Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Rajiv_splunk
Rajiv_splunk
Path Finder
Member since:
07-29-2022
2 weeks ago
Community Statistics
| Posts | 16 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 1 |
| Member Since | 07-29-2022 |
Activity Feed
- Posted how to exclude a events in the search query if the events is present in the other index on Splunk Search. 3 weeks ago
- Posted Re: Splunk Alerts getting triggered to ServiceNow using Splunk Add-on for Service Now gets truncated on All Apps and Add-ons. 4 weeks ago
- Posted Re: props.conf for eventline breaking sometime works sometime doesnt on Getting Data In. 04-10-2023 01:29 AM
- Karma Re: props.conf for eventline breaking sometime works sometime doesnt for woodcock. 04-10-2023 01:27 AM
- Karma Re: props.conf for eventline breaking sometime works sometime doesnt for woodcock. 04-10-2023 01:27 AM
- Posted Re: props.conf for eventline breaking sometime works sometime doesnt on Getting Data In. 04-06-2023 11:59 PM
- Posted Why does props.conf for eventline break sometimes and works sometimes? on Getting Data In. 04-06-2023 05:47 AM
- Tagged Why does props.conf for eventline break sometimes and works sometimes? on Getting Data In. 04-06-2023 05:47 AM
- Posted Re: Is there an addon for VTOM ? on All Apps and Add-ons. 01-10-2023 01:55 AM
- Posted Why does alert manager not always trigger an alert? on Alerting. 09-12-2022 05:26 AM
- Tagged Why does alert manager not always trigger an alert? on Alerting. 09-12-2022 05:26 AM
- Posted How do I retrieve data from Password.conf file using curl command? on Splunk Enterprise. 08-10-2022 04:58 AM
- Posted Re: How to update a new row in lookup file using eval command or some other command? on Splunk Search. 07-30-2022 10:22 AM
- Posted Re: How to update a new row in lookup file using eval command or some other command? on Splunk Search. 07-30-2022 10:16 AM
- Posted Re: How to update a new row in lookup file using eval command or some other command? on Splunk Search. 07-30-2022 10:13 AM
- Karma Re: How to update a new row in lookup file using eval command or some other command? for richgalloway. 07-30-2022 10:11 AM
- Posted How to update a new row in lookup file using eval command or some other command? on Splunk Search. 07-30-2022 08:01 AM
- Posted Re: Consuming large amounts of data from ServiceNow on Splunk Enterprise. 07-29-2022 08:25 AM
- Posted Re: Updating multiple value in same field using eval command on Security. 07-29-2022 08:18 AM
- Got Karma for Re: Updating multiple value in same field using eval command. 07-29-2022 07:56 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
3 weeks ago
I have a scenario where events are coming from one index =sample field= status as status 1, 2, 3, 4 , and 5. I have to exclude all the status which is present in the other index =services as status 1 and 2. How can i achieve it. I am trying the below query in the base query to exclude but it is not working index=sample status=* ''''''base query"''' |search NOT [search index="service" earliest=-24h latest=now |search status IN (1,2)| table status]
... View more
Labels
- Labels:
-
subsearch
4 weeks ago
HI @spl_unker we are facing a similar issue what you faced a year ago. Our short description is also getting truncated after 80 character and when i checked the code snippet it has same details as you shown in your post.
FIELD_SEPARATOR = "||"
INDEX_LENGTH = 80
DID YOU FOUND THE ANSWER FOR THIS. IS THIS HAS ANYTHING TO DO WITH THE INDEX_LENGTH. Should we change the index length and redeploy. Your answer on this will be highly appreciated
... View more
04-10-2023
01:29 AM
@woodcock Thanks for your reply. The issue is fixed. My team has recently created one new HF which i was not aware of(could be because was on leave). So i added my props in that newly added HF and issue is fixed
... View more
04-06-2023
11:59 PM
HI Thanks for the reply. I checked all the points you mentioned. props.conf is in all indexer and in all HF I am using sourcetype based configuration and all the logs are coming from the same sourcetype and same host. Can you help me with the 4th point you mentioned- when i am running this query across all time its returning nothing. I am using this query like below _index_earliest=-1h _index_latest=now sourcetype=mysourcetype. Is there any other way i can check if earlier messed up events are combining
... View more
04-06-2023
05:47 AM
HI All,
I am stuck with one issue for a event line breaking. I have an environment in which UF sending logs from HF to IDX. I created props.conf in HF and Indexer both. and it worked. The stanzas i provided in the props.cong is working exactly the way i wanted, but after sometime, some of the events appears in unstructured format again...and after sometime it worked exactly the way i want.
