About gnangia

gnangia · ‎01-07-2020

I haven't used the app but in your screen shots, I don't see which index the dashboard is looking to get its data. You may want to check to make sure they match. Also check the dashboard time picker vs. the data.

gnangia · ‎01-07-2020

Here are the steps I would take to troubleshoot - (1) Login to the server to make sure splunk process is running (2) Check that your outputs.conf is still on the system (3) Try to do a network connectivity test to your HF/Indexer (4) Check splunkd.log to see if there are any errors

gnangia · ‎01-03-2019

Hi Will Thanks I have installed the app but I have to use a proxy as part of my configuration with no credentials needed and it is giving the following error - NoCredentialsError: Unable to locate credentials Can you please assist?

gnangia · ‎12-19-2018

We have installed the AWS Trusted Advisor Aggregator app and have configured it to use the proxy without any username/password as it does not require any. Since I don't see any data, I looked at the internal logs and found the following consistently. ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-aws-trusted-advisor/bin/aws_trusted_advisor.py" NoCredentialsError: Unable to locate credentials Does anyone know how to get around the issue? Thanks Gaurav

gnangia · ‎11-15-2018

Same here. I am also not able to find any documentation from Hurricane Labs that have released the Add-on.

gnangia · ‎03-21-2018

Answer by niketnilay is correct. We struggled for sometime before looking at answers and added the code that was provided and it works like a charm. Thank you so much.

gnangia · ‎01-06-2017

Thank you for your response. While using type=left I see all the rows even the ones with no count. However the values are empty. So what I did was to add | fillnull value=0 Applicationwhich does show me all the rows with the # 0 in lieu of blank which is good. However when I click on the number when greater than zero, it does not show me the event. I then tried your map command as an alternative and it gives me the raw events for only things it can find and not based on the input file. Here is my query - | inputlookup iss_apps.csv | map search="search sourcetype=netcool_QA_app_logs AND Application=$Application$" maxsearches=200. Any additional advice? Thanks

gnangia · ‎01-05-2017

I have a lookup file with 2 columns. I would like to take each row and then run a search query and show results including searches that don't have any results for that particular row. For starters, I have saved the lookup file as a saved report and have attempted to do a join but it only shows if any results are found. Here is my search query - |inputlookup lookupFile.csv | join Application [search sourcetype=xxxx] Any help would be appreciated. Thanks

Posts	8
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎01-05-2017

Online Status	Offline
Date Last Visited	‎11-12-2021 09:45 AM

Tusted Advisor Proxy connction error

How to take static lookup entries to run searches ...

Re: Splunk App for *nix - all dashboards show "no ...

Re: Why did a Splunk forwarder stop sending to log...

Re: AWS Trusted Advisor for Splunk: Multiple Accou...

Tusted Advisor Proxy connction error

Re: AWS Trusted Advisor for Splunk: Multiple Accou...

Re: Splunk Dashboard Examples - Table Row highligh...

Re: How to take static lookup entries to run searc...

How to take static lookup entries to run searches ...