Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ashish9433
ashish9433
Communicator
Member since:
01-11-2015
a week ago
Community Statistics
| Posts | 84 |
| Solutions | 2 |
| Karma Given | 46 |
| Karma Received | 21 |
| Member Since | 01-11-2015 |
Activity Feed
- Got Karma for Re: Align the first column of the table. 12-02-2021 11:07 PM
- Karma What's Happening With the Splunk Community @.conf21! for sensitive-thug. 10-13-2021 01:16 AM
- Got Karma for Re: Where does Splunk Technical Assessment App should be exactly installed. 03-18-2021 09:27 AM
- Posted Re: Where does Splunk Technical Assessment App should be exactly installed on Splunk Enterprise. 03-18-2021 08:42 AM
- Karma My Journey of Life with Splunk for vikramyadav. 12-15-2020 06:59 AM
- Got Karma for Remove "All" from Multiselect Input in Dashboard. 10-08-2020 11:36 AM
- Got Karma for Get URL for Splunk ITSI Glasstables with Service Swappning. 09-21-2020 07:08 AM
- Got Karma for Re: how to input encrypted files like PGP encrypted files. 06-29-2020 09:03 AM
- Got Karma for Re: how to input encrypted files like PGP encrypted files. 06-29-2020 08:43 AM
- Got Karma for Re: how to input encrypted files like PGP encrypted files. 06-29-2020 08:39 AM
- Posted Re: how to input encrypted files like PGP encrypted files on Getting Data In. 06-29-2020 08:30 AM
- Karma how to input encrypted files like PGP encrypted files for VSIRIS. 06-29-2020 08:26 AM
- Karma ITSI - Issue with no entities showing in service for rcraft1218. 06-05-2020 12:50 AM
- Karma Re: How can I apply JavaScript on a multiselect dropdown menu? for jeffland. 06-05-2020 12:49 AM
- Karma Re: Heavy Forwarder not showing in Deployment Server for s2_splunk. 06-05-2020 12:49 AM
- Karma Re: Remove "All" from Multiselect Input in Dashboard for ashleyherbert. 06-05-2020 12:49 AM
- Karma Re: Remove "All" from Multiselect Input in Dashboard for niketn. 06-05-2020 12:49 AM
- Got Karma for Remove "All" from Multiselect Input in Dashboard. 06-05-2020 12:49 AM
- Got Karma for Heavy Forwarder not showing in Deployment Server. 06-05-2020 12:49 AM
- Got Karma for Re: Remove "All" from Multiselect Input in Dashboard. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
03-18-2021
08:42 AM
1 Karma
I would suggest installing it on DMC and you would be able to get the results you are looking for.
... View more
06-29-2020
08:30 AM
3 Karma
Hey, There is no direct way of onboarding encrypted data to Splunk. In case there is a requirement to do so, you can go ahead and write a script (python/shell) that access the API of encrypted source, parse it and send it to Splunk. There is a python library to address this https://pypi.org/project/py-pgp/ The below code should be a starter for you import pgpy
emsg = pgpy.PGPMessage.from_file(<path to the file from the client that was encrypted using your public key>)
key,_ = pgpy.PGPKey.from_file(<path to your private key>)
with key.unlock(<your private key passpharase>):
print (key.decrypt(emsg).message)
... View more
07-29-2019
07:50 AM
Yup baiscally the rest API was sending out the data is random order everytime it polled and the regex was written without that things to be taken into consideration. Later on it was realized that the JSON response is completely jumbled up on every hit and fixing the Regex solved the prblm.
Thanks for your help!
... View more
07-19-2019
02:11 PM
yeah even i am banging my head that what is that i am missing. I have posted only half of the output. The actual output is a valid json.
