Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About satyaallaparthi
satyaallaparthi
Communicator
Member since:
09-06-2018
4 weeks ago
Community Statistics
| Posts | 75 |
| Solutions | 1 |
| Karma Given | 18 |
| Karma Received | 1 |
| Member Since | 09-06-2018 |
Activity Feed
- Posted Re: How do I write a Search that can match a word from 2 different lookup files? on Splunk Search. 4 weeks ago
- Posted How do I write a search that can match a word from two different lookup files? on Splunk Search. a month ago
- Karma Re: How can I combine multiple fields with a common name results in to single column for bowesmana. 01-31-2023 06:08 PM
- Posted How can I combine multiple fields with a common name results in to single column? on Splunk Search. 01-31-2023 01:51 PM
- Posted Re: Need help with Data capture from large datasets on Knowledge Management. 01-06-2023 11:06 AM
- Posted How to create data capture from large datasets? on Knowledge Management. 01-06-2023 07:46 AM
- Tagged How to create data capture from large datasets? on Knowledge Management. 01-06-2023 07:46 AM
- Karma Re: how to find Anomalies in my login data for ITWhisperer. 11-08-2022 06:06 AM
- Posted Re: how to find Anomalies in my login data on Security. 11-07-2022 04:24 PM
- Posted How to find Anomalies in my login data? on Security. 11-07-2022 02:13 PM
- Karma Re: How to do a multi line field extraction? for somesoni2. 08-09-2022 03:44 PM
- Karma Re: How to do a multi line field extraction? for ITWhisperer. 08-09-2022 03:40 PM
- Posted Re: How to do a multi line field extraction? on Splunk Search. 08-09-2022 03:39 PM
- Posted Re: How to do a multi line field extraction? on Splunk Search. 08-09-2022 03:08 PM
- Posted Re: How to do a multi line field extraction? on Splunk Search. 08-09-2022 03:05 PM
- Posted Re: How to do a multi line field extraction? on Splunk Search. 08-09-2022 03:03 PM
- Posted How to do a multi line field extraction? on Splunk Search. 08-09-2022 11:14 AM
- Posted Re: Need a help in changing host name of/in Splunk on Splunk Enterprise. 08-31-2020 12:22 PM
- Posted Re: Need a help in changing host name of/in Splunk on Splunk Enterprise. 08-31-2020 11:48 AM
- Posted Need a help in changing host name of/in Splunk on Splunk Enterprise. 08-31-2020 11:34 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
4 weeks ago
Hi, Entire output will be in between two lookups. desired output: if there is a word match in between Column A of two files, then I want to display “yes” in a new Column called Matching_word and “no” if there is no word match.
... View more
a month ago
Hello,
I have 2 different files names lookup1.csv and lookup2.csv, which have column A and column B in both.
How can we merge two files using a single word in Column A in both files with a sentence in it?
lookup1: Column A: "I am good"
lookup2: Column A: "I am bad"
I want to combine both the files using a word "I am" in this case.
Any help would be appreciated.
... View more
01-31-2023
01:51 PM
How can I combine multiple fields results in to single column with common name for example Test1, Test2, Test3 and so on up to Test 20 with a common word as "Test" in all the fields (either using foreach or any other solution)?
Test1
Test2
Test3
Test4
Test5
Test6
Test7
Test8
1
6
11
16
21
26
31
36
2
7
12
17
22
27
32
37
3
8
13
18
23
28
33
38
4
9
14
19
24
29
34
39
5
10
15
20
25
30
35
40
Result:
Test21
1
2
3
4
5
6
7
8
9
so on
Any help would be appreciated.
... View more
- Tags:
- foreach
01-06-2023
11:06 AM
I tried in fast mode. However I got an idea to capture that large set data.. palling to create 3 separate schedule reports with time modifiers earliest=-90d@d latest=-60d@d, earliest=-60d@d latest=-30d@d and earliest=-30d@d latest=now and then append all 3 csv outputs into one using another schedule report. Thanks,
... View more
01-06-2023
07:46 AM
Hello,
Please help me with the below requirement.
I need to capture usernames from 90 days worth of data from a large datasets which includes multiple source types and multiple indexes.
Search "index=* sourcetype=* earliest=-90d@d latest=now | eval LOGIN = lower(user) | stats count by LOGIN sourcetype"" is taking forever.
Is there a better way to capture the 90 days worth usernames and source types without timeout?
