About umesh

umesh · ‎01-31-2023

Hi We are having multiple UFs running on old version and i wanted to upgrade them to the latest version using Deployment server using Scripts. can you please help me how to do it. Can you please provide powershell script to upgrade UF version

umesh · ‎01-30-2023

Hi, I am using Splunk Cloud and we are getting all the logs in IST timezone when IST is my preferred time zone. there are some of the logs reporting in UTC time zone and the logs we are getting to search head via UTC time zone. i wanted UTC time zone to reflect as IST. Can you please help me in this way. if the way is to use TZ attribute in props.conf what will be the value for TZ attribute. Please let me know. props.conf must be edited in HF or indexer? Thanks in advance

umesh · ‎12-21-2022

@gcusello can you please help on this. when i click on the contributing events in notable alert it is showing count of 59 events and aftersometime when i analyse the same notable contributing events link the event count is getting increased. Please i explain the reason why it is happening

umesh · ‎12-11-2022

Hi Team, I have created a notable in the Splunk ES and i received a notable and i analyzed the notable and i can see 130 events in the raw logs. But after sometime if i analyse the same notable i can see that there is increase in the count of events . Can i know what the issue is regarding the increase in the event count. Thanks & Regards, Umesh

umesh · ‎11-08-2022

@gcusello [pan:traffic] location of props.conf and tranforms.conf is etc/system local or Splunk add-on for paloalto app. which is preferable . Thanks for the quick response

umesh · ‎11-08-2022

Hi i am using palo-alto firewall. i am getting firewall logs to syslog server and monitoring those logs and forwarding to indexer and to search head. I want to exclude events from particular src_ip from indexing as the src is generating high volume of logs and consuming my license. How to exclude these events. Please let me know. Thanks

umesh · ‎11-05-2022

Hi , I am forwarding logs from UF -----> HF -----------> Indexer------->Search Head i am forwarding Windows Event Logs on index = os_windows from UF to Heavyforwarder and then to indexer Do i need to create index =os_windows on Heavy forwarder . If the answer is No - i wanted to check the logs on HF if the logs are sent from UF to HF. How do i need to search. Please let me Know. Thanks

umesh · ‎11-02-2022

Hi , I am using splunk v.9.0 splunk cloud i think it is the problem after the upgrade. Can you please confirm your version of splunk.

umesh · ‎11-02-2022

Hi team, I have "file_size" in my extracted fields and the values are 1.56 KB,5.03 MB, 1.06 B. and those values are strings. I need a query how to convert string to Integer to sum(file_size) i need to use max and min and sum commands for the file_size. Please help me on the same. Thanks

umesh · ‎10-20-2022

Hi I have created dashboard with column charts and tables and it is working fine but when i export the dashboard to pdf i am unable to see the bar chart but the statistic tables are visible in the pdf. Any help will be appreciated. Thanks

umesh · ‎10-19-2022

@bowesmana I am doing this drill down in enterprise security notable events not in the dashboards the drill down search for getting contributing events for the notable. I am using tokens in the drill down search as index=xxx |search Dest=$dest$

umesh · ‎10-19-2022

Hi I have two questions here 1.In the drill down search i have given dest=$dest$ and it is not working and when i click on contributing link it is reflecting the same. 2. When i click on drilldown search it is taking me to the search window with the time range as last 30 mins but what i expect is the custom timerange when the event got triggered. i kept offset values to default Please let me know. Thanks

umesh · ‎10-07-2022

Hi I wanted to get the details of the top 5 indexes consuming high license seperated by date for last 7 days in a single query. 16th -top 5 index --gb 17th -top 5 index --gb 18th top 5 index --gb ......... Please help me with the above query

umesh · ‎09-29-2022

Hi , i want to find the license utilization of firewall logs based on severity level. can anyone help me with the query on how to find the license utilization based on particular events like eventid in windows logs

Posts	14
Solutions	0
Karma Given	5
Karma Received	1
Member Since	‎09-29-2022

Online Status	Offline
Date Last Visited	‎02-01-2023 12:25 AM

Upgrading UF using deployment server

Why are we getting all the logs in IST timezone wh...

Why is there an increase in security notables even...

How to exclude firewall events in Splunk?

Index at Heavy forwarder- Do I need to create inde...

How to convert String to Integer search?

Dashboard Chart Display issue when exporting to pd...

Is there a drill down search variable substitution...

How to create a search to calculate top5 license c...

How to write a Splunk search for License Utilizati...