About Atchyuth_P

Atchyuth_P · ‎06-14-2024

Hi team, I have two indexers in a clustered environment and one of my colleague created a index in both the indexers (/opt/splunk/etc/apps/search/indexes.conf) not on the cluster master. This is very old index and have more than 50GB of data If I add the same config in master (/opt/splunk/etc/master-apps/_cluster/local/indexes.conf) will it hamper anything. Would I lose any data.

Atchyuth_P · ‎12-04-2023

Hi Team, While running the below search we are not getting license calculation for 2-3 indexes(showing 0) but for other indexes I am able to see the results. index=_internal source="*license_usage.log" sourcetype=splunkd | stats sum(b) as Bytes by idx | eval GB=round(Bytes/1024/1024/1024,3) | rename h as Host, s as Source, st as Sourcetype, idx as Index, GB as "License Used in GB" | table Index, "License Used in GB" I am trying to understand why it is happening for only 2-3 indexes. We have the index data present on both the indexers.

Atchyuth_P · ‎10-23-2023

Hi Team, We have a requirement to forward the archived data to external storage (GCS Bucket). I have verified the splunk document but haven't found any luck on this. Kinldy assist me in forwarding the archived data to GCS Bucket.

Atchyuth_P · ‎06-05-2023

Hi Team, I would like to monitor the below files with extension (.json.gz) in splunk. In DS APP inputs i have given the stanza like this When checked in splunk it is showing only 1 day. These are the files that i want to monitor Kindly let me know how to monitor the files.

Atchyuth_P · ‎05-22-2023

Hi Team, Kindly check with below logs [19-May-2023 06:15:55.341][INFO] abc@abc.com@ABC-CB-NOC, 1.1.1.1:61, create, user:Test, appliances: ALR-prod1 , changeset:devices { device{ALR-prod1} { config { orgs { org-services{ATCHYUTH-NOC} { user-identification { local-database { users { + user{Test} { + email-address test@abc.com + passwd + status CREATED} } } } } } } } } [28-Jun-2022 08:35:48.010][INFO] abc@abc.com@ABC-CB-NOC, 1.1.1.1:61, create, authentication-method:Dummy-Auth, template:Access-Template , changeset:devices { template{Access-Template} { config { orgs { org-services{Atchyuth-NOC} { user-identification { authentication-methods { + authentication-method{Dummy-Auth} { + method { + local }} } } } } } } } [28-Sep-2020 12:13:07.137][INFO] abc@abc.com@ABC-CB-NOC, CLI 'set devices template ABC config orgs org-services ATCHYUTH-NOC security captive-portal url abc.net' [28-Jun-2022 08:35:48.010][INFO] abc@abc.com@ABC-CB-NOC, 1.1.1.1:53, create, authentication-method:Dummy-Auth, template:Access-Template, changeset:devices { template{Access-Template} { config { orgs { org-services{Atchyuth} { user-identification { authentication-methods { + authentication-method{Dummy-Auth} { + method { + local }} } } } } } } } [28-Sep-2020 12:13:07.137][INFO] abc@abc.com@ABC-CB-NOC, CLI 'set devices template ABC config orgs org-services ATCHYUTH security portal url abc.net' Based on above logs we have one common field org-services. Depending on org-services need to create new field and extract the values to the field. Kindly help me in props.conf and transforms.conf and also let me know the regex pattern that will create a new field based on org-services.

