About Atchyuth_P

isoutamo · ‎12-04-2023

Hi ate you sure that you have events on that time on those indexes? Another option is that saved search which are collecting those events haven’t run. See more https://docs.splunk.com/Documentation/Splunk/9.1.2/Admin/LicenseUsageReportViewexamples r. Ismo

Atchyuth_P · ‎10-23-2023

Hi Team, We have a requirement to forward the archived data to external storage (GCS Bucket). I have verified the splunk document but haven't found any luck on this. Kinldy assist me in forwarding the archived data to GCS Bucket.

VatsalJagani · ‎06-05-2023

@Atchyuth_P - Please check the source value instead to see what you see. Also, as suggested by @PickleRick kindly try to put text or code block instead of screenshot, so its much easier for community member to help you. I hope this helps!!

PickleRick · ‎05-28-2023

One possible solution is of course the one shown by @isoutamo but there is more to it than meets the eye. There are two different kinds of events here so it would probably be best to define two separate definitions for field extractions. Or even two separate sourcetypes. As a side note - that application log seems to be overly complicated - I'd try to work with the app team to make them log in a less nested and easier parseable format.

Atchyuth_P · ‎05-03-2023

<form version="1.1" theme="dark"> <label>Windows Testing</label> <fieldset submitButton="false"> <input type="time" token="time" searchWhenChanged="true"> <label>Select Time Ranage</label> <default> <earliest>0</earliest> <latest></latest> </default> </input> </fieldset> <row> <panel> <title></title> <html> <div> <h2>Successful Authentications</h2> </div> <style> h2 { text-align: center; background-color:gray ; border: 1px solid black; border-radius: 25px; } .dashboard-panel { background-color: #177843; border-radius: 25px; border: 2px solid #73AD21; } .dashboard-panel:hover { transform: scale(0.95); } </style> </html> <single> <search> <query>| tstats count from datamodel=Authentication.Authentication where Authentication.EventCode=4624</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option> <option name="refresh.display">progressbar</option> </single> </panel> <panel> <title></title> <html> <div> <h2>Failed Authentications</h2> </div> </html> <single> <search> <query>| tstats count from datamodel=Authentication.Authentication where Authentication.EventCode=4625</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </single> </panel> <panel> <html> <div> <h2>User Account Created</h2> </div> </html> <single> <search> <query>| tstats count from datamodel=Authentication.Authentication where Authentication.EventCode=4720</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </single> </panel> <panel> <html> <div> <h2>Account Lockout</h2> </div> </html> <single> <search> <query>| tstats count as "Accounts Created" from datamodel=Authentication.Authentication where Authentication.EventCode=4740</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </single> </panel> </row> </form> Kindly check with source code

gcusello · ‎04-11-2023

Hi @Atchyuth_P, as @woodcock said, in general there's no requirement to use an HF in your architecture. Usually HFs are used as concentrators when you want to reduce the open routes between a segregated network and an external Splunk or when you have to pull logs from Cloud Service Providers. About the License Master, I usually don't install it on the Deployment Server because, if it has to manage more than 50 clients, it must be on a dedicated Server. I usually put the License Master on the Master Node or on the Monitoring Console, in your case I'd put it on the Indexer. Ciao. Giuseppe

richgalloway · ‎02-14-2023

Having two aliases for the same field will result in 3 fields (the original plus 2 aliases) with the same data. That may be necessary for some use cases, which means you have to live with it. Fortunately, aliases are search-time operations so no storage is consumed. If you don't have a need for multiple aliases for the same data then remove one of them.

chinmoya · ‎12-22-2022

Check This https://community.splunk.com/t5/Splunk-Search/search-peers-sick/m-p/445481#M170589

Atchyuth_P · ‎12-19-2022

Hi Team, I have the env setup like 2 Indexers, 1 Search Head,1 Heavy Forwarder,1 Deployment Server, 1 Cluster Master My DS is connected to HF and from here the data will be pushed to Indexers I would like use bots_v3_dataset for my env https://github.com/splunk/botsv3 Kindly help me how to push the data in distributed deployment.

gcusello · ‎12-16-2022

Hi @Atchyuth_P, good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉

bowesmana · ‎12-12-2022

Do you mean show a column in a table with a checkbox type display that is just information and cannot be checked? You can always do this type of logic without using an JS | fieldformat Active=if(Active=1,"✅","❌") where you are pasting the Unicode tick/cross characters into the UI Those characters come from https://unicode-table.com/en/sets/check/

