Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Anu
Anu
Path Finder
Member since:
07-08-2020
a month ago
Community Statistics
| Posts | 25 |
| Solutions | 0 |
| Karma Given | 3 |
| Karma Received | 1 |
| Member Since | 07-08-2020 |
Activity Feed
- Karma Re: Unable to extract fields from package source type on (splunk_TA_*nix)app for isoutamo. a month ago
- Karma Re: Unable to extract fields from package source type on (splunk_TA_*nix)app for gcusello. a month ago
- Got Karma for Re: Unable to extract fields from package source type on (splunk_TA_*nix)app. 08-28-2023 09:36 AM
- Posted Re: Unable to extract fields from package source type on (splunk_TA_*nix)app on Dashboards & Visualizations. 08-28-2023 06:06 AM
- Posted Re: Unable to extract fields from package source type on (splunk_TA_*nix)app on Dashboards & Visualizations. 08-23-2023 03:41 AM
- Posted Re: Unable to extract fields from package source type on (splunk_TA_*nix)app on Dashboards & Visualizations. 08-23-2023 03:40 AM
- Posted Re: Unable to extract fields from package source type on (splunk_TA_*nix)app on Dashboards & Visualizations. 08-23-2023 03:37 AM
- Tagged Re: Unable to extract fields from package source type on (splunk_TA_*nix)app on Dashboards & Visualizations. 08-23-2023 03:37 AM
- Posted Re: Why am I Unable to extract fields from package source type on (splunk_TA_*nix)app? on Dashboards & Visualizations. 08-22-2023 05:13 AM
- Posted Re: Unable to extract fields from package source type on (splunk_TA_*nix)app on Dashboards & Visualizations. 08-22-2023 03:17 AM
- Tagged Re: Unable to extract fields from package source type on (splunk_TA_*nix)app on Dashboards & Visualizations. 08-22-2023 03:17 AM
- Posted Re: Why am I Unable to extract fields from package source type on (splunk_TA_*nix)app? on Dashboards & Visualizations. 08-22-2023 03:10 AM
- Posted Re: Unable to extract fields from package source type on (splunk_TA_*nix)app on Dashboards & Visualizations. 08-21-2023 12:03 PM
- Posted Why am I Unable to extract fields from package source type on (splunk_TA_*nix)app? on Dashboards & Visualizations. 08-21-2023 12:01 PM
- Posted Problem attaching csv file to splunk reports. on Splunk Enterprise. 04-09-2021 09:43 AM
- Tagged ERROR intializing ssl context : check splunkd.log on Splunk Enterprise. 03-22-2021 05:04 AM
- Posted ERROR intializing ssl context : check splunkd.log on Splunk Enterprise. 03-22-2021 05:01 AM
- Posted Re: Does a cluster supports multiple version of splunk?? on Getting Data In. 02-11-2021 05:50 AM
- Posted Re: Does a cluster supports multiple version of splunk?? on Getting Data In. 02-11-2021 12:09 AM
- Posted Re: Does a cluster supports multiple version of splunk?? on Getting Data In. 02-11-2021 12:02 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-28-2023
06:06 AM
1 Karma
Hi , The query started working after upgrading the app to the 8.10 version. @isoutamo , @gcusello Thank you for the help
... View more
08-23-2023
03:41 AM
Hi @Roy_9 , Yes i do see results when i do the basic search with index and sourcetype .see above comment for more details. Thanks Anu
... View more
08-23-2023
03:40 AM
Hi @isoutamo , I have installed the TA*nix app on search heads as well,my index is os.I can see the results when i do the basic search index=* sourcetype=package but when i add NAME IN i dont see any results.Attached the screenshots for reference.
... View more
08-23-2023
03:37 AM
Yes i did install the app on sh too.
... View more
- Tags:
- hi
08-22-2023
05:13 AM
Hi @gcusello , yes, i did try both queries but still no luck. Thanks Anu
... View more
08-22-2023
03:17 AM
@isoutamo The query is not yielding any results in my environment. I suspect it is because the NAME field is not extracted.
