Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About Sangu
Sangu
Explorer
Member since:
03-25-2021
08-13-2021
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 0 |
| Member Since | 03-25-2021 |
Activity Feed
- Karma Re: How to make inputlookup return function check all records (rows) in a CSV? for niketn. 08-13-2021 04:36 AM
- Karma Re: Is it better to have higher CPU for a search head or Indexer? for gcusello. 07-13-2021 10:18 AM
- Posted Dynamic lookup table on Getting Data In. 06-16-2021 04:58 AM
- Tagged Dynamic lookup table on Getting Data In. 06-16-2021 04:58 AM
- Posted Re: Alert when host not sending data to splunk on Alerting. 05-28-2021 10:26 AM
- Karma Re: Alert when host not sending data to splunk for richgalloway. 05-28-2021 10:26 AM
- Posted Re: Alert when host not sending data to splunk on Alerting. 05-28-2021 09:55 AM
- Posted Alert when host not sending data to splunk on Alerting. 05-28-2021 07:51 AM
- Posted I need to display field value in dashboard from realtime log on Splunk Search. 05-27-2021 10:43 AM
- Posted Re: Rex need to extract field till first occurrence of /r on Splunk Search. 05-20-2021 04:56 AM
- Karma Re: Rex need to extract field till first occurrence of /r for ITWhisperer. 05-20-2021 04:56 AM
- Posted Rex need to extract field till first occurrence of /r on Splunk Search. 05-20-2021 04:21 AM
- Tagged Rex need to extract field till first occurrence of /r on Splunk Search. 05-20-2021 04:21 AM
- Posted Top 10 values of a field based top 2 values of another field on Splunk Search. 03-29-2021 08:44 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-16-2021
04:58 AM
Hi, I have request to create dashboard with user information, but that user information is provided by AD team, So I need to create a lookup table to access that information. Issue is that the user information may change everyday and AD team will give new excel sheet with updated info, so how can I update the lookup table automatically, Otherwise I need to upload the csv file everyday to splunk which is not best option. Please give some ideas, Can we replace that file from splunk server lookup directory? does that work or any other way to do this. Thanks in Advance!
... View more
- Tags:
- lookup
Labels
- Labels:
-
CSV
05-28-2021
09:55 AM
Hi, | metasearch index=abc sourcetype=abc | eval host=lower(host) | stats count BY host | append [ inputlookup Devices.csv | eval host=lower(Hostname+".amat.com"), count=0 | fields host count ] | stats sum(count) AS total BY host | where total=0 This is the query I used, lookup table has all the servers which needs to send data. Another details I wanted to add is, not all servers are there in cluster, expect 3 cluster other 10 servers are there which are not part of any cluster.
... View more
05-28-2021
07:51 AM
Hi, I need to write a query which alerts if any of my host is not sending any logs to splunk in 10mins. I'm able to get this result. Challenge here is, I have 2 cluster servers group, if anyone one of the server is sending data then I should exclude the other server from the alert list, not able to write this logic in search. Example: Cluster one : Server 1, server 2 and server3 If Server 1 sends data in 10 mins, then I should remove Server 2 and server 3 from the final list. right now it will only remove server 1 from the list and other 2 servers come in final list. Like this I have 3 clusters, 2 servers in each cluster. Please give some ideas on this Thanks in Advance!
... View more
Labels
- Labels:
-
alert condition
05-27-2021
10:43 AM
Hi, I have logs coming from 5 servers, consider each sends status data everytime there is change in status, So I want to create a dashboard where it shows the servername and status as single value panel. challenge here is, whenever new log comes from server, that status should be updated in dashboard panel, like real time, So old value will be replaces with new status value. Example: ABC Server Status:Down When new log comes server down status, ABC server Status:Up Like this I need to update some fields based on recent log values. Thanks in Advance!
... View more
Labels
- Labels:
-
fields
05-20-2021
04:56 AM
Thanks for the help, It worked 🙂
... View more
05-20-2021
04:21 AM
Hi I need to extract hostname or IP address from raw log. My log looks like below: somerandometest host: abc@email.com \r\n someothertext I wrote rex as "Host:.(?<Host>.*?)(\\r)" this works great in regex site, but when I put it in splunk search it does not work. Please let me know if anything need to be updated. I'm extracting text between host to till \r. here extracted field can be hostname or IP address hence taking till "\r" Thanks in advance!
... View more
- Tags:
- extract field
Labels
- Labels:
-
rex
03-29-2021
08:44 AM
I want to get top 10 destination IP's for each top 2 source IP's . Where count of is more that 1000 for Source IP Right now I'm using sub search for getting top 2 source IP's then I'm filtering the top 10 Source IP in base search. But I want to do it without using sub search. Someone please help to get this done. I'm looking for command something like : top limit=10 destIP by top limit=2 sourceIP where count > 1000
... View more
Labels
- Labels:
-
subsearch
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-13-2021
07:57 AM
|