... View more
07-19-2019
01:42 PM
This doesnt work and in preview even with/without the events shows properly formatted and parsed, but i don't know why when it is getting indexed it is messing up
... View more
07-19-2019
04:56 AM
Hi,
I have tried Splunk Add-on builder as well as REST API app of App store to get data via REST API from Mongo DB OPS Manager, but the results events are not getting broken properly
I tried fiddling dump, dumps, load & loads function in python as well as whatever i could think of in props.conf but no positive results.
Any inputs on how do i fix it?
Below is how i see the data in splunk irrespective i use Splunk Add-on builder or REST API App
{"links":[{"href":"http://opsmanager.abc.xyz.org:80/api/public/v1.0/globalAlerts?status=OPEN&pageNum=1&itemsPerPage=100","rel":"self"}],"results":[{"acknowledgedUntil":"2119-03-01T14:07:52Z","acknowledgingUsername":"abc@zyz.com","alertConfigId":"5980bcc00e545f881d3659a1","created":"2018-08-21T14:49:27Z","currentValue":{"number":2.3656959E7,"units":"SECONDS"},"eventTypeName":"OUTSIDE_METRIC_THRESHOLD","groupId":"5a0dbc440e545f72701d8ca6","hostId":"8d9e4f32e307e1b4a935d0f3e0055940","hostnameAndPort":"denata3utmdb01.abc.xyz.org:27045","id":"5b7c26771f98cf1493f1577b","lastNotified":"2019-03-25T01:24:51Z","links":[{"href":"http://opsmanager.abc.xyz.org:80/api/public/v1.0/globalAlerts/5b7c26771f98cf1493f1577b","rel":"self"}],"metricName":"OPLOG_SLAVE_LAG_MASTER_TIME","replicaSetName":"ATBDAP03","status":"OPEN","tags":["TAG_SDLC"],"typeName":"HOST_METRIC","updated":"2019-05-22T09:52:52Z"},{"acknowledgedUntil":"2119-06-22T14:08:19Z","acknowledgingUsername":"abc@zyz.com","alertConfigId":"5980bf8a0e545f881d3663fd","created":"2019-03-09T23:20:40Z","eventTypeName":"HOST_RECOVERING","groupId":"5a0dbc440e545f72701d8ca6","hostId":"8d9e4f32e307e1b4a935d0f3e0055940","hostnameAndPort":"denata3utmdb01.abc.xyz.org:27045","id":"5c844a480e545f1d153be335","lastNotified":"2019-05-21T21:24:59Z","links":[{"href":"http://opsmanager.abc.xyz.org:80/api/public/v1.0/globalAlerts/5c844a480e545f1d153be335","rel":"self"}],"replicaSetName":"ATBDAP03","status":"OPEN","tags":["TAG_SDLC"],"typeName":"HOST","updated":"2019-07-16T14:08:19Z"},{"acknowledgedUntil":"2119-06-22T14:08:09Z","acknowledgingUsername":"abc@zyz.com","alertConfigId":"5980c0390e545f881d366688","created":"2019-03-29T01:49:16Z","eventTypeName":"HOST_DOWN","groupId":"5994baea0e545f0fb11a7bf8","hostId":"61a2829f7bbb5f89f3406642206a36fa","hostnameAndPort":"denatb3mdips01.abc.xyz.org:27045","id":"5c9d799cf76e9d3f9d9934f1","lastNotified":"2019-05-21T21:24:53Z","links":[{"href":"http://opsmanager.abc.xyz.org:80/api/public/v1.0/globalAlerts/5c9d799cf76e9d3f9d9934f1","rel":"self"}],"replicaSetName":"ATIPS03","status":"OPEN","tags":["TAG_SDLC"],"typeName":"HOST","updated":"2019-07-16T14:08:09Z"},{"acknowledgedUntil":"2119-06-22T14:08:03Z","acknowledgingUsername":"abc@zyz.com","alertConfigId":"5980bf280e545f881d36629d","created":"2019-04-26T01:48:10Z","currentValue":{"number":92.42220000