Note: I can able to schedule the search to capture them and append the results. However I am not sure, what time modifiers I should use, If I want to capture all of them in a single day & that should be a continuous process every day.
... View more
11-07-2022
04:24 PM
I'm trying to measure login count or unusual number of logins from particular source.
... View more
11-07-2022
02:13 PM
Looking for the exact query to find outliers or anomalies in my csv data using stddev in Splunk enterprise?
Fields from csv: user, action, src, dest, host, _time
Any help would be appreciated.
Thanks in advance!
... View more
- Tags:
- Anomaly detection
Labels
- Labels:
-
other
08-09-2022
03:39 PM
Thank you, I got the result I need using split and mvindex too
... View more
08-09-2022
03:08 PM
Yes, I need in multi line, but I can do mvexpand even if I get all of them in one, but I need the date aswell when the package was installed.
... View more
08-09-2022
03:05 PM
that's awesome I don't even know we can do "max_match = 0" that's extracting all of them, but I need date aswell, when the package was installed. may be I should write regex for whole line and then use some split and mvindex? 🤔
... View more
08-09-2022
03:03 PM
< "TCP","0","Software Enumeration (SSH)","It was possible to enumerate installed software on the remote host via SSH.","Nessus was able to list the software installed on the remote host by calling the appropriate command (e.g., 'rpm -qa' on RPM-based Linux distributions, qpkg, dpkg, etc.).","Remove any software that is not in compliance with your organization's acceptable use and security policies.","","
Here is the list of packages installed on the remote CentOS Linux system :
python-prettytable-0.7.2-3.el7|(none) Wed Jan 9 20:38:03 2019
gettext-0.19.8.1-3.el7|(none) Wed May 13 07:35:27 2020
cpp-4.8.5-44.el7|(none) Tue Feb 2 09:59:27 2021
kmod-20-28.el7|(none) Tue Feb 2 09:59:31 2021
glibc-2.17-324.el7_9|(none) Wed Mar 16 18:10:11 2022
diffutils-3.3-5.el7|(none) Tue Feb 2 09:59:00 2021
elfutils-default-yama-scope-0.176-5.el7|(none) Tue Feb 2 09:59:35 2021
glibc-2.17-324.el7_9|(none) Wed Mar 16 18:10:12 2022
numactl-libs-2.0.12-5.el7|(none) Tue Feb 2 09:59:02 2021
device-mapper-event-1.02.170-6.el7_9.3|7 Tue Feb 2 09:59:51 2021
coreutils-8.22-24.el7_9.2|(none) Tue Feb 2 09:59:07 2021
ipset-libs-7.1-1.el7|(none) Tue Feb 2 09:59:56 2021
shared-mime-info-1.8-5.el7|(none) Tue Feb 2 09:59:13 2021
iptables-services-1.4.21-35.el7|(none) Tue Feb 2 10:00:27 2021
python-chardet-2.2.1-3.el7|(none) Tue Feb 2 09:59:17 2021
logrotate-3.8.6-19.el7|(none) Tue Feb 2 09:59:18 2021
python2-cryptography-1.7.2-2.el7|(none) Wed Jan 9 19:43:51 2019
perl-HTTP-Tiny-0.033-3.el7|(none) Tue Aug 27 08:09:45 2019
PyYAML-3.10-11.el7|(none) Wed Jan 9 20:19:50 2019
python-srpm-macros-3-34.el7|(none) Tue Feb 2 09:59:26 2021
perl-File-Path-2.09-2.el7|(none) Tue Aug 27 08:09:49 2019
ivtv-firmware-20080701-26.el7|2 Wed Jan 9 19:12:50 2019
