About Rakzskull

Rakzskull · ‎07-25-2023

Hi Folks When I enter the Ingest actions page from our Splunk portal, we get the error shown below. "Unable to load sourcetypes: An unexpected error occurred" I also attempted to clear the browser's cookies, which worked for a short time and returning to the same error page. Is anyone aware of this problem? If this is the case, please provide an approach for eliminating it. How to reproduce an issue. Splunk Homepage > Setting > Ingest Action > Click on any rule

Rakzskull · ‎04-25-2023

@ITWhisperer Thanks for the reply. We already have N number of alerts set up to go out when the count crosses certain thresholds. Having all the alerts configured this this way is not a fesilbe choice. Is there an achievable Splunk solution I can use to schedule a downtime?

Rakzskull · ‎04-24-2023

Hi I intend to mute the alerts at a specified time during the maintenance window, and they should start up again once the maintenance window is to finish. Can someone please guide me on how to achieve this? because Splunk doesn't have a feature for scheduling maintenance. Thanks 🙂

Rakzskull · ‎04-24-2023

@ITWhispererI'd want to extract fields, however some of them aren't in interesting fields. The first one you provided worked. so if you could make the rex for this as well : [04/24/2023 05:47:38.551][530e4835abe4717b,530e4835abe4717b,,][CAPIRESP] [ec-25] I [go.web.filter.APILoggingFilter: ] [en_US] [ANDROID] [23.3.0] I'd want to copy the text in bold above.

Rakzskull · ‎04-24-2023

@ITWhisperer What would be the rex for --> [en_US] [ANDROID] [23.3.0] Thanks in advance

Rakzskull · ‎04-24-2023

Hi Guys, Could you possibly assist me with creating a rex for the log below? Rex for "CEOTransactionSessionId":"1D2667DC-7849-1122-3FE3-C4A08EAC9FEB"

Rakzskull · ‎04-20-2023

One more thing: just out of curiosity, I changed the output.conf file with the new HF IP. Is it necessary to also change the same HF IP in the deploymentclient.conf ?

Rakzskull · ‎04-20-2023

The local config directory of the UF’s does not contain outputs.conf file. I can only see below files in opt/splunk/etc/system/local deploymentclient.conf inputs.conf migration.conf server.conf

Rakzskull · ‎04-20-2023

Hi Guys, I deployed a new heavy forwarder in our environment, however I'd want to repoint certain devices to the freshly deployed forwarder. I tried updating the ip in the local/deploymentclient.conf, but I'm still getting the old HF information in logs. Could you demonstrate to me how to do so?

Rakzskull · ‎01-08-2023

I'd want to merge two regex strings into a single one; any suggestions would be greatly appreciated. Reference Search Query - index=* sourcetype=XYZ "<ABC2>" "<ABC1>" | regex _raw="<ABC1>[^\x00-\x7F]" | regex _raw="<ABC2>[^\x00-\x7F]" Thanks in advance. 🙂

Rakzskull · ‎09-30-2022

@gcusello I'm a rookie, so I don't know much about creating lookup csv. If you could explain the detailed technique with steps, I'd appreciate it. 🙂

Rakzskull · ‎09-29-2022

I've seen a few posts on the subject, but I'd like to know how we can disable the multiple alerts throughout the maintenance window. For example, I'd like to disable alerts 1, 2, and 3 from Saturday 11:30 p.m. until Sunday 6:00 a.m. Thank you in advance. ------------------------------------ reference alert query index=ABC sourcetype=XYZ ("Internal System Error") |stats count |where count >=30

Posts	12
Solutions	0
Karma Given	8
Karma Received	0
Member Since	‎09-15-2022

Online Status	Offline
Date Last Visited	‎08-25-2023 12:20 AM

An unexpected error occurred on Ingest Action afte...

How to mute alerts during maintenance?

Rex for "CEOTransactionSessionId":"1D2667DC-7849-1...

How to repoint the UF to the newly added forwarder...

How to merge two regex in single query?

How to stop alerts from being generated during mai...

An unexpected error occurred on Ingest Action afte...

Re: How to mute alerts during maintenance?