Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About chintan_shah
chintan_shah
Path Finder
Member since:
06-16-2016
06-05-2020
Community Statistics
| Posts | 65 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 6 |
| Member Since | 06-16-2016 |
Activity Feed
- Got Karma for Re: How to remove the View Dashboard link from PDF report emails?. 10-14-2024 12:56 AM
- Got Karma for Re: How to remove the View Dashboard link from PDF report emails?. 11-19-2023 12:26 AM
- Got Karma for Re: How to remove the View Dashboard link from PDF report emails?. 07-12-2021 12:49 AM
- Karma Re: Convert multiple fields as timestamp in csv file for yannK. 06-05-2020 12:49 AM
- Karma Re: Setting up a search head and indexer on existing machine for somesoni2. 06-05-2020 12:49 AM
- Got Karma for How to remove zeros from appearing on my stacked column chart?. 06-05-2020 12:48 AM
- Got Karma for My forwarder's outgoing data rate is lagging. How to resolve this in order for the forwarder to send data continuously?. 06-05-2020 12:48 AM
- Got Karma for Re: How to remove the View Dashboard link from PDF report emails?. 06-05-2020 12:47 AM
- Posted Sending Splunk Alerts to Netcool using SNMP v3 in Windows 10 on All Apps and Add-ons. 08-15-2018 09:51 AM
- Tagged Sending Splunk Alerts to Netcool using SNMP v3 in Windows 10 on All Apps and Add-ons. 08-15-2018 09:51 AM
- Posted Searches running in Batches and needs to be triggered once the previous search is completed on Splunk Search. 04-27-2018 07:18 AM
- Posted Re: How to remove the View Dashboard link from PDF report emails? on Dashboards & Visualizations. 02-08-2018 08:46 AM
- Posted Splunk Applications Protocol (Layer 7) on All Apps and Add-ons. 12-15-2017 11:34 AM
- Posted inputs.conf and outputs.conf for SSL encryption on Getting Data In. 10-23-2017 03:29 PM
- Tagged inputs.conf and outputs.conf for SSL encryption on Getting Data In. 10-23-2017 03:29 PM
- Posted How can I identity forwarder data rate and index data rate (to identify a lag and prioritize logs)? on Getting Data In. 10-06-2017 11:09 AM
- Tagged How can I identity forwarder data rate and index data rate (to identify a lag and prioritize logs)? on Getting Data In. 10-06-2017 11:09 AM
- Tagged How can I identity forwarder data rate and index data rate (to identify a lag and prioritize logs)? on Getting Data In. 10-06-2017 11:09 AM
- Posted Re: Convert multiple fields as timestamp in csv file on Getting Data In. 10-06-2017 09:04 AM
- Posted Re: Convert multiple fields as timestamp in csv file on Getting Data In. 10-05-2017 10:34 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-15-2018
09:51 AM
Hi All,
We have a requirement where we are supposed to capture error from the logs using Splunk running on Windows 10 machine which will trigger a script to send the details to Netcool using snmp protocol version 3 from Windows 10 so that they can create tickets.
I refer to below link:
http://docs.splunk.com/Documentation/Splunk/6.3.12/Alert/SendingSNMPtrapstoothersystems
http://wiki.splunk.com/Community:Splunk_Alert_MIB
http://wiki.splunk.com/Community:Sending_SNMP_Traps_On_Windows
but was not able to get it worked. Also the script is using SNMP v2.
Also i was not able to installed NET-SNMP on Windows 10. Is there any exe file for 64 bit.
Can anyone please help me to resolve this issues?
... View more
04-27-2018
07:18 AM
i am creating various reports which are schedule on cron expression but i wanted to see if there is any possibilites to trigger the searches if the previous search is ran successfully.
I am running various searches which create a csv as output and my last search runs a python scripts which combines all the csv into excel.
... View more
- Tags:
- scheduling
- searches
02-08-2018
08:46 AM
4 Karma
Hi,
I updated the action.email.include.results_link = 0 & action.email.include.view_link
= 0 in Advance Edit for the schedule view from Setting - Searches/Reports & Views and now the schedule dashboard doesnt show the "View dashboard" link
... View more
12-15-2017
11:34 AM
Hi,
I need to open the firewall for communication between Iron stream and Splunk. As per the requirement, I am aware that Ironstream will be sending the logs to Splunk via TCP/IP protocol to port. But as per the requirement, i need the Application Protocol which Splunk will use for ingesting the logs on the port.
Can someone help me?
... View more
10-23-2017
03:29 PM
Hi,
Can someone share with me the recent inputs & outputs conf file for SSL encryption? I am having some trouble for securing the connection between forwarder and indexer.
... View more
10-06-2017
11:09 AM
Hi,
Is there any way where we can identify how much data the forwarder is sending and how much data is being indexed in real-time?
The problem is that I have a single forwarder that is sending data to a single indexer and its sending multiple logs i.e. 50 monitored files with different indexes. I am receiving data from a few indexes in real time whereas for some indexes I am having a lag, so I want to remove the lag and if possible give higher preferences to some logs file.
... View more
10-06-2017
09:04 AM
@yannK,
Could you please tell me if its possible, to convert this epoch time in readable format in the same query so that i can use the string in Calculated Fields?
I have below query which works fine but cant use it for creating calculated fields
|convert mktime(EFF_DT) as epoch_EFF_DT timeformat="%b %d %Y %I:%M:%S:%3N%P"|eval EFF_DATE=strftime(epoch_EFF_DT,"%m/%d/%y %H:%M:%S")
... View more
10-05-2017
10:34 AM
@yannK,
Currently I am not able to convert this time "Oct 2 2017 1:22:21:000PM" to epochtime? I am trying the below query but its not providing desired results
convert timeformat="%b %d %Y %h:%M:%S:%3N%p" mktime(EFF_DT) as epochtime|table epochtime
... View more
10-05-2017
08:39 AM
I have a file with multiple fields as timestamp in the format of "Oct 2 2017 1:22:21:000PM". Can someone suggest how to convert it into timestamp so that i can perform logical operations on them?