pyparsing-1.5.6-9.el7|(none) Tue Aug 27 08:09:54 2019
systemd-219-78.el7_9.2|(none) Tue Feb 2 09:59:34 2021
which-2.20-7.el7|(none) Wed Jan 9 19:12:04 2019
slang-2.2.4-11.el7|(none) Wed Jan 9 19:12:08 2019
perl-devel-5.16.3-299.el7_9|4 Wed Mar 16 18:15:48 2022
python-configobj-4.7.2-7.el7|(none) Wed Jan 9 19:12:10 2019
perl-libs-5.16.3-299.el7_9|4 Wed Mar 23 14:08:57 2022
pyliblzma-0.5.3-11.el7|(none) Wed Jan 9 19:12:10 2019
readline-6.2-11.el7|(none) Tue Feb 2 09:58:59 2021
glusterfs-client-xlators-6.0-49.1.el7|(none) Wed Mar 23 14:08:59 2022
hardlink-1.0-19.el7|1 Wed Jan 9 19:12:25 2019
sqlite-3.7.17-8.el7_7.1|(none) Tue Feb 2 09:59:01 2021
polkit-pkla-compat-0.1-4.el7|(none) Wed Jan 9 19:12:30 2019
python-ply-3.4-11.el7|(none) Wed Jan 9 19:43:49 2019
qemu-img-1.5.3-175.el7_9.3|10 Wed Mar 23 14:09:14 2022
pygpgme-0.3-9.el7|(none) Wed Jan 9 19:12:37 2019
zlib-devel-1.2.7-19.el7_9|(none) Wed Mar 23 14:09:15 2022
lsscsi-0.27-6.el7|(none) Wed Jan 9 19:12:36 2019
iwl1000-firmware-39.31.5.1-80.el7_9|1 Wed Mar 23 14:09:15 2022
grubby-8.28-26.el7|(none) Tue Feb 2 10:01:13 2021
iwl5150-firmware-8.24.2.2-80.el7_9|(none) Wed Mar 23 14:09:15 2022
python-babel-0.9.6-8.el7|(none) Wed Jan 9 20:38:02 2019
iwl6000-firmware-9.221.4.1-80.el7_9|(none) Wed Mar 23 14:09:16 2022
perl-Exporter-5.68-3.el7|(none) Tue Aug 27 08:09:47 2019
ncurses-libs-5.9-14.20130511.el7_4|(none) Wed Jan 9 19:12:00 2019
iwl5000-firmware-8.83.5.1_1-80.el7_9|(none) Wed Mar 23 14:09:17 2022
perl-constant-1.27-2.el7|(none) Tue Aug 27 08:09:48 2019
libsysfs-2.1.0-16.el7|(none) Wed Jan 9 19:12:49 2019
xz-libs-5.2.2-1.el7|(none) Wed Jan 9 19:12:03 2019
libcap-ng-0.7.5-4.el7|(none) Wed Jan 9 19:12:04 2019
libxml2-2.9.1-6.el7_9.6|(none) Wed Mar 23 14:13:38 2022
lua-5.1.4-15.el7|(none) Wed Jan 9 19:12:04 2019
centos-release-7-9.2009.1.el7.centos|(none) Sun Jan 31 14:17:24 2021
yum-3.4.3-161.el7.centos|(none) Wed Jan 9 19:21:07 2019
libXi-1.7.9-1.el7|(none) Thu Apr 14 23:04:10 2022
python-pycurl-7.19.0-19.el7|(none) Wed Jan 9 19:12:23 2019
fipscheck-1.4.1-6.el7|(none) Wed Jan 9 19:12:22 2019
libXcomposite-0.4.4-4.1.el7|(none) Thu Apr 14 23:04:10 2022
cpio-2.11-28.el7|(none) Tue Feb 2 09:59:01 2021
qrencode-libs-3.4.1-3.el7|(none) Wed Jan 9 19:12:26 2019
jasper-libs-1.900.1-33.el7|(none) Thu Apr 14 23:04:11 2022
iptables-1.4.21-35.el7|(none) Tue Feb 2 09:59:03 2021
gobject-introspection-1.56.1-1.el7|(none) Wed Jan 9 19:22:09 2019
psmisc-22.20-17.el7|(none) Thu Apr 14 23:04:11 2022
python-libs-2.7.5-90.el7|(none) Tue Feb 2 09:59:11 2021
alsa-firmware-1.0.28-2.el7|(none) Wed Jan 9 19:12:34 2019
jbigkit-libs-2.0-11.el7|(none) Thu Apr 14 23:04:11 2022
libssh2-1.8.0-4.el7|(none) Tue Feb 2 09:59:15 2021
python-pycparser-2.14-1.el7|(none) Wed Jan 9 19:43:49 2019
pcsc-lite-libs-1.8.8-8.el7|(none) Thu Apr 14 23:04:11 2022
device-mapper-persistent-data-0.8.5-3.el7_9.2|(none) Tue Feb 2 09:59:19 2021
acpid-2.0.19-9.el7|(none) Wed Jan 16 09:56:44 2019
hicolor-icon-theme-0.12-7.el7|(none) Thu Apr 14 23:04:11 2022
