Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About shugup2923
shugup2923
Path Finder
Member since:
06-03-2019
03-01-2021
Community Statistics
| Posts | 55 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 2 |
| Member Since | 06-03-2019 |
Activity Feed
- Karma Re: Validate filter value and show error message if value is invalid for vnravikumar. 02-28-2021 10:57 PM
- Posted Failover Cluster Manager - Resource Monitoring on Dashboards & Visualizations. 01-28-2021 10:35 PM
- Posted Re: Disk I/O error monitoring on Linux Servers on Getting Data In. 10-12-2020 03:47 AM
- Posted Re: Disk I/O error monitoring on Linux Servers on Getting Data In. 10-12-2020 02:31 AM
- Posted Re: Disk I/O error monitoring on Linux Servers on Getting Data In. 10-12-2020 02:20 AM
- Posted Disk I/O error monitoring on Linux Servers on Getting Data In. 10-11-2020 11:35 PM
- Posted Re: Dashboard loading time for first time is high on Dashboards & Visualizations. 10-06-2020 01:51 AM
- Posted Dashboard loading time for first time is high on Dashboards & Visualizations. 10-06-2020 01:37 AM
- Posted Re: CSV Extraction on Deployment Architecture. 09-30-2020 04:01 AM
- Posted CSV Extraction on Deployment Architecture. 09-30-2020 03:29 AM
- Posted DB connections to be excluded for specific time period on daily basis. on All Apps and Add-ons. 08-14-2020 03:30 AM
- Posted Re: How can we make first tab as default when dashboard is opened on Splunk Search. 07-31-2020 02:34 AM
- Karma Re: Tcpout Processor: The TCP output processor has paused the data flow. Forwarding to output group default-autolb-group for soutamo. 07-29-2020 07:39 AM
- Posted Re: Tcpout Processor: The TCP output processor has paused the data flow. Forwarding to output group default-autolb-group on Splunk Enterprise. 07-29-2020 07:30 AM
- Posted Tcpout Processor: The TCP output processor has paused the data flow. Forwarding to output group default-autolb-group has on Splunk Enterprise. 07-29-2020 06:31 AM
- Tagged How can we make first tab as default when dashboard is opened on Splunk Search. 07-24-2020 01:44 AM
- Posted How can we make first tab as default when dashboard is opened on Splunk Search. 07-24-2020 01:43 AM
- Karma Re: How to use self join for wmyersas. 06-05-2020 12:50 AM
- Got Karma for How to use self join. 06-05-2020 12:50 AM
- Got Karma for Re: How to use self join. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-28-2021
10:35 PM
Hi Everyone, I need to monitor resource status in failover cluster manager - any suggestion how can we implement it.. I found this link related to this - https://community.splunk.com/t5/Deployment-Architecture/How-to-monitoring-a-log-in-a-cluster-failover-environemnt/m-p/25794 just want to know is there any other way to monitor it .
... View more
Labels
- Labels:
-
other
10-12-2020
03:47 AM
Dmesg command itself don't work on all flavours of linux
... View more
10-12-2020
02:31 AM
Thu Oct 1 00:01:00 2020, blk_update_request: I/O error, dev fd0, sector 0 Fri Oct 2 00:01:00 2020, blk_update_request: I/O error, dev fd0, sector 0 Fri Oct 2 00:01:00 2020, blk_update_request: I/O error, dev fd0, sector 0 this is the output, currently my script works only with redhat 7, centos 7, I need a common way to monitor on all versions.
... View more
10-12-2020
02:20 AM
redhat 7, centos 7,redhat 6,centos 6,suse linux 12,ubuntu 16,amazon ami linux
... View more
10-11-2020
11:35 PM
I am looking to monitor Disk IO error, is there any way to monitor it.. Currently we have filtered disk related hardware error message like below format and same output is redirected into splunk readable log file. we are monitoring error message if that log file contains “I/O error” string. Command which we used to convert hardware message into splunk readable format: # dmesg -L -T| grep -iE "I/O error"|tr -d '['| awk -F']' '{print $1 "," $2}' Thu Oct 1 00:01:00 2020, blk_update_request: I/O error, dev fd0, sector 0 Fri Oct 2 00:01:00 2020, blk_update_request: I/O error, dev fd0, sector 0 Fri Oct 2 00:01:00 2020, blk_update_request: I/O error, dev fd0, sector 0 But this is not the feasible way to monitor as this command don't work on all linux version, so is there any default app available to monitor Disk I/O error.
... View more
Labels
- Labels:
-
Linux
10-06-2020
01:51 AM
we have used tabs for this purpose only, so when user select particular tab then panels under that tab only are running, to improve performance. we have certain filter at the top based on which other panel work. Queries are optimised . Problem is just with the first time loading . Need to understand what factors are causing this behaviour.
... View more
10-06-2020
01:37 AM
I have a dashboard created in separate app, in its structure it has multiple tabs, there are around 100 panels in the dashboard, whenever we open that app for the first dashboard takes too much time to open it , however after loading panel queries are working at normal speed. Any suggestion to make it load faster when user open it for the first time. ???
