | rex field=" actionid"=(?<actionid>.*)", | rex field =log " manid=(?<mandid>.*?)", | rex field=log "bid=(?<bid>.*" | rex field= log " state=(?<state>.*" | table _time bid,mandid,actionid,state | apppend [
index=y sourcetype=yytype source=y "VALIDATION SUCESS" " msg got" | rex field =msg " manid\:(?<mandid>.*?)", | rex field=msg "actionid"\:(?<actionid>.*" | table _time manid actionid ] | stats values(*) as * by mandid, actionid
... View more
04-17-2023
11:19 PM
hi @Erfan, This is working for me, make sure your file contains data in the below format. There should not be any space b/w fields and values. src,dst,protocol,user,whitelisted
192.168.10.1,120.18.97.6,*,*,true
192.168.10.5,*,*,*,true
*,*,https,bob,true
... View more
04-17-2023
11:04 PM
hi @chanhee1 , Try this: Updating the answer with @ITWhisperer regex. | makeresults
| eval query="SELECT /*4/18 test */ DRTA_SEQ\r\n FROM DATA_REQ_LIST\r\n WHERE DATE < TO_DATE('2023-04-18 06:00:00', 'YYYY-MM-DD HH24:MI:SS')\r\n"
| append
[| makeresults
| eval query="
with my_index as (\n select index_name from ALL_indexes where table_owner = :1 \n /* test select index_name from CHAN_indexes where table_owner = :schema_name and table_name in ( :[*object_names] )\n *//* test select * from Chanlist */"]
| rex max_match=0 field=query "\/\*\s?(?<test>.+)(?>\*\/)"
| mvexpand test
... View more
04-12-2023
10:42 PM
You are following the recommended way. Check if you've met prerequisites mentioned: https://docs.splunk.com/Documentation/Splunk/9.0.4/Installation/InstallonWindowsviathecommandline#Prerequisites_to_installing_Splunk_Enterprise_on_Windows
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-09-2026
07:52 AM
|