... View more
- Tags:
- @
08-22-2023
03:10 AM
Thank you so much for the reply @gcusello and @isoutamo . Please find the sample logs. NAME VERSION RELEASE ARCH VENDOR GROUP initscripts 10.00.18 1.el8 x86_64 Red Hat, Inc. Unspecified fuse 2.9.7 16.el8 x86_64 Red Hat, Inc. Unspecified libattr 2.4.48 3.el8 x86_64 Red Hat, Inc. Unspecified xmlsec1-openssl 1.2.25 4.el8 x86_64 Red Hat, Inc. Unspecified lua 5.3.4 12.el8 x86_64 CentOS Development/Languages zip 3.0 23.el8 x86_64 Red Hat, Inc. Applications/Archiving libidn2 2.2.0 1.el8 x86_64 Red Hat, Inc. Unspecified popt 1.18 1.el8 x86_64 Red Hat, Inc. System Environment/Libraries nimsoft-robot 9.33 1 x86_64 CA Technologies System/Daemons
... View more
08-21-2023
12:03 PM
@isoutamo Can you please help
... View more
08-21-2023
12:01 PM
Hi,
I'm trying to create a report that has information about all the hosts with the kernel version and OpenSSL version and SSH version. The package.sh (sourcetype=package)script on the Splunk_TA_*nix app fetches all the information but the issue is I'm not able to extract fields from the sourcetype=package.Any help is appreciated
... View more
- Tags:
- field extraction
04-09-2021
09:43 AM
Hi All, My splunk is running on version 7.3.6 the issue is that the scheduled report emails doesn't have csv format result if the results returned are zero. Any help is appreciated . pdf file is sent even if the results are zero. Thank you Anu @isoutamo
... View more
Labels
- Labels:
-
using Splunk Enterprise
03-22-2021
05:01 AM
Hi, I'm having the following error on my search heads-- ERROR initializing ssl context : check splunkd.log regarding configuration errors for server <indexer ip> Any help would be very much appreciated. @isoutamo @aakwah
... View more
- Tags:
- SSL error
Labels
- Labels:
-
configuration
-
troubleshooting
02-11-2021
05:50 AM
Thank you .Just a last question, How do i verify all the apps/add-ons are working fine after the upgrade??
... View more
02-11-2021
12:09 AM
Thank you Ismo.Is it possible to upgrade from 6.6.3 to 7.3 directly??
... View more
02-11-2021
12:02 AM
So what you meant is i should upgrade the indexer cluster and search head cluster at the same time.Is it possible upgrade to 7.3.x directly from 6.6.3??
... View more
02-10-2021
01:14 AM
Hi all, I have 3 search heads as a part of search head cluster and 5 indexers in the indexer cluster and also my search heads are also part of this indexer cluster. I'm upgrading my splunk infrastrcture from 6.63 to 7.2.Should all the search heads and indexers be upgraded at the same time or can i upgrade the search head cluster first and indexer cluster later?? The problem here is search heads are also part of indexer cluster if i upgrade the search heads will i run into problem with different versions of splunk in indexer cluster searchhead cluster components sh1 sh2 sh3 indexer cluster idx1 idx2 idx3 idx4 idx5 sh1 sh2 sh3 @isoutamo
... View more
Labels
- Labels:
-
Linux
-
source
-
sourcetype
11-23-2020
02:46 AM
@somesoni2 still didn't work for me.. Do you have any workaround for getting asm alert log in to splunk??
... View more
09-02-2020
12:34 AM
But it was working well from long time.I see this errors from last 1 month.Is there any other reason why this can happen.
... View more
09-01-2020
05:56 AM
HI, I see lot of DateParserverbose warnings in splunkd.log on my indexers. The errors goes as follows: WARN DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event Time parsed (Sun Aug 2 22:06:30 2020) is too far away from the previous event's time (Tue Nov 5 15:47:34 2019) to be accepted. If this is a correct time, MAX_DIFF_SECS_AGO (3600) or MAX_DIFF_SECS_HENCE (604800) may be overly restrictive DateParserVerbose - Accepted time format has changed (some random text) possibly indicating a problem in extracting timestamps. @isoutamo
... View more
Labels
- Labels:
-
props.conf
09-01-2020
05:48 AM
HI, I see lot of DateParserverbose warnings in splunkd.log on my indexers. The errors goes as follows: WARN DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event Time parsed (Sun Aug 2 22:06:30 2020) is too far away from the previous event's time (Tue Nov 5 15:47:34 2019) to be accepted. If this is a correct time, MAX_DIFF_SECS_AGO (3600) or MAX_DIFF_SECS_HENCE (604800) may be overly restrictive DateParserVerbose - Accepted time format has changed (some random text) possibly indicating a problem in extracting timestamps.
... View more
Labels
- Labels:
-
props.conf
