About ramganeshn

ramganeshn · ‎07-14-2022

Nope. I am not able to resolve this. I am using the same correlation ID. Still, a new incident is getting created every time. Any help on this is much appreciated.

ramganeshn · ‎07-07-2022

Hi, I have a requirement to update an incident that had been created. Every time, my alert gets triggered, it gets a new incident created in ServiceNow. I would like to get some clarity here as to whether I can be able to close an incident once it is created or can I be able to update some comments or update status or update description/short description. Please help me with the steps or process to be followed in updating an incident. I am trying to update an incident that was created by an alert action from Splunk ITSI. But, every time the alert gets triggered, a new incident is getting created instead of updating the existing incident. I tried everything mentioned in the link given below: https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Commandsandscripts#Update_behavior_... Please guide as to what needs to be done to update a previously created incident? Should I need to get the status of the incident from ServiceNow and use that in the search query when I try to update the incident? Thanks!

ramganeshn · ‎07-06-2022

Hi, I am trying to update an incident that was created by an alert action from Splunk ITSI. But, everytime the alert gets triggered, a new incident is getting created instead of updating the existing incident. I tried everything mentioned in the link given below: https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Commandsandscripts#Update_behavior_for_incidents Please guide as to what needs to be done to update a previously created incident? Should I need to get the status of the incident from ServiceNow and use that in the search query when I try to update the incident? It would be great if you could help me with any documentation or a video reference that could help me in performing this activity of updating an incident that was created already. Thanks!

ramganeshn · ‎06-14-2022

Thanks Giuseppe!

ramganeshn · ‎06-08-2022

Hi, I have a few queries regarding data ingestion from a .csv file. I am interested in knowing the following: 1. What is the most optimal way to bring the data from a .csv file into Splunk? 2. Are there any pre-requisites to be satisfied before indexing a .csv file? 3. Are there any limitations in indexing data from a .csv file? 4. Are there any restrictions in indexing data from a .csv file (maximum file size allowed, maximum rows or maximum columns that can be placed in a single .csv file, maximum number of the file allowed, etc.) 5. Is there any Splunk documentation available about this requirement? If so, please share the link for the same. Thanks much!

ramganeshn · ‎10-19-2021

Thank you!

ramganeshn · ‎10-19-2021

Hi, Thanks for your response! Do you mean that, even if we have a scenario, wherein we place very frequent data pulls from an azure resource, this will not have an impact to our performance? Also, does Splunk enforce any performance limits(i.e, maximum number of inputs, minimum time interval for pull frequency, maximum add-on installation count, etc) to the customers over the usage of IDM? Please advise.

ramganeshn · ‎10-19-2021

Hi All, We would like to know for an alternative solution to website monitoring app in Splunkbase. Could someone please let us know if there is an alternate way to monitor website availability in Splunk? Thanks!

ramganeshn · ‎10-18-2021

Hi All, We have configured multiple inputs in our Splunk IDM Layer and few of them are Microsoft Add-ons. Each of these add-ons have multiple inputs with varied time frequency to pull data from Azure resources. Hence, we would like to know the limit on configuring the inputs or the limit of apps & add-ons that can be installed in the Splunk IDM layer. Also, we would like to know if the performance can be monitored by us through some means? Thanks!

ramganeshn · ‎05-24-2021

Hi Team, We have set up the Website Monitoring App in one of our Heavy Forwarders hosted in Azure and it is sending data to Splunk Cloud. The App is monitoring Internet URLs, but the Intranet URLs are not getting monitored. It is throwing a 401 error message even after passing the valid credentials. Please as to whether the Intranet URLs can be monitored using the Website Monitoring App or some additional configuration changes need to be made, so as to enable this monitoring. Thanks!

ramganeshn · ‎10-16-2020

We are trying to send data to raw endpoint via Splunk HEC. When we do so, the data is always sent only to the default index and is not sent to the other indexes. Can someone guide us on how to have this resolved? Any idea? The scenario is as below: [http://LGS-HEC-PROD] disabled = 0 index = index_one indexes = index_one,index_two,index_three,index_four,index_five token = <OUR_HEC_TOKEN> We are trying to send data from splunk-library-javalogging and to the raw endpoint of our Splunk HEC. So, whenever we send changing the index from index_one to index_two or index_three, the events are still written to the index_one(Which is the default index index = index_one). This is not happening with the event endpoint and happens only with the raw endpoint. Is this a limitation with the Splunk HEC or are we missing something on this. Please advise.

Posts	11
Solutions	0
Karma Given	3
Karma Received	1
Member Since	‎08-17-2020

Online Status	Offline
Date Last Visited	‎07-15-2022 11:00 AM

Is there Documentation for Updating an incident us...

Questions about Indexing from a .csv file into Spl...

App/Add-On for monitoring website availability

Monitor the performance of Splunk Inputs Data Mana...

Intranet URL Monitoring using Website Monitoring A...

Unable to send data to multiple indexes using raw ...

Re: ServiceNow Incident Integration: How to create...