Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About satishsdange
satishsdange
Builder
Member since:
05-06-2014
06-05-2020
Community Statistics
| Posts | 146 |
| Solutions | 12 |
| Karma Given | 17 |
| Karma Received | 33 |
| Member Since | 05-06-2014 |
Activity Feed
- Karma Re: Using the Splunk Tutorial data, how to find the number of hits and top 20 category and top 20 domain? for niketn. 06-05-2020 12:48 AM
- Got Karma for Re: After installing a universal forwarder on Ubuntu 14.04 LTS, why am I getting an error trying to accept the license?. 06-05-2020 12:48 AM
- Got Karma for Re: Why am I getting duplicate values for all fields from JSON events?. 06-05-2020 12:48 AM
- Karma Re: Why is my Universal Forwarder showing extreme lag or latency when sending Windows event log data? for hsrawat. 06-05-2020 12:47 AM
- Karma Re: How to set up a license for a Heavy Forwarder that is also a Deployment Server? for andrewdidone. 06-05-2020 12:47 AM
- Karma Re: Splunk App for Enterprise Security: How does Identity Management work? for ekost. 06-05-2020 12:47 AM
- Karma Re: Forwarding events to an indexer cluster using an AWS ELB for dwaddle. 06-05-2020 12:47 AM
- Karma Re: Where to create a new app when using Search Head Clustering? for esix_splunk. 06-05-2020 12:47 AM
- Karma Re: How to control the number of top results shown from a search in Splunk 6.1.2? for ramdaspr. 06-05-2020 12:47 AM
- Karma Re: How to edit my serach to display count in a column chart? for Gilberto_Castil. 06-05-2020 12:47 AM
- Karma Re: Splunk App for Enterprise Security: Is there a way to clear out all previously imported Nessus data? for john_miller1. 06-05-2020 12:47 AM
- Karma Re: How to upgrade multiple Linux forwarders at the same time ? for MuS. 06-05-2020 12:47 AM
- Karma Re: How to upgrade multiple Linux forwarders at the same time ? for koshyk. 06-05-2020 12:47 AM
- Karma How does a forwarder protect against the loss of inflight detail? for NickCorbettAt. 06-05-2020 12:47 AM
- Karma Re: How do I shut off indexing for a certain group who are forwarding their data to my indexer when their data reaches a certain volume? for rsennett_splunk. 06-05-2020 12:47 AM
- Karma Splunk Enterprise Security App Integration with Ticketing / Incident Response System for fharding. 06-05-2020 12:47 AM
- Karma Re: Field extracting using Regex for Sebastian2. 06-05-2020 12:47 AM
- Got Karma for Re: How to create the regex to match the pattern in my data for proper event breaking?. 06-05-2020 12:47 AM
- Got Karma for Re: How to build a dashboard to show extracted email details from a log file?. 06-05-2020 12:47 AM
- Got Karma for Re: How to create the regex to match the pattern in my data for proper event breaking?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 |
05-12-2017
07:52 AM
I am trying to write a subsearch which will negate few days/hours from results considering event count. But below search is not giving me desired result. Could someone please point me the right search?
index=_internal sourcetype="splunkd" NOT [search index=_internal sourcetype="splunkd" | timechart count | search count > 10] | timechart count
... View more
- Tags:
- subsearch
02-12-2017
09:53 PM
I guess you are looking for this link - http://docs.splunk.com/Documentation/Splunk/latest/Data/ConsiderationsfordecidinghowtomonitorWindowsdata
... View more
02-08-2017
09:53 PM
please refer this post - https://answers.splunk.com/answers/227596/why-am-i-seeing-a-mismatch-between-key-value-and-c.html
... View more
06-28-2016
01:42 AM
You can use Add-on to get data into Splunk. You can also use Cisco Security Suite App for visualization.
Splunk Add-on for Cisco FireSIGHT (formerly Splunk Add-on for Cisco Sourcefire) - https://splunkbase.splunk.com/app/1808/
Cisco Security Suite - https://splunkbase.splunk.com/app/525/
... View more
06-22-2016
02:14 AM
One of the option that comes to my mind is to save a search in dashboard & export that to PDF.
... View more
06-04-2016
08:55 AM
Problem has been fixed.
Root cause - Configured ip address to 0.0.0.0 which was bringing stream forwarder down. Just changed it to interface ip & now its working.
root@ip-172-31-19-68:/opt/splunkforwarder/etc/apps/Splunk_TA_stream/local# cat streamfwd.conf
[streamfwd]
port = 8889
ipAddr = 0.0.0.0
root@ip-172-31-19-68:/opt/splunkforwarder/etc/apps/Splunk_TA_stream/local#
... View more
05-26-2016
11:23 PM
Has anyone faced this problem -
root@ip-172-31-19-68:/home/ubuntu# tail /opt/splunkforwarder/var/log/splunk/streamfwd.log
2016-05-26 05:05:45 INFO 140144301864832 stream.main - web interface listening on port 8889
2016-05-26 05:11:01 INFO 140144301864832 stream.main - streamfwd is shutting down
2016-05-26 05:10:58 INFO 139783477241728 stream.CaptureServer - Found DataDirectory: /opt/splunkforwarder/etc/apps/Splunk_TA_stream/data
2016-05-26 05:10:58 INFO 139783477241728 stream.CaptureServer - Found UIDirectory: /opt/splunkforwarder/etc/apps/Splunk_TA_stream/ui
2016-05-26 05:10:59 INFO 139783477241728 stream.CaptureServer - Default configuration directory: /opt/splunkforwarder/etc/apps/Splunk_TA_stream/default
2016-05-26 05:10:59 INFO 139783477241728 stream.CaptureServer - Starting data capture
2016-05-26 05:10:59 INFO 139783477241728 stream.main - streamfwd has started successfully (version 6.5.0 build 233)
2016-05-26 05:10:59 INFO 139783477241728 stream.main - web interface listening on port 8889
2016-05-26 05:11:08 WARN 139783339513600 stream.SnifferReactor - SSL decryption error (unrecognized SSL version) (ssl) [c=202.47.24.180:38361, s=172.31.19.68:80]
2016-05-26 06:05:12 INFO 139783477241728 stream.main - streamfwd is shutting down
... View more
- Tags:
- stream
05-18-2016
08:48 PM
1 Karma
Please see this https://answers.splunk.com/answers/227596/why-am-i-seeing-a-mismatch-between-key-value-and-c.html
... View more
05-18-2016
09:22 AM
Unfortunately it did not work.
