Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About saurabh009
saurabh009
Path Finder
Member since:
03-30-2016
06-05-2020
Community Statistics
| Posts | 38 |
| Solutions | 3 |
| Karma Given | 3 |
| Karma Received | 15 |
| Member Since | 03-30-2016 |
Activity Feed
- Karma Can you hot add RAM to a splunk searchhead virtual machine without a restart of Splunkd for fsolercasanova. 06-05-2020 12:50 AM
- Got Karma for Re: Changing the server hostname has impact in splunk environment?. 06-05-2020 12:50 AM
- Got Karma for Re: universal forwarder is installed in a QA server and configured to splunk still logs are not showing up in splunk what are the possible connections to be checked?. 06-05-2020 12:50 AM
- Got Karma for Can I set different interval of execution for different hosts receiving same scripted input app from deployment server?. 06-05-2020 12:50 AM
- Got Karma for Re: Can I set different interval of execution for different hosts receiving same scripted input app from deployment server?. 06-05-2020 12:50 AM
- Got Karma for Re: Global dashboard.js. 06-05-2020 12:50 AM
- Got Karma for Re: Global dashboard.js. 06-05-2020 12:50 AM
- Got Karma for How to setup order of apps in the launcher page for all the users?. 06-05-2020 12:50 AM
- Got Karma for Re: How to setup order of apps in the launcher page for all the users?. 06-05-2020 12:50 AM
- Got Karma for Does splunk support Appdynamics add-on integration if they are behind the SAML?. 06-05-2020 12:50 AM
- Got Karma for Re: Does splunk support Appdynamics add-on integration if they are behind the SAML?. 06-05-2020 12:50 AM
- Got Karma for Re: What are your Splunk t-shirt ideas?. 06-05-2020 12:49 AM
- Got Karma for Re: NOT a question: There is a small bug in the health checks for 6.5.0 Monitoring Console and this is how to resolve it.. 06-05-2020 12:48 AM
- Got Karma for Why am I unable to delete search peers from the Distributed Management Console?. 06-05-2020 12:48 AM
- Got Karma for Re: Why am I unable to delete search peers from the Distributed Management Console?. 06-05-2020 12:48 AM
- Got Karma for How to extract IOPS of an indexer in Splunk. 06-05-2020 12:48 AM
- Karma How to customize or change the default footer in Splunk Web? for fdi01. 06-05-2020 12:47 AM
- Karma Re: Using lookup tables for jbouch03. 06-05-2020 12:46 AM
- Posted How can we send an email alert with a colored table in the result set? on Dashboards & Visualizations. 06-21-2019 01:32 PM
- Tagged How can we send an email alert with a colored table in the result set? on Dashboards & Visualizations. 06-21-2019 01:32 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 1 |
06-21-2019
01:32 PM
Hi, We have a requirement where we need to send the email alert having tabular results in it with the color condition. Red, green and yellow colors will be decided based on the values in the table going as a result in an email.
Regards Saurabh
... View more
05-30-2019
08:38 AM
so the app contains
etc/apps/dsconfig/default/inputs.conf
etc/apps/dsconfig/bin/dsconfig.sh
etc/apps/dsconfig/local/deploymentclient.conf
here inputs.conf triggers the script dsconfig.sh which deletes already existing deploymentclient.conf from etc/system/local and tries to restart splunkforwarder in order to new deploymenclient.conf(etc/apps/dsconfig/local/depoymentclient.conf) can take effect
But, restart from the script doesn't work. it only stops the forwarder and i have to manually login to fowarder to start it again and the new deploymentclient can take effect.
Do you know why splunkforwarder cannot be restarted using a script inside one of it's apps?
... View more
05-29-2019
09:05 AM
Deploymentclient.conf is inside etc/system/local. I am one of the brave souls who attempted to remove deploymentclient.conf from system/local, but once you remove the system/local/deploymenclient.conf than a restart is required.
I tried restarting splunkforwarder after deleting the file, but splunk never comes back, it stops and stays in that state until I go and manually restart it.
... View more
05-29-2019
08:06 AM
Hi,
We are trying to switch to different deployment server from the current one. We have 100s of forwarders where deploymentclient.conf need to be changed.
Is it possible to do it via an app pushing to all the forwarders which will replace the deploymentclient.conf?
... View more
05-24-2019
01:31 PM
I don't want to deploy second app to restart the splunk forwarder.
App which is intended to remove the deploymentclient.conf should also do the restart of splunkforwarder second time after the app deployment restart the forwarder.
... View more
05-24-2019
01:30 PM
I am trying to restart second time after the app gets deployed via script.
... View more
05-24-2019
11:47 AM
Hi,
I am trying switch deployment server.
In order to do that, I am trying to push an app having deploymentclient.conf pointing to the new deployment server and inputs.conf which triggers a script.
That script removes deploymentclient.conf from "system/local" but it could't restart the splunkforwarder to take new deploymentclient.conf(app/local/deloymentclient.conf) to take effect.
Script causing the forwarder to stop and never comes back.
