About sravankaripe

sravankaripe · ‎05-06-2021

remove dedup after stats you may get some results

sravankaripe · ‎05-06-2021

Yes, you can try this <form> <init> <set token="global_token">host=host1 OR host=host2</set> </init> ---- ----- </form>

sravankaripe · ‎05-06-2021

try with this at the end select timerange last 30 days like that --- ---- ---- | bin _time span=1w | stats count

sravankaripe · ‎05-05-2021

You may not have access to them copy and paste xml to another app where you have access like search and report or your team app

sravankaripe · ‎05-05-2021

try this -------- | table RemoteDevice DatacenterCollector BytesSeenWestCoast DatacenterCollector BytesSeenEastCoast | eval RemoteDeviceStatus=if(BytesSeenWestCoast=0 AND BytesSeenEastCoast=0,"Down","Up") | table RemoteDevice DatacenterCollector BytesSeenWestCoast DatacenterCollector BytesSeenEastCoast RemoteDeviceStatus | where RemoteDeviceStatus like "Down"

sravankaripe · ‎05-05-2021

please try this index=_* sourcetype=audittrail action=search host=host1 OR host=host2 OR host=host3 OR host=host4 OR host=host5 OR host=host6 | stats count BY user host | sort 0 - count | stats list(*) AS * BY user

sravankaripe · ‎05-05-2021

| stats sum(firstTransaction) as TotalfirstTransaction sum(secondTransaction) as TotalsecondTransaction by app_id | fields app_id TotalfirstTransaction TotalsecondTransaction | eval -----------

sravankaripe · ‎05-05-2021

Could you please some example how your events look like and what is your expected output

sravankaripe · ‎05-05-2021

please try with extract command in to extract all fields splunk https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Extract ex : for your case ... | extract pairdelim="," , kvdelim="/":" OR ... | extract pairdelim="," , kvdelim="\":"

sravankaripe · ‎05-05-2021

please try this index=someIndex sourcetype=sourcetype1 (NOT (index=someIndex sourcetype=sourcetype2 | return 100000 host) ) | table host

sravankaripe · ‎05-05-2021

index=myIndex application=application1 (fieldA=* OR fieldB=*)

sravankaripe · ‎05-05-2021

try this | eval StartTime=strpTime("now()-7d@h", "%Y-%m-%d %H:%M:%S"), EndTime= strpTime(now(), "%Y-%m-%d %H:%M:%S.%q")

sravankaripe · ‎05-05-2021

2021-05-05 12:20:20.032 +0000 [QuartzScheduler_Worker-16] ERROR c.s.d.s.task.listeners.RecordWriterMetricsListener - action=unable_to_write_batch java.net.SocketTimeoutException: Read timed out 2021-05-05 12:20:20.032 +0000 [QuartzScheduler_Worker-16] ERROR org.easybatch.core.job.BatchJob - Unable to write records java.net.SocketTimeoutException: Read timed out 2021-05-05 12:20:20.032 +0000 [QuartzScheduler_Worker-16] INFO org.easybatch.core.job.BatchJob - Job ‘IPOD_UNBRICK_LOG’ finished with status: FAILED

sravankaripe · ‎08-13-2020

hi, Match below condition is not working I also tried by using <done></done> as well could someone help with this <drilldown> <condition match="$click.value2$==foo"> <set token="foo">true</set> </condition> </drilldown>

sravankaripe · ‎08-13-2020

Hi I have a dashboard with 3 panels. 2nd and 3rd will be invisible by default first panel have some data like show below app | fail | success ---------------------------- A | 10 | 20 B | 30 | 40 ------------------------------ if i click on A, corresponding panel (say 2nd(only)) should be visible. if i click on B, corresponding panel (say 3nd(only)) should be visible. could someone please help me with the condition I have do in <drilldown></drilldown> in first panel Currently I am trying like this. <panel id="first"> ....... </panel> <panel depends="$second$"> ...... </panel> <panel depends="$third$"> ...... </panel>

sravankaripe · ‎08-10-2020

Hi, I have created a dashboard say mydashboard. I have one custom app with search, dashboard, App health tabs . when I saved mydashboard it is falling under dashboard tab, how can I move this dashboard to App health tabs. I have only splunk UI access(Splunk developer access only).

sravankaripe · ‎08-10-2020

Hi, Can someone help me with this. I have fields with values SP=3390510 and TP=3394992 I am trying to get Success percentage | eval Success=(SP/TP)*100 the expected value is 99.8679% but I am value as 100.0000% I also set precision to 0.0000 but I am not getting the expected results

sravankaripe · ‎07-24-2020

when i tried to configure splunk dbconnect app i am seeing below error 2020-07-24 11:18:06.745 -0400 [dw-55 - POST /api/connections/status] ERROR io.dropwizard.jersey.errors.LoggingExceptionMapper - Error handling a request: af5d8ac47fd41568 java.lang.NullPointerException: null at com.splunk.dbx.connector.logger.AuditLogger.replace(AuditLogger.java:50) at com.splunk.dbx.connector.logger.AuditLogger.error(AuditLogger.java:44) at com.splunk.dbx.server.api.service.database.impl.DatabaseMetadataServiceImpl.getStatus(DatabaseMetadataServiceImpl.java:159) at com.splunk.dbx.server.api.service.database.impl.DatabaseMetadataServiceImpl.getConnectionStatus(DatabaseMetadataServiceImpl.java:116) at com.splunk.dbx.server.api.resource.ConnectionResource.getConnectionStatusOfEntity(ConnectionResource.java:72) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:566) at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory.lambda$static$0(ResourceMethodInvocationHandlerFactory.java:52) at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:124) at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:167) at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:219) at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:79)

sravankaripe · ‎05-14-2019

use Linux auditd app

sravankaripe · ‎05-14-2019

https://answers.splunk.com/answers/369183/splunk-searches-run-by-user.html

sravankaripe · ‎05-14-2019

Hi, i want to know the user who/what commands are running in splunk machines. please help me with splunk query for this

sravankaripe · ‎05-10-2019

Hi , i have more that 22 SH and 18 indexers i want to know the how may request are coming to each search head and indexer Can someone help me with basic query for this

sravankaripe · ‎05-09-2019

How to see what kind of logs are indexing to each indexer can please help with splunk basic query.

sravankaripe · ‎05-09-2019

netstat -anp tcp | grep LISTEN use this command to check the port status

sravankaripe · ‎05-08-2019

How can i move all apps and sources from search head to new search head cluster

Posts	191
Solutions	3
Karma Given	0
Karma Received	9
Member Since	‎06-23-2016

Online Status	Offline
Date Last Visited	‎09-24-2021 12:11 AM

Could someone help me with this error in splunk DB...

below drilldown match contain is not working

could someone help me with Drilldown option

how can I move my dashboard to another tab in Splu...

issue with dividing two numbers

i am seeing this error when i connected to Splunk ...

splunk cmd status

user request in splunk servers

How to know what kind of logs are indexing to each...

moving apps and source from SH to SH cluster

Re: format my successRate query into a week over w...

Re: token

Re: format my successRate query into a week over w...

Re: Drilldown options only include link to url

Re: Alerting when a remote device shows zero bytes...

Re: search help

Re: measuring overall success rate based off two t...

Re: measuring overall success rate based off two t...

Re: rex -> spath -> field extract not working?

Re: Field diff search

Re: Wildcard search on non-existent field search

Re: Time token for date range and and relative tim...