Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About bohrasaurabh
bohrasaurabh
Communicator
Member since:
07-15-2013
06-05-2020
Community Statistics
| Posts | 61 |
| Solutions | 5 |
| Karma Given | 5 |
| Karma Received | 25 |
| Member Since | 07-15-2013 |
Activity Feed
- Got Karma for Re: Why are we getting message "waiting for queued job to start..." and search job takes 5 minutes to run?. 01-11-2022 01:11 AM
- Got Karma for Re: Why are we getting message "waiting for queued job to start..." and search job takes 5 minutes to run?. 11-04-2021 04:34 PM
- Got Karma for Single panel with multiple values. 06-05-2020 12:49 AM
- Got Karma for Single panel with multiple values. 06-05-2020 12:49 AM
- Karma Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time? for vhallan_splunk. 06-05-2020 12:47 AM
- Got Karma for Is there a way to set the job TTL to a different value for a saved search?. 06-05-2020 12:47 AM
- Got Karma for Re: Can I send an email if splunk is not running. 06-05-2020 12:47 AM
- Got Karma for Re: Data not being indexed / inputs.conf. 06-05-2020 12:47 AM
- Got Karma for Re: Data not being indexed / inputs.conf. 06-05-2020 12:47 AM
- Got Karma for Monitoring privileged and non-privileged logs using universal Forwarder on *nix. 06-05-2020 12:47 AM
- Got Karma for Monitoring privileged and non-privileged logs using universal Forwarder on *nix. 06-05-2020 12:47 AM
- Got Karma for Monitoring privileged and non-privileged logs using universal Forwarder on *nix. 06-05-2020 12:47 AM
- Got Karma for Is there a way to set the job TTL to a different value for a saved search?. 06-05-2020 12:47 AM
- Got Karma for Is there a way to set the job TTL to a different value for a saved search?. 06-05-2020 12:47 AM
- Got Karma for Re: Where do I configure inputs.conf for Splunk DB Connect 1.1.5 in a search head pooling environment?. 06-05-2020 12:47 AM
- Got Karma for Re: Why are we getting message "waiting for queued job to start..." and search job takes 5 minutes to run?. 06-05-2020 12:47 AM
- Got Karma for Re: Why are we getting message "waiting for queued job to start..." and search job takes 5 minutes to run?. 06-05-2020 12:47 AM
- Got Karma for Re: Why are we getting message "waiting for queued job to start..." and search job takes 5 minutes to run?. 06-05-2020 12:47 AM
- Got Karma for Re: Why are we getting message "waiting for queued job to start..." and search job takes 5 minutes to run?. 06-05-2020 12:47 AM
- Got Karma for Re: Why are we getting message "waiting for queued job to start..." and search job takes 5 minutes to run?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 3 | |||
| 0 | |||
| 0 | |||
| 0 |
08-16-2017
10:15 AM
@lfedak: The page still exists. I think the issue is the period at the end of the link is becoming part of the URL when you click it and hence page does not exist error. I am unable to edit the question any more to remove that period sign.
... View more
08-16-2017
09:53 AM
@lfedak Intresting... The link I posted existed when I posted this question. I still had it open from yesterday and posting the screen capture.
@cmerriman I will try your suggestion and will let you know. Thanks,
... View more
08-15-2017
02:40 PM
2 Karma
I am interested in creating a dashboard which has a row with one panel with multiple single values similar to the first row in the documentation -> http://docs.splunk.com/Documentation/Splunk/6.6.2/Viz/Aboutthismanual
Can someone please let me know how to do it....
... View more
03-03-2016
07:34 AM
Has anyone configured Splunk Forwarder running on Arista switches to talk to distributed Splunk environment with configs being pushed from Deployment server?
... View more
10-02-2015
07:55 AM
When you run the below search, how many splunk_server do you get in your results.
index=_internal | stats count by splunk_server
... View more
10-01-2015
08:46 AM
I should have mentioned that it will only work if you have more than 1 index server. Based on your posting I assumed you have more that 1 index servers, how many do you have?
... View more
10-01-2015
08:23 AM
1 Karma
I have an Alert setup which runs every 30 mins and looks for 5 or more instances of "Connect to *:9997 failed" if host is any of my searchheads. If found sends email to Admins.
index="_internal" source="*splunkd.log" host="SEARCH_HEAD_NAME*" "Connect to *:9997 failed"
... View more
10-01-2015
08:11 AM
In our environment when we run the powershell command to get a user's properties on AD server by running the below command we get 168 keys/properties/fields
Get-ADUser <username> -Properties *
However when I use ldapsearch command from Splunk for the same user I only get 83 properties.
| ldapsearch domain=mydomain search="(&(objectClass=user)(sAMAccountName=username))"
Some of the properties which are missing and we are interested are accountExpires, badPwdCount, scriptPath which are mentioned in the below question.
http://answers.splunk.com/answers/206725/ldapsearch-is-not-parsing-info-back-from-ad-well.html
I am seeing the above scenario on both (1.1.13 and 2.1.1) release of SA-ldapsearch. Am I missing some configuration which will fetch the missing properties?