Can we update props/transforms command so that i can update it once and use the formats for all fields?
... View more
10-04-2017
08:19 AM
Can someone help me in resolving the issue? Splunkd Universal Forwarder is taking 100% process.
I am monitoring around 50 logs files and the data is not more than 30GB daily.
For monitoring i am not having any wild characters and have given full path of log files.
... View more
09-21-2017
02:39 PM
I am facing issues while searching any logs and its takes a lot of time to index the log.
While investigating, i am seeing many times the queues are blocked as mentioned below.
INFO Metrics - group=queue, name=indexqueue, blocked=true, max_size_kb=500, current_size_kb=499, current_size=1466, largest_size=1466, smallest_size=0
Is it worth to increase the max size of the queues? Also while config file i need to change to increase the same?
... View more
- Tags:
- blocked_queues
- queues
09-21-2017
11:11 AM
I have created an alert which checks if logs are not present in last 20 mins per source. I have around 32 source files from single forwarder. Many of my files are not getting indexed in real time and I am receiving this alert frequently.
Can anyone tell me any parameters which needs to be changed so that I can index the data in real time?
is there any mechanism to check what is the inflow rate of the data?
System Info:
I also see my CPU is around 80% idle and working Windows OS. I have 4 Core machine 32gb ram
Splunk Enterprise 6.4.3
... View more
09-20-2017
02:16 PM
I have one instance which run as Search Head and other instance as Indexer. I wanted to know where should i setup Monitoring Console so that i can monitor the performance of search peers? If i try to setup distributed mode on my search head, its give me warning "Do not configure the DMC in distributed mode if this is a production search head. Doing so can change the behavior of all searches on this instance. This is dangerous and unsupported.
If you want to configure the DMC in distributed mode, you must locate the DMC on an instance that is not a production search head."
... View more
09-15-2017
01:09 PM
Hi @somesoni2,
I have various apps,lookups,schedule searches,reports , dashboards & config file changes. Should they be present at search head or indexer?
... View more
09-15-2017
01:07 PM
Hi @rphillips,
I have various apps,lookups,schedule searches, reports, dashboards and config file changes. Should all this files be present at Search Head or Indexer?
... View more
09-14-2017
08:42 AM
Hi @rphillips,
As per the documentation, they have mentioned to install Splunk after you have moved the data from one machine to other machine.
... View more
09-13-2017
12:01 PM
Hi,
I need to migrate Splunk Enterprise from one machine to other machine. Currently I am running Splunk 6.4 and wants it to run on Splunk 6.6.
Could someone suggest me the steps to do the same? Should i install Splunk Enterprise 6.4 in new machine and then move all the indexers or then upgrade? or should i install Splunk 6.6 and then move all the indexers?
... View more
- Tags:
- migrate-indexer
09-07-2017
10:41 AM
its just the count of events, my requirement is to show counts based on the time range.
... View more
09-07-2017
10:36 AM
Hi,
I need to create report in format.
Could anyone help me in achieving this.
I can have time interval of 2 hours as well if cannot have in the format.
... View more
08-16-2017
01:09 PM
Hi Steve G.
If given a scenario where i have two instances ( a workstation with 4 core and another workstation with 8 core), which you will suggest to use for indexer and search head?
... View more
08-16-2017
01:05 PM
Hi somesoni2,
If given a scenario where i have two instances ( a workstation with 4 core and another workstation with 8 core), which you will suggest to use for indexer and search head?
... View more
08-16-2017
11:53 AM
Thanks Somesoni2, the issue is the current machine doesnt have high processing capacity (currently its 4 Core) and hence need to have new machine (8 Core) as indexer.
... View more
08-16-2017
11:24 AM
Hi All,
Currently I have a single instance which acts as indexers as well as search head. But i am planning to include another instance and make it as indexers and use the existing machine as search head.
Could anyone explain how can i achieve that and also how can i use the existing index data for searching as well.
Thanks
... View more
08-11-2017
01:06 PM
05-23-2017
02:55 PM
Hi Woodcock,
the above solution will works when we have only three components but in my case i have 4 components such as 1 and 2 which wont work.
I have the below query
index=guistats_summary DIVISION_CD=E GUI_Enable=Y COUNTRY_CD="EE" OR COUNTRY_CD="LT" OR COUNTRY_CD="LV" OR COUNTRY_CD="LB" | bin span=1mon _time | eval GUI_Count=if(GUI_IND="Y",Total_Count,0), Non_GUI_Count=if(GUI_IND="N",Total_Count,0)|rename _time as Date|eval Date=strftime(Date,"%b-%y")|chart sum(GUI_Count) as GUI_Count,sum(Non_GUI_Count) as Non_GUI_Count OVER COUNTRY_CD By Date
which give the below results
COUNTRY_CD GUI_Count: Feb-17 GUI_Count: Jan-17 GUI_Count: Mar-17 Non_GUI_Count: Feb-17 Non_GUI_Count: Jan-17 Non_GUI_Count: Mar-17
EE 344 237 249 262 304 251
LB 2576 2173 2800 251 9 2
LT 367 347 411 292 489 354
LV 587 449 449 387 108 75
is it possible to arrange the column so that GUI_Count and Non GUI for same months comes together so that i dont need to run tables /fields command?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
