About VijaySrrie

VijaySrrie

Hi Team, How to integrate proficio with splunk

VijaySrrie · ‎08-22-2023

Hi, Working on splunk capacity planning 1. splunk is in cloud 2. 100GB of data 3. 10 users 4. No use of splunk enterprise security How much license would be required? No. of indexers? search heads? Is there any site where I can get the exact details?

VijaySrrie · ‎08-16-2023

Hi, I could see duplicate data in splunk by using below query index="indexname" | stats count by _raw | where count >1 I checked 10 different indexes out of which 8 indexes are having duplicate logs

VijaySrrie · ‎08-01-2023

I wanted to show an example to my junior in practical setup

VijaySrrie · ‎08-01-2023

Hi All, How to find unwanted logs (noise) in crowdStrike Falcon logs? Do you know the details that can be filtered in crowdstrike falcon logs?

VijaySrrie · ‎04-20-2023

Hi All, Is there an option to see the working of Fish bucket in real time? Switching off the server? can we test it? If yes, please let me know how to do it in test server.

VijaySrrie · ‎03-01-2023

Hi I have extracted a field username and it has domain and user username= "google\\john" username="googleuser" username = "admin" I need calculated to be created in props.conf where google should go to domain and john should go to user field This domain field will be there only in certain logs So whatever is there before "\\" should be considered as domain and after "\\" is user In some cases domain wont be there, for those cases username to be tagged to user field All this should happeb at backend props.conf domain = google user= john user = googleuser user = admin

VijaySrrie · ‎02-26-2023

Hi @ITWhisperer , Thanks for the reply, I have pasted the answer that worked for me.

VijaySrrie · ‎02-26-2023

This answer worked for me https://community.splunk.com/t5/Splunk-Search/Matching-fields-from-different-indices-to-return-another-field/m-p/470361

VijaySrrie · ‎02-26-2023

index=_internal host=hoatname or IP

VijaySrrie · ‎02-26-2023

index=cat Name Place ID jack delhi 1 jill melbourne 2 index=dog Country number Australia 2 India 1 ID field in cat and number field in dog are same, I need below output Name Place ID Country jack delhi 1 India jill melbourne 2 Australia

VijaySrrie · ‎02-18-2023

Hi @bowesmana The query which you shared works fine. I am bit confused about the timing This query should run 60 mins once. cron_schedule = 01 * * * * dispatch.earliest_time = -60m dispatch.latest_time = now May I know the correct earliest and latest time?

VijaySrrie · ‎02-16-2023

Hi Team, We have a field called Status=Start and Status=Success OrderId is one field When orderId has the Status=start and if there is no Status=Success for 10 mins it should be considered as failure May i know how to write a condition for this?

VijaySrrie · ‎11-24-2022

Hi All, I have encrypted the user field with sha256 index=abc sourcetype=xyz | eval domain = sha256(User) | table domain I am able to see encrypted values under domain field Is there a splunk command to decrypt it?

VijaySrrie · ‎11-24-2022

@gcusello Below config worked Props [host::LIANS*] TRANSFORMS-change_index_abc_secure = change_index_abc_secure Transforms.conf [change_index_abc_secure] SOURCE_KEY = _MetaData:Index REGEX = os|os_secure DEST_KEY = _MetaData:Index FORMAT = abc_secure

VijaySrrie · ‎11-06-2022

Hi @gcusello This isn't working Not sure where am I going wrong

VijaySrrie · ‎11-03-2022

Hi @gcusello Yes, this is fine, also I want the logs only from the hostname LIANS* Will the below props and transforms work? props.conf [host=LIANS*] TRANSFORMS-change_index_abc_secure = change_index_abc_secure transforms.conf [change_index_abc_secure] SOURCE_KEY = MetaData:Index REGEX = os|os_secure DEST_KEY = MetaData:Index FORMAT = index::abc_secure

VijaySrrie · ‎11-01-2022

Hi Team, [host::1.(xx|xx).xx.xx(x|y)] TRANSFORMS-change_index_abc_secure = change_index_abc_secure [change_index_abc_secure] SOURCE_KEY = MetaData:Index REGEX = os, os_secure DEST_KEY = MetaData:Index FORMAT = index::abc_secure I need to route the logs from certain host to index=abc_secure (not all the logs only os and os_secure logs)

VijaySrrie · ‎09-04-2022

what happens when move_policy setting is not given in the batch config?

VijaySrrie · ‎09-01-2022

Hi All, What is the use of move_policy = sinkhole and on which scenario we will use batch (Batch will index the file and delete but in which application or server this should be used?)

Posts	246
Solutions	11
Karma Given	64
Karma Received	10
Member Since	‎02-22-2019

Online Status	Offline
Date Last Visited	Saturday

How to integrate proficio with splunk?

Splunk capacity planning: How much license, search...

Why am I seeing Duplicate data (_raw)?

How to find the noise in crowdstrike falcon logs?

Is there an option to see the working of Fish Buck...

How do I calculate field in props.conf?

Help with alert search with join or append?

How to write a condition for this?

Is there a Splunk command to decrypt encrypted val...

How to route the logs from certain host to index=a...

How to integrate proficio with splunk?

Splunk capacity planning: How much license, search...

Why am I seeing Duplicate data (_raw)?

Re: Is there an option to see the working of Fish ...

How to find the noise in crowdstrike falcon logs?

Is there an option to see the working of Fish Buck...

How do I calculate field in props.conf?

Re: alert query with join or append?

Re: alert query with join or append?

Re: Splunk Syslog

Help with alert search with join or append?

Re: Need alert query

How to write a condition for this?

Is there a Splunk command to decrypt encrypted val...

Re: How to route the logs from certain host to ind...

Re: How to route the logs from certain host to ind...

Re: How to route the logs from certain host to ind...

How to route the logs from certain host to index=a...

Re: Batch and move_policy = sinkhole

What is the use of batch and move_policy = sinkhol...