Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mitali
mitali
Explorer
Member since:
12-15-2021
07-27-2022
Community Statistics
| Posts | 19 |
| Solutions | 0 |
| Karma Given | 6 |
| Karma Received | 0 |
| Member Since | 12-15-2021 |
Activity Feed
- Posted Re: How to override source from raw data while indexing in splunk? on Getting Data In. 07-26-2022 12:59 PM
- Posted Re: How to override source from raw data while indexing in splunk? on Getting Data In. 07-26-2022 12:00 PM
- Posted How to override source from raw data while indexing in splunk? on Getting Data In. 07-26-2022 08:50 AM
- Karma Re: index=_interospection for gcusello. 02-03-2022 06:36 AM
- Posted Re: how to solve this error in Splunk-TA-nix on Splunk ITSI. 02-03-2022 06:35 AM
- Karma Re: how to solve this error in Splunk-TA-nix for tshah-splunk. 02-03-2022 06:32 AM
- Posted how to solve this error in Splunk-TA-nix on Splunk ITSI. 01-27-2022 10:13 AM
- Posted Re: index=_interospection on Deployment Architecture. 01-25-2022 08:10 AM
- Posted Re: index=_interospection on Deployment Architecture. 01-21-2022 09:20 AM
- Posted Re: index=_interospection on Deployment Architecture. 01-21-2022 08:59 AM
- Posted Re: index=_interospection on Deployment Architecture. 01-21-2022 08:30 AM
- Posted Re: index=_interospection on Deployment Architecture. 01-21-2022 08:08 AM
- Posted Re: index=_interospection on Deployment Architecture. 01-21-2022 08:00 AM
- Tagged Re: index=_interospection on Deployment Architecture. 01-21-2022 08:00 AM
- Posted index=_interospection on Deployment Architecture. 01-21-2022 07:48 AM
- Karma Re: web interface is not available in splunk for SinghK. 01-13-2022 11:24 AM
- Posted Re: web interface is not available in splunk on Installation. 01-13-2022 11:11 AM
- Karma Re: web interface is not available in splunk for SinghK. 01-13-2022 11:11 AM
- Posted Re: web interface is not available in splunk on Installation. 01-13-2022 10:10 AM
- Tagged Re: web interface is not available in splunk on Installation. 01-13-2022 10:10 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-26-2022
12:59 PM
We have lot of logs coming from different sources which are going to a specific directory which is than getting monitored by splunk. These log source changes everyday (everyday a new log file is created).Out of these log some of them contain AWS logs so I need to change the source for those particular logs which has AWS logs in it. The only way to differentiate AWS logs from other logs is that AWS contains field which has "AWS" and that was my trying to do using props and transforms.
... View more
07-26-2022
12:00 PM
1).we are using random sourcetype and not a specific sourcetype does it matter? 2) We have to forward data from UF and props.conf and transforms.conf are on indexer.
... View more
07-26-2022
08:50 AM
For example below is my raw data in sample.log file.
This is a |AWS| test log testing.
The source of this file is opt/sample.log but I want to change my source from source= /opt/sample.log to source=AWS which will be extracted from raw data while indexing in splunk.
props.conf
[log] TRANSFORMS-sourcechange=replacedefaultsource
Transforms.conf
[replacedefaultsource] WRITE_META = true SOURCE_KEY = _raw REGEX = \|(.*)\| DEST_KEY = MetaData:Source FORMAT= source::$1
Thank you in advance please help me.
... View more
Labels
- Labels:
-
props.conf
-
transforms.conf
02-03-2022
06:35 AM
From splunk_TA_Nix app few sourcetpye are missing like -sourcetype protocol is not excute in bin command sh protocol.sh no data is showing .can you please let me what is the reason of missing sourcetype.
... View more
01-27-2022
10:13 AM
message from "/opt/splunk/etc/apps/Splunk_TA_nix/bin/vmstat.sh" dmesg: read kernel buffer failed: Operation not permitted
... View more
Labels
- Labels:
-
configuration
01-25-2022
08:10 AM
Problem sloved solution was to create outputs.conf on Search head
... View more
01-21-2022
09:20 AM
Error [00000080] Instance name "BCCS-P25ES." REST interface to peer is taking longer than 5 seconds to respond on https. Peer may be over subscribed or misconfigured. Check var/log/splunk/splunkd_access.log on the peer Last Connect Time:2022-01-21T22:45:45.000+05:30; Failed 11 out of 11 times. showing this error in monitoring console.
... View more
01-21-2022
08:00 AM
Yes running index=_internal on ES search head but not showing ES host name yes the hostname in server.conf file is correct. yes even after expanding timerange hostname is not available.
... View more
- Tags:
- yes
01-21-2022
07:48 AM
Unable to see my host in index=_interospection /_internal after runing the above query in the same host I can't see the hostname. Unable to see host ES
... View more
Labels
- Labels:
-
distributed search
01-13-2022
09:04 AM
web.conf [settings] startwebserver = 1 enableSplunkWebSSL = 1 tools.sessions.timeout = 30 loginBackgroundImageOption = custom loginCustomBackgroundImage = search:logincustombg/Splunk_Wall.png max_upload_size = 1024 privKeyPath = /opt/splunk/etc/auth/mycerts/mySplunkWebPrivateKey.key #Absolute paths may be used. Non-absolute paths are relative to $SPLUNK_HOME. serverCert = /opt/splunk/etc/auth/mycerts/mySplunkWebCertificate.pem httpport = 8000 #Absolute paths may be used. Non-absolute paths are relative to $SPLUNK_HOME.
... View more
01-13-2022
08:25 AM
Waiting for web server at https://127.0.0.1:8000 to be available......................................... it has stopped here. No error in splunkd.log
... View more
Labels
- Labels:
-
Linux
12-15-2021
11:27 AM
logfile unable to monitor the file
... View more
12-15-2021
08:20 AM
[new] DATETIME_CONFIG=/etc/apps/Test/local/datetime.xml SHOULD_LINEMERGE=false BREAK_ONLY_BEFORE=\nExecution\sServer CHARSET=UTF-8 TIME_FORMAT= %H:%M:%S.%3N MAX_EVENTS=10000 SEDCMD-test=s/Ex\w.*\nS\w+.*\n+\+-.*\n\|\s+\w.*\n\+-.*|\|Ste\w.*\n\|P\w.*\n\|T\w.*\n\|V\w.*\n+\|\n\|Va\w.*|\|Para.*|\+-.*//g TRUNCATE=0
... View more
Labels
- Labels:
-
props.conf
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-27-2022
06:24 PM
|
