Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About satyaallaparthi
satyaallaparthi
Path Finder
Member since:
09-06-2018
06-05-2020
Community Statistics
| Posts | 57 |
| Solutions | 1 |
| Karma Given | 13 |
| Karma Received | 1 |
| Member Since | 09-06-2018 |
Activity Feed
- Karma Re: Need a help with skipped saved searches and help with calculation in limits for diogofgm. 06-05-2020 12:50 AM
- Karma Re: Help with Suspect IP hits to my web. for solarboyz1. 06-05-2020 12:50 AM
- Karma Re: Need help with bundle replication fail for ivanreis. 06-05-2020 12:50 AM
- Karma Re: Need a Help with Query for Report for richgalloway. 06-05-2020 12:50 AM
- Karma Re: Need a help with workflow action or notable event contribution Events for solarboyz1. 06-05-2020 12:50 AM
- Karma Re: how to compare successful logins in the host with yesterday's for mayurr98. 06-05-2020 12:50 AM
- Karma Re: How to change time from GMT to EST after ingesting IIS logs? for VatsalJagani. 06-05-2020 12:50 AM
- Karma Re: How to Span=2w but starting every firts monday of the month and so on? for DavidHourani. 06-05-2020 12:50 AM
- Karma Re: Need a help with posting data using Rest API's from one Splunk to another for starcher. 06-05-2020 12:50 AM
- Got Karma for Can you help me with my data filtering query?. 06-05-2020 12:50 AM
- Karma Re: Why is the Windows App Lookup giving errors in Splunk App for Windows Infrastructure? for bhargavnariyani. 06-05-2020 12:49 AM
- Karma Re: Why is the ES Incident Review page still lists deleted Correlation Searches in the Multiselect box "Correlation Search Name"? for rphillips_splun. 06-05-2020 12:49 AM
- Karma Re: How to Forward Splunk WMIEventLog:Security to syslog_ng with backend MYSQL for solarboyz1. 06-05-2020 12:46 AM
- Karma Re: How do I determine my indexing volume by host, source, or sourcetype? for ziegfried. 06-05-2020 12:45 AM
- Posted Need a help with my KVStore replicationStatus is recovering on Knowledge Management. 02-03-2020 01:12 PM
- Posted need help with splunk btool in powershell on Getting Data In. 12-04-2019 11:17 AM
- Tagged need help with splunk btool in powershell on Getting Data In. 12-04-2019 11:17 AM
- Posted Need a suggestion in buying recorded future for my organization on Splunk Enterprise Security. 11-14-2019 06:13 PM
- Tagged Need a suggestion in buying recorded future for my organization on Splunk Enterprise Security. 11-14-2019 06:13 PM
- Posted Need help with threat activity dashboards in ESS on Splunk Enterprise Security. 11-01-2019 09:18 AM
02-03-2020
01:12 PM
Hello,
I have a problem with my replication status.. getting the below result when ever I am trying to see kvstore status.
host 2 replication status is showing recovering from past 1 week.
I tried to resync both shcluster config using "splunk resync shcluster-replicated-config" and kvstore using "splunk resync kvstore -source MyGUID"
But, both didn't work.
Any help would be appreciated.
This member: backupRestoreStatus : Ready date : Mon Feb 3 15:50:19 2020 dateSec : 1580763019.583 disabled : 0 guid : ****-46ED-450B-BE21-****** oplogEndTimestamp : Mon Feb 3 15:50:18 2020 oplogEndTimestampSec : 1580763018 oplogStartTimestamp : Mon Feb 3 06:06:00 2020 oplogStartTimestampSec : 1580727960 port : 8191 replicaSet : splunkrs replicationStatus : KV store captain standalone : 0 status : ready
Enabled KV store members: host1:8191 guid : ****-46ED-450B-BE21-****** hostAndPort : host1:8191 host2:8191 guid : ***-9A10-4962-9A3F-****** hostAndPort : host2:8191 host3:8191 guid : ****-F4B3-4E58-B765-******* hostAndPort : host3:8191
KV store members: host1:8191 configVersion : 205602 hostAndPort : host1:8191 lastHeartbeat : Mon Feb 3 15:50:17 2020 lastHeartbeatRecv : Mon Feb 3 15:50:17 2020 lastHeartbeatRecvSec : 1580763017.874 lastHeartbeatSec : 1580763017.873 optimeDate : Mon Feb 3 15:50:14 2020 optimeDateSec : 1580763014 pingMs : 0 replicationStatus : Non-captain KV store member uptime : 253492
host2:8191
configVersion : 205602
hostAndPort : host:8191
lastHeartbeat : Mon Feb 3 15:50:17 2020
lastHeartbeatRecv : Mon Feb 3 15:50:19 2020
lastHeartbeatRecvSec : 1580763019.366
lastHeartbeatSec : 1580763017.873
optimeDate : Wed Oct 2 11:09:46 2019
optimeDateSec : 1570028986
pingMs : 0
replicationStatus : Recovering
uptime : 253417
host3:8191
configVersion : 205602
electionDate : Fri Jan 24 21:18:18 2020
electionDateSec : 1579918698
hostAndPort : host3:8191
optimeDate : Mon Feb 3 15:50:18 2020
optimeDateSec : 1580763018
replicationStatus : KV store captain
uptime : 844587
Thanks,
... View more
- Tags:
- kvstore
- replication
Labels
12-04-2019
11:17 AM
Hello,
How can I write power shell script for running btool command ?
