Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About vikram_m
vikram_m
Path Finder
Member since:
10-05-2016
06-02-2021
Community Statistics
| Posts | 90 |
| Solutions | 1 |
| Karma Given | 6 |
| Karma Received | 3 |
| Member Since | 10-05-2016 |
Activity Feed
- Karma Re: Monitor Linux environment for jkat54. 06-02-2021 03:08 AM
- Posted Re: Consolidate data from 2 indexes on Splunk Search. 11-12-2020 02:34 AM
- Karma Re: Consolidate data from 2 indexes for isoutamo. 11-12-2020 02:33 AM
- Posted Re: Consolidate data from 2 indexes on Splunk Search. 11-10-2020 02:01 AM
- Posted Re: Consolidate data from 2 indexes on Splunk Search. 11-10-2020 01:59 AM
- Karma Re: Consolidate data from 2 indexes for bowesmana. 11-10-2020 01:58 AM
- Karma Re: Consolidate data from 2 indexes for isoutamo. 11-10-2020 01:58 AM
- Posted Re: Consolidate data from 2 indexes on Splunk Search. 11-09-2020 07:44 PM
- Posted Consolidate data from 2 indexes on Splunk Search. 11-09-2020 06:51 PM
- Karma Re: migration of splunk custom app from one server to another for martin_mueller. 06-05-2020 12:48 AM
- Got Karma for Percentage calculation by timechart. 06-05-2020 12:48 AM
- Got Karma for how can a saved search owner be changed. 06-05-2020 12:48 AM
- Got Karma for installing a SSL certificate in Splunk. 06-05-2020 12:48 AM
- Karma Re: How to reindex data from a forwarder for yannK. 06-05-2020 12:46 AM
- Posted pass username and password while search head cluster restart on Deployment Architecture. 11-05-2019 12:06 AM
- Posted Re: Stop splunk gracefully during system shutdown or reboot - RESOLVED on Monitoring Splunk. 08-09-2019 03:29 AM
- Posted Stop splunk gracefully during system shutdown or reboot - RESOLVED on Monitoring Splunk. 08-08-2019 06:03 AM
- Posted Need a querry to triage an api on all possible hosts. on All Apps and Add-ons. 09-27-2018 04:59 AM
- Posted any error or warning in all cluster members need to be monitored and mailed. on Alerting. 05-14-2018 12:23 AM
- Posted Re: Unable to anonymise data even after we have right regex. on Deployment Architecture. 04-11-2018 06:21 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-12-2020
02:34 AM
Thanks @isoutamo I read through the doc you shared accorss....in future if I need it I'll use the solution in the document....Thanks again
... View more
11-10-2020
02:01 AM
I tried the stats command but I need an output matching username in index1 with login name in index2 followed with table command from both the indexes.
... View more
11-10-2020
01:59 AM
I tried the above stats query but I am trying to fame something like username from index1 is login_name in index2 and then rest of the data from both index should be used like a table command
... View more
11-09-2020
06:51 PM
We have 2 index 1. Having user name and his machine details and everything about his login 2. User name and his actual machine behaviour like link speed, could usage, memusage etc. I am trying to frame a query where both indexes will be called and getting an output something like username, user machine, user machine make, os details, CPU, mem, ...... I tried 2 ways from last 2 days 1. (Index 1 sourcetype) or (index 2 source type) | eval which I want | rename cols | table columns Outcome : details from index 1 appear but not from index2 2. Index 1 sourcetype | join [search index 2 sourcetype] | eval which I want | rename cols | table columns Outcome : details of few columns are not visible rest appear Please help which command and how do I frame query to get my panel completed. Thanks.
... View more
11-05-2019
12:06 AM
We are using a Search Head cluster
Splunk Enterprise
Version:
7.2.6
When the CPU and Memory of servers goes high we restart the cluster and the cluster comes back to normal.
I wrote a shell script with 2 lines.
!#/bin/bash
sudo -u splunk /opt/splunk/bin/splunk rolling-restart shcluster-members
when the alert in SH is triggered it is failing as splunk username and passwd needs to be passed to the script manually.
Is there any way I can pass username and password for Splunk in the script to get triggered as per alert.
... View more
08-09-2019
03:29 AM
Thanks for your reply J. I found in the docs that firing the reboot or shutdown command Splunk stops itself gracefully.
Also I found command to stop and start it with particular user name. Thanks for the link and clearing my doubts.
... View more
08-08-2019
06:03 AM
As the indexers and search heads are in cluster and on Unix OS, whenever there is a proper shutdown or reboot of servers is there any command or script which can tell Unix to use bin/splunk stop command.
For now I think Unix uses kill -9 before kernel is shutdown so I think there might be some alternative to stop Splunk gracefully.