mesa-libglapi-18.3.4-12.el7_9|(none) Tue Feb 2 16:18:30 2021
perl-podlators-2.5.1-3.el7|(none) Tue Aug 27 08:09:45 2019
javapackages-tools-3.4.1-11.el7|(none) Thu Apr 14 23:04:11 2022
libwayland-server-1.15.0-1.el7|(none) Tue Feb 2 16:18:31 2021
perl-Time-HiRes-1.9725-3.el7|4 Tue Aug 27 08:09:47 2019
ttmkfdir-3.0.9-42.el7|(none) Thu Apr 14 23:04:15 2022
graphite2-1.3.10-1.el7_3|(none) Tue Feb 2 16:18:33 2021
gtk2-2.24.31-1.el7|(none) Thu Apr 14 23:04:15 2022
pixman-0.34.0-1.el7|(none) Tue Feb 2 16:18:34 2021
keyutils-libs-1.5.8-3.el7|(none) Wed Jan 9 19:12:00 2019
bind-libs-lite-9.11.4-26.P2.el7_9.7|32 Fri Jul 1 14:18:53 2022
libXrender-0.9.10-1.el7|(none) Tue Feb 2 16:18:35 2021
perl-Pod-Simple-3.28-4.el7|1 Tue Aug 27 08:09:49 2019
binutils-2.27-44.base.el7_9.1|(none) Fri Jul 1 14:18:56 2022
libXxf86vm-1.1.4-1.el7|(none) Tue Feb 2 16:18:35 2021
tar-1.26-35.el7|2 Wed Jan 9 19:20:57 2019
cyrus-sasl-gssapi-2.1.26-24.el7_9|(none) Fri Jul 1 14:19:01 2022
hwdata-0.252-9.7.el7|(none) Tue Feb 2 16:18:37 2021
libedit-3.0-12.20121213cvs.el7|(none) Wed Jan 9 19:12:07 2019
glib2-2.56.1-9.el7_9|(none) Fri Jul 1 14:19:17 2022
mesa-libGL-18.3.4-12.el7_9|(none) Tue Feb 2 16:18:38 2021
newt-0.52.15-4.el7|(none) Wed Jan 9 19:12:08 2019
kernel-tools-3.10.0-1160.59.1.el7|(none) Fri Jul 1 14:20:09 2022
cairo-1.15.12-4.el7|(none) Tue Feb 2 16:18:39 2021
python-slip-0.4.0-4.el7|(none) Wed Jan 9 19:12:10 2019
libX11-common-1.6.7-4.el7_9|(none) Fri Jul 1 14:20:32 2022
libselinux-2.5-15.el7|(none) Tue Feb 2 09:58:51 2021
nss-util-3.67.0-1.el7_9|(none) Fri Jul 1 14:21:33 2022
haveged-1.9.1-1.el7|(none) Sun Sep 12 03:43:55 2021
libacl-2.2.51-15.el7|(none) Tue Feb 2 09:58:53 2021
nss-sysinit-3.67.0-4.el7_9|(none) Fri Jul 1 14:21:34 2022
oracle-instantclient12.1-sqlplus-12.1.0.2.0-1|(none) Sun Sep 12 05:09:38 2021
iputils-20160308-10.el7|(none) Wed Jan 9 19:12:30 2019
openssh-7.4p1-22.el7_9|(none) Fri Jul 1 14:21:45 2022
python-backports-ssl_match_hostname-3.5.0.1-1.el7|(none) Wed Jan 9 19:43:49 2019
openssl-1.0.2k-25.el7_9|1 Fri Jul 1 14:21:54 2022
python-enum34-1.0.4-1.el7|(none) Wed Jan 9 19:43:50 2019
python-perf-3.10.0-1160.59.1.el7|(none) Fri Jul 1 14:22:06 2022
vim-minimal-7.4.629-8.el7_9|2 Tue Feb 2 09:59:24 2021
rpm-python-4.11.3-48.el7_9|(none) Fri Jul 1 14:22:09 2022
freetype-2.8-14.el7_9.1|(none) Tue Feb 2 09:59:25 2021
python-rpm-macros-3-34.el7|(none) Tue Feb 2 09:59:26 2021
dracut-033-572.el7|(none) Tue Feb 2 09:59:30 2021
dbus-1.10.24-15.el7|1 Tue Feb 2 09:59:35 2021
cronie-1.4.11-23.el7|(none) Tue Feb 2 09:59:53 2021
libseccomp-2.3.1-4.el7|(none) Tue Feb 2 09:59:56 2021
dhclient-4.2.5-82.el7.centos|12 Tue Feb 2 10:00:01 2021
ncurses-libs-5.9-14.20130511.el7_4|(none) Sun Sep 12 05:27:37 2021
tuned-2.11.0-10.el7|(none) Tue Feb 2 10:00:26 2021
unixODBC-2.3.1-14.el7|(none) Sun Sep 12 05:28:23 2021
parted-3.1-32.el7|(none) Tue Feb 2 10:01:04 2021
xz-devel-5.2.2-1.el7|(none) Sun Sep 12 05:43:48 2021
libgcrypt-devel-1.5.3-14.el7|(none) Sun Sep 12 05:44:44 2021