... View more
Labels
- Labels:
-
other
09-30-2020
04:01 AM
My issue got resolved, issue was with field_delimiter , it was tab and I was missing that
... View more
09-30-2020
03:29 AM
I have a csv with data as below- Timestamp Total Capacity Used Capacity Available Capacity Percentage Used 9/30/2020 11:11 209.34 TB 201.46 TB 7.88 TB 96.24% my inputs.conf is - [monitor://F:\Storage\Tools\CTW\MSA\MSA_FSutilization.csv] sourcetype=csv_use_current_date disabled=false index=storage crcSalt=<SOURCE> props.conf - [csv_use_current_date] DATETIME_CONFIG = CURRENT HEADER_FIELD_LINE_NUMBER = 1 INDEXED_EXTRACTIONS = csv KV_MODE = none NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Structured description = Comma-separated value format. Set header and other settings in "Delimited Settings" disabled = false pulldown_type = 1 fields are not extracted properly, getting full data in single field- Any Suggestion ??
... View more
- Tags:
- Getting data
Labels
- Labels:
-
universal forwarder
08-14-2020
03:30 AM
There are few DBs where the backup scheduled to be offline hence the DBs are to be made offline, however as the DBs are getting queried through DB connect the Splunk process are blocking the backup activities. is there any way we can stop this connection for any specific time window, except manual enabling and disabling connection.
... View more
Labels
- Labels:
-
configuration
07-31-2020
02:34 AM
Anyone who can help on this ??
... View more
07-29-2020
07:30 AM
Just for your knowledge, this instance on which we are seeing error don't send any data to indexers directly, so in that case also can this be a issue from indexer side? If not then might be a issue on HF's on which this instance is sending data then these HF's send data to indexers? Actually this warning is ok but sometime it is increased to more than 600 seconds which becomes a problem sometimes.
... View more
07-29-2020
06:31 AM
Hi , I have been getting this warning event on one of my Splunk instance (Role - Deployment Server + License Master) Architecture is as below- Deployement Server > HF1 and HF2 > Indexers error- Tcpout Processor: The TCP output processor has paused the data flow. Forwarding to output group default-autolb-group has been block for X seconds. This will probably stall the data flow towards indexing and other outputs. Review the receiving system’s health in the Splunk Monitoring Console. It is probably not accepting data. Can you please help how this can be resolved.
... View more
Labels
- Labels:
-
troubleshooting
07-24-2020
01:43 AM
Hi All, We have a dashboard which uses three layers of tabs- (please refer attached screenshot) Issue- when we load the dashboard, by default it opens first tab of third layer, Ideally it should be first tab of first layer. Splunk Version - 7.3.3 Note- we are using latest tabs.js and tabs.css file.
... View more
Labels
- Labels:
-
other
05-11-2020
02:28 AM
After upgrade to 7.3.3, drilldown option for link to search is not working as expected,
sometimes it shows page not found, sometimes incomplete query is executed.
I tried decoding the query and add it, but then also its not working properly.
Any idea what the issue here ?
... View more
05-08-2020
09:25 AM
What can I do so fields are automatically extracted, such as
NAS ARRAY
LATEST SNAPSHOT(In Days)
OLDEST SNAPSHOT(In Days)
LATEST SNAPSHOT DATE
@{Date=05/08/2020; NAS ARRAY=SERVER1; LATEST SNAPSHOT(In Days)=1; LATEST SNAPSHOT DATE=05/08/2020; OLDEST SNAPSHOT(In Days)=107}
host = DC2VM-AUTOM-I01 source = Powershell sourcetype = NAS:Snapshot
As of now ARRAY and DATE is only extracted
... View more
05-08-2020
09:21 AM
Yes, It worked ,thanks so much
... View more
05-08-2020
07:43 AM
My props.conf is stored universal forwarder ? will it work from universal forwarder ?
or do i need this to updated on indexers ?
... View more
05-08-2020
06:33 AM
I have a search head cluster, So is there any another way to update sourcetype on search head cluster ?
Or we can add on any search head member- by going to sourcetype>add new sourcetype >adding it there ?
... View more
05-08-2020
01:30 AM
I have created an app with for running powershell script which gives output as below-
@{Date=05/08/2020; ARRAY=Server1; LATEST SNAPSHOT(In Days)=1; LATEST SNAPSHOT DATE=05/07/2020; OLDEST SNAPSHOT(In Days)=62}
@{Date=05/08/2020; ARRAY=Server2; LATEST SNAPSHOT(In Days)=1; LATEST SNAPSHOT DATE=05/07/2020; OLDEST SNAPSHOT(In Days)=62}
@{Date=05/08/2020; ARRAY=Server3; LATEST SNAPSHOT(In Days)=1; LATEST SNAPSHOT DATE=05/07/2020; OLDEST SNAPSHOT(In Days)=62}
@{Date=05/08/2020; ARRAY=Server3; LATEST SNAPSHOT(In Days)=0; LATEST SNAPSHOT DATE=05/08/2020; OLDEST SNAPSHOT(In Days)=112}
These events are coming as a single event, I need every line as a separate event for which I tried giving props.conf for my sourcetype as
[my_sourcetype]
LINE_BREAKER =([\r\n]+)
SHOULD_LINEMERGE = false
But after this also,I am not able to get separate events ? Any suggestion over this ?
... View more
