About tshah-splunk

tshah-splunk · ‎03-23-2022

Hey @Shlifka, Can you let me know which tags were used while vetting the app? Also, I can see that there are 17 manual checks present in the vetting summary. Any private app will be self-service installable only if there are no Errors, Failures, or Manual Checks. Try fixing the manual checks and re-vet the app. It'll get installed successfully via self-service.

tshah-splunk · ‎03-22-2022

Hey @AidanMarkSmith, If the instances are on Windows OS, you can try installing and configuring https://splunkbase.splunk.com/app/3177/ add-on in your environment. It is pretty much helpful for auditing purposes. A guide on setting this app can be found here - https://splunkbase.splunk.com/app/3177/#/details

tshah-splunk · ‎03-22-2022

Hey @manikanta461, Try using spath in the search query and in the output parameter, you can set the fieldname that you want. Related docs for spath command can be found here - https://docs.splunk.com/Documentation/Splunk/8.2.5/SearchReference/Spath https://blog.avotrix.com/spath-command-in-splunk/

tshah-splunk · ‎03-20-2022

Hey @aamirulh, I also faced a similar issue earlier while monitoring the windows event logs. If the data you are trying to read is windows event logs, try assigning winevt-preprocess sourcetype to the data in the monitor stanza and have the file ingested. Please find the reference stanza below: [monitor://C:\Program Files\SplunkUniversalForwarder\tmp\file.evtx] index=<<index_name>> disabled=0 renderXml=false sourcetype=preprocess-winevt PS. This will not work with the Add Data GUI operation.

tshah-splunk · ‎03-17-2022

Hey @novaty, I would suggest you look for this in ideas.splunk.com. This seems to be an enhancement request in the product itself. Once the required number of upvotes are there for a specific idea, it'll be considered to be added to the product.

tshah-splunk · ‎03-11-2022

Hey @human96, Can you provide more context on the requirement please?

tshah-splunk · ‎03-07-2022

Hey @svendby90, There is an alternate way as well to take a backup of the kvstore other than the backup command. Steps are as below: Stop splunk $SPLUNK_HOME/bin/splunk stop Create tar of the kvstore directory tar -cvzf <destination_path>/backup.tgz $SPLUNK_HOME/var/lib/splunk/kvstore Start splunk again $SPLUNK_HOME/bin/splunk start

tshah-splunk · ‎03-07-2022

Hey @raysonjoberts, Can you try replacing the eval function with the below line in the query please? | stats sum(hours) as hours by stage resource This will do a total of hours and group it w.r.t resource and the stage.

tshah-splunk · ‎03-06-2022

Hey @Splunk_noobie, You can add the below code to the source of your dashboard and have a refresh button in the dashboard to reset all the tokens set. <fieldset submitButton="false" autoRun="false"> <html> <style> div.fieldset.dashboard-form-globalfieldset div.dashboard-element.html.dashboard-element-html { display: inline-block; } </style> <a href="<<dashboard_id>>" class="btn btn-primary">Refresh</a> </html> </fieldset> PS. Don't forget to change the dashboard_id. Reference can be found here - https://splunkonbigdata.com/how-to-add-a-refresh-button-in-splunk-dashboard/

tshah-splunk · ‎03-02-2022

Hey @splunktrain9, You can create a chart with functions like values() and group it by age field. These can be achieved since using rex also, the fields will be created and can be used in charts. Your query should look something like below: <your query> | chart values(height) as height by age

tshah-splunk · ‎03-02-2022

Hey @AK89, Can you try running the below query? I believe it should help you achieve your use case. You can use multiple latest functions and group by the target. sourcetype=xyz (Disk_Group = "Data*") | stats latest(Usable_Free_GB) as latestusable latest(Usable_Total_GB) as latesttotal by Target_Name Disk_Group | stats sum(latestusable) as UsableFree sum(latesttotal) as UsableTotal by Target_Name | eval percent_free = round(((UsableFree/UsableTotal)*100),2) | table Target_Name UsableFree UsableTotal precent_free

tshah-splunk · ‎03-02-2022

Hey @jip31, Along with the dc function, you can also use the min() and max() functions to fetch the minimum and maximum value of the field respectively. Your query should look something like below index=tutu sourcetype=titi | timechart span=15min dc(s) as "Uniq" min(s) as s_min max(s) as s_max

tshah-splunk · ‎03-02-2022

Hey @random_event, Yes, it is possible that the app installed via Self Service doesn't get installed on the indexers. You can run the following search to get list of apps that are installed on Indexers | rest services/apps/local | sort title | stats values(splunk_server) as splunk_server by title | rename title as app

tshah-splunk · ‎02-28-2022

Hey @Hemnaath, The INFO log you are seeing doesn't seem to be a warning. Can you run the below command on the forwarder and check if the file has been monitored or not. $SPLUNK_HOME/bin/splunk list inputstatus That can be considered as the first step to troubleshoot monitor inputs.

