About santosh121

santosh121 · ‎06-03-2021

Is there any conf settings due to which even though i have bigger data size and search shows 33.5 lakh records only 1GB(somewhere around 20 lakh is getting downloaded) is getting downloaded. csv - 1GB json - 1gb Regards, Santosh

santosh121 · ‎06-03-2021

Hello All, In UI panel the 30 lakh data is displayed .The data count is 30 lakhs rows , We are trying to export data into csv which is done and when we open the csv the count is 10 lakh+ which is csv limitation and when we open the same csv in notepad++ the total data count goes upto 25 lakhs. but all the rows are not downloaded. Can you please let me know how can i download all the data as it is for monthly report. Regards, Santosh

santosh121 · ‎06-01-2021

Dear All, We are trying to build splunk cloud rest api call where we will be sending data from splunk cloud to another server via rest api call. Since it is production data below are few points raised by security team and asked us to get that verified whether splunk supports these security noums or not. 1. All the APIs must be served securely over HTTPS using TLS v1.2 with oauth 2.0 implementation. 2. Any HTTP API requests must be rejected or redirected to HTTPS. 3. The API token must be validated for signing, tampering and expiry before any details are extracted from the token. 4. The API token expiry must be limited to 15 mins only. 5. The IP whitelisting must be performed for all INTERNET facing API endpoints to reject any unauthorized requests. 6. The API credentials must be set to expire and rotated at least annually. 7. The API credentials must be stored encrypted in Key vault and access must be granted to application or user following principle of least privilege. 8. The API credentials must not be hardcoded within the application source code, client-side scripts, or configuration files. 9. The tokens or credentials must not be passed in the URL parameters. 10. The API tokens must be scoped following the principle of least privilege and validated at method level. 11. Enumerable ID values must not be used in API methods. 12. Proper error or exception handling must be performed to return only generic error messages. 13. API rate limiting must be performed. 14. Proper input and content validation must be performed at the APIs including length, datatype etc. 15. In case of file uploads, file type, content type validation and scanning must be performed. 16. Un wanted HTTP methods must be disabled. 17. Log failed attempts, denied access, input validation failures, any failures in security policy checks must be logged. 18. No sensitive data must be captured in the logs. 19. The API logs must be ingested automatically into Genpact SIEM using standard integration mechanism for monitoring. 20. APIs must implement strict authentication, security headers, redirects, CORS etc. 21. All the API endpoints internally or externally exposed must undergo InfoSec design review and security testing before moving to production. can someone provide any details on them. Regards, Santosh

santosh121 · ‎06-01-2021

We want to send data from Splunk Cloud to outside world via rest api process. 1) Create a saved search 2) Contact splunk cloud and Open 8089 outbound port in search heads 3) Contact splunk cloud and whitelist the ip address or DNS name. Will it be enough? Regards, Santosh

santosh121 · ‎05-28-2021

Dear All, I am trying to push some records in patches to splunk i want it to be automated. Usecase: We have 1 lakh + records in index and we want to push those 1 lakh+ records in batches of 500 as we will run some logic on them. How can i collect all these records in loop in splunk. can i collect in "for loop" or only way is via python or node sdk? Regards, Santosh

santosh121 · ‎05-23-2021

Thanks for the reply. I will test from my side today and update you on that. Regards, Santosh

santosh121 · ‎05-22-2021

Can anyone suggest on the above usecase please.

santosh121 · ‎05-22-2021

Dear All, I am trying to store some aggregated values so that my query will perform better way when searching time is of 6-8 months. Use case: _time Environment BG ApplicationName Interface ErrorType 22-05-2021 01:12:33 E B K Z TimeOut 22-05-2021 01:13:33 E B K Z HttpConnectivityErr 22-05-2021 01:14:33 E B K Z TimeOut 22-05-2021 01:15:33 E B K Z HttpConnectivityErr 22-05-2021 01:16:33 E B K Z TimeOut 22-05-2021 01:17:33 E B K Z HttpConnectivityErr 22-05-2021 01:18:33 E B K Z HttpConnectivityErr 22-05-2021 01:19:33 E B K Z HttpConnectivityErr Expected Output: bin span 4m _time _time Environment BG ApplicationName Interface ErrorType(multiValue) 22-05-2021 01:12:33 E B K Z TimeOut_2 HttpConnectivityErr_2 22-05-2021 01:16:33 E B K Z TimeOut_1 HttpConnectivityErr_3 What i want is for a span of 4 min i need unique "ErrorType" column along with its count group by Environment,BG,ApplicationName,Interface. Please help me out with it. Regards, Santosh

santosh121 · ‎05-19-2021

Thanks richgalloway. Yeah i meant that 🙂 I have a data set like We get events every sec multiple entries with the columns Env, BG, APP, Interface,BusinessField1, Valuefield1,techSuccessCount, TechnicalInprogressCnt, TechnicalFailureCnt, BusinessSuccessCount,BusinessInprogressCount,BusinessfailureCount,Valuefield2Count Env, BG, APP, Interface,BusinessField1, Valuefield1 (These columns are string and can be unique row when we do stats with these. alongwith the above fields we have techSuccessCount, TechnicalInprogressCnt, TechnicalFailureCnt, BusinessSuccessCount,BusinessInprogressCount,BusinessfailureCount,Valuefield2Count (These columns are int) Now when we do stats everytime for last 6-8 months it is too much of processing so we are performing bin span 15m _time and storing them uniquely. will it be to store them as metrics?

santosh121 · ‎05-19-2021

I wanted to understand how actually splunk internally stores the events and Matrix data and what is the benefits of Matrix way of storing over events ?

Posts	10
Solutions	1
Karma Given	1
Karma Received	0
Member Since	‎05-19-2021

Online Status	Offline
Date Last Visited	‎06-04-2021 06:29 AM

Splunk export csv only downloads 1GB data but sear...

Export csv from dashboard panel issue

Splunk cloud rest API call related security questi...

Splunk Cloud rest api call

How to collect data to index in batches

How to store Multi Value Field with its sum of num...

How splunk internally stores events and Matrix dat...