... View more
09-27-2018
04:59 AM
We have around 10 hosts with similar APIs i.e 20. something like below.
/api/v1/device/host1
/api/v1/device/host2
/api/v1/device/host3
/api/v1/device/host4
/api/v1/device/host5
/api/v1/device/host1/provisioning/
/api/v1/device/host2/provisioning/
/api/v1/device/host3/provisioning/
/api/v1/device/host5/provisioning/
/api/v1/device/host6/provisioning/
/api/v1/device/host7/provisioning/
/api/v1/device/host1/authentication
/api/v1/device/host2/authentication
/api/v1/device/host3/authentication
/api/v1/device/host3/authentication
/api/v1/device/host4/authentication
/api/v1/device/host5/authentication
based on these set of 20 apis and 10 devices I need a querry which can give me stats for the individual apis irrespective of devices something like below.
/api/v1/device//authentication/ 10
/api/v1/device//provisioning/ 20
/api/v1/device/* 12
... View more
05-14-2018
12:23 AM
We are using Splunk 6.5.6.
Recently we are seeing too many issue on alomst every server.
Is there any way all the server internal logs can be collected at cluster one place( it is costly and time consuming to configure email client on individual cluster member)
from that cluster server we can configure querry like "index=_internal error*" and mail this querry to our entire team. We can find and fix the issue soonest the possible.
Please suggest.
... View more
04-11-2018
06:21 AM
Thanks for your reply @mayurr98 the same configuration is deployed which you have said above.
can you confirm if the sourcetype definition which we are doing is correct or do we need to have a bracket like <> when we want to define our sourcetype.
... View more
04-11-2018
12:14 AM
I have a log file as detailed below.
"02d4224f-8cc8-48b4-a06d-034a97ad68a8-333999","2018-03-24T04:58:09.280Z","OPENIG-HTTP-ACCESS","02d4224f-8cc8-48b4-a06d-034a97ad68a8-333998",,,"10.255.0.19","8443","10.255.0.11","11700",,,,"true","GET","https://imsdat.sentienceanalytics.com:443/sentience/iams/api/auth/services/system","{}","{""activityid"":[""d7eb3997-f3f6-479e-a412-7f5fabe291a7""],""authorization"":[""Bearer eyAidHlwIjogIkpXVCIsICJraWQiOiAiaFNsNTU4b2NrZHpsWmFHTXpweUZUOGZSamg0PSIsICJhbGciOiAiUlMyNTYiIH0.eyAiYXRfaGFzaCI6ICJIemJPcTJkLTB5LThIWThMOS1ZdFVnIiwgInN1YiI6ICI5MDFkMTMwNy00NjdkLTRmZDctOTEzMC1lNzUwM2U5OGFhOWEiLCAiYXVkaXRUcmFja2luZ0lkIjogIjkyMDk5NzcyLWU0MWEtNGQwYi1hYmM1LTg2NzY3MGIzYTIyNC01NTg2NDQiLCAiaXNzIjogImh0dHBzOi8vaW1zZGF0LnNlbnRpZW5jZWFuYWx5dGljcy5jb206NDQzL29wZW5hbS9vYXV0aDIvY2JwZ2ZiZGV2IiwgInRva2VuTmFtZSI6ICJpZF90b2tlbiIsICJhdWQiOiAiOTAxZDEzMDctNDY3ZC00ZmQ3LTkxMzAtZTc1MDNlOThhYTlhIiwgIm9yZy5mb3JnZXJvY2sub3BlbmlkY29ubmVjdC5vcHMiOiAiZDg5NTM5ZTUtNDA3Mi00MDNkLWExYjEtM2Q2M2FkZmI5ZmVjIiwgImF6cCI6ICI5MDFkMTMwNy00NjdkLTRmZDctOTEzMC1lNzUwM2U5OGFhOWEiLCAiYXV0aF90aW1lIjogMTUyMTg2NzA2MSwgInJlYWxtIjogIi9jYnBnZmJkZXYiLCAiZXhwIjogMTUyMTg3MDY2MSwgInRva2VuVHlwZSI6ICJKV1RUb2tlbiIsICJpYXQiOiAxNTIxODY3MDYxIH0.WO7PoFhmieqV0tK03Zft0gUY2fDzd6-h0FJQtCoAWtUbiK_5v2OY-wbpXyMK3GC_XlOX4VfbavjBE4K00ryzhZsaQ2CZA-uQGgeDELQEsxk_yNQyex00WpPpq0Xg8S_4gNBDg3HvfrlDrGD6MYoWRhrP2K3i6ggbSqdCPu5YSqIRF9P06WqeoD01z4tm4D_4tG-Z17_EuXllUAmtoPqN0ZKrYda56HsS-u6EuRqHvUViHIeawCwTgzdkvGMzvWs-SoP5-_djHUP7mZbI2I4CoS_eDTEbTiJ8uYOyvhXnLEqmOjy4FYIHHqP6E4yA2bGDfVCtj85ixOEZfxLCp_yG9g""],""host"":[""imsdat.sentienceanalytics.com""],""user-agent"":[""Honeywell.Sentience.WebApiClient.Identity.Rest.SentienceIdentityPublicWebApis/1.0.0-ci.182+Branch.master.Sha.0a4c3e515876f9ce616d0bf07bd1fe9bb7831f6c""]}","{}","{""Cache-Control"":[""no-cache, no-store, max-age=0, must-revalidate""],""Content-Type"":[""application/json; charset=UTF-8""],""Date"":[""Sat, 24 Mar 2018 04:58:09 GMT""],""Expires"":[""0""],""Pragma"":[""no-cache""],""RequestId"":[""02d4224f-8cc8-48b4-a06d-034a97ad68a8-333998""],""X-Content-Type-Options"":[""nosniff""],""X-Frame-Options"":[""DENY""],""X-XSS-Protection"":[""1; mode=block""]}","SUCCESSFUL","200",,"18","MILLISECONDS"
When I wrote the SED command in Linux and checked I am able to see the Bearer field is hashed.