... View more
09-29-2015
10:28 AM
That worked. I removed \n from my REGEX and it preserved the formatting too.
REGEX = (?s)(.*community\s+)(\S+)(.*)
Thanks,
... View more
09-29-2015
09:31 AM
I have a multiline event and want to mask the sensitive data at the end of line 1, in the below sample data any word after community. I have tried the below REGEX in transforms.conf, however, I have been unable to rewrite the entire transformed data back to _raw. Currently I don't care about about reformatting the event, as long as entire event gets re-written after masking. Any suggestions for REGEX?
props.conf
[snmptrap:generic]
TIME_FORMAT = %Y-%m-%d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 20
TRANSFORMS-community = maskCommunity
transforms.conf
[maskCommunity]
#REGEX = (.*community\s+)(\w+)(.*)
#REGEX = (?m)(.*community\s+)(\S+)\n(.*)
REGEX = (.*community\s+)(\S+)\n(.*)
DEST_KEY = _raw
FORMAT = $1xxxxx$3
Sample Data:
2015-09-25 11:30:13 10.11.12.13(via UDP: [trapforwarder]:162->;[traprec] TRAP, SNMP v1, community test#&0
.1.3.6.1.4.1.6827.10.17.7.1 Enterprise Specific Trap (1035) Uptime: 22 days, 19:41:52.45
.1.3.6.1.4.1.6827.10.17.3.1.1.1.1 = INTEGER: 1
.1.3.6.1.4.1.6827.10.17.3.1.1.1.2 = INTEGER: 2
.1.3.6.1.4.1.6827.10.17.3.1.1.1.3 = STRING: "This is fake"
2015-09-25 11:30:13 10.11.12.13(via UDP: [trapforwarder]:162->;[traprec]) TRAP, SNMP v1, community test1
.1.3.6.1.4.1.6827.10.17.7.2 Enterprise Specific Trap (1034) Uptime: 22 days, 19:41:53.07
.1.3.6.1.4.1.6827.10.17.3.1.1.1.1 = INTEGER: 1
2015-09-29 11:39:19 172.22.2.92(via UDP: [trapforwarder]:162->[traprec]) TRAP, SNMP v1, community test2
.1.3.6.1.4.1.321.2.1 Enterprise Specific Trap (3) Uptime: 167 days, 1:50:11.60
The best result so far I have seen with the above REGEX is as below:
2015-09-25 11:30:13 10.11.12.13(via UDP: [trapforwarder]:162->;[traprec] TRAP, SNMP v1, community xxxxx .1.3.6.1.4.1.6827.10.17.7.1 Enterprise Specific Trap (1035) Uptime: 22 days, 19:41:52.45
... View more
09-29-2015
07:17 AM
Several re-start of Splunk Enterprise 6.3.0 and just having TIME_FORMAT in my props.conf seems to have resolved the issue. Based on above suggestions I added back MAX_TIMESTAMP_LOOKAHEAD in props.conf.
However I still haven't figured out why events were getting merged together just after upgrade with props.conf.
... View more
09-28-2015
09:14 AM
I added my comments as new answer. Can you please accept it as correct answer and if possible award points. Thanks,
... View more
09-28-2015
09:13 AM
1 Karma
Oliver you mentioned -> "My index.conf looks like this:", I am assuming you meant "inputs.conf"
Can you also post your serverclass.conf for this config.
You dont have to specify host=... in the inputs.conf unless the source of the data is from a different server then specified and you want to override the default hostname.
... View more
09-28-2015
07:31 AM
1 Karma
Oliver you mentioned -> "My index.conf looks like this:", I am assuming you meant "inputs.conf"
Can you also post your serverclass.conf for this config.
You dont have to specify host=... in the inputs.conf unless the source of the data is from a different server then specified and you want to override the default hostname.
... View more
09-28-2015
07:11 AM
passed file is for local authentication only and not Roles and Privileges.
... View more
09-28-2015
06:48 AM
Also from the path "somesoni2" as mentioned, from authorize.conf you will have to copy the contents of the stanza which starts as below.
[roleMap_]
Note: Dont copy the entire authorize.conf as it has hashed password for binding to AD, in case you use AD integration.
