About rakeshh123

rakeshh123 · ‎04-01-2016

https://answers.splunk.com/answers/83480/installing-sdk-for-python.html

rakeshh123 · ‎02-15-2016

hi HattrickNZ, please see my query correctly ,,,it is | eval output = makemv delim=";"output |mvexpand output|table output ,meansfold...... ...... also if you are not getting meansfold you can write a separate query for meansfold and join both the queries.......by using join .....

rakeshh123 · ‎02-15-2016

hi HattrickNZ, try this query......... index=a sourcetype=b | eval output = toString(c1x) + ";" + toString(c2x) + ";" + toString(c3x) + ";" + toString(c4x).... |makemv delim=";"output |mvexpand output|table output ,meansfold...... reply me if its working ........

rakeshh123 · ‎02-11-2016

Hi , HattrickNZ maxspan=30 means .....The first and last events in the transaction should be no more than thirty seconds apart.... see u r events and change it accordingly, maxpause=5s .... each event should not be longer than five seconds apart....Leave them if it is irrevalant to u r data ...... table meansInfold ,c*---sorry i forgot * what i see from ur answers is u want meansfold unique .......and you want to list c* by meansfold........try this query index = |transaction meansInfold | table meansInfold ,c*|eventstats list(c* ) by meansfold|table meansfold,list(c*).... remove any irrevvalent fields using fields - field uwant to remove see if its working...........reply me if u have any problem .....

rakeshh123 · ‎02-07-2016

An alert can trigger frequently based on similar results that the search returns. The schedule to run an alert can also cause the alert to trigger frequently. To reduce the frequency of the alert firing u can use throttling to reduce the frequency at which an alert triggers.configure these two parameters to reduce the frequency of search results.... 1. Time period..... In real time search time window is 60 seconds ...so alerts occuring may be frequent ....u can it suppress all successive alerts of the same type for the next 10 minutes by using throttling .....specify u required time 2. Field values ....you can also specify field value to supress alerts for that particular field...... hope it helps.........

rakeshh123 · ‎02-07-2016

Hi ,HattrickNZ May be you can solve it by using transaction.....what transaction will do is group events based on fields specified .....try this query.....from u r information u meansInfold has to be grouped. meansInfold :1907443286 1907443286 1907443286......... index = |transaction meansInfold maxspan=30s maxpause=5s| table meansInfold ,c|eventstats list(meansInfold ) by c*|fields - meansInfold........

rakeshh123 · ‎02-03-2016

Hello sunnyparmer, i just changed order of the queries and changed stats to eventstats in the query ........I actually worked on my data with a similar query it is working fine..this is just due to the fact stats cannot pass data to another stats command in chain you have to use eventstats for that....i am sending screenshot of my query and data.... (host="e2e-onp-front" response="Message acknowledged successfully*") OR (host= "e2e-onp-bl-db" DocumentNotificationHookServiceImpl Successfully created notification ) org=|rex "Successfully (?created) notification"|eventstats count by notifications*|stats count(eval(like(response,"%created%"))) AS Total, count(eval(NOT like(response,"%created%"))) as Acknowledge| eval Diff = Total - Acknowledged... Let me know if it works

rakeshh123 · ‎02-02-2016

hi adamblock2, I can give the answer to your question...........let me explain you by taking my example.....Below u can see i have one categorytag...given to categoryId= Accessories .....also see the number of events and tags in the below diagrams and next same tag is given to another categoryId=Strategy when you take a tag for both events with a name it will take both events or none at all .......solution to ur problem naming two tags one with source_ip and destination_ip...... index=* tag= categorytag AND categoryID!=STRATEGY--------no results u r doing a(intersection) !a==definetely null i have created another tag as actiontag where action =purchase ( like destination_ip) i write query like this index=* tag=categorytag NOT tag=actiontag then u will get all the results for categories in category tag that doesnt have purchases...(ie..source ip).........let me know if it works

rakeshh123 · ‎02-01-2016

Hi Kasu_Praveen There is another way of doing other than changing the limits.confi by using savedsearches.conf ...........i dont know how to do it through GUI .....But you can change It through Configuration files .........Go to Splunk-----> etc---->system----> default---->savedsearches.conf copy the files paste it in etc---->system-------->local and all u need to do is change only one attribute dispatch.max_count----> default value is 500000 change it to ur required value ...........Let me know if it helps .....................

rakeshh123 · ‎02-01-2016

Regards Rakesh Vedicsoft Technologies

rakeshh123 · ‎02-01-2016

Hello rishiaggarwal, I tried to solve your problem..........I have taken sample data returning the same results like you Data in my sample data index="demo1"| table Username,ID,Date Now i have written a query ..........for u r expected results index="demo1"|streamstats count by _raw | search count<2 | eval eid=_cd |transaction ID,Date maxspan=5s| table Username,ID,Date I hope u can use this query on your data ..........let me know if it works for u ...........