199045,"units":"RAW"},"eventTypeName":"OUTSIDE_METRIC_THRESHOLD","groupId":"5994baea0e545f0fb11a7bf8","hostId":"b4711110d008f035c85bc9edd549bb46","hostnameAndPort":"denatb3mdips02.abc.xyz.org:27045","id":"5cc2635a0e545f54c4245073","lastNotified":"2019-05-21T21:24:53Z","links":[{"href":"http://opsmanager.abc.xyz.org:80/api/public/v1.0/globalAlerts/5cc2635a0e545f54c4245073","rel":"self"}],"metricName":"DISK_PARTITION_SPACE_USED_DATA","replicaSetName":"ATIPS03","status":"OPEN","tags":["TAG_SDLC"],"typeName":"HOST_METRIC","updated":"2019-07-16T14:08:03Z"},{"acknowledgedUntil":"2119-06-22T14:07:58Z","acknowledgingUsername":"abc@zyz.com","alertConfigId":"5980bf280e545f881d36629d","created":"2019-05-03T17:17:46Z","currentValue":{"number":93.33982523912108,"units":"RAW"},"eventTypeName":"OUTSIDE_METRIC_THRESHOLD","groupId":"5994baea0e545f0fb11a7bf8","hostId":"b4270e868d403038d18dad42693416f5","hostnameAndPort":"denatb3mdips03.abc.xyz.org:27045","id":"5ccc77ba0e545f54c4d931d4","lastNotified":"2019-05-21T21:24:53Z","links":[{"href":"http://opsmanager.abc.xyz.org:80/api/public/v1.0/globalAlerts/5ccc77ba0e545f54c4d931d4","rel":"self"}],"metricName":"DISK_PARTITION_SPACE_USED_DATA","replicaSetName":"ATIPS03","status":"OPEN","tags":["TAG_SDLC"],"typeName":"HOST_METRIC","updated":"2019-07-16T14:07:58Z"},{"acknowledgedUntil":"2119-06-22T14:07:52Z","acknowledgingUsername":"abc@zyz.com","alertConfigId":"5980bf280e545f881d36629d","created":"2019-05-08T01:46:28Z","currentValue":{"number":91.2596940644846,"units":"RAW"},"eventTypeName":"OUTSIDE_METRIC_THRESHOLD","groupId":"5994baea0e545f0fb11a7bf8","hostId":"697b2c7697e9fb5f466a6f6f65d1f914","hostnameAndPort":"dens2b3mdips02.abc.xyz.org:27045","id":"5cd234f4f76e9d580f1c16b4","lastNotified":"2019-05-21T21:24:53Z","links":[{"href":"http://opsmanager.abc.xyz.org:80/api/public/v1.0/globalAlerts/5cd234f4f76e9d580f1c16b4","rel":"self"}],"metricName":"DISK_PARTITION_SPACE_USED_DATA","replicaSetName":"ST2IPS03","status":"OPEN","tags":["TAG_SDLC"],"typeName":"HOST_METRIC","updated":"2019-07-16T14:07:52Z"},{"acknowledgedUntil":"2119-06-22T14:07:43Z","acknowledgingUsername":"abc@zyz.com","alertConfigId":"5980bd950e545f881d365cb2","created":"2019-05-20T14:35:51Z","currentValue":{"number":155845.0,"units":"SECONDS"},"eventTypeName":"OUTSIDE_METRIC_THRESHOLD","groupId":"597f93d70e545f881d331591","hostId":"42d7c182422a623b875df934da1cc3e9","hostnameAndPort":"deni1b3mdedi01.abc.xyz.org:27130","id":"5ce2bb470e545f55d16ed5b4","lastNotified":"2019-05-22T02:39:58Z","links":[{"href":"http://opsmanager.abc.xyz.org:80/api/public/v1.0/globalAlerts/5ce2bb470e545f55d16ed5b4","rel":"self"}]
... View more
03-12-2019
01:52 AM
Hi,
I have lot of alerts which even trigger during the maintenance period causing false incidents. The cmdb has the maintenance schedule but in the formats like "1st&3rd-Friday@10am", "2nd&4th-Monday@6pm" and so on. I am trying to prase this time in Splunk search query so that i can create Starttime & Endtime for which the alert will not trigger.