... View more
09-28-2015
06:42 AM
Lisa,
My upgraded test system is all in one server and props.conf is created at $SPLUNK_HOME/etc/apps/TA-snmptrap/local directory.
I can confidently say my configs are correct as I copied/rsynced them to 6.2.3 release and they work. Moreover based on the sample traps/events, my experience is Splunk should have auto extracted the Date and Time and also break events, as based on documentation SHOULD_LINEMERGE and BREAK_ONLY_BEFORE_DATE are by default true.
I had MAX_TIMESTAMP_LOOKAHEAD = 20, in my props, however I removed it, as I read it was best used if I am using TIME_PREFIX and in my events Time Stamp starts at the beginning of the line.
Anyways, I will continue to test the config this morning.
... View more
09-25-2015
09:43 AM
We have a development environment (replica of prod) running Splunk 6.2.3 (upgraded from 6.1.5). I am testing monitoring of a file which has snmp traps received using net-snmp snmptrapd on *nix platform.
Earlier this week I upgraded Splunk from 6.1.5 to 6.3.0 on a new standalone instance of test environment to validate new feature set. And import of snmp trap file was one of them.
I am noticing that line breaking dosent seems to work on upgraded 6.3.0 release. Is anyone else facing this situation?
In 6.2.3 release, only the first event breaks incorrectly, all other events are breaking with or without TA.
In 6.3.0 release, the events are getting merged.
Note: I added the events using oneshot method.
To force line breaking on both releases I created props.conf with default values as below, still the same behavior:
[snmptrap:generic]
TIME_FORMAT = %Y-%m-%d %H:%M:%S
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE_DATE = true
Sample Traps logged as below:
`2015-09-25 11:30:13 10.11.12.13(via UDP: [trapforwarder]:162->[traprec] TRAP, SNMP v1, community testing
.1.3.6.1.4.1.6827.10.17.7.1 Enterprise Specific Trap (1035) Uptime: 22 days, 19:41:52.45
.1.3.6.1.4.1.6827.10.17.3.1.1.1.1 = INTEGER: 1
2015-09-25 11:30:13 10.11.12.13(via UDP: [trapforwarder]:162->[traprec]) TRAP, SNMP v1, community testing
.1.3.6.1.4.1.6827.10.17.7.1 Enterprise Specific Trap (1034) Uptime: 22 days, 19:41:53.07
.1.3.6.1.4.1.6827.10.17.3.1.1.1.1 = INTEGER: 1
2015-09-25 11:30:14 10.11.12.13(via UDP: [trapforwarder]:162->[traprec]) TRAP, SNMP v1, community testing
.1.3.6.1.4.1.6827.10.17.7.1 Enterprise Specific Trap (1035) Uptime: 22 days, 19:41:53.71
.1.3.6.1.4.1.6827.10.17.3.1.1.1.1 = INTEGER: 1`
alt text
... View more
06-30-2015
01:16 PM
Is there a way to configure forwarders running on AD/DNS servers not to index REPLICATED data.
For example, when an entry is removed from DNS, around 140 events are logged in Splunk from our several DNS servers and most of the data is duplicate.
... View more
06-02-2015
10:22 AM
This should be actually done within the Windows TA's local directory and then deployed to all Index servers. The location on the index server should be $SPLUNKHOME/etc/apps/{Windows_TA_NAME}/local.
If you have deployment server, then use that to deploy.
... View more
06-01-2015
02:15 PM
in props.conf try stanza as
[source::*:Security]
in transforms you might have to change REGEX as
REGEX = (EventCode)=(5145)
... View more
06-01-2015
02:13 PM
LANG=en_US.UTF-8
LC_CTYPE="en_US.UTF-8"
LC_NUMERIC="en_US.UTF-8"
LC_TIME="en_US.UTF-8"
LC_COLLATE="en_US.UTF-8"
LC_MONETARY="en_US.UTF-8"
LC_MESSAGES="en_US.UTF-8"
LC_PAPER="en_US.UTF-8"
LC_NAME="en_US.UTF-8"
LC_ADDRESS="en_US.UTF-8"
LC_TELEPHONE="en_US.UTF-8"
LC_MEASUREMENT="en_US.UTF-8"
LC_IDENTIFICATION="en_US.UTF-8"
LC_ALL=
... View more
06-01-2015
01:43 PM
I just checked the search app license usage gives the same result as above search, however in bits.
Are you sure the data in kiwi is just for today and not for last 4-5 days?
... View more
06-01-2015
12:52 PM
This is specific to DBX and we have noticed the same issue on DBX release 1.15 also.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
| User | Karma Count |
|---|---|
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
