Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About aknsun
aknsun
Path Finder
Member since:
01-22-2019
11-21-2024
Community Statistics
| Posts | 58 |
| Solutions | 0 |
| Karma Given | 23 |
| Karma Received | 3 |
| Member Since | 01-22-2019 |
Activity Feed
- Posted Re: Unable to get TA-metricator-for-nmonr working for VIOS? on Getting Data In. 04-11-2023 05:06 PM
- Karma Re: Not alll metrics not being captured using Splunk Add-On for Unix & Linux for richgalloway. 04-04-2023 11:43 PM
- Posted Re: Unable to get TA-metricator-for-nmonr working for VIOS? on Getting Data In. 04-04-2023 11:31 PM
- Posted Not all metrics not being captured using Splunk Add-On for Unix & Linux? on Monitoring Splunk. 02-20-2023 04:44 PM
- Posted Why am I unable to get TA-metricator-for-nmonr working for VIOS? on Getting Data In. 02-10-2023 07:47 PM
- Posted Re: License usage by Host on Splunk Search. 11-04-2022 12:42 AM
- Posted Collect Perfmon counters data for ASP.NET & Paging File on Getting Data In. 04-15-2021 07:00 PM
- Posted Template for Citrix XenApp: Environment Overview page shows Machines & Application count as 250 on All Apps and Add-ons. 07-06-2020 12:40 AM
- Karma Re: CIM Mapping issue for nickhills. 06-05-2020 12:51 AM
- Got Karma for Re: Field Extraction help. 06-05-2020 12:51 AM
- Karma Re: AWS Guardduty & Splunk for amiracle. 06-05-2020 12:50 AM
- Karma Re: Splunk Add on for AWS for amiracle. 06-05-2020 12:50 AM
- Karma Re: Splunk Enpterprise - Indexer Cluster issue for gcusello. 06-05-2020 12:50 AM
- Karma Re: help on comparison between 2 lookup for gcusello. 06-05-2020 12:50 AM
- Karma Re: Splunk for desktop environment for martin_mueller. 06-05-2020 12:50 AM
- Karma Re: Index time Search Not Working for woodcock. 06-05-2020 12:50 AM
- Karma Re: Index time Search Not Working for koshyk. 06-05-2020 12:50 AM
- Karma Re: Splunk Add-On for AWS for DavidHourani. 06-05-2020 12:50 AM
- Karma Re: What are the best practices for installing Splunk on Windows endpoints? for sloshburch. 06-05-2020 12:50 AM
- Karma Re: How do I collect basic Windows OS Event Log data from my Windows systems? for sloshburch. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-11-2023
05:06 PM
Hi @guilmxm Is this something you can help out with? Regards, AKN
... View more
- Tags:
- hi
02-21-2023
05:52 AM
1 Karma
The add-on uses shell scripts to capture data for ingestion by Splunk. Run the scripts manually (see inputs.conf for the script names) to see what they return and how they should be modified to run on your OS. Then make the changes to the add-on. You'll want to include switches that test the current OS so you don't break the scripts on other systems. Be aware that upgrades to the add-on will overwrite your changes so you will have to re-apply them.
... View more
11-04-2022
12:42 AM
Am I missing something? I tried something similar, but it doesn't seem to return any data when using the lookup. My lookup has just 2 columns host DC Host1 AWS Host2 AWS Host 3 OnPrem Using what you mentioned earlier. index=_internal source=*license_usage.log type=Usage [|inputlookup DataCentre.csv | fields host | format] | stats sum(b) AS Bytes by h | eval GB = Bytes/1024/1024/1024 | rename h as host | table host GB | sort -GB | addcoltotals
... View more
04-15-2021
07:00 PM
Hi, I have managed to get Process, Memory, LogicalDisk and a few other perfmon counters working. However I can't get the ASP.NET & Paging File to work. Played around with the stanza a bit, but no luck. Has anyone managed to get these working? ## ASP.NET [perfmon://ASP.NET] counters = Requests Queued;Requests Rejected index = windows_metrics disabled = 0 instances = * interval = 60 mode = single object = ASP.NET sourcetype = PerfmonMetrics:ASP _meta = entity_type::Windows_Host useEnglishOnly=true ## Paging File [perfmon://Paging File] counters = % Usage index = windows_metrics disabled = 0 instances = * interval = 60 mode = single object = Paging File sourcetype = PerfmonMetrics:PagingFile _meta = entity_type::Windows_Host useEnglishOnly=true
... View more
Labels
- Labels:
-
Windows
03-18-2021
04:50 AM
It's not working for our environment. Do we have any alternative query for this. Actually in LDAP rest api query , we are only getting admin, user,power , splunk-system-user roles i'm getting.. Due to that, i'm not getting proper results. can you please help me.