I am able to "| eval CurrentDay = strftime(now(), "%A")" which gives me the current day like whether today is Monday/Tuesday or what day, but how do i find out if it is first monday of the month or 2nd monday or so for me to address this requirement.
Anyone who can point me towards some direction in addressing this?
... View more
02-26-2019
11:25 AM
I have tried similar to what you have mentioned but i dont see that working!
... View more
02-24-2019
10:33 AM
Hi,
I am using below search query which list's out the sequence of login using standard querying. What the below query does is it gives me the authentication actions as list. I am looking for those security events which gets succeed after multiple failures. The below query does the job but i want to use it using tstats command as the below conventional query is quite slow.
sourcetype="WinEventLog:Security" EventCode=4624 OR EventCode=4625 | stats count sparkline as trend values(user) as Users max(_time) as maxtime min(_time) as mintime values(difference) as difference list(action) as list values(src_bunit) as src_bunit values(dest_bunit) as dest_bunit values(dvc_bunit) as dvc_bunit values(user_email) as user_email,values(Failure_Reason) as Failure_Reason, values(signature) as signature,values(Error_Code) as Error_Code by user | eval list = mvjoin(list, " ") | eval alert = if(match(list, "(?:failure\s?){4,}(?:success)"), "True", "False") | where alert = "True" | eval diff = round((maxtime - mintime)/60,0) | eval timediff = mvindex(split(diff, "-"),1) | eval maxtime=strftime(maxtime,"%H:%M:%S") | eval mintime=strftime(mintime,"%H:%M:%S") | where count>100 | fields - diff | where timediff<=60
I tried constructing the below query but list() function doesn't seems to be working with tstats command and hence i am unable to get the exact sequence. In the below query list(Authentication.action) as list doesn't work and hence the issue. If i use values() it will only give me success & failure but not the sequence and hence i am not able to find success after four failures.
| tstats summariesonly=t earliest(_time) as maxtime, latest(_time) as mintime, values(Authentication.dest_nt_domain) as dest_nt_domain,values(Authentication.signature) as signature, list(Authentication.action) as list,values(Authentication.user_email) as user_email,values(Authentication.dest) as dest ,values(Authentication.body) as body,values(Authentication.signature_id) as signature_id values(Authentication.Error_Code) as Error_Code, count as EventCount from datamodel=Authentication where sourcetype="WinEventLog:Security" (Authentication.signature_id="4624" OR Authentication.signature_id="4625") groupby Authentication.user | eval list = mvjoin(list, " ") | eval alert = if(match(list, "(?:failure\s?){4,}(?:success)"), "True", "False") | where alert = "True" | eval diff = round((maxtime - mintime)/60,0) | eval timediff = mvindex(split(diff, "-"),1) | eval maxtime=strftime(maxtime,"%H:%M:%S %Z") | eval mintime=strftime(mintime,"%H:%M:%S %Z") | where EventCount>=50 | fields - diff | where timediff<=60
Why I am using "list" cmd?
To get failure followed by a success action sequence like below example
After list command, | eval list = mvjoin(list, " ") | eval alert = if(match(list, "(?:failure\s?){4,}(?:success)"), "True", "False") | where alert = "True"
Example: failure failure failure failure success failure success
How can i address the above scenario using datamodel/tsats?
... View more
12-23-2018
09:03 AM
Hi,
I have JSON data, which seems to be properly prased. I have a field which holds multiple IPs in a new lined when seen in formatted events and seperated with \n when seen in un-formatted.
Check the below screenshot
I am unable to use mvexpand or split or even i tried to use makemv command but it doesn't work as expected.
Any clue, how to handle this situation, when i do a stats or table i want IPs as multivalued whereas currently it is displayed as just a text with IPs separated with space.
