Hello, I needs efforts in Hrs for event correlation to be implemented for a general application considering data from 5 to 6 sources, such as Appdynamics, OEM, splunk itself and others. And are there any pre-requisite to be considered for event correlation. What are main things to be taken care before we start event correlation.    Thanks ... View more

Hi , In one of my field I have data in below format , I want data to be displayed day wise, like time for each day separately  Any suggestions ? Mon-Sat: 10AM-9PM, Sun: 11AM-6PM Mon-Sat: 9:30AM-9:30PM, Sun: 10AM-8PM Mon-Wed: 9:30am - 9pm, Thu: 9:30am - 9pm, Fri: 9:30am - 9pm, Sat: 9am - 9pm, Sun: 10am - 7pm Mon-Sat: 9:30AM-9:30PM, Sun: 10AM-8PM Mon-Sat: 9:30AM-9:30PM, Sun: 10AM-8PM Mon-Wed: 9:30am - 9pm, Thu: 9:30am - 9pm, Fri: 9:30am - 9pm, Sat: 9am - 9pm, Sun: 10am - 7pm Mon-Sat: 9:30AM-9:30PM, Sun: 10AM-8PM Mon-Sat: 9:30AM-9:30PM, Sun: 10AM-8PM Mon-Wed: 9:30am - 9pm, Thu: 9:30am - 9pm, Fri: 9:30am - 9pm, Sat: 9am - 9pm, Sun: 10am - 6pm Mon-Sat: 9:30AM-9:30PM, Sun: 10AM-8PM ... View more

Hello, I have created one add-on to collect data using python code, testing gives me the required data, But once I try to create input in this add-on I am getting below error- Unexpected error "<class 'splunktaucclib.rest_handler.error.RestError'>" from python handler: "REST Error [400]: Bad Request -- HTTP 400 Bad Request -- {"messages":[{"type":"ERROR","text":"'NoneType' object has no attribute 'startswith'"}]}". See splunkd.log/python.log for more details. Can anyone help on this ??? ... View more

Hi Everyone, I need to monitor resource status in failover cluster manager - any suggestion how can we implement it.. I found this link related to this - https://community.splunk.com/t5/Deployment-Architecture/How-to-monitoring-a-log-in-a-cluster-failover-environemnt/m-p/25794 just want to know is there any other way to monitor it . ... View more

I am looking to monitor Disk IO error, is there any way to monitor it.. Currently we have filtered disk related hardware error message like below format and same output is  redirected into splunk readable log file. we are monitoring  error message  if that log file contains “I/O error” string. Command which we used to convert hardware message into splunk readable format: # dmesg -L -T| grep -iE "I/O error"|tr -d '['| awk -F']' '{print $1 "," $2}' Thu Oct  1 00:01:00 2020, blk_update_request: I/O error, dev fd0, sector 0 Fri Oct  2 00:01:00 2020, blk_update_request: I/O error, dev fd0, sector 0 Fri Oct  2 00:01:00 2020, blk_update_request: I/O error, dev fd0, sector 0 But this is not the feasible way to monitor as this command don't work on all linux version, so is there any default app available to monitor Disk I/O error. ... View more

I have a dashboard created in separate app, in its structure it has multiple tabs, there are around 100 panels in the dashboard, whenever we open that app for the first dashboard takes too much time to open it , however after loading panel queries are working at normal speed. Any suggestion to make it load faster when user open it for the first time. ??? ... View more

There are few DBs where the backup scheduled to be offline hence the DBs are to be made offline, however as the DBs are getting queried through DB connect the Splunk process are blocking the backup activities. is there any way we can stop this connection for any specific time window, except manual enabling and disabling connection. ... View more