... View more
07-06-2020
12:40 AM
Hi, I'm having an issue with the Template for Citrix XenApp. The Environment Overview page shows Machines & Application count as 250. Rebuilding the lookup doesn't make any change either. I have tried to disabling the following, but doesn't help. Lookups > Lookup definitions > siteHosts > Advanced options > uncheck Case sensitive match. The lookup_sites.csv just seems to stuck at 250 Machines. Thanks, AKN
... View more
Labels
- Labels:
-
dashboard
05-01-2020
12:48 AM
@jconger Hi Jason,
Wondering if you can provide input on the above issue?
Thanks.
AKN
... View more
04-05-2020
07:23 PM
Hi,
Has anyone been able to successfully automate Splunk UF for Windows upgrades using Powershell?
Thanks, AKN
... View more
Labels
- Labels:
-
app
-
universal forwarder
-
upgrade
-
Windows
02-19-2020
11:19 PM
Have one more issue with extraction of https status code. Stuck with this issue.
In most cases it picks up 200, but in other events it tends to pick 70 when position changes. Sample events with data masked.
10...* - - [20/Feb/2020:17:00:57 +1000] "GET abcd********* / HTTP/1.1" 200 75666
10...* - - [20/Feb/2020:17:00:57 +1000] "GET abcd*********" 200 70
... View more
02-05-2020
02:03 AM
| makeresults
| eval file_name="/opt/splunk/var/log/splunk/splunkd.log"
| rex field=file_name "(?<dir_name>\/.*\/)"
Hi, how about this?
... View more
01-27-2020
10:28 PM
I got this working. Just had to replace the "$" with a ".*" at the end of the REGEX.
^79\.40\.(96\.([1-9]|[1-9]\d|[12]\d\d)|99\.([1-9]?\d|1\d\d|2[0-4]\d|25[0-4])|9[78]\.([1-9]?\d|[12]\d\d)).*
... View more
12-12-2019
02:45 AM
Hi,
Do we need to also copy the 10 csv files that come along with the TemplateforXendesktop7 App when deploying or are they sample ones?
Thanks
... View more
12-01-2019
03:54 PM
Hi @jconger
Is there a plan to launch a new version of Template for Citrix XenDesktop 7 that is CIM compliant?
Thanks.
... View more
11-20-2019
11:56 AM
Does the user Splunk is running under have read permissions to the file?
Perhaps it was running under a different user before the upgrade.
If that's not the case are you seeing any specific errors?
You can also run the search below, look at the "file" field, and search for events related to the specific file:
index=_internal component=WatchedFile
... View more
10-15-2019
05:26 PM
Thanks @gcusello. That worked.
... View more
08-22-2019
09:39 PM
@harsmarvania57 Thanks. That worked.
... View more
07-31-2019
06:28 PM
@aknsun
Can you accept the answer if it's helped you? Thanks.
... View more
07-21-2019
11:58 PM
There is an option to use Cron. However, as I found out, it wasn't very reliable. Reverted back to using "interval = seconds "
... View more
07-11-2019
07:46 PM
Is there a search query that can show if all Indexers in a Distributed Search Environment are actively participating in searches or not?
Thanks,
AKN
... View more
- Tags:
- splunk-enterprise
11-21-2019
01:41 AM
It's not true the documentation doesn't explain the advantages.
"Each incremental S3 input is a single point of failure.
(...)
"Any SQS message not successfully processed in time by the SQS-based S3 input will reappear in the queue and will be retrieved and processed again.
In addition, data collection can be horizontally scaled out so that if one SQS-based S3 input fails, other inputs can still continue to pick up messages from the SQS queue and ingest corresponding data from the S3 bucket.
"
https://docs.splunk.com/Documentation/AddOns/released/AWS/ConfigureInputs
... View more
06-12-2019
05:44 AM
As long as the logs are not modified and the events are clearly readable by Splunk, then your approach should work without the need for the AWS Add-on. You can also collect that data using Kinesis Data Firehose without the need for a server.
... View more
05-25-2019
10:09 PM
Most welcome! Please accept the answer if it was helpful 😉
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-21-2024
05:12 PM
|
