Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About vin02ptl
vin02ptl
Explorer
Member since:
01-28-2019
07-08-2020
Community Statistics
| Posts | 22 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 01-28-2019 |
Activity Feed
- Posted Re: Terminate User Session on Security. 07-08-2020 07:12 AM
- Posted Re: DB connect issue on Splunk Search. 06-30-2020 09:51 AM
- Posted Re: DB connect issue on Splunk Search. 06-30-2020 08:04 AM
- Posted DB connect issue on Splunk Search. 06-30-2020 07:18 AM
- Got Karma for How to exclude field with null value?. 06-05-2020 12:50 AM
- Posted Re: Need to remove prefix from json array. on Getting Data In. 05-15-2020 05:54 AM
- Posted Re: Need to remove prefix from json array. on Getting Data In. 05-15-2020 04:18 AM
- Posted Re: Need to remove prefix from json array. on Getting Data In. 05-15-2020 03:25 AM
- Posted Need to remove prefix from json array. on Getting Data In. 05-15-2020 03:10 AM
- Tagged Need to remove prefix from json array. on Getting Data In. 05-15-2020 03:10 AM
- Posted Additional field is not populating in ES inscident review page for the AWS cloudtail correlation search. on Splunk Enterprise Security. 12-01-2019 10:41 PM
- Tagged Additional field is not populating in ES inscident review page for the AWS cloudtail correlation search. on Splunk Enterprise Security. 12-01-2019 10:41 PM
- Tagged Additional field is not populating in ES inscident review page for the AWS cloudtail correlation search. on Splunk Enterprise Security. 12-01-2019 10:41 PM
- Tagged Additional field is not populating in ES inscident review page for the AWS cloudtail correlation search. on Splunk Enterprise Security. 12-01-2019 10:41 PM
- Posted Re: what will be regex for timestamp format 2019-11-06T03:30:27+00:00? on Getting Data In. 11-06-2019 10:02 PM
- Posted Re: what will be regex for timestamp format 2019-11-06T03:30:27+00:00? on Getting Data In. 11-06-2019 10:01 PM
- Posted what will be regex for timestamp format 2019-11-06T03:30:27+00:00? on Getting Data In. 11-06-2019 10:19 AM
- Tagged what will be regex for timestamp format 2019-11-06T03:30:27+00:00? on Getting Data In. 11-06-2019 10:19 AM
- Tagged what will be regex for timestamp format 2019-11-06T03:30:27+00:00? on Getting Data In. 11-06-2019 10:19 AM
- Posted Re: How to exclude field with null value on Getting Data In. 11-04-2019 10:22 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-30-2020
08:04 AM
inputs ,identities ,connection etc all I have created .It was working some time before but not working now. There is no change in credentials and I could see the result with sql query. I using search "index=*** source=***" in SH to find the data.
... View more
06-30-2020
07:18 AM
Hi Team, I have created connection for oracle DB in db connect app. When i am trying to run the sql query in DB connect i can see the result. But when i am trying to search the same result in search head using index and source , not getting any result.
... View more
Labels
- Labels:
-
other
05-15-2020
05:54 AM
i just want to remove header part during indexing remaining parsing field regex i can write....
... View more
05-15-2020
03:25 AM
how to write in props.conf
{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#auditLogs/directoryAudits","value":[]}
{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#auditLogs/directoryAudits","value":[]}
{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#auditLogs/directoryAudits","value":[{"id":"B2Cxx","category":"xxx","correlationId":xxx,"activityDateTime":"xxx"....},{"id":"B2Cxx","category":"xxx","correlationId":xxx,"activityDateTime":"xxx"....},{"id":"B2Cxx","category":"xxx","correlationId":xxx,"activityDateTime":"xxx"....}]}
... View more
05-15-2020
03:10 AM
Need to remove prefix from json array. I want to remove everything before {"id"
{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#auditLogs/directoryAudits","value":[{"id"
... View more
- Tags:
- props.conf
12-01-2019
10:41 PM
I have created correlation search to get the alert for the aws cloudtrail activity in enterprise security. Alert is triggering but not populating any Additional field in the incident review page.
What are the ahnges needs to do to get the additional fields in the incident review page for aws cloudtrail alert.
... View more
11-06-2019
10:02 PM
need to YMS format
... View more
11-06-2019
10:19 AM
what will be regex for timestamp format 2019-11-06T03:30:27+00:00? I am getting error during indexing the data file.
... View more
- Tags:
- props.conf
- timestamps
11-04-2019
10:22 AM
I am looking for search time extraction for cim compliance and using kv_mode = json. In that case how to proceed?
... View more
11-04-2019
04:07 AM
1 Karma
I have indexed a JSON file and want to remove field which has 'null' value(event 1) but if the same field have any correct value in the next event(2) it should consider that field and extract the result. Please advise. Logs as below:
Event1:
{
policy: null
protocol: null
reason: null
severity: low
sid: xxx
source_port: null
src: xx.xx.xx.xx
success: null
terminal_source: xx.xx.xx.xx
}
Event2:
{
policy: Normal
protocol: 4
reason: null
severity: low
sid: xxx
source_port: 234
src: xx.xx.xx.xx
success: null
terminal_source: xx.xx.xx.xx
}
... View more
Labels
- Labels:
-
field extraction
11-03-2019
10:02 AM
Filename: xxx
dest: xxx
created_at: xxxx
destination_port: null
source: xxx
username: zxx
above fields are not populating and time and date field which i have added those only populating
... View more
11-03-2019
09:54 AM
i have tried, but fields are not reflecting under interesting field
... View more
11-03-2019
02:15 AM
My log contains multiple {} data structure and i want to get all json field inside extracted field in splunk . How to parse?
{ [-]
service: [ [-]
{ [-]
name: xxxxx
id: xxx
}
]
Filename: xxx
dest: xxx
created_at: xxxx
destination_port: null
source: xxx
username: zxx
}
... View more
08-07-2019
03:29 AM
I have completed Splunk Enterprise Certified Architect exam version 6.x last year. I want to do recertification to upgrade my certification. But "Splunk Enterprise Certified Architect" Exam is not listed inside the Pre-approved exams in my Pearson Vue account. Pearson Vue support team ask me to confirm with Splunk team.
Could you please help me on this. So I can proceed for the recertification.
... View more
04-12-2019
12:00 AM
I want to call splunk from web services and fetch the endpoint result from splunk and send in to webservices UI.
... View more
01-29-2019
08:29 AM
Thanks for your reply.......yes I want same data to go to both the indexers.
... View more
01-29-2019
04:30 AM
both the indexers are in different cloud and they are part of totally different cluster and environment.
... View more
01-28-2019
11:14 PM
I have one heavy forwarder and two different cloud indexers.
heavy forwarder (HF)
indx1(placed in cloud 1)
indx2(placed in cloud 2)
Both are the part for different cluster. Is it possible to send the data from the HF to both the cloud indexers at the same time.
What will be the steps?
... View more
