Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About akpadhi
akpadhi
Explorer
Member since:
11-13-2020
09-29-2021
Community Statistics
| Posts | 10 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 11-13-2020 |
Activity Feed
- Got Karma for Why an error in the logs after universal forwarder upgrade to 8.2.1?. 03-14-2022 01:38 PM
- Posted Why an error in the logs after universal forwarder upgrade to 8.2.1? on Installation. 09-27-2021 12:22 AM
- Posted Re: Count based on a rolling average on All Apps and Add-ons. 03-10-2021 03:09 AM
- Tagged Count based on a rolling average on All Apps and Add-ons. 03-09-2021 10:11 PM
- Posted Count based on a rolling average on All Apps and Add-ons. 03-09-2021 05:32 AM
- Posted Re: Filter condition in a timechart on Splunk Enterprise. 03-05-2021 12:26 AM
- Posted Re: Filter condition in a timechart on Splunk Enterprise. 03-05-2021 12:08 AM
- Posted Filter condition in a timechart on Splunk Enterprise. 03-04-2021 11:36 PM
- Posted Re: Checksum for seek ptr didn't match, will re-read entire file on Getting Data In. 11-17-2020 09:49 AM
- Posted Checksum for seek ptr didn't match, will re-read entire file on Getting Data In. 11-17-2020 04:55 AM
- Posted Re: Timestamp field not working as expected on IT Operations Discussions. 11-13-2020 12:33 PM
- Posted Timestamp field not working as expected on IT Operations Discussions. 11-13-2020 10:48 AM
- Tagged Timestamp field not working as expected on IT Operations Discussions. 11-13-2020 10:48 AM
- Tagged Timestamp field not working as expected on IT Operations Discussions. 11-13-2020 10:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-27-2021
12:22 AM
1 Karma
We are recieving following error in the logs after UF upgrade to 8.2.1, can someone please confirm if any action needs to be taken or if this error can be ignored?
ERROR DistributedTracer [389066 MainThread] - Couldn't find "distributed_tracer" in server.conf.
./splunk --version Splunk Universal Forwarder 8.2.1 (build ddff1c41e5cf)
UF has been started and running correctly.
... View more
03-10-2021
03:09 AM
@ITWhisperer i am getting an error Error in 'streamstats' command: time_window can only be used on input that is sorted in time order (both ascending and descending order are ok). tried few options nothing worked, can you pls cross check..
... View more
03-09-2021
05:32 AM
I have following query which provides me details of a db userid whenever the count crosses X value, however I want to modify this to a dynamic search based on a rolling average of that value for last 10 days. Can you pls help? index=abc sourcetype=DBConnectionUsage | spath cdb | spath pdb | spath application_user | search cdb=* pdb=* application_user = "*" cluster="E3"| bin span=30m _time| stats sum(connection_count) as connection_count by application_user, pdb | where connection_count >100 I want to modify the where condition to where connection_count > 'avg (conn count for last 10 days)'.
... View more
- Tags:
- Splunk Enterprise
Labels
- Labels:
-
configuration
-
dashboard
-
search
-
troubleshooting
03-05-2021
12:08 AM
@ITWhisperer @scelikok I tried above suggestion but the where condition is still not working and not returning any results even though the timechart values are satisfying the condition. Yes either a condition on the alert or in the search would work for me.
... View more
03-04-2021
11:36 PM
We have following query used for generating few dashboards. However we would like to setup an alert whenever the sum(connection_count) goes above a threshold value say 100. Tried few options but the filter contion is not working. Can someone please help. index=app sourcetype=DBConnectionUsage NOT(application_user="No User" OR application_user="SYS" OR application_user="C##GGS_OWNER") | spath cdb | spath pdb | spath application_user | search cdb=* pdb=* application_user = "*" cluster="E3"| timechart span=1H sum(connection_count) by application_user
... View more
Labels
- Labels:
-
using Splunk Enterprise
11-17-2020
09:49 AM
@somesoni2 contents of file below: we didnt specify initcrclength because we are appending to the same file. 11/16/2020 06:37:20 Timestamp test with setting to GMT+5.5 in inputs.conf, MST-06:07:20 11/16/2020 06:46:20 Timestamp test with setting to GMT+5.5 in inputs.conf - test2 , MST-06:16:20 11/16/2020 06:56:20 Timestamp test with setting to GMT+5.5 in inputs.conf - test2 , MST-06:26:20 11/16/2020 19:36:20 Timestamp test with setting to GMT+5.5 in inputs.conf - test2 , MST-07:06:20 11/16/2020 19:40:10 Timestamp test with setting to GMT+5.5 in inputs.conf - test2 , MST-07:10:10 11/16/2020 7:40:15 Timestamp test with setting to GMT+5.5 in inputs.conf - test2 , MST-07:10:15
... View more
11-17-2020
04:55 AM
_TCP_ROUTING = forward_logs disabled = false index = 1idx1 sourcetype = LOGS crcSalt = <SOURCE> Even though our inputs.conf has crcSalt=<SOURCE>, we see following info messages in splunkd.log and entire log file is getting reindexed for each log entry. Can you please confirm if any other parameters are needed? 11-17-2020 05:07:22.103 -0700 INFO WatchedFile - Checksum for seekptr didn't match, will re-read entire file='Xyz.log'. 11-17-2020 05:07:22.103 -0700 INFO WatchedFile - Will begin reading at offset=0 for file='Xyz.log'. 11-17-2020 05:07:22.104 -0700 WARN CsvLineBreaker - CSV StreamId: 8593577840253621053 has empty line. - data_source="Xyz.log"
... View more
Labels
- Labels:
-
inputs.conf
-
Linux
-
universal forwarder
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-29-2021
02:54 PM
|