... View more
05-17-2016
08:18 PM
Any taker for this question?
... View more
05-17-2016
09:21 AM
Config is from indexer.
... View more
05-17-2016
08:47 AM
Hi Gang -
I know this question has been asked and answered several times, but I could not fix my problem. Could someone please help me out
root@ip-172-31-26-78:/opt/splunk/etc/system/local# cat inputs.conf
[monitor:///var/log/syslog]
host = splunk_indx
sourcetype = syslog
root@ip-172-31-26-78:/opt/splunk/etc/system/local# cat outputs.conf
[tcpout:syslog]
server = 54.169.86.31:514
sendCookedData = false
root@ip-172-31-26-78:/opt/splunk/etc/system/local# cat props.conf
[syslog]
TRANSFORMS-forward = syslogTcpOut
root@ip-172-31-26-78:/opt/splunk/etc/system/local# cat transforms.conf
[syslogTcpOut]
REGEX = .
DEST_KEY=_TCP_ROUTING
FORMAT=syslog
root@ip-172-31-26-78:/opt/splunk/etc/system/local#
BTW, I have referred this post https://answers.splunk.com/answers/65818/forward-data-to-a-third-party-system.html
Thank you so much!!!
... View more
05-13-2016
06:36 AM
Is there anyway to include timestamp for data read by UF as well?
Thanks
... View more
05-12-2016
05:23 AM
Hey Guys -
I am looking to create a simple report with event timestamp & indexed timestamp information but not able to merge index=xxx & index=_internal. Could someone please help me with search. You may consider any sample data.
Thanks in advance.
... View more
04-27-2016
02:40 AM
SQL TA upgrade to 1.2 solved my problem
... View more
04-19-2016
09:26 PM
I am unable to see MSSQL KPIs in ITSI. Below is what I have done so far -
- Installed SQL TA, DBX2 & Windows TA
- configured lookup in SQL TA for host & port
- I am able to see data into Splunk
But I don't following fields that populates DB KPIs -deadlock_rate, server, read_iops, server_write_iops, response_time, connections, connection_pool_used_percent, transaction_rate.
Search for datamodel has produced following results -
I am suspecting problem with tag=server field which does not produce any results.
index=* tag=database tag=performance tag=server
Could someone please advise me how to fix this problem.
Thanks in advance.
... View more
04-05-2016
11:52 PM
I have installed Splunk DB Connect 2 to monitor MS SQL Audit Logs. I am able to get audit logs, but I see same data is getting reindexed every 5 min.
Could someone please help fix this problem?
Inputs.conf
[rpcstart://default]
javahome = C:\Program Files\Java\jdk1.8.0_74
useSSL = 1
proc_pid = 668
[mi_input://Audit_Logs]
connection = splunk_sql
index = main
interval = 300
max_rows = 10000
mode = batch
output.timestamp = true
output.timestamp.column = EVENT_TIME
output_timestamp_format = yyyy-MM-dd HH:mm:ss.SSSSSS
query = select * From SQL_audit_log
source = dbx2
sourcetype = mssql:audit
ui_query_catalog = master
ui_query_mode = advanced
ui_query_schema = sys
... View more
04-03-2016
09:01 PM
1 Karma
I am suspecting a permission issue with your instance. Please refer to below link -
http://docs.splunk.com/Documentation/Splunk/6.3.3/Installation/InstallonLinux
... View more
01-18-2016
01:28 AM
I am trying to extract username & password from below event -
form_key=6LgmjzGyzOYLIf11&login[username]=dev_lee@gmail.com&login[password]=password&send=
I am able to extract password properly but for username I am getting dev_lee%40gmail.com instead of precise email ID.
Below is my regex
login.*?username.*?=(?<splUsername>.*?)&.*?login.*?password.*?=(?<splPassword>.*?)&
Could someone please help me fix the problem.
... View more
- Tags:
- regex
01-05-2016
10:18 PM
Possible. You can push Apps/TA (e.g. Windows Infra App, *nix app) which can have scripts using deployment server.
... View more
09-16-2015
01:43 PM
can you post your inputs.conf & outputs.conf
... View more
07-17-2015
12:22 AM
I am suspecting problem with your inputs.conf [monitor:///var/log]
Shouldn't it be [monitor:///var/log/*] ?
... View more
05-24-2015
08:03 PM
Try this - https://splunkbase.splunk.com/app/1180/
... View more
05-24-2015
08:01 PM
Splunk is a single piece of software for data collection, reporting & parsing. You can use the same binary to access core Splunk i.e. Use Search Head(s) to access Indexer(s).
Is there any specific requirement/need, you want to build a separate application using Python?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