xfsprogs-4.5.0-22.el7|(none) Tue Feb 2 10:01:14 2021
... View more
08-09-2022
11:14 AM
I want to extract package line as individual results, tried rex "Linux\ssystem\s\:\s+(?<packages>.+)", but that is just extracting the first package line. tried rex "Linux\ssystem\s\:\s+(?<packages>(.+\w{1,3}\s\w{1,3}(\s+)?\d{1,2}\s\d{1,2}\:\d{1,2}\:\d{1,2}\s\d{4})", but same first line. Here is the list of packages installed on the remote CentOS Linux system : python-prettytable-0.7.2-3.el7|(none) Wed Jan 9 20:38:03 2019 gettext-0.19.8.1-3.el7|(none) Wed May 13 07:35:27 2020 cpp-4.8.5-44.el7|(none) Tue Feb 2 09:59:27 2021 kmod-20-28.el7|(none) Tue Feb 2 09:59:31 2021 glibc-2.17-324.el7_9|(none) Wed Mar 16 18:10:11 2022 diffutils-3.3-5.el7|(none) Tue Feb 2 09:59:00 2021 elfutils-default-yama-scope-0.176-5.el7|(none) Tue Feb 2 09:59:35 2021 glibc-2.17-324.el7_9|(none) Wed Mar 16 18:10:12 2022 numactl-libs-2.0.12-5.el7|(none) Tue Feb 2 09:59:02 2021 device-mapper-event-1.02.170-6.el7_9.3|7 Tue Feb 2 09:59:51 2021
... View more
- Tags:
- Splunk csv
08-31-2020
12:22 PM
I changed splunk set default-hostname “servername” and I tried all possiblities, that I can. But nothing has helped me and still displaying the linux host name in deployment server. Even though, I am changing inputs.conf to another server name.. it's going back to the server name again after restart(I am not using any conf management tool for the inputs)
... View more
08-31-2020
11:48 AM
Did you mean to say after changing hostname in system/local/inputs.conf and server.conf still seeing old name? Yes, I am seeing instance name is changed, but not the host name reporting to deployment server If yes, did you restart splunk after changing host value in above two places? Yes can you confirm where exactly are you seeing old name? I am seeing the Linux server name in deployment server -->forwarder management-->clients, which start with number like 01.splunk and 02.splunk (I want to take out the number and keep in the middle Ex: splunk.01 and splunk.02, with out changing linux host name)
... View more
08-31-2020
11:34 AM
Hello, How can I change the host name displaying in Splunk with out changing /etc/hostname in linux. I did changed in system/local/inputs.conf under default and /local/server.conf under general. But nothing has helped me. I am trying to achieve SAML integration with Splunk for SSO. I am getting an error, since my linux host name starts with numbers. Please do help me. Thanks in Advance.
... View more
Labels
- Labels:
-
configuration
02-03-2020
01:12 PM
Hello,
I have a problem with my replication status.. getting the below result when ever I am trying to see kvstore status.
host 2 replication status is showing recovering from past 1 week.
I tried to resync both shcluster config using "splunk resync shcluster-replicated-config" and kvstore using "splunk resync kvstore -source MyGUID"
But, both didn't work.
Any help would be appreciated.