Below are the contents for script:-
FILE=/opt/splunkforwarder/etc/system/local/deploymentclient.conf
if test -f "$FILE"; then
echo "$FILE exist"
rm -fr "$FILE"
ls -lt "$FILE"
sleep60
/opt/splunkforwarder/bin/splunk restart
else
echo "$FILE no more exist" 1>&2
fi
exit 0
contents for inputs.conf
[script://./bin/dsconfig.sh]
interval = -1
... View more
05-14-2019
12:52 PM
Hi,
We have situation where we can't login to one of the single indexer in the cluster and we need to stop it for maintenance purpose.
Is it possible to stop single indexer from indexer-master ?
... View more
04-02-2019
02:02 PM
Hi,
We have enabled distributed mode monitoring console on one of the splunk servers, how can I disable monitoring console on all other splunk servers via command line.
... View more
03-19-2019
11:21 AM
Hi,
Is there a way to find which dashboards are accessible to a particular role of users?
... View more
03-12-2019
01:37 PM
Try out this query:-
Index=indexName sourcetype=sourcetypeName |search STATE != "closed"|sort _time|head 50
Search for AllTime as your data is pretty old, this may take sometime.
... View more
03-12-2019
11:45 AM
1 Karma
I am able to implement and test same in un-clustered search head environment, below are steps for same:-
1) Login to search head UI and drag drop the apps in the order we want.
2) Copy the settings for appOrder from [general] stanza which got created under
Splunk_home/etc/users/MyLoginId/user-prefs/local/user-prefs.conf
3) Create below file with copied stanza with specified setting
Splunk_home/etc/system/local/user-prefs.conf
This file will override all the appOrders created for any user in any user-prefs.conf.
4) restart the splunk search head to see the changes.
For clustered search heads we need to do it manually on all search heads inside system/local folder because if we create an app and push it from DS then user setting will take precedence.
Thanks for all the inputs provided.
... View more
03-12-2019
08:37 AM
1 Karma
Hi,
I am trying to setup the order of apps in the launcher page but I am unable to do so.
I tried creating
SPLUNK_HOME(searchHead)/etc/system/local/user-prefs.conf
[general]
appOrder = app1, app2,app3,app4
Restarted the searchhead, but this didn't work.
... View more
03-08-2019
11:28 AM
2 Karma
You can use a single JavaScript file at the app level. Place a file named dashboard.js in $SPLUNK_HOME/etc/apps/Splunk_app/appserver/static Every dashboard in your app will execute this JavaScript without any modifications to the actual dashboard.
To make changes global you need to make changes here:-
$SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/
Need to be careful when you make changes to global file.
you can find more help here:-
https://docs.splunk.com/Documentation/Splunk/7.2.4/Module/Simplecustomizations
... View more
03-08-2019
11:13 AM
1 Karma
Just for information to everyone.
Splunk support SAML integration but you can't access rest api of Appdynamics as a SAML user.
To fix the problem, need to create a local user in Appdynamics and same user can access rest Api for appdynamics.
Tried and tested worked perfectly fine.
... View more
02-28-2019
08:48 AM
1 Karma
I found an easiest way to do it.
From inputs.conf , I am passing parameter to the script as TST1 and TST2 from separate monitoring stanza.
Each Stanza has their own execution interval and script reads the passed parameter and matches with the hostname where it's running.
Thanks for inputs @chrisyoungerjds @somesoni2
... View more
02-21-2019
10:17 AM
We have two servers, each gets updated with network information every 12 hour, therefore we need to collect the information from each host at the interval of 12 hour.
Like script on host 1 should run at 12:00 afternoon and on host 2 it should run at 00:00 midnight.
both hosts starts with "TST" and differ by number appended at the end.
TST1 and TST2.
... View more
02-21-2019
07:38 AM
1 Karma
Hi,
We have a requirement where we need to deploy an app having a script in it but interval of execution of script should differ for each hosts receiving the app.
Is this possible to do in the same app?
... View more
02-16-2019
04:15 AM
It doesn't matter where your forwarder is, Deployer server can push the apps on any forwarders until they are not behind firewall rules.
... View more
02-15-2019
10:02 PM
I was suggesting apps to be deployed on indexer cluster master/master-apps and search head cluster deployer/shcluster using deploy servers instead of copying manually and than push on cluster members.
... View more
02-15-2019
01:16 PM
1 Karma
Telnet from the forwarder to you indexers
telnet hostname 9997
If your forwarder is behind the firewall you won't be able to connect.
check for "err_connected " handshake exception logs in
/Splunk_home/var/logs/splunkd.log
... View more
02-15-2019
01:09 PM
Do you want splunk deploy server to push apps on indexer cluster master and search head cluster master?
This can be achieved by specifying the repository directories.
... View more
02-12-2019
02:04 PM
1 Karma
If you are using the machine as forwarder than you need to update the whitelist in serverclass.conf.
... View more
01-29-2019
11:53 AM
The easiest way to check for any regular expression is using splunk extract fields. Its quite powerful and gives almost exact extraction.
you can see the regular expression used and apply the same in your query using "rex " command.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