tshah-splunk · ‎02-27-2022

Hey @elaborateGecko, Can you try installing and configuring the Content Packs for ITSI/ITEW (https://splunkbase.splunk.com/app/5391)? They have multiple content packs which can be helpful for the information you are looking for. Here is the documentation link for an overview of the Content Packs - https://docs.splunk.com/Documentation/ContentPackApp/1.4.0/Overview/Overview For Windows data, you can configure the "Content Pack for Windows Dashboards and Reports". Installation and configuration guide for the same can be found here - https://docs.splunk.com/Documentation/CPWindowsDash/1.0.0/CP/Install

tshah-splunk · ‎02-24-2022

Hey @tokio13, Can you run the btool command to check what value is configured for the maxBundleSize parameter on one of your SHC members? $SPLUNK_HOME/bin/splunk btool distsearch list --debug | grep maxBundleSize If this returns you value less than 2000, consider having the value of the parameter updated to a higher value. than the limit.

tshah-splunk · ‎02-24-2022

Hey @ajromero, You can append | search user != 0* to the query and exclude users starting with 0. You search query should look something like below: | from inputlookup:access_tracker | stats min(firstTime) as firstTime,max(lastTime) as lastTime by user | where ((now()-'lastTime')/86400)>90 | search user != 0*

tshah-splunk · ‎02-24-2022

Hey @iMarko, You can try using the mvexpand function as below and then filter from the fileExtension field. I believe the third column is a file name and the extension is being extracted in another field for which you have written the where condition. Please find the reference query below | mvexpand fileName | where FileEntension=".doc"

tshah-splunk · ‎02-24-2022

Hey @MeMilo09, You can use different options for formatting the chart. The reference for chart options can be found here - https://docs.splunk.com/Documentation/Splunk/8.2.4/Viz/ChartConfigurationReference This will help you enable colors in the heat map using chart as well.

tshah-splunk · ‎02-23-2022

Hey @uagraw01, Can you confirm if you have enabled boot-start to run splunk? If not, please consider setting it up using the below command. Ref doc - https://docs.splunk.com/Documentation/Splunk/8.2.5/Admin/ConfigureSplunktostartatboottime sudo $SPLUNK_HOME/bin/splunk enable boot-start -user splunk You can also configure your Splunk to run as systemd. Reference doc can be found here - https://docs.splunk.com/Documentation/Splunk/8.2.5/Admin/RunSplunkassystemdservice

tshah-splunk · ‎02-23-2022

Hi @Jackiifilwhh, Can you try using the field directly in the sort function instead of converting it to string? Although, you will need to convert time to string using time converter functions. Below is the sample query you can try out. | eval Time=strftime(time, "%Y-%m-%d %H:%M:%S.%Q") | table no Time | sort no - Time

tshah-splunk · ‎02-23-2022

Additionally, if you have access to the shell, you can find the viewname in below path: For views/dashboards that ships directly with the app: $SPLUNK_HOME/etc/apps/<app_name>/default/data/ui/views/<viewname>.xml For views/dashboards that were created from an app: $SPLUNK_HOME/etc/apps/<app_name>/local/data/ui/views/<viewname>.xml

tshah-splunk · ‎02-23-2022

Hey @BigShak, You can use the XML editor of the dashboard and use the below options in the panel <format type="color" field="status"> <colorPalette type="map"> {"Warning":#F7BC38,"OK":#65A637,"Critical":#D93F3C </colorPalette> </format> PS: status in the format tag represents the field name on which I want to apply color and in the mapping via colorPalette, there should be values mapped to specific colors which in your case would be HIGH, MEDIUM, and LOW.

tshah-splunk · ‎02-22-2022

Hey @So76, You can open the Job inspector and see what exactly is the error and why is the scheduled search results not loading. Open the search.log from the Job Inspector page and search for the "ERROR" keyword. You will be able to identify the reason for not displaying the results.

tshah-splunk · ‎02-22-2022

Hey @phil_wong, It seems that previously there was a method to create a backup from the ITSI app itself to include the Unix content packs which I believe is outdated now. Also, ITSI v4.8.x is a quite outdated version. Please have the app upgraded to the latest version and it will also bring new features and installation/configuration of content packs will be easier.

Posts	86
Solutions	11
Karma Given	41
Karma Received	46
Member Since	‎24-11-2020

Online Status	Offline
Date Last Visited	‎05-02-2024 08:24 AM

Re: Add-on builder: Cloud vetting failed but no er...

Re: How to create dashboard that will closely moni...

Re: How to remove {} in Json extracted fields duri...

Re: Read a file

Re: Can we get full Box information via Splunk Add...

Re: dashboard

Re: Backup KV Store (alternative to splunk backup ...

Re: Creating multiple SUMs within a field based on...

Re: Add Refresh button to dashboard

Re: How can I make a simple x over y chart

Re: Help with temp tables / variables

Re: help to display min and max in a timechart

Re: Splunk Cloud - How to generate list of deploye...

Re: How to fix INFO TailingProcessor - Parsing co...

Re: Visualizing Performance Metrics using IT essen...

Re: How to remove/disable files from knowledge bun...

Re: How to exclude user name that start with the n...

Re: How can I ignore additional data from a field

Re: Table Formats Coloring

Re: Why doe Splunk instances goes down and I am ge...

Re: Does sort like "order by" in sql for list of f...

Re: Where could I edit the apps bar on splunk?

Re: Number display viz threshold color based on va...

Re: Alert not loading

Re: From where I can find Content Pack for Monitor...

Join the Conversation