Its kind of a bizarre scenario where when i am testing it works fine just at the time of presenting it to the client it stopped working again...and after few minutes it started working fine again :P.
Can anyone help me in finding the root cause for inconsistent performance of props.conf
Note- The stanzas are fine and its breaking the events the way i want but something is stopping it to work consistently
... View more
- Tags:
- props.conf
Labels
- Labels:
-
other
01-10-2023
01:55 AM
HI @arthurf Did you find any app or add on for VTOM. Even I am looking for the same. Please help me if you have found one
... View more
09-12-2022
05:26 AM
Why does alert manager not always trigger an alert?
... View more
- Tags:
- Alert Manager
Labels
- Labels:
-
alert action
08-10-2022
04:58 AM
HI All,
I have used one password for VMware app configuration and forgot the password. And the password is save in the password.conf file in encrypted format .Now we are trying to retrieve the password through curl command api but it throwing <msg type="ERROR">Unauthorized</msg>.
curl -k -u username:password https://localhost:8089/servicesNS/nobody/Splunk_TA_vmware/storage/passwords/
i tried above curl command without servicesNS and without nobody but its not working
can anyone please help on this.
... View more
Labels
- Labels:
-
troubleshooting
07-30-2022
10:22 AM
i got it fixed...run the eval command again...Thanks
... View more
07-30-2022
10:16 AM
I got stuck in an another issue..how would i add multiple rows in lookup file through query if only one field vlaue i have to change. say i also have to add all the field value as "yes" and all the field value as "accepted"
... View more
07-30-2022
10:13 AM
Thanks a ton @richgalloway for your quick reply. It works like a charm 🙂
... View more
07-30-2022
08:01 AM
Hello everyone,
I have a lookup file which have 5 entry with filed name and field value as below
"New_field"="yes", New_field1="yes", "New_field3"="yes", New_field4="Yes"
I need to append a new row to the lookup file with all the field value as "No". I am using the below command to do this
|inputlookup sample_demo.csv |append [|inputlookup sample_demo.csv|eval "New_field"="no", New_field1="no", "New_field3"="no", New_field4="no"]
this query is adding the new row but its adding 5 new row... I just need one row to append with new field value as "no"
Can anyone please guide me on this, as what am i missing in the query
... View more
Labels
- Labels:
-
subsearch
07-29-2022
08:25 AM
HI @Chris_SNOW Even i am facing the same issue, did you able to fix your issue if yes then please guide me as well
... View more
07-29-2022
08:18 AM
Thanks a lot @DanielPriceUK . It works :)... Thanks for a quick reply
... View more
07-29-2022
07:55 AM
1 Karma
Thanks a lot @DanielPriceUK . It works :)... Thanks for a quick reply
... View more
07-29-2022
07:45 AM
HI Everyone,
I am trying to update multiple value in the same field using eval case command but it returning the below error
Error in 'eval' command: The expression is malformed. Expected ).
My requirement is to update when website is ABC the delievery_status should be on_the_way, and when website is xyz the delievery_status should be delievered else it should say Nt delievered. and i am writing the below case statement
| eval delievery_status = case (website="ABC" "on_the_way" website="xyz", "delievered", "Not_delievered")
Can anyone please help me on this what i am missing in this
... View more
- Tags:
- splunk-search
Labels
- Labels:
-
other
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
2 weeks ago
|