Atchyuth_P · ‎11-22-2022

Hi @tsawant Please try to check the lookup definition permission whether it is in private or app. Hoping this will resolve the issue

emallinger · ‎11-17-2022

Hello all ! I agree with @gcusello. Depending on the behaviour you wish to create, maybe you'll have to create the alerts and only send the results (via mail ?) to users. Or share only the result in a particular app, developped for that purpose on which users only have read access. In that case, you are doing the job of creating and managing alerts, so it might not be the desired effect. Happy splunking ! Ema

johnhuang · ‎10-04-2022

Try something like this: | tstats earliest(_time) AS earliest_epoch latest(_time) AS latest_epoch count AS event_count WHERE (index=_internal earliest=-1mon) BY index, sourcetype, host, _time span=1d | eval earliest_time=strftime(earliest_epoch,"%Y-%m-%dT%H:%M:%S.%Q") | eval latest_time=strftime(latest_epoch,"%Y-%m-%dT%H:%M:%S.%Q") | stats min(earliest_time) AS earliest_time max(latest_time) AS latest_time sum(event_count) AS total_events sparkline(sum(event_count)) AS event_count_sparkline BY index sourcetype host

wapese3400 · ‎08-05-2022

Atchyuth_P · ‎05-11-2022

Hi @jaracan Please execute the commands in the terminal ## Fix minimum free diskspace issue - only for lab environment not for production echo "[diskUsage]" >> /opt/splunk/etc/system/local/server.conf echo "minFreeSpace = 50" >> /opt/splunk/etc/system/local/server.conf After this restart the splunk service

richgalloway · ‎03-11-2022

What did you download if not the .msi file? You can get the MSI file from splunk.com. Just click on Free Splunk then click the "Download Free 60-day Trial" link under "Splunk Enterprise". Then you'll see the download button for the installer. If you see a .zip file available for download DO NOT use it.

gcusello · ‎12-21-2021

Hi @Atchyuth_P, your question is vague but anyway: About Deployment Server troubleshhoting: at this url you can find throubleshooting https://wiki.splunk.com/Deploy:Troubleshooting Anyway, you can know if there's a problem on the Monitoring Console and in the Forwarders Management page. CLI Commands for the deployment Server https://docs.splunk.com/Documentation/Splunk/8.2.3/Updating/Aboutdeploymentserver Something similar for Master Node: you can use the Monitor Console and the Master Node Cluster Management: you can find infos at https://docs.splunk.com/Documentation/Splunk/8.2.3/Indexer/Bucketreplicationissues About troubleshhting concept, in each section you can find them, in addition there's a dedicated section at https://docs.splunk.com/Documentation/Splunk/8.2.3/Overview/Troubleshooting , in addition there's a corse for this https://www.splunk.com/en_us/training/courses/troubleshooting-splunk-enterprise.html Ciao. Giuseppe

Roy_9 · ‎11-04-2021

It would be helpful if you provide the source of the logs that you would like to ingest into Splunk? your options varies based on the source.

Atchyuth_P · ‎09-26-2021

Thank you @ITWhisperer for suggesting the method of using XML . I have tried with the command (chart count by "Online Booking") gives me the accurate search result and also tried with XML and my dashboard looks quite good.

Posts	33
Solutions	0
Karma Given	13
Karma Received	2
Member Since	‎08-15-2021

Online Status	Offline
Date Last Visited	‎02-08-2024 04:31 AM

License Utlilization is not Showing for all Indexe...

Splunk Archived data to GCS Bucket

How to monitor the below files with extension (.js...

How to extract values depending on field, props.co...

How to make Splunk Dashboard for creating panels i...

Deployment Server License Calculation: Will my arc...

How to avoid duplicate fields in CIM Data Normaliz...

Can you help me on this Splunk SH and Shared stora...

How to push Bots V3 Dataset in distributed deploym...

Why am I unable to retrieve events when searching ...

Re: License Utlilization is not Showing for all In...

Splunk Archived data to GCS Bucket

Re: How to monitor the below files with extension ...

Re: How to extract values depending on field, prop...

Re: Splunk Dashboard for creating panels inside gr...

Re: Deployment Server License Calculation

Re: How to avoid duplicate fields in CIM Data Norm...

Re: Can you help me on this Splunk SH and Shared s...

How to push Bots V3 Dataset in distributed deploym...

Re: Splunk Troubleshhoting

Re: Change color of checkbox on the basis of user ...

Re: Migrate from CSV to KV store

Re: How can I Delete Option for Alerts?

Re: Dashboard for host,sourcetype, latest event re...

Re: Why is Event Log time and Indexed time differe...

Re: How to resolve this error: The minimum free di...

Re: Installation

Re: Splunk

Re: Integration

Re: Getting field and value count in the same form...