Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About arjunpkishore5
arjunpkishore5
Motivator
Member since:
08-02-2019
04-13-2023
Community Statistics
| Posts | 257 |
| Solutions | 33 |
| Karma Given | 21 |
| Karma Received | 38 |
| Member Since | 08-02-2019 |
Activity Feed
- Got Karma for Re: How to get dashboard information on users who ran it and time it ran. 09-15-2022 05:25 AM
- Got Karma for Re: Help for retrieving a lookup date and to display it in a dashboard. 02-04-2022 01:47 PM
- Got Karma for Re: How to get dashboard information on users who ran it and time it ran. 11-09-2020 11:33 AM
- Got Karma for Re: Calculate Index Size increase 24 hours. No admin privilege.. 10-23-2020 06:14 AM
- Got Karma for Re: Calculate Index Size increase 24 hours. No admin privilege.. 10-23-2020 02:55 AM
- Posted Re: Calculate Index Size increase 24 hours. No admin privilege. on Splunk Search. 10-22-2020 03:54 PM
- Posted Re: Using HEC vs Heavy Forwarder on Getting Data In. 10-22-2020 03:49 PM
- Posted Re: Table containing url, total requests, error responses on Splunk Search. 07-18-2020 08:53 AM
- Posted Re: rex on Splunk Search. 07-18-2020 08:34 AM
- Posted Re: REST API Incomplete Results on Splunk Search. 07-18-2020 08:31 AM
- Karma Re: display columns from 2 splunk queries based on a common column for gcusello. 07-18-2020 08:26 AM
- Posted Re: Table containing url, total requests, error responses on Splunk Search. 07-18-2020 08:22 AM
- Posted Re: Changing permissions on buckets on Splunk Enterprise. 07-18-2020 08:17 AM
- Karma Re: Changing permissions on buckets for richgalloway. 07-18-2020 08:16 AM
- Posted Changing permissions on buckets on Splunk Enterprise. 07-16-2020 05:26 PM
- Posted Re: transforms.conf set hostname to current host on Getting Data In. 06-29-2020 06:11 PM
- Posted Re: transforms.conf set hostname to current host on Getting Data In. 06-29-2020 06:09 PM
- Posted transforms.conf set hostname to current host on Getting Data In. 06-29-2020 03:42 PM
- Karma Re: How to overlay daily avg on count per day using timechart? for to4kawa. 06-05-2020 12:51 AM
- Karma Re: Need help with search command for efavreau. 06-05-2020 12:51 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 2 |
11-26-2024
05:18 AM
We are using Splunk Enterprise Version: 9.3.1 and we need it for Classic Dashboard What I managed to put together is this : <html>
<style type="text/css">
table tr:nth-child(odd) td{color: red;
}
table tr:nth-child(even) td{color: green;
}
</style>
</html>
It looks like this : What I actually need is to Select rows Containing INFO / ERROR / WARNING and color them RED , BLUE , YELLOW
... View more
09-12-2024
08:04 AM
Run it like a... | makeresults
| eval base_search="| makeresults | appendcols [| inputlookup ticket_templates where _key=5d433a4e10a7872f3a197e81 | stats max(*) as *]" | map search="| makeresults | map search="$base_search$ This would definitely work!!
... View more
06-14-2024
01:02 AM
Could this contribute to the slow performance when search for Knowledge Objects in our deployment? We have over 2000 user directories in $SPLUNK_HOME/etc/users on our SHs, representing every user who ever existed since we started with Splunk. When we run Settings -> Searches, Report and Alerts it can take over a minute to find a search.
... View more
02-23-2024
01:59 AM
Can you use above rest query for kv store lookup also?
... View more
11-06-2023
12:09 AM
@gcusello Same issue am facing as i had checked above solution worked on that it is working fine ,Till September received(email notification ) the report for the alert triggered but it is stopped from October. what could be the issue ??
... View more
- Tags:
- alert
- notification
09-01-2023
12:23 AM
You could also use MC to look those. Just select MC -> Search -> Scheduler and there are couple of different dashboard. Then select suitable panel and open SPL for it and modify as needed.
... View more
11-16-2022
11:08 AM
I have this issue as well but without the benefit of logs in GMT. My logs are multiple time zones in a single host, index, source, sourcetype combo. Here's an example: { [-]
AppID:
ElapsedSeconds: 0.694 seconds
Event: RestCall
Method: POST
Request: { [+]
}
RequestLength: 371
RequestTimestamp: 16-Nov-2022 12:59:54
Response: { [+]
}
ResponseLength: 286
ResponseTimestamp: 16-Nov-2022 12:59:55
SequenceNumber: null
ServiceName:
ServiceURL:
StatusCode: 200
StatusText: OK
TimeZone: Asia/Shanghai
UserID:
UserIP: 127.0.0.1
UserName:
} In total there are about 85 different timezones logging here. Any idea how to get Splunk to recognize the timezone when not with the time stamp?
