Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About rupeshn
rupeshn
Explorer
Member since:
05-06-2019
07-14-2020
Community Statistics
| Posts | 35 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 1 |
| Member Since | 05-06-2019 |
Activity Feed
- Posted Re: Not able to create new index in standalone instance of Splunk indexer on Deployment Architecture. 07-13-2020 09:16 PM
- Posted Not able to create new index in standalone instance of Splunk indexer on Deployment Architecture. 06-28-2020 09:31 PM
- Karma Re: What is the purpose of ess_admin role in splunk ES when it is advised not to assign it to users? for skalliger. 06-05-2020 12:50 AM
- Karma Re: Comparing results from two searches for kmaron. 06-05-2020 12:50 AM
- Got Karma for Comparing results from two searches. 06-05-2020 12:50 AM
- Posted Is it possible to get data for last 10 days if i install UF today on any endpoint/Server? on Security. 04-15-2020 02:02 AM
- Tagged Is it possible to get data for last 10 days if i install UF today on any endpoint/Server? on Security. 04-15-2020 02:02 AM
- Posted Re: Splunk Db Connect app -- Getting "Login failed for user 40053. ClientConnectionId:662899f0-1eb3-476f-b0d5-5db2494404db" on All Apps and Add-ons. 02-11-2020 07:04 PM
- Posted Splunk with reverse proxy. After Authenticating, not able to see logs (Search could not found) on Security. 02-05-2020 10:52 PM
- Tagged Splunk with reverse proxy. After Authenticating, not able to see logs (Search could not found) on Security. 02-05-2020 10:52 PM
- Tagged Splunk with reverse proxy. After Authenticating, not able to see logs (Search could not found) on Security. 02-05-2020 10:52 PM
- Posted Re: Index 10 different companies data into splunk on Getting Data In. 02-05-2020 10:15 PM
- Posted Re: Index 10 different companies data into splunk on Getting Data In. 02-04-2020 08:41 PM
- Posted Re: Index 10 different companies data into splunk on Getting Data In. 02-04-2020 07:58 PM
- Posted Index 10 different companies data into splunk on Getting Data In. 02-04-2020 06:40 PM
- Tagged Index 10 different companies data into splunk on Getting Data In. 02-04-2020 06:40 PM
- Posted Re: Indexed data till date with no access on license master. on Deployment Architecture. 01-14-2020 11:27 PM
- Posted Indexed data till date with no access on license master. on Deployment Architecture. 01-14-2020 07:16 PM
- Tagged Indexed data till date with no access on license master. on Deployment Architecture. 01-14-2020 07:16 PM
- Tagged Indexed data till date with no access on license master. on Deployment Architecture. 01-14-2020 07:16 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
07-13-2020
09:16 PM
Sorry! I did not get time to check on this. Today i checked it and it worked fine. Thank You!
... View more
06-28-2020
09:31 PM
Hi All, I've created new app with all the indexes required and have added all the stanzas for parameters.Restarted the Splunk on Indexer. Now when i login all is good. The indexes are reflected in GUI and logs are ingesting. But when i try to create new index. It is throwing e a below error. stanza=alm_win_allservers parameter=frozenTimePeriodInSecs Value supplied='12096000' is illegal; default='188697600' Could you please help here
... View more
- Tags:
- configuration
- indexer
Labels
- Labels:
-
other
04-15-2020
02:02 AM
Is it possible to get data for last 10 days if i install UF today on any endpoint/Server?
I would like to get data like resource utilization of a particular server/endpoint for last 10 days, I'm planning to install Splunk UF today. Can i get the data if i install UF today
... View more
- Tags:
- splunk-enterprise
02-11-2020
07:04 PM
@tahayazdani8416 ,
Got any update on this or was this issue resolved?
Since I'm facing same issue. Could you please let me know how was it resolved
... View more
02-05-2020
10:52 PM
Hi All,
We'v implemented reverse proxy in our environment for authentication. We're able to login thorough our card but after logging in.
We could see all the dashboards but the saved searches and queries on dashboard cannot run.
It shows error as following "Search could not start/found
Following is the change that we've done in web.conf
root_endpoint = /
SSOMode = strict
trustedIP = proxy IP
remoteUser = user on proxy server
tools.proxy.on = false
enableWebDebug=true"
Could you please look into this and advice what could be the reason ?
... View more
02-05-2020
10:15 PM
Thanks @nickhillscpl
... View more
02-04-2020
08:41 PM
@morethanyell
I believe you've misunderstood my question.
... View more
02-04-2020
07:58 PM
@morethanyell ,
Once we install add-ons on universal forwarders and send the logs to indexer. We would need to install the same add-on on indexer as well. Then which logs would the add-on on indexer consider? I believe there would be conflict as there are logs of 10 companies coming to indexer. What logs would add-on indexer consider?
Company 1 logs or company 2 logs or.................company10 logs
For example one company has index=wineventlog_company1 for all windows related logs where i installed "Windows add-on" and another company has index=wineventlog_company2 for all windows related logs where i installed same add-on "Windows add-on". When windows logs from both these companies goes to indexer where we installed the same add-on. What logs would this add-on consider and on what basis?
