Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About shreyasathavale
shreyasathavale
Communicator
Member since:
03-26-2014
01-16-2025
Community Statistics
| Posts | 78 |
| Solutions | 2 |
| Karma Given | 4 |
| Karma Received | 6 |
| Member Since | 03-26-2014 |
Activity Feed
- Posted Single Value Viz Dashboard Studio on Splunk Dev. 01-13-2025 01:48 PM
- Karma Re: I want to find the difference in count of processes from last 2 months for tiagofbmm. 06-05-2020 12:49 AM
- Got Karma for Re: How to display all host names returned from my search as x-axis labels on a chart?. 06-05-2020 12:48 AM
- Karma Re: Why is my savedsearches.conf configuration not honoring the alert condition of number of events > 10? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Why are users automatically getting logged out of Splunk the past few days and any running searches have to be re-run? for woodcock. 06-05-2020 12:47 AM
- Karma Re: How to use the result from an index of the 1st search as input to return results from another index in a 2nd search? for woodcock. 06-05-2020 12:47 AM
- Got Karma for Why are users automatically getting logged out of Splunk the past few days and any running searches have to be re-run?. 06-05-2020 12:47 AM
- Got Karma for Why is the Windows perfmon data in Splunk for percentage processor time different from the performance counter value on the server?. 06-05-2020 12:47 AM
- Got Karma for Why is the Windows perfmon data in Splunk for percentage processor time different from the performance counter value on the server?. 06-05-2020 12:47 AM
- Got Karma for Why is the Windows perfmon data in Splunk for percentage processor time different from the performance counter value on the server?. 06-05-2020 12:47 AM
- Got Karma for Unable to find solution for error in splunkd log file. 06-05-2020 12:46 AM
- Posted Re: Send data from file even if there is no change on Getting Data In. 02-24-2020 06:53 AM
- Posted Re: Send data from file even if there is no change on Getting Data In. 02-24-2020 05:51 AM
- Posted Re: Send data from file even if there is no change on Getting Data In. 02-24-2020 04:50 AM
- Posted Send data from file even if there is no change on Getting Data In. 02-24-2020 01:09 AM
- Posted Re: How to continuously monitor a file in splunk even though it is not updated on Getting Data In. 12-26-2019 05:14 AM
- Posted How to continuously monitor a file in splunk even though it is not updated on Getting Data In. 12-24-2019 04:18 AM
- Posted Re: How to add result of search to all rows in lookup? on Splunk Search. 04-22-2019 06:36 AM
- Posted Re: How to add result of search to all rows in lookup? on Splunk Search. 04-22-2019 06:35 AM
- Posted How to add result of search to all rows in lookup? on Splunk Search. 04-22-2019 06:19 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-27-2015
08:01 PM
I have admin user and power user (role=power), when i search a particular index (iis_web) it does not return the output for power user but gives output for admin user. But for other indexes it returns the output. The server for iis_web is 2012 and others are 2008 . Is it related to OS or some other reason?
... View more
05-24-2015
08:46 PM
Had tried that too previously but was not working. Created the same alert using savedsearch and it worked 🙂
... View more
05-21-2015
01:32 PM
Thanks.. I will surely try that.. And how can I find out why user gets logged out and it shows error splunk daemon cannot reach splunk Web?
... View more
05-21-2015
08:53 AM
1 Karma
Since last few days the users that are logged in Splunk get logged out automatically. If any search is kept running it automatically logs out and have to search again.
Someone faces similar issue with Splunk?
FYI: I am using Admin account.
... View more
05-19-2015
03:15 PM
search is returning values but still not sending an email.. 😞 rather have got a blank mail without results in mail
... View more
05-19-2015
03:07 PM
Thanks..will try it..
... View more
05-19-2015
02:39 PM
I have created the following alert (using UI or Alert Manager) and have set alert mail on condition warning > 0 which is working fine.
earliest=-2h environment=Test Severity=Error|stats count as warning by Message,_time |sort _time desc
Now i want the mail format to be in tabular form so i modified the search to below with same alert condition:
earliest=-2h environment=Test Severity=Error|stats count as warning by Message,_time |sort _time desc|table Message,_time
But the 2nd search is not generating an alert mail.