Atchyuth_P · ‎05-03-2023

<form version="1.1" theme="dark"> <label>Windows Testing</label> <fieldset submitButton="false"> <input type="time" token="time" searchWhenChanged="true"> <label>Select Time Ranage</label> <default> <earliest>0</earliest> <latest></latest> </default> </input> </fieldset> <row> <panel> <title></title> <html> <div> <h2>Successful Authentications</h2> </div> <style> h2 { text-align: center; background-color:gray ; border: 1px solid black; border-radius: 25px; } .dashboard-panel { background-color: #177843; border-radius: 25px; border: 2px solid #73AD21; } .dashboard-panel:hover { transform: scale(0.95); } </style> </html> <single> <search> <query>| tstats count from datamodel=Authentication.Authentication where Authentication.EventCode=4624</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option> <option name="refresh.display">progressbar</option> </single> </panel> <panel> <title></title> <html> <div> <h2>Failed Authentications</h2> </div> </html> <single> <search> <query>| tstats count from datamodel=Authentication.Authentication where Authentication.EventCode=4625</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </single> </panel> <panel> <html> <div> <h2>User Account Created</h2> </div> </html> <single> <search> <query>| tstats count from datamodel=Authentication.Authentication where Authentication.EventCode=4720</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </single> </panel> <panel> <html> <div> <h2>Account Lockout</h2> </div> </html> <single> <search> <query>| tstats count as "Accounts Created" from datamodel=Authentication.Authentication where Authentication.EventCode=4740</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </single> </panel> </row> </form> Kindly check with source code

Atchyuth_P · ‎05-03-2023

Hi Team, I would like to achieve the below dashboard which is having outer grid and inside we have multiple panels. Please check with the XML code Kindly help in achieving this.

Atchyuth_P · ‎04-11-2023

Hi @woodcock Agree. We have data sources(database server) which needs to be parsed for that reason need HF I am planning to introduce a intermediate forwarder in between. Just want to know will it cause an impact. Pls have a look into my first question.

Atchyuth_P · ‎04-11-2023

Hi Team, In my environment we made the Deployment Server as License Master as well. Current Architecture 1 - Search Head 1 - Indexer 1 - Deployment Server 2 - Universal Forwarders I am planning to implement Master as well for the current architecture. Will my architecture requires Heavy Forwarder? Addition to the above, If I am implementing HF is there an impact and also like to understand how the deployment pipeline works

Atchyuth_P · ‎02-13-2023

Hi Team, I am using field aliases as in my sourcetype i have two common fields (dest & dest_ip) which have same values. When i applied field aliases both were reflecting. How to avoid duplicate fields Kindly help in this scenario

Atchyuth_P · ‎12-22-2022

Hi team, Can you please me on this error?

Atchyuth_P · ‎12-19-2022

Hi Team, I have the env setup like 2 Indexers, 1 Search Head,1 Heavy Forwarder,1 Deployment Server, 1 Cluster Master My DS is connected to HF and from here the data will be pushed to Indexers I would like use bots_v3_dataset for my env https://github.com/splunk/botsv3 Kindly help me how to push the data in distributed deployment.

Atchyuth_P · ‎12-15-2022

Hi @gcusello Thanks for the info i miss the catch i have done the configuration in SH as well. Almost, forgot IDX will not acts as SH. Sorry for the trouble.

Atchyuth_P · ‎12-15-2022

Hi @gcusello I am trying to check the search in both the indexers because the events is showing zero I tried both telnet and ping HF---> IDX2,IDX2 ---> HF all the connection established

Atchyuth_P · ‎12-15-2022

Hi @gcusello I can see for HF to Indexer 2 the connection is in TIME_WAIT and for indexer 1 it is established Yes there is a local copy but when i tried to check previously it worked the events got shown in indexer 2 but not in indexer 1 Now the data is not showing in two indexers

Atchyuth_P · ‎12-15-2022

Hi @gcusello Ok, i found the mistake that i have done but from HF the data is not pushing to indexers. I am sharing the screenshots for reference Heavy Forwarder : inputs.conf outputs.conf Indexer 1 inputs.conf Indexer 2 When i check with connectivity all were connected The index is showing "0" Events In HF i can see the data Please suggest

Atchyuth_P · ‎12-14-2022

Hi Team, Environment 1 - Search Head, 2-Indexers, 1 - Deployment Server, 1 - Heavy Forwarder, 1 -Cluster Master Problem Statement 1)I am unable to retrieve events when searching with index=* 2) When checked with connectives all were connected (SH --> Indexers --> CM --> HF --> DS) When checked with internal index showing 401 client is not authenticated. When checked from backend there is no error showing in splunkd.log

Atchyuth_P · ‎12-12-2022

Hello - I have a requirement where there are 10 user and want to highlight if user is active or inactive. Based on the requirement I have gone with checkbox since there can be multiple users active at same time. Condition - If the user is active then checkbox should be checked. If the user is inactive then checkbox should be unchecked We are validating via SPL query if user is active or inactive. Help me with JS Code where we can pass data into checkbox and toggle the checkbox value. i.e. 1 or 0 1 means active 0 means inactive

Atchyuth_P · ‎11-22-2022

Hi @tsawant Please try to check the lookup definition permission whether it is in private or app. Hoping this will resolve the issue

Atchyuth_P · ‎11-16-2022

Hi @gcusello Thank you for the response I just want to disable the delete option for user itself.