... View more
07-02-2018
06:05 AM
@niketnilay no it doesn't work, i do not see any events. I assume since the file is empty it is not creating any event and since no event no entry in the source list. I may be wrong but i cannot see any result for source=*.trg
Any work around getting the list of file uploaded using Metadata or Rest command.
... View more
07-02-2018
05:24 AM
@niketnilay i do not want to block those files, infact i want a way to identify if the respective .trg file has been available in the directory or not.
If i see that an empty .trg file was available in the directory i can alert using Splunk and that's what is my requirement.
... View more
07-02-2018
05:04 AM
Hi Team,
I have folder in which batch jobs loads the data files which are being consumed by Splunk. The data files are larger and sometimes it takes hours to get loaded into the directory. Once the file is loaded completely there is a empty file created with the same name as of the data file but with extension as .trg.
This empty .trg file is just to indicate the data is completely copied and the next process can start.
When monitoring the directory the empty files as usual would not be uploaded into splunk as it doesn't have any data, but is there a way using metadata command or REST command i can find out if splunk attempted to upload that empty file so that i can alert the file has been completely copied into the directory?
... View more
03-20-2018
05:51 AM
I already did this, the problem is the result is shown as list of all image_name as columns and date as rows with all zero in all the row of all the cloumns and thus the issue!
... View more
03-20-2018
05:50 AM
I want to group by span=15d and have a visualization and also use a single value with trend indicator option.
I tried span, bin and timechart none of them is working on lookup data.
... View more
03-20-2018
05:48 AM
I already did this, the problem is the result is shown as list of all image_name as columns and date as rows with all zero in all the row of all the cloumns and thus the issue!
... View more
03-20-2018
01:10 AM
Hi Team,
I have a scheduled search which generates a lookup file similar to below
Whenever i run stats command on this data it runs perfectly fine. But whenever i try to run timechart command it doesnt work, like below
search ...| timechart count by image_name
search ... | timechart count(image_name)
or any permutation i try with i get either zero or null but not the actuall count or aggregate function. Basically i am looking to use span/bin on this data but i am unable to do that so thought of using timechart command.
I have properly formatted the time to _time by converting into epoch time and then into %c standard format.
I am not sure why timechart is not working on the lookup/csv file data.
... View more
02-19-2018
04:16 AM
1 Karma
I have a glass table which has multiple services and each of the services has multiple KPIs mapped on the glasstable as in the below image.
When i click on Circle (KPI 1) within the respective service, it takes me to a another glasstable which has Service swapping enable. I did generated a unique URL by clicking on each of the services and then put that in the drilldown of the orignal glass table circle click.
What is happening is that on clicking it takes to the another glasstable but always default (service 1) is selected by default irrespective if i click on service 2 or 3 or any one. I made it very sure that the URL is correct.
Also i found that if i select say respective service from the service swapping menu of the glass table the URl changes with the service ID, but if i just copy paste the same URL into another tab it resets to default service.
The same i have to do with click on square (KPI 2) and it should take to a glasstable where respective service should be selected as from where the click came from.
inshort how do i drilldown from Glasstable 1 to Glasstable 2 (with service swapping) with respective service selected from the dropdown.
... View more
02-16-2018
09:41 PM
looks like easy and innovative way of doing it! Thanks @ashleyherbert
... View more
01-15-2018
04:55 AM
HI Team,
I have a table which has multiple values like below. In the table there are multiple Check_Category and for each Check_Category there are multiple check_ids.
What i want to do is, when someone clicks on Any Check_Category, in the above example lets say the person click on "Initial Setup", then i need to drilldown to another page having only those Check_ID as columns
As in below screenshot i will have only those check_ID as colomn which are listed for clicked "Check_Category".
Basically if i can get the list of all the Check_ID, separated by "Space", then i can use fields command to list only those columns.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
a week ago
|
Karma given to