where ever I am directly doing in powershell. That is working fine. But, when I store "C:\Program Files\Splunk\bin\splunk" cmd btool props list --debug in test.ps1 and running the script from powersell then, I am getting the error.
Unfortunately, Splunk team does not always have access to the server, so we have to either gain access (takes time and approvals) or involve the server owner to run some Splunk commands.
Rather than walk the server owner through a bunch of long command strings, we should use a script.
Write a powershell script that will:
Start in a UniversalForwarder directory..
Run btool for inputs, outputs, props, and transforms and send the output to .txt files.
Then zip up those 4 files along with the contents of /etc/apps/* and /etc/system/local/* into a single zip file as an output.
The server owner can then mail that .zip file to us and we can diagnose the UF.
Thanks,
Satya Allaparthi
... View more
11-14-2019
06:13 PM
Hello,
We are planning to buy recorded future for my organization to integrate with splunk ES.
We have small Infrastructure with 50GB per day splunk license and I am the only Splunk Engineer working or who can configure things.
We are 4 people in my SOC team. When we contacted recorded future sales rep. They are forcing us to buy 4 core licenses since we are 4 people.
What if we buy only one core license and integrate with splunk ES?
can I run recorded future with domain account?
Can we use same account for multiple users?
Please do help me with my queries.
That will help us save money.
Thanks in advance!
Happy splunking 🙂
... View more
11-01-2019
09:18 AM
Hello,
My Threat Activity dashboards returning zero result found message on every dashboard.
I turned on data model for threat and threat downloads for all locals
When ever I am searching for ipintel and serviceintel, then I am getting the result but all dashboards are empty.
Please do help me.
Any help would be appreciated.
... View more
10-29-2019
01:31 PM
Hello,
I really don't know what is going on in my splunk.
I tried to route data from main index to iis_nonprod. That is not working.
I kept props and transforms in HF. Because the data is touting HF before going to IDX.
source: e:\IISLogs\W3SVC1\u_ex191029.log
props:
[source::e:\IISLogs\W3SVC1*.log]
TRANSFORMS-filter = routeData
tried both REGEX = . and REGEX= . and REGEX =. but nothing is working.
transforms:
[routeData]
REGEX = .
DESTKEY = _MetaData:Index
FORMAT = iisnonprod
but still the data is not routing.
By the way. the above filterings are not working. 😞
can any one please help me with that?
... View more
10-29-2019
01:30 PM
Hello,
I really don't know what is going on in my splunk.
I tried to route data from main index to iis_nonprod. That is not working.
I kept props and transforms in HF. Because the data is touting HF before going to IDX.
source: e:\IISLogs\W3SVC1\u_ex191029.log
props:
[source::e:\IISLogs\W3SVC1*.log]
TRANSFORMS-filter = routeData
tried both REGEX = . and REGEX= . and REGEX =. but nothing is working.
transforms:
[routeData]
REGEX = .
DESTKEY = _MetaData:Index
FORMAT = iisnonprod
but still the data is not routing.
By the way. the above filterings are not working. 😞
can you please help me with that?
... View more
10-26-2019
06:10 AM
Sure,
I will do the the step by step process and will let u know.
Thanks,
... View more
10-26-2019
06:08 AM
Yes, I did edited now.
[Events]
REGEX= .+(Event|Payment|Transaction).+
DESTKEY = _MetaData:Index
FORMAT = Eventlog
Thanks,
... View more
10-25-2019
08:13 PM
Yes, but what about the 3rd one for routing data to another index ?
As I mentioned, I want to route data to new index. Which is events_logs. But that is not working..
That is the reason I posted for help.
Thanks,
... View more
10-25-2019
10:21 AM
But I want the third one to route data to new index.