Any idea on this will be helpful
... View more
03-26-2015
03:16 PM
I have setup a search to read a log file which is in txt format and it has various fields. What i want is when i run a search, it should give selected fields as output by reading the log file. Currently it is giving output what it is in log file as it is.
I have made changes in props.conf and transforms.conf, but still no use
transforms.conf:
FIELDS="Timestamp","Name","Success"
DELIMS=","
props.conf:
INDEXED_EXTRACTIONS = "Name of what i put in transforms.conf"
TZ = UTC
... View more
03-24-2015
04:45 PM
I am creating an alert and configuring it in savedsearches.conf. The condition that i am giving is not firing the alert. It is firing whenever it finds the message, but my condition is "it should alert only if it is greater than 10" .. Below is savedsearch
counttype = number of events
quantity = 10
relation = greater than
alert_condition = | Where Message ="asdad"
My alert should fire if I have events more than 10, but even if the events are just 2 it is firing.. Any help?
I have removed alert_condition part now and checking if it works or not.
... View more
02-26-2015
10:01 AM
I added the eval resolution and got the output but what i required is if we get some message in the mail, it will be great!!!
... View more
02-26-2015
09:59 AM
I gave this a try but not getting the output , this is what i wrote:
action.email.message.report = Enable the job from task scheduler
... View more
02-25-2015
03:47 PM
Giving this also a try..
... View more
02-25-2015
03:31 PM
Thanks..That can work too ..Will give it a try ..
... View more
02-25-2015
02:51 PM
I have added the line to savedsearch.conf but still its not working 😞
action.email.message = Recycle app pool
Any suggestion???
... View more
02-25-2015
01:00 PM
Hi sanjay thanks for the reply but my question is do we have anything in splunk that we can add with alert mail example :
I received an alert for high memory usage for app pool and Splunk sent alert for it that particular app pool is high memory usage
Can I add to that mail the below:
"Recycle app pool name to solve it"
... View more
02-25-2015
12:40 PM
If I have a alert and I need to take particular action for that alert can I integrate the action that needs to be taken in the alert mail that we receive from splunk
... View more
01-12-2015
09:44 PM
I am getting same error for both powershell and powershell2 ... And execution-policy is Unrestricted. Any ideas?
... View more
05-04-2014
11:28 AM
Thanks lguinn , I found that DELIMS was set to nothing
It was : DELIMS=
I will be correcting it to : DELIMS= " "
... View more
05-04-2014
10:42 AM
1 Karma
Hey I am getting this error in splunkd log file, I am unable to understand what is the error. The error is
SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='delimExtractionsIIS2003-WEB'
... View more
- Tags:
- splunkd.log
04-25-2014
06:26 AM
Hi, Thanks for replying..but I am getting alert for other searches but not for this..could not fid alert_actions="email" in scheduler.log file 😞
... View more
04-25-2014
03:34 AM
Hi,
Below is my saved search :
index=perfmon source="perfmon:cputime" counter="% Processor Time" earliest=-15m | stats avg(Value) as CpuUsage by role,host |where CpuUsage > 10 | join type=left max=0 host [search source="Perfmon:Process"|top limit=5 instance by host|rename instance AS Process|where (Process!="_Total" AND Process!="Idle" AND Process!="System")|fields role,CpuUsage,host,Process]
for this I am unable to get Email alert, following I have added in savedsearch.conf file
action.email = 1
action.email.inline = 1
action.email.sendresults = 1
action.email.to = myemailid@gmail.com
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
counttype = custom
cron_schedule = */15 * * * *
enableSched = 1
What is wrong need help!!!
... View more
04-18-2014
12:39 PM
I have mentioned roles in serverclass.conf
... View more
- « Previous
- Next »