[splunk@splunkqadeployer ~]$ sed 's/Bearer (.{1150})/#####/g' /tmp/test.anon
"02d4224f-8cc8-48b4-a06d-034a97ad68a8-334002","2018-03-24T04:58:09.313Z","OPENIG-HTTP-ACCESS","02d4224f-8cc8-48b4-a06d-034a97ad68a8-334001",,,"10.255.0.19","8443","10.255.0.11","11700",,,,"true","POST","https://imsdat.sentienceanalytics.com:443/sentience/iams/api/auth/systems/8a5bc996-8045-41af-b137-713711367ac7/permissions","{}","{""activityid"":[""d7eb3997-f3f6-479e-a412-7f5fabe291a7""],""authorization"":[""#####""],""Content-Length"":[""402""],""Content-Type"":[""application/json; charset=utf-8""],""host"":[""imsdat.sentienceanalytics.com""],""user-agent"":[""Honeywell.Sentience.WebApiClient.Identity.Rest.SentienceIdentityPublicWebApis/1.0.0-ci.182+Branch.master.Sha.0a4c3e515876f9ce616d0bf07bd1fe9bb7831f6c""]}","{}","{""Cache-Control"":[""no-cache, no-store, max-age=0, must-revalidate""],""Content-Length"":[""0""],""Date"":[""Sat, 24 Mar 2018 04:58:09 GMT""],""Expires"":[""0""],""Pragma"":[""no-cache""],""RequestId"":[""02d4224f-8cc8-48b4-a06d-034a97ad68a8-334001""],""X-Content-Type-Options"":[""nosniff""],""X-Frame-Options"":[""DENY""],""X-XSS-Protection"":[""1; mode=block""]}","SUCCESSFUL","200",,"75","MILLISECONDS"
I had put this thing into props.conf with below parameters in place.
[splunk@splunkqadeployer local]$ cat props.conf
[SOURCETYPE]
SEDCMD-Bearer = s/Bearer (.{1150})/#####/g
I deployed this app into the indexer and UF from where these files are comming.
after multiple efforts I am unable to see the data masked. May I know where I am missing here. As RegEx seems fine by the app deployment is getting failed for me.
... View more
04-03-2018
12:14 AM
How to change the execution schedule of a report which is already embeded.
Also how to find if a report is embeded?
... View more
03-02-2018
06:10 PM
We have a database server whose logs are pushed into Splunk. Those logs also contain userdata information like their login mail-id, phone numbers, personal mail-id for reference and such details.
Now when the user leaves the organisation or the contract we need these details to be deleted and move ur developer team is asking me for a backend API if possible where we can delete these sensitive data immediately so that his/her privacy is also maintained.
I suggested them to hash the user parameter but the db team wants those data to be sent to splunk for a record.
Can anyone suggest is there any API open from backend which we can give to the developers and achieve the task expected.
Thanks in advance for your replies.
... View more
01-11-2018
05:17 AM
I would like to reuse the same field extraction name for multiple sourcetypes.
this will help us create one alertfor all the kind of sourceytpes and avoid existing descripancies.
Thanks.
Vikram.
... View more
12-14-2017
12:54 AM
Yes Nick,
I will be doing the same as starting the application the whole day is not a good option.
Thanks.
Vikram.
... View more
12-13-2017
11:17 PM
Hello Nick,
The use case here is Splunk is on Linux, UFs are on Windows. sometime the UFs stop reporting and once splunk serivce restarted things seem to work again.
So I wanted to develop an app which will restart the splunk service after every 30 min on the Windows servers.