This member: backupRestoreStatus : Ready date : Mon Feb 3 15:50:19 2020 dateSec : 1580763019.583 disabled : 0 guid : ****-46ED-450B-BE21-****** oplogEndTimestamp : Mon Feb 3 15:50:18 2020 oplogEndTimestampSec : 1580763018 oplogStartTimestamp : Mon Feb 3 06:06:00 2020 oplogStartTimestampSec : 1580727960 port : 8191 replicaSet : splunkrs replicationStatus : KV store captain standalone : 0 status : ready
Enabled KV store members: host1:8191 guid : ****-46ED-450B-BE21-****** hostAndPort : host1:8191 host2:8191 guid : ***-9A10-4962-9A3F-****** hostAndPort : host2:8191 host3:8191 guid : ****-F4B3-4E58-B765-******* hostAndPort : host3:8191
KV store members: host1:8191 configVersion : 205602 hostAndPort : host1:8191 lastHeartbeat : Mon Feb 3 15:50:17 2020 lastHeartbeatRecv : Mon Feb 3 15:50:17 2020 lastHeartbeatRecvSec : 1580763017.874 lastHeartbeatSec : 1580763017.873 optimeDate : Mon Feb 3 15:50:14 2020 optimeDateSec : 1580763014 pingMs : 0 replicationStatus : Non-captain KV store member uptime : 253492
host2:8191
configVersion : 205602
hostAndPort : host:8191
lastHeartbeat : Mon Feb 3 15:50:17 2020
lastHeartbeatRecv : Mon Feb 3 15:50:19 2020
lastHeartbeatRecvSec : 1580763019.366
lastHeartbeatSec : 1580763017.873
optimeDate : Wed Oct 2 11:09:46 2019
optimeDateSec : 1570028986
pingMs : 0
replicationStatus : Recovering
uptime : 253417
host3:8191
configVersion : 205602
electionDate : Fri Jan 24 21:18:18 2020
electionDateSec : 1579918698
hostAndPort : host3:8191
optimeDate : Mon Feb 3 15:50:18 2020
optimeDateSec : 1580763018
replicationStatus : KV store captain
uptime : 844587
Thanks,
... View more
- Tags:
- kvstore
- replication
Labels
- Labels:
-
kvstore
12-04-2019
11:17 AM
Hello,
How can I write power shell script for running btool command ?
where ever I am directly doing in powershell. That is working fine. But, when I store "C:\Program Files\Splunk\bin\splunk" cmd btool props list --debug in test.ps1 and running the script from powersell then, I am getting the error.
Unfortunately, Splunk team does not always have access to the server, so we have to either gain access (takes time and approvals) or involve the server owner to run some Splunk commands.
Rather than walk the server owner through a bunch of long command strings, we should use a script.
Write a powershell script that will:
Start in a UniversalForwarder directory..
Run btool for inputs, outputs, props, and transforms and send the output to .txt files.
Then zip up those 4 files along with the contents of /etc/apps/* and /etc/system/local/* into a single zip file as an output.
The server owner can then mail that .zip file to us and we can diagnose the UF.
Thanks,
Satya Allaparthi
... View more
11-14-2019
06:13 PM
Hello,
We are planning to buy recorded future for my organization to integrate with splunk ES.
We have small Infrastructure with 50GB per day splunk license and I am the only Splunk Engineer working or who can configure things.
We are 4 people in my SOC team. When we contacted recorded future sales rep. They are forcing us to buy 4 core licenses since we are 4 people.
What if we buy only one core license and integrate with splunk ES?
can I run recorded future with domain account?
Can we use same account for multiple users?
Please do help me with my queries.
That will help us save money.
Thanks in advance!
Happy splunking 🙂
... View more
11-01-2019
09:18 AM
Hello,
My Threat Activity dashboards returning zero result found message on every dashboard.
I turned on data model for threat and threat downloads for all locals
When ever I am searching for ip_intel and service_intel, then I am getting the result but all dashboards are empty.
Please do help me.
Any help would be appreciated.
... View more
10-29-2019
01:31 PM
Hello,
I really don't know what is going on in my splunk.
I tried to route data from main index to iis_nonprod. That is not working.
I kept props and transforms in HF. Because the data is touting HF before going to IDX.
source: e:\IISLogs\W3SVC1\u_ex191029.log
props:
[source::e:\IISLogs\W3SVC1*.log]
TRANSFORMS-filter = routeData
tried both REGEX = . and REGEX= . and REGEX =. but nothing is working.
transforms:
[routeData]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = iis_nonprod
but still the data is not routing.
By the way. the above filterings are not working. 😞
can any one please help me with that?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
4 weeks ago
|
Karma given to