rakeshh123 · ‎02-01-2016

Splunk user's session times out has three timeout settings: splunkweb session timeout. splunkd session timeout. browser session timeout. The splunkweb and splunkd timeouts determine the maximum idle time in the interaction between browser and Splunk....... splunkweb and splunkd timeouts generally have the same value, as the same field sets both of them. ....for this u have to go to Settings--------------->General Settings---------------->Session timeout --------->generally default value is 1h------> change it to 6h or more.........

rakeshh123 · ‎02-01-2016

Hi mnorindr, It can be solved by using Transaction......according to data u got 2lines having redundant data ....for example sessionid may remain same for a particular transaction this can be solved by using Transaction query

rakeshh123 · ‎01-31-2016

hello boopaljoti, Let me know if u r scheduled alert is triggering any alerts ........You can check triggered alerts in Activity....Also see in search reports and alerts----------> whether alert mode is once per result /once per search .........understand the difference between them....make sure the severity is set to critical( i don't why ,but it worked for me)..... No connection could be made because the target machine actively refused it while sending mail to: xxxx@gmail.com: this may be due to u r trying to connect to another server .... in the first setting i specified Go to server settings -----> email settings ----->Host :port........Give your required sever.. I can see ur link is HTTP not HTTPS......is ssl enabled ? let me know ....

rakeshh123 · ‎01-28-2016

Hello boopaljothi , Please check whether u have configured the following settings ...... Go to server settings -----> email settings -----> Host:smtp.gmail.com:465 enable ssl Email: x@gmail.com password:****** save and restart and use https: in the url( ssl is enabled) Now If u r not getting mail after restart then go to 1.Gmail --------> Settings -----------> Forwarding and POP/IMAP---------> IMAP Access------> IMAP Access: enable it ...... 2.Gmail --------> Myaccount -----------> Sign-in & security----------> Connected apps & sites------>Allow less secure apps: enable it ....... let me know if it helps

rakeshh123 · ‎01-28-2016

I already installed the universal forwarder on a Windows system. What I would like to do is get the data into another Windows system from the forwarder, but I can't figure this out, so please help me. I have set the forwarder and receiver to listen on port 9997. I configured like this on my receiver machine: inputs.conf file [default] host = TRAINING12 [splunktcp://9997] connection_host=ip deployementclient.conf [deployment-client] [target-broker:deploymentServer] targetUri= deploymentserver.splunk.satishnagalla:9997 serverclass.conf [serverClass:satishnagalla:app:_server_app_rakesh] restartSplunkWeb = 0 restartSplunkd = 0 stateOnClient = enabled [serverClass:satishnagalla] whitelist.0 = * [serverClass:satishnagalla:app:_server_app_satishnagalla] I configured like this in my forwarder machine: output.conf file: [tcpout] defaultGroup=receiver indexAndForward=true [tcpout:receiver] disabled = false server=VEDICINDIA-PC:9996,TRAINING12:9997 [tcpout-server://TRAINING12:9997] inputs.conf file: [default] host = satishnagalla [script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path] disabled = 0

rakeshh123 · ‎01-26-2016

OK first U have to go to server settings and check if SSL is enabled in Splunk Web ....... if not enable it...Restart it If u r not getting mail after restart then go to 1.Gmail --------> Settings -----------> Forwarding and POP/IMAP---------> IMAP Access------> IMAP Access: enable it ...... Gmail --------> Myaccount -----------> Sign-in & security----------> Connected apps & sites------> Allow less secure apps: enable it .......

rakeshh123 · ‎01-25-2016

-----try using eventstats instead of stats in the queries.....bcz ex: index=x|stats count by y| table z ,y wont return any results ...but evenstats will work...bcz stats wont forward events .. replace your second query with first bcz mapping more events ---> less events will result in redundancy ... query is very big try to reduce it ...use tags for specific events --give your own naming conventions Index=X earliest=-1d maxsearches=42 filter_result!=DENIED | eventstats earliest(_time) as blocktime by cs_host | eval nice_time = strftime(first_event,"%F %T")| eval check_from = relative_time(first_event, "-d") | eval check_from = strftime(check_from,"%F %T") |eval acesstimes = strftime(_time,"%F %T") | transaction cs_host | dedup cs_uri_path | table cs_host, cs_uri_path, cs_uri_query, acesstimes, cs_username | join 3rd Query ......

Posts	18
Solutions	3
Karma Given	5
Karma Received	7
Member Since	‎01-25-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to configure a universal forwarder on Windows ...

Re: How to install SDK for Python and resolve erro...

Re: How do I group one field's values by another f...

Re: How do I group one field's values by another f...

Re: How do I group one field's values by another f...

Re: Why is Splunk's alert frequencies not working ...

Re: How do I group one field's values by another f...

Re: How do I edit my search to find the difference...

Re: How to use tags to identify complete subnets?

Re: Splunk JavaScript Web Framework: How to return...

Re: Email alert error "command="sendemail" [Errno ...

Re: xpath is returning the duplicate values. How d...

Re: HTTP Client Timeout

Re: Merge Lines Query based on ID

Re: Email alert error "command="sendemail" [Errno ...

Re: Email alert error "command="sendemail" [Errno ...

How to configure a universal forwarder on Windows ...

Re: Why is my scheduled alert not sending email?

Re: Using stats to select the earliest record to p...