Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About anilchaithu
anilchaithu
Builder
Member since:
11-24-2016
08-31-2022
Community Statistics
| Posts | 143 |
| Solutions | 25 |
| Karma Given | 1 |
| Karma Received | 41 |
| Member Since | 11-24-2016 |
Activity Feed
- Got Karma for Re: Not able to create new index in standalone instance of Splunk indexer. 11-08-2022 11:38 PM
- Got Karma for Re: KV Store initialization failed. Please contact your system administrator. 04-18-2022 05:25 PM
- Got Karma for Re: TsidxStats Error after Splunk v8 Upgrade. 10-13-2021 03:34 PM
- Posted Re: deletion of disabled alerts and reports on Reporting. 08-24-2021 01:21 PM
- Got Karma for Re: PROF Conf Issues. 08-12-2021 12:36 PM
- Posted Re: PROF Conf Issues on Splunk Search. 08-12-2021 12:33 PM
- Posted Re: Using Splunk HEC and validating Certificates on Getting Data In. 08-12-2021 08:01 AM
- Posted Re: Edit data In Splunk on Splunk Search. 08-12-2021 07:15 AM
- Posted Re: Edit data In Splunk on Splunk Search. 08-12-2021 06:18 AM
- Posted Re: User limit events on Dashboards & Visualizations. 08-11-2021 06:10 PM
- Posted Re: Splunk and Ldap cloned group Not seeing on Splunk Enterprise. 08-11-2021 07:56 AM
- Posted Re: Looking for a search solution based on excel data on Splunk Enterprise. 08-06-2021 08:55 PM
- Posted Re: Imperva Integration with Splunk on Installation. 08-06-2021 03:33 PM
- Posted Re: Self Signed Certificate error on Splunk Enterprise. 08-06-2021 03:29 PM
- Posted Re: Calling Python script from Front End on Getting Data In. 08-06-2021 10:36 AM
- Posted Re: Waiting for queued job to start getting error for a particular user on Installation. 08-06-2021 10:22 AM
- Got Karma for Re: Windows perfmon stats. 08-06-2021 10:19 AM
- Posted Re: How to prevent data duplication on a csv file ? on Getting Data In. 08-06-2021 10:14 AM
- Posted Re: Windows perfmon stats on Getting Data In. 08-06-2021 10:08 AM
- Posted Re: How filter all panels by clicking on a cell ? on Dashboards & Visualizations. 04-16-2021 07:54 AM
Topics I've Started
08-24-2021
01:21 PM
@Susha you can use a rest search to get list of saved searches that includes all your alerts & reports. Use the below search to get the disabled alerts & reports. | rest /servicesNS/-/-/saved/searches splunk_server="local"
| search disabled=1
| table title author eai:acl.app updated Similarly you can use another rest search to get all the views | rest /servicesNS/-/-/data/ui/views splunk_server="local"
| table title author eai:acl.app updated -- Hope this helps
... View more
08-12-2021
12:33 PM
1 Karma
@SplunkDash How are you onboarding this data? If you are onboarding this data from a remote server using UF, you should place the props.conf on the remote server to extract the fields. Its always better to test the extraction using UI i.e. settings -> Add Data -> upload -> choose psv as sourcetype. Once you are ok with extraction, copy the parameters deploy it over to the UF. If this psv file does not has a header file, you need to mention the fields as well in the props.conf. -- Hope this helps.
... View more
08-12-2021
08:01 AM
@Kamaal_Mohammed How did you configure ssl cert on this host? Is it using default cert OR CA-signed cert (internal OR external). you can find this by using the btool command /opt/splunk/bin/splunk btool inputs list http --debug | grep serverCert You need to copy over the root cert from the above path to the source from which you are doing this post request. -- Hope this helps
... View more
08-12-2021
07:15 AM
@jokovitch strange, try this. index="main" | eval Phone= case(like(Fname, "%fname1%", "123") -- Hope this helps
... View more
08-12-2021
06:18 AM
@jokovitch you can use the below eval command for this task eval Country = if(Fname="fname1", "UK", Fname), Phone= case(Fname="fname1", "123") -- Hope this helps
... View more
08-11-2021
06:10 PM
@pbarbuto Please use the below search. you should be able to see the reached limit messages for both user & role assuming someone is hitting the limit. index=_internal sourcetype=splunkd component=DispatchManager -- Hope this helps.
... View more
08-11-2021
07:56 AM
@jcorcoran508 just curious whether the new cloned group has members? The AD Group would only show up if it has members in it. If yes, please reload authentication (settings -> Authentication Methods -> Reload Authentication Configuration) and check. -- Hope this helps.