And yes, I have heavy forwarder is between indexer and UF. I restarted the server after I placed. But no luck
Thanks,
... View more
10-25-2019
07:51 AM
Hello,
Yes, I did tried that before doing this.. but no luck.. that is why I changed the regex..
No, that is not possible to set in Inputs. Because I am getting the data from other instance.
Thanks,
... View more
10-25-2019
07:27 AM
Hello,
I have tons of data that are ingesting to some index="abc".
But I want to filter the whole data and want to ingest the log with the words "Events,Transaction,Payment" and then want to route that data to index=event_logs
I wrote the below props and transforms. But no luck.
Props:
TRANSFORMS-filter = null, IQ,Events
Transforms:
[null]
REGEX= .
DEST_KEY = Queue
FORMAT = nullQueue
[IQ]
REGEX= .+(Event|Payment|Transaction).+
DEST_KEY = Queue
FORMAT = indexQueue
[Events]
REGEX= .+(Event|Payment|Transaction).+
DESTKEY = _MetaData:Index
FORMAT = Eventlog
Please do help me with the issue.
Thanks in Advance
... View more
10-16-2019
05:21 PM
I deleted the file causing the problem.. but again getting the problem with new .delta file.
Should I need to write blacklist with splunk home
staylocal = $SPLUNK_HOME\apps\appsname\filename.csv
or just
staylocal = apps\appsname\filename.csv
... View more
10-16-2019
08:08 AM
Hello,
I am always getting the below message in my Search head's
Even though I wrote:
distsearch.conf:
[replicationBlacklist]
staylocal = *.csv
limits.conf:
[lookup]
maxmemtablebytes = 1000000000
The current bundle directory contains a large lookup file that might cause bundle replication fail.
The path to the directory is
C:\Program Files\Splunk\var\run\61CFC563-07F6-44A0-9DFF-31D6A01BA6D9-1571219534-1571220067.delta.
Please do help me in fixing that issue and how to troubleshoot that.
Thanks in Advance!
... View more
10-14-2019
12:26 PM
Hello,
Unfortunately, I am getting all 3150 login names When I am trying with Below Query.
index=lookups sourcetype=usersroles earliest=-7d@d latest=now
NOT
[search index=lookups sourcetype=usersroles earliest=-14d@d latest=-7d@d]
| stats count by login_name
3,143 events (10/7/19 12:00:00.000 AM to 10/14/19 3:21:06.000 PM)
Please do help if there is something else to sort out this issue..
Thanks,
... View more
10-14-2019
11:49 AM
Hello,
I have user data which is ingesting every week on Saturday in to Splunk.
I have 3000 Events on 5th Oct and 3150 Events on 12th Oct. i.e, 150 new users created in last one week.
And I have the fields called loginname and Usertype.
I want to create a report showing new login_name by comparing 2 weeks of data. which is not in Splunk on 5th Oct and which is on 12th Oct.
Please do help me with the query.
Thanks in Advance.
... View more
09-10-2019
10:31 AM
Yes, I have a CM/deployer/Shdeployer with 16 core and 32GB RAM.. I suggested my manger for another Indexer but they are agreeing.. any best solution ?
... View more
09-10-2019
08:54 AM
sizing is 25 GB per day. I have 2 Indexers (Cluster) 16 core and 32 GB RAM, 2 SH (cluster) 16 core and 32 GB RAM, 1 SH standalone for ES 32 core and 64 GB RAM.
All are in windows servers 2016
13 data models are accelerated and 16 correlation searches are enabled..
and Just want to know any calculations to keep limits.conf? If yes, Please let me know the formula and calculation for my Environment.
Thanks,
... View more
09-10-2019
07:38 AM
Hello,
My schedule jobs are skipping all the time and getting following reasons:
The maximum number of concurrent auto-summarization searches on this instance has been reached
The maximum number of concurrent historical scheduled searches on this instance has been reached
The maximum number of concurrent running jobs for this historical scheduled search on this instance has been reached
ES is installed in 32 CPU Cores and 64GB RAM machine.
Lots of Jobs are running under ESS admin account.
For now, I didn't change any of limits.conf and Authorize.conf.
Can anyone help with the reason for above messages and how to set limits.conf and Authorize.conf with the calculation.
Any Help would be Appreciated!
Thanks in advance!
... View more
08-23-2019
08:30 AM
We will get some Pre built threat feeds in splunk ES.. right ?? When we Enable those feeds.. To Which index that data will go ?
Index = ioc ? or index = stix ? or index = threat_activity?
what is IOC(indicator of Compromise) format or STIX format ?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