... View more
07-08-2022
06:00 AM
@woodcock this was the same issue which i was facing...and now using your steps it resolved thanks a lot
... View more
Please show me where (which Splunk server) this advanced setting area is located & how to change the TTL. Thank u
... View more
01-05-2021
11:10 AM
Hi, While using split I am facing an issue, in my events I have null values for a filed sometimes. for sexample - f1,f2,f3,f4,f5 - this works perfectly but below data with missing values in few fields giving issues. f1,f2,,,f5 split commands suggests f5 is f4 Can this be handled ? Thanks in advance!!!
... View more
12-23-2020
12:50 PM
I just had to deal with this same 'deduping' crushing results as well.. Did it with if() statements for any fields that were NULL at times: <search> |eval os=if(ISNULL(os),"dummyValue",os)| eval department=if(ISNULL(department),"dummyValue",department) |dedup ip,hostname,status,department and could then change the dummyValue back after the dedup if needed
... View more
11-21-2020
07:31 AM
Hey guys, Solved long time ago. This is standart: passing smth like JSON thru REST API is just passing a string parameter for a custom Python script (when calling via REST API a search like " | myScript arg1=\"aaa\" arg2=\"bbb\" "
... View more
10-23-2020
03:01 AM
2 Karma
Thank you @arjunpkishore5 ! I used these two queries : |eventcount summarize=false index=* report_size=true | eval GB=(size_bytes/1024)/(1024*1024) | stats sum(GB) as total by index|sort -total And | tstats earliest(_indextime) AS indexing_time where index=* OR index=_* by index|convert ctime(indexing_time) timeformat="%m/%d/%Y" The first query gave me all the disk space event logs would take (without a replication factor). I checked and found out that the replication factor is 3. Multiplied the values with 3 and got the total disk space required by each index (With replication). Now, I took the second query and got the total number of days from which the first indexing happened for an indexer. I got the total number of days for which indexers are being used by by substracting with current date. Now, I took the average disk required by dividing the two outputs and estimated the disk spaces for the next 3months, 6 months, 9 months and 12 months. Hope the way I took is ok. Regards, Abhishek Singh
... View more
09-10-2020
03:53 PM
I dont see this as working : I have transforms.conf and props.conf set as you stated above in my etc/system/local area. my search is as follows : index=xxx | eval myDynamicSource=source | collect index=xxx source=myDynamicSource i see the source still set to myDynamicSource. what am i missing ?
... View more
07-22-2020
04:02 AM
Post the search to https://<host>:<mPort>/servicesNS/userName/appName/search
... View more
07-19-2020
02:30 PM
>search canceled message. what's this? we can't see your display, so you should provide exactly messages.
... View more
07-18-2020
08:34 AM
Can you post a sample of your raw data line and what you need extracted? for your question, it isn't clear, if you want one variable to extract the entire phrase or if you want to extract fields from the pasted line.
... View more
07-18-2020
08:17 AM
Just an update. I did change the permissions, and that doesn't seem to have caused any problems. Not that I expected it to, but i had confirm if there are any hidden implications from this action.
... View more
07-08-2020
05:12 AM
Hello, I am curious if you have found another way to accomplish this. For us, going through audit functions to a blob storage on a heavily used azure sql database is beyond painful and completely impractical.
... View more
06-29-2020
06:11 PM
The source is HEC. The forwarders are on a load balanced url for HEC inputs. I'm trying to override the host from the LB url to the forwarder that receives it.
... View more
02-28-2020
03:21 AM
Yes, it's possible with changes in indexes.conf
Default system file location is $SPLUNK_HOME/etc/system/local/
Customised/add-on file location is $SPLUNK_HOME/etc/apps/< app_folder_name >
Increase "frozenTimePeriodInSecs" attribute for the indexes.conf
For example for _internal logs, you can increase retention from 30 days to 90 days by changing frozenTimePeriodInSecs from 259200 to 77,76,000
[_internal]
frozenTimePeriodInSecs = 77,76,000
... View more
02-18-2020
07:24 AM
Thankyou Arjun,
This works.
I had to add a zero in the curly braces.
response = json.loads(requests.get('{0}/services/collector/health'.format(hecBaseUrl), auth=HTTPBasicAuth(username, password), verify=False).text)
If possible can you please explain this request.
... View more
02-17-2020
06:29 AM
it is visible via btool as soon as i add an index to our indexes.conf
... View more
02-17-2020
05:17 AM
Step 1:
The Requirement of the project is to automate the web service and it's developed with maven.
Step 2:
I need the entire maven project's should be integrate with the SPLUNK.
Step 3:
After integrating my maven project with SPLUNK then i believe the logs will be present in SPLUNK and i can generate the report as well.
... View more
