About rohit1793

rohit1793 · ‎05-30-2023

I am replying to very old thread but for members who will face this issue in future: below the correct way: [general] serverName = pass4SymmKey = site = site(0|1|2) [clustering] manager_uri = https://xxxx:8089 mode = searchhead pass4SymmKey = multisite = true

rohit1793 · ‎04-18-2023

Hello @random_event , It pulls whatever you have at that endpoint for all time.for example if you want to know all the KO belongs to x person you can filter it and see all the enabled and disabled KO’s belongs to the x.

rohit1793 · ‎04-04-2022

Hey, 1. You can try your login password as it seems Splunk taking SSO sign in. 2. If that doesn't work, you can create AD account and get necessary splunk access to that account.

rohit1793 · ‎04-04-2022

Hey @jadengoho , This is due to access issue ,After creating token/Tenant ID , That Token required the read permission of the API graph. Below the excel sheet you can refer and ask the AD team to provide the read access to the token. https://docs.google.com/spreadsheets/d/1YJAqNmcXZU-7O9CxVKupOkR6q2S8TXriMeLAUMYmMs4/edit#gid=0 One last things, if all the permission are up to mark check if the proxy is configured.

rohit1793 · ‎04-04-2022

Hi @Shadolu , [<spec>] TIME_PREFIX = Timestamp --change as per your raw data MAX_TIMESTAMP_LOOKAHEAD = 21 TIME_FORMAT = write regex as per your data , if timestamp is start of your event[%Y-%m-%d %H:%M:%S.%Z] Yes this is possible, you have to change the parameter in props.conf file. let's say you have data coming in xyz sourcetype, you have to Add above parameter.

rohit1793 · ‎04-04-2022

Hello @xinyizhang, 1. As a prerequisite to connect the tableau with Splunk , Download the Splunk ODBC connector for splunkbase . (https://splunkbase.splunk.com/app/1606/ ) 2. Login to tableau , On right side click on connect, you will see a form will pop up with Splunk Creds. 3. Add the details, Sever as splunkXXX.xx.xx. , Port will be 443 4. User should have access of Splunk URL. 5. Once connection is successful, you can see all the reports as a table in Tableau.

rohit1793 · ‎02-16-2022

There is a command multikv, it works for tabled data like we get from Unix/Linux machines: index=foo host=abc* sourcetype=vmstat | bucket _time span=5m | multikv fields | stats avg(memUsedPct) as MemoryUsed by host

rohit1793 · ‎07-28-2020

II am facing the same issue, did you found any workaround for this issue?

rohit1793 · ‎03-23-2020

Hi Folks, Hope you are well!! We want to password protect the Splunk reports while delivering to user emailbox so that only users who having key they can access it, can we do it on Splunk or Do we have any Splunkbase Application for this?

rohit1793 · ‎10-07-2019

Hi All, Can you please help me to extract the fields and related data from vmstat logs which are coming into splunk,Below the logs lines: memTotalMB memFreeMB memUsedMB memFreePct memUsedPct pgPageOut swapUsedPct pgSwapOut cSwitches interrupts forks processes threads loadAvg1mi waitThreads interrupts_PS pgPageIn_PS pgPageOut_PS 7000 xx8 xxx5 9.4 90.6 1561978416 100.0 85616943 4002987866 3965557908 66831877 250 3251 11.04 9.04 27902.02 48.24 2132.66

Posts	10
Solutions	2
Karma Given	4
Karma Received	3
Member Since	‎04-10-2019

Online Status	Offline
Date Last Visited	2 weeks ago

Password protected reports from Splunk

Help with extracting the fields and related data ...

Re: Multisite and Single-Site Environment

Re: What timeframe do REST API searches use?

Re: How do I find the credentials to connect Splun...

Re: Splunk Add-on for 0365: Why am I receiving Inv...

Re: Link Timestamp from data to Time picker

Re: How do I find the credentials to connect Splun...

Re: issue with VMSTAT data coming from OS logs

Re: Splunk App for Infrastructre

Password protected reports from Splunk

Help with extracting the fields and related data ...

Join the Conversation