Atchyuth_P · ‎11-16-2022

Hi team I have created a user and set up capabilities however I haven't checked any delete in capabilities. When I checked with user console able to see the delete option. Please refer to below screenshot. Even I tried unchecking can_delete option for alert with admin access but still it is not working. Please suggest .

Atchyuth_P · ‎10-04-2022

Hi, | tstats earliest(_time) as Earliest latest(_time) as Latest where index=_internal by _time, index, sourcetype, host span=1d | eval Earliest=strftime(Earliest,"%Y-%m-%dT%H:%M:%S.%Q") | eval Latest=strftime(Latest,"%Y-%m-%dT%H:%M:%S.%Q") | appendcols [tstats count where index=_internal by _time] I would like to generate the dashboard for host,sourcetype, latest event received,Total Eventcount and sparkline for count of 1month As per the above query i am getting result like this Is there any other alternative for this please suggest?

Atchyuth_P · ‎08-04-2022

Hi @chaker Thank you so much. I have learned a lot about Splunk while watching your videos and those helped me to shift my career transition. Please check the below screenshot for reference. I have applied the MAX_DAYS_AGO setting in Splunk it identified the Y-m-d but was unable to find out the exact hours, minutes, seconds I have tried with the TZ setting but was unable to solve it. Please help

Atchyuth_P · ‎08-04-2022

Hi @gcusello Please check the below screenshot for reference. I have applied the MAX_DAYS_AGO setting in Splunk it identified the Y-m-d but was unable to find out the exact hours, minutes, seconds I have tried with the TZ setting but was unable to solve it. Please help

Atchyuth_P · ‎08-03-2022

hi, Please check with below screenshot The indexed time and event log time both are different. Kindly let me know the solution to fix this error.

Posts	34
Solutions	0
Karma Given	13
Karma Received	2
Member Since	‎08-15-2021

Online Status	Offline
Date Last Visited	‎06-19-2024 11:57 AM

Adding existing index to cluster master

License Utlilization is not Showing for all Indexe...

Splunk Archived data to GCS Bucket

How to monitor the below files with extension (.js...

How to extract values depending on field, props.co...

How to make Splunk Dashboard for creating panels i...

Deployment Server License Calculation: Will my arc...

How to avoid duplicate fields in CIM Data Normaliz...

Can you help me on this Splunk SH and Shared stora...

How to push Bots V3 Dataset in distributed deploym...

Adding existing index to cluster master

License Utlilization is not Showing for all Indexe...

Splunk Archived data to GCS Bucket

How to monitor the below files with extension (.js...

How to extract values depending on field, props.co...

Re: Splunk Dashboard for creating panels inside gr...

How to make Splunk Dashboard for creating panels i...

Re: Deployment Server License Calculation

Deployment Server License Calculation: Will my arc...

How to avoid duplicate fields in CIM Data Normaliz...

Can you help me on this Splunk SH and Shared stora...

How to push Bots V3 Dataset in distributed deploym...

Re: Splunk Troubleshhoting

Re: Splunk Troubleshhoting

Re: Splunk Troubleshhoting

Re: Splunk Troubleshhoting

Why am I unable to retrieve events when searching ...

How to change color of checkbox on the basis of us...

Re: Migrate from CSV to KV store

Re: How can I Delete Option for Alerts?

How can I delete option for alerts?

Dashboard for host,sourcetype, latest event receiv...

Re: Event Log time and Indexed time is different

Re: Event Log time and Indexed time is different

Why is Event Log time and Indexed time different?