About risgupta_splunk

risgupta_splunk · ‎09-22-2017

http://dev.splunk.com/view/webframework-developapps/SP-CAAAEMY This is answer for your query !!

risgupta_splunk · ‎05-03-2017

This is already resolved in latest version of splunk 6.5.3

risgupta_splunk · ‎04-17-2017

This issue is a known bug and will be getting fixed in 6.6 Version of Splunk release.

risgupta_splunk · ‎02-28-2017

The issue here is that, in case of static captaincy we read the mgmt_uri from memory. Hence, when we restarted the node, the value was lost and we did not read the value from disk/config. Hence the "?" in show shcluster-status command.

risgupta_splunk · ‎01-05-2017

Hi, We are trying to get Palo alto traps log into splunk however we have incurred an issue of logs being sent to the indexer are having a delay of around 2 to 4 hours from the actual time of generation . This is leading to inconvenience in generating reports and daily monitoring. Confirmed that the following architecture. Palo Alto device -> UF -> HF -> indexer (Palo Alto device and UF are on the same server) We have tried the below query to verify the delay in logs : Run the following command for the last 15 minutes which can confirm whether there is any delay from the forwarder to the index. index=_internal host=NESWPR10APACL01 |eval diff = _indextime - _time |eval i_time = _indextime |eval e_time = _time |convert timeformat="%Y-%m-%d %H:%M:%S" ctime(i_time) |convert timeformat="%Y-%m-%d %H:%M:%S" ctime(e_time) |sort -diff |table _raw, i_time, e_time, diff Delay is less than 5 min i.e.0.299. Please help us with this issue.

risgupta_splunk · ‎12-13-2016

Has it ever been able to send logs to your indexers? If not, verify that your universal fowarder can: telnet splunkservername 9997 If that is successful, rule out slow/problematic dns resolutions by configuring your hosts file to map that server name to its IP. Report back after ruling these out. If you try both of these and there are still issues, chances are the problem is on the indexer and not your client sending data. You can also try setting connection_host=false in your inputs.conf for the 9997 stanza, making sure the indexer isn't trying to resolve the name of the forwarder.

risgupta_splunk · ‎12-13-2016

Has it ever been able to send logs to your indexers? If not, verify that your universal fowarder can: telnet splunkservername 9997 If that is successful, rule out slow/problematic dns resolutions by configuring your hosts file to map that server name to its IP. Report back after ruling these out. If you try both of these and there are still issues, chances are the problem is on the indexer and not your client sending data. You can also try setting connection_host=false in your inputs.conf for the 9997 stanza, making sure the indexer isn't trying to resolve the name of the forwarder.

risgupta_splunk · ‎10-13-2016

Yes, it is possible to add. you just need to edit the .js file for the app under location : Splunk_HOME\etc\apps\timeline_app\appserver\static\visualizations\timeline\src\timeline.js You'll have to play around with those locations for time_format. Don't forget to run "npm run build" after you modify the JS. And disable caching on Splunk. https://docs.splunk.com/Documentation/Splunk/6.5.0/AdvancedDev/CustomVizTutorial

risgupta_splunk · ‎09-20-2016

Yes, the TTL setting for the alert overrides the setting in savedsearches.conf, but you should set the TTL in both places. The TTL in alert_actions.conf only applies if an alert is triggered, otherwise the TTL in savedsearches.conf applies. In both places, you can use the p notation or just the number of seconds to save. There are also settings for TTL in limits.conf, but those only apply to ad hoc searches.

risgupta_splunk · ‎09-20-2016

Yes, the TTL setting for the alert overrides the setting in savedsearches.conf, but you should set the TTL in both places. The TTL in alert_actions.conf only applies if an alert is triggered, otherwise the TTL in savedsearches.conf applies. In both places, you can use the p notation or just the number of seconds to save. There are also settings for TTL in limits.conf, but those only apply to ad hoc searches.

risgupta_splunk · ‎08-31-2016

use [too_small] PREFIX_SOURCETYPE = false and check.

risgupta_splunk · ‎08-31-2016

You can use settings in your props.conf as : [too_small] PREFIX_SOURCETYPE = false This is will not grow the sourcetypes for your data.

risgupta_splunk · ‎08-28-2016

If all the sourcetypes are marked as {{-too_small}}. For small files Splunk is unable to determine the type. This can be controlled by: {noformat:title=props.conf} [too_small] PREFIX_SOURCETYPE = false {noformat} Could you please try to add a new entry in props.conf with below configuration and restart splunk: [too_small] PREFIX_SOURCETYPE = false This above configuration will not grow the sourcetypes in learned app and .gz file will also read and forwarded by the splunk.

risgupta_splunk · ‎08-10-2016

This message means your search processes are taking >1s to read initial configuration information from disk. What does the I/O subsystem underneath $SPLUNK_HOME/etc look like in your environment? If $SPLUNK_HOME/etc is networked storage, for example, there might be disk/network performance issues affecting search startup time.

Posts	14
Solutions	0
Karma Given	26
Karma Received	14
Member Since	‎08-03-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Delay in logs from Universal Forwarder approx 4 ho...

Re: package deployment-app via CLI or rest

Re: How to remediate CVE-2013-2566 related to "SSH...

Re: Search Head Cluster - default.old directories

Re: Search head cluster is breaking when mgmt_uri ...

Delay in logs from Universal Forwarder approx 4 ho...

Re: universal forwarder deployment on a windows fa...

Re: cooked connection timed out?

Re: Timeline - Custom Visualization: Can full date...

Re: Scheduled Saved Search Retention

Re: Is there a way to set the job TTL to a differe...

Re: Why is my sourcetype auto classified as too_sm...

Re: Why is my sourcetype auto classified as too_sm...

Re: Splunk learned app should stop learning / too_...

Re: After upgrading my search head and indexer to ...

Join the Conversation