... View more
02-04-2020
06:40 PM
Hi All,
I've got into weird situation where in i need to get data of 10 different companies into Splunk with two indexers in single site clustering with one SH.
I'm under planning stage.
I'm wondering how can we install apps for each company individually on same indexer since each company will have their own indexes.
For example: If i install windows add-on, It would give results of any one company. Then , How can i get data of other 9 companies as well.
Please suggest.
... View more
- Tags:
- splunk-enterprise
01-14-2020
11:27 PM
Hi @jarizeloyola,
Yes we do have GUI monitoring console.
We don't have any access to GUI of license master.
In GUI monitoring console, when we see disk usage - it shows 409 GB around and when we see size of indexes for today 390GB.
and there's no change in config files ans still we can see that disk usage is increasing day by day 1 to 2 GB while size of indexes remains same almost. Could you help here and let me know what would be issue?
... View more
01-14-2020
07:16 PM
Hi All,
I'm stuck in a situation where i believe i would need your help.
I need to get total indexed data per index till date. My splunk instance(indexer+SH) is a salve to license master pool located in some other country. I don't have access on license_usage.log file in cluster master as forwarding data from that country to our country is against Government Rules.
So, There's no outputs.conf file configured on license master and we cannot do it either.
Is there a way to know total data indexed per index till date.
Please help.
I'll be thankful to you!
... View more
01-13-2020
10:15 PM
We don't have privilege to forward the logs of license master to indexer(Test Environment) due to other country Rules and Regulations. Is there any other way to get total amount of data indexed per day?
... View more
01-13-2020
10:11 PM
Seems License master is not forwarding its logs to Indexer(Test Environment).
... View more
01-13-2020
10:10 PM
Hi @dvg06,
I can confirm that those are not summary/internal indexes.
Just checked license_usage.log file in Test Environment and found the following line:
11-28-2019 11:18:33.645 +0530 INFO LicenseUsage - type=Message - License usage logging not available for slave licensing instances, please see license_usage.log on license master=https://splunkl****:9089 for usage breakdown
?
... View more
01-13-2020
08:10 PM
Hi,
I was trying to get amount of data getting indexed in particular index per day and analyze it as a trend. I used below Query:
index=_internal source=license_usage.log type=Usage | stats sum(eval(b/1024/1024/1024)) AS volume_b by idx date_mday date_month date_year | stats max(volume_b) by idx date_month date_year.
But I can see that i'm getting only below indexes in my result.
default.
mcafee
msad
network
perfmon
veeammon
wineventlog
wireless
zscaler
But when i run a search to get all indexes i.e index=* | dedup index | table index. I got 32 indexes in my results.
I'm running this search on test Environment which acts as SH+DS+Indexer and reporting to another instance for license(License master).
And can we search licensing on slave nodes by default or do we need to enable it explicitly?
Could you please and let me know what is the issue here.
Thank You!
... View more
- Tags:
- splunk-enterprise
01-07-2020
07:46 PM
Thank You gcusello
... View more
01-07-2020
01:16 AM
Hi ,
1.Could you please let me know if one of the indexers in Single site Clustering be made as Cluster master?
Is it a good idea to have Indexers, SearchHeads on Windows servers (2012 and above versions)
Thank You 🙂
... View more
01-05-2020
08:32 AM
Hi
Planning to migrate data from current environment to future environment!
Current = (One search head + one indexer + Deployment Server )on the same server
Future = New search head + 2 indexers (New installs) + New DS.
But my standalone indexer which acts as SH, Indexer and DS has very few(2-3) Apps.
I plan to set up new DS and new SH and single site clustered environment(with new two indexers).
What are the points to be considered and could you please provide your inputs, procedure to complete the task and help here.
... View more
01-05-2020
05:04 AM
@woodcock
Similar type of situation, But my standalone indexer which acts as SH, Indexer and DS has very few(2-3) Apps. So I plan to delete those apps first, then set it as indexer and add 2 new indexers and add new SH. Would that be feasible? If so, what are Pros and cons involved. Please provide your inputs.
... View more
11-21-2019
06:29 AM
You can try this,
index="prd" "PassiveReceiver" PID_3="*" |stats count by PID_3
... View more
11-20-2019
02:28 AM
That can be any command. Can i write a regex for command in place of "command line". If yes, Could you please suggest.
... View more
11-20-2019
02:18 AM
Hi,
After Extracting a field using regex. I now need to compare whether that particular field contains any command . Could you please help how to proceed further using eval,match or any other way?
... View more
09-07-2019
10:10 AM
Hi kmaron,
I'm getting output but i believe the output that i'm getting is very less(less number of records) than what it should be.
... View more
09-04-2019
08:42 AM
I mean users with both actions.
... View more
09-04-2019
08:25 AM
@kmaron ,I've tried the query posted by you. But it still gives both the users.
... View more