... View more
12-12-2017
11:32 PM
Hi,
I need to deploy an app from deplyment server which will restart the Splunkd UF application installed on Windows server.
Can some one please help me with what should I write in the $Splunk_Home/etc/deployment-apps/restart_app/local folder of Splunk.
Thanks.
Vikram.
... View more
12-12-2017
06:34 AM
We have configured our UFs to send data from a particular folder.
But every time the UF need to be stopped and started again after which it starts sending data.
I am also surprised why this is the kind of behavior as it is not feasible idea to restart the services every time whenever we want to get data into Splunk.
... View more
09-15-2017
03:19 AM
(1) your UFs are connected to Indexers and send internal logs to them (test it with index=_internal host=your_host | head 1000 using Always as Time Period) : This doesnot seem working.
(2) there are monitoring logs : These are also not working.
(3) monitoring logs don't arrive to Indexers (test it with index=* host=your_host | head 1000 ) : This command doesnot seem working.
(4) you correctly configured outputs.conf in UFs to link them to indexers (you can use the same of before) : YEs I did the same configuration as previous configuration.
(5) you have in UFs all the required TAs (you can use the same of before) or inputs.conf in $SPLUNK_HOME/system/local : We have inputs.conf on the system/local directory.....outputs.conf at etc/apps/ssl_indexer_app/local/ this app is pushed from deployment server we use for servers as well.
(6) After reinstall log reception totally stopped. However I can see in splunkd.log that UF is able to get connected to the indexers as per app from deployment server.
... View more
09-15-2017
02:05 AM
Now I created one more problem for me.
In hope that I can give definitive answer I found that the UF version was 6.6.2 and our Enterprise instance is 6.5.3.
So I uninstalled UF, restarted UF server, installed 6.5.2 version of UF and configured the UF in similar way.
Now UF has totally stopped from sending data to the enterprise instance.
I feel I am in big trouble on please help.
... View more
09-15-2017
01:58 AM
We were facing issue in Splunk log forwarding to IDXer cluster.
I found that our enterprise instance servers are 6.5.3 and UFs were of 6.6.2. So I uninstalled 6.6.2 version of UF and reinstalled 6.5.2 version on the same machine.
Then I did the similar configuration on the new UF. Now in the logs I can see UF is connected to Indexer but no data is been forwarded to the enterprise version.
I feel there is something I missed during the reinstallation.
Thanks.
Vikram.
... View more
09-14-2017
10:49 AM
but one more problem which I can see here is some of the data from the UF is going to main and some of it is going to ChilQA seems like I need to debug more on the issue. Please help if you have seen similar issue before.
Thanks.
Vikram.
... View more
09-14-2017
10:43 AM
On executing this command I came to know that in system\default directory the index = default.
There I changed the index to chilqa and took a UF restart.
This resolved the issue.
But the surprise to me was as per Splunk and the conf file precedence local file will be one which has heighest priority and its index and configuration values will be picked up.
Then in this was why is that default folder values were pickup and index was been sent to "main".
Thanks.
Vikram.
... View more
09-14-2017
10:20 AM
Hello Ssiever,
I cannot find anything for the host name in Splunkd.log
However I can find only below mentioned lines in the /var/log/splunk directory.
metrics.log:09-14-2017 10:32:17.333 +0000 INFO Metrics - group=per_host_thruput, series="db-containers", kbps=7.893489, eps=34.709250, kb=244.701172, ev=1076, avg_age=5464.828067, max_age=29468
metrics.log:09-14-2017 10:32:17.334 +0000 INFO Metrics - group=tcpin_connections, 104.45.237.119:19163:9998, connectionType=cooked, sourcePort=19163, sourceHost=, sourceIp=104.45.237.119, destPort=9998, kb=327.58, _tcp_Bps=26608.31, _tcp_KBps=25.98, _tcp_avg_thruput=25.98, _tcp_Kprocessed=327.58, _tcp_eps=52.19, _process_time_ms=1, chan_new_kBps=0.08, evt_misc_kBps=1.19, evt_raw_kBps=19.51, evt_fields_kBps=5.00, evt_fn_kBps=1.27, evt_fv_kBps=3.73, evt_fn_str_kBps=1.19, evt_fn_meta_dyn_kBps=0.00, evt_fn_meta_predef_kBps=0.00, evt_fn_meta_str_kBps=0.00, evt_fv_num_kBps=0.00, evt_fv_str_kBps=3.73, evt_fv_predef_kBps=0.00, evt_fv_offlen_kBps=0.00, build=4b804538c686, version=6.6.2, os=Windows, arch=x64, hostname=db-containers, guid=A9AADA66-57BB-4410-A075-328AE2C24FA3, fwdType=uf, ssl=false, lastIndexer=None, ack=false
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-02-2021
03:14 AM
|