... View more
08-06-2021
08:55 PM
@AishwaryaDevi If I understand your problem correctly, you want to search login data in splunk for the users in your spread sheet. If not pls elaborate your use case
... View more
08-06-2021
03:33 PM
@nisha_sh Please follow the splunk doc to complete the setup. https://docs.splunk.com/Documentation/AddOns/released/ImpervaWAF/Setup -- Hope this helps
... View more
08-06-2021
03:29 PM
@timsheets13 Couple of questions 1. Have you created "mySplunkWebCert.csr" mentioned in the command? 2. From which directory, you are executing this openssl command? the certs will be stored in /opt/splunk/etc/auth
... View more
08-06-2021
10:36 AM
@ashwath4k You can create a scripted input from UI. I assume you have UI enabled on this HF. Please follow the below path to create the scripted input. Settings -> Data Inputs -> Scripts -> New Local Script Fill the required parameters and save the input. -- Hope this helps
... View more
08-06-2021
10:22 AM
@rahul2gupta This is not related to disk space. You need to increase the concurrent searches limit on the role/user level. By default the user has a limit 3 standard searches. -- Hope this helps.
... View more
08-06-2021
10:14 AM
@dm1 If the csv file generated from the search has duplicate rows, indexer will index them as is. You need to remove duplicates in your search. Please try this out. index=abc |fields _time _raw |fields - _indextime _sourcetype _subsecond | dedup field_names* |outputcsv abc_dns -- Hope this helps
... View more
08-06-2021
10:08 AM
1 Karma
@redsox07928 Please refer Splunk Add-On for Microsoft Windows. It has many inputs. You can deploy this add-on as is OR you can tweak the input parameters per the use case. https://splunkbase.splunk.com/app/742/ Sample perfmon stanza for CPU [perfmon://CPU]
counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec
disabled = 0
instances = *
interval = 10
mode = multikv
object = Processor
useEnglishOnly=true index = index_name -- Hope this helps
... View more
04-16-2021
07:54 AM
you should have an initial value like a wild card (*) for this form input
... View more
04-16-2021
07:39 AM
1 Karma
@Sathya0Q I guess you have the list of users in a lookup file. If not please create one with field name as user. Use the below search to get the login attempts from the selected users. If the field name in the lookup is not user, you should use a rename command in the subsearch index=_audit [ | inputlookup users.csv ] login attempt -- Hope this helps
... View more
04-16-2021
06:54 AM
@mah Does the table panel is also built on this base search? Its possible to pass the value from the table panel to the base search. you should create tokens based on requirements. In your case, you can use $click.value2$ to pick the value from table. To manage tokens, Edit Dashboard -> More Actions (3 vertical dots on the top right of the panel) -> Edit Drilldown -> select 'Manage tokens on this dashboard' from dropdown -- Hope this helps
... View more
04-16-2021
06:10 AM
@jason_hotchkiss parentheses is missing. The below should work | eval MemoryUtilization = round(((memTotalMB - memFreeMB) / memTotalMB * 100),2) -- Hope this helps
... View more
04-12-2021
03:43 PM
1 Karma
@SamHTexas Splunk has a dashboard "Orphaned Scheduled Searches, Reports, and Alerts" to find the orphaned knowledge objects. This dashboard is in search app. Users can remove/reassign the orphaned knowledge objects from below. Settings -> All Configurations -> Reassign Knowledge Objects -> Orphaned. -- Hope this helps.
... View more
02-04-2021
02:10 PM
@ziko0303 Which version of Splunk ? Can you please share the snap shot of the settings tab?
... View more
12-09-2020
12:04 PM
@edgarsilva01 you can get all sourcetypes using below search. | metadata type=sourcetypes index=* Hope this helps !!!
... View more
11-24-2020
07:28 AM
1 Karma
@klischatb The peers will be added to search head cluster by default when you integrate it with indexer cluster (from cluster master). If you no longer have this peer (server 2), you need to remove it from the indexer cluster and then the cluster master. -- Hope this helps
... View more
11-23-2020
09:30 AM
@altink strftime converts UNIX time to regualr readable time. From the SPL, the min_time & max_time are already converted in line 2 of the code. Simply you can remove line 2 OR you can add the following stanzas | eval min_time = strftime(strptime(min_time,"%m/%d/%Y %H:%M:%S"),"%Y-%m-%d"))
| eval max_time = strftime(strptime(max_time,"%m/%d/%Y %H:%M:%S"),"%Y-%m-%d")) -- Hope this helps
... View more
11-23-2020
08:52 AM
1 Karma
@krvamsireddy From the logs it is clear that the cert was expired and you need to generate a new server cert. Check the validity of the cert using below command. This should give you the end data of the cert openssl x509 -noout -enddate -in /opt/splunk/etc/auth/server.pem To generate a new ssl cert /opt/splunk/bin/splunk createssl server-cert 3072 -d /opt/splunk/etc/auth -n server -c <FQDN> Restart splunk check kvstore status /opt/splunk/bin/splunk show kvstore-status -- Hope this Helps
... View more
09-05-2020
04:12 PM
@rsilwal7 You can use splunk add-on for aws to send data from aws s3 to splunk. you should use SQS based S3 approach. If the data volume is high, you can use this route s3 -> kinesis firehose -> Splunk (using HEC) https://docs.splunk.com/Documentation/AddOns/released/AWS/SQS-basedS3 hope this helps.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-31-2022
09:03 PM
|
Karma from
