About AzmathShaik

AzmathShaik

unfortunately it is not extracting the values

AzmathShaik

i have a field as createddate where the DateTime format is as below 2023-02-28T21:55:35.646-08:00 2022-03-24T02:42:16.983-07:00 i'm trying to calculate the difference between now and createddate. can some help me in doing so. i tried to convert createddate and get the difference but no luck Thanks in advance

AzmathShaik · ‎01-29-2021

@gcusello , it's a custom app developed by us. As this app is not pushed to uf using deployment server, we are unable to use deployment server. we have an custom app which gets downloaded during the installation (part of image) and we are trying to disable it using deployment server.

AzmathShaik · ‎01-28-2021

Hello All, i have a default app which gets installed on the UF during the installation (part of our install script). to disable this app, i create the app on deployment server with same name and changed the value of state from enabled to disabled. when i checked uf it is still remaining as enabled. am wondering why it is doing that? can’t i disable the app on UF but install the app

AzmathShaik · ‎01-20-2021

@manjunathmeti Here are my configs. i don't have any local.meta file.

AzmathShaik · ‎01-20-2021

@manjunathmeti we already have this in our config file. it still allowing users to create KO's

AzmathShaik · ‎01-19-2021

Hello Splunkers we are trying to restrict users (non admins) from creating knowledge objects (dashboards and reports) in our custom apps. we would like users to use the dashboards created but not save any dashboards. we have not given write permissions to users for the app. Also we default.meta config file we added the below stanza [viewstates] access = read : [ * ], write : [ admin ] export = system [views] access = read : [ * ], write : [ admin ] we have few groups who have write access to default search and reporting app. is this causing users to create KO's in custom app? if not can someone suggest me if there is anyway to restrict users doing so.

AzmathShaik · ‎12-22-2020

Hello All, i have source with events ****4007656256*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:01:30 Partition not defined for this node: ****4062182208*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:00:01 Partition not defined for this node: ****4062182208*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:00:01 Partition not defined for this node: ****4059036480*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:00:00 Partition not defined for this node: ****4007656256*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:00:00 Partition not defined for this node: ****4059036480*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:00:00 Partition not defined for this node: ****4007656256*vwxmsghdlr.cpp*03523*08000*2020DEC22*14:00:00 Partition not defined for this node: ****4029676352*vwxmsghdlr.cpp*03523*08000*2020DEC22*13:58:54 Partition not defined for this node: can someone help me in writing TIME_PREFIX and LINE_BREAKER?

AzmathShaik · ‎10-09-2020

hellowe’ve directory structure as follows /apps/ftp/user/logs/admin -- main directory sub-directories 2018 2019 2020 and further more each sub-directory with year has directories with months as 01 02 02 03 04 05 06 07 08 09 10 under months directories we have csv log filesso to access a csv file for today /apps/ftp/user/logs/admin/2020/10/20201008.csvhere is monitor stanza for to read this file [monitor:///apps/*/user/logs/admin/.../.../*.csv] disabled = false sourcetype = csv index= user-access-logs crcSalt = <SOURCE>but it’s not reading logs and no error in splunkd logs. can someone help me in correcting the monitor stanza if i’ve done mistake

AzmathShaik · ‎08-13-2020

Hello i have log events with time format "2020-08-13 15:50:20 UTC+0000" and i have defined TIME_FORMAT as %Y-%m-%d %H:%M:%S %Z but still seeing Failed to parse timestamp warnings. can someone correct where am doing mistake?

AzmathShaik · ‎09-23-2019

i 'm trying to calculate the difference between two timestamps in number of days. here is my query base_search | eval intime = strptime(minTime, "%Y-%m-%dT%H:%M:%S") | eval outtime = strptime(maxTime, "%Y-%m-%dT%H:%M:%S") | eval timediffindays = tostring((outtime - intime), "duration") my timestamp filed looks like "2019-09-23T18:51:52+0000" my outcome looks like " 367+01:43:52.000000" i am expecting to see the results in number of days Thanks Azmath

AzmathShaik · ‎09-05-2019

Couple of reasons that might cause this issue splunk boot start is not enabled as the splunk user daemon-reload might have failed please try the below steps systemctl daemon-reload the run the boot start command ( if already enabled it should say file exists) run the old method for starting and stopping splunk ( start should fail asking the system password) run systemctl start Splunkd ( should start splunk)

AzmathShaik · ‎05-31-2019

Thanks for reply. might need to figure out some other way

AzmathShaik · ‎05-31-2019

i am trying to create my own dashboard where i can display host metrics. to do this i want to group the hosts based of roles. role of the server is mapped to component key.

AzmathShaik · ‎05-31-2019

Hello All We are using splunk_app_infrastructure where we have created additional dimensions . I want to create a drop down where I pick a dimension and display values associated with it- as shown in the image. Thanks in Advance ~AZ

AzmathShaik · ‎02-13-2019

Hello All, i have log events, in which my time stamp looks like superuser:02/13/2019 04:08:24:367 PM UTC supportUser:02/13/2019 02:06:23:497 PM UTC auditUser:02/13/2019 09:04:44:367 PM UTC libSMAL:02/13/2019 03:08:29:300 PM UTC and i defined TIME_PREFIX as TIME_PREFIX=^: . Can some please tell me if i defined it correctly? Thanks

AzmathShaik · ‎01-29-2019

Hello all, I wanted to run a report on the last day of the month and send an email. Can some help me with cron value for it?

AzmathShaik · ‎03-28-2018

Hello We have a search head cluster, where one of the servers which were configured as a cluster member was terminated accidentally. Though our cluster is functioning properly, we are receiving an error message as "SHC member is down: https://127.0.0.1:8089. Please fix the issue on that node and bring it back online as soon as possible to avoid service disruption" We restarted the search head cluster but still, we are seeing the message. Can anyone help in how can I get rid of the message? Thanks Azmath

AzmathShaik · ‎01-03-2018

yeah i'm also experiencing the same.

AzmathShaik · ‎01-03-2018

Hello All does any one have any idea, weather splunk use any of the following Apache tomcat or Apache struts if it uses what is the purpose? Thanks.

Posts	72
Solutions	1
Karma Given	3
Karma Received	6
Member Since	‎02-18-2016

Online Status	Offline
Date Last Visited	3 weeks ago

How to convert dateTime and calculate difference?

Disable app on UF using deployment server

how to prevent users from creating knowledge objec...

time_format help

splunk uf not reading logs

Time Format Help

Calculate difference between 2 timestamps in days?

How to create a dropdown with a list of selected D...

Can you help me write the time prefix?

How do you use cron schedule to run a report on th...

Re: convert dateTime and calculate difference

How to convert dateTime and calculate difference?

Re: Disable app on UF using deployment server

Disable app on UF using deployment server

Re: how to prevent users from creating knowledge o...

Re: how to prevent users from creating knowledge o...

how to prevent users from creating knowledge objec...

time_format help

splunk uf not reading logs

Time Format Help

Calculate difference between 2 timestamps in days?

Re: Receiving the following error: "failed to star...

Re: How to create a dropdown with a list of select...

Re: How to create a dropdown with a list of select...

How to create a dropdown with a list of selected D...

Can you help me write the time prefix?

How do you use cron schedule to run a report on th...

How to remove search head peer from the cluster?

Re: Does splunk use Apache tomcat or Apache struts

Does splunk use Apache tomcat or Apache struts