Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About izzie123
izzie123
Path Finder
Member since:
11-02-2022
06-25-2024
Community Statistics
| Posts | 20 |
| Solutions | 0 |
| Karma Given | 9 |
| Karma Received | 1 |
| Member Since | 11-02-2022 |
Activity Feed
- Got Karma for Splunk Add-on for AWS - Ingesting csv files and he fields are not getting extracted at all. 10-09-2024 07:57 AM
- Posted Re: Time parsing working correctly but not able to see nanoseconds in the results on Getting Data In. 02-16-2024 04:33 AM
- Posted Re: Time parsing working correctly but not able to see nanoseconds in the results on Getting Data In. 02-15-2024 06:24 AM
- Posted Re: Time parsing working correctly but not able to see nanoseconds in the results on Getting Data In. 02-15-2024 06:21 AM
- Posted Re: Time parsing working correctly but not able to see nanoseconds in the results on Getting Data In. 02-15-2024 05:10 AM
- Posted Time parsing working correctly but not able to see nanoseconds in the results on Getting Data In. 02-15-2024 04:49 AM
- Posted Splunk Addon For ServiceNow doesn't show proper results when "Include Parameters" is set on Splunk Enterprise. 11-28-2023 05:12 AM
- Posted Splunk Add-on for AWS - Ingesting csv files and he fields are not getting extracted at all on Splunk Enterprise. 09-07-2023 12:35 AM
- Posted Why the macro error when updated the cloudflare app on Splunk? on Splunk Enterprise. 08-16-2023 02:21 AM
- Karma Re: ERROR:root:Connection unexpectedly closed: [Errno 104] Connection reset by peer while sending mail for PickleRick. 08-01-2023 03:08 AM
- Posted Why the ERROR:root:Connection unexpectedly closed: [Errno 104] Connection reset by peer while sending mail? on Other Usage. 07-19-2023 03:06 AM
- Karma Re: Changing the default hostname of Splunk Universal Forwarder for richgalloway. 07-18-2023 12:24 AM
- Karma Re: Changing the default hostname of Splunk Universal Forwarder for SanjayReddy. 07-18-2023 12:23 AM
- Posted Re: Changing the default hostname of Splunk Universal Forwarder on Getting Data In. 07-14-2023 09:25 PM
- Posted Changing the default hostname of Splunk Universal Forwarder on Getting Data In. 07-14-2023 10:19 AM
- Posted Re: Saved searches Run time on Splunk Search. 07-03-2023 03:31 AM
- Karma Re: Saved searches Run time for richgalloway. 07-03-2023 03:30 AM
- Posted Saved searches Run time on Splunk Search. 06-30-2023 10:41 AM
- Posted Re: Splunk alert not firing email on Other Usage. 06-21-2023 10:40 PM
- Posted Why is Splunk alert not firing email? on Other Usage. 06-21-2023 10:57 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-16-2024
04:33 AM
@ITWhisperer I just want to be sure that we are extracting the timestamp correctly, so my doubt is that for an event which has timestamp as 2024-02-16T11:46:02.9895330Z, we have created the time format as %Y-%m-%dT%H:%M:%S.%9N%Z but the _time field shows values like 2/16/24 11:46:02.989 AM, So is this correct? Thank you so much for the help. Regards.
... View more
02-15-2024
06:24 AM
@ITWhisperer however, I need to create a parser which will parse the events which have the timestamp like "time: 2024-02-15T11:40:26.498494245Z" I read on the community that Splunk does not support nanoseconds. so, if I put in the microseconds logic(%Y-%m-%dT%H:%M:%S.%6Q%Z), will I get the values till microseconds?
... View more
02-15-2024
06:21 AM
@ITWhisperer
index="test1"
| fieldformat _time=strftime(_time,"%Y-%m-%dT%H:%M:%S.Z")
... View more
02-15-2024
05:10 AM
@ITWhisperer Thanks for your reply, this can be done inline but how do we ensure we have the right time extraction from the data? Is it possible to set the _time to show nanoseconds while creation of the parser? Also, with the command that you gave I cannot see the right results, below is the result I am getting. NaN/NaN/aN NaN:NaN:NaN.000 AM
... View more
02-15-2024
04:49 AM
Hello I have to work on a parser which has the time format like this : "time: 2024-02-15T11:40:19.843185438Z" It is json data so I have created a logic like below to extract the time. TIME_PREFIX = \"time\"\:\s*\" TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%9Q%Z Although, I see no errors while uploading the test data, in the time field I can see values upto 3 milliseconds only, for eg : 2/15/24 11:40:19.843 AM Is this the right way or Splunk does show the nanoseconds values too? If it does, what is it that is missing in my logic to view the same? Kindly help. Regards.
... View more
Labels
- Labels:
-
JSON
-
Linux
-
props.conf
-
source
11-28-2023
05:12 AM
Hello All, I am testing the data inputs for Splunk Addon for ServiceNow and there is a requirement to include only certain fields in the data. I tried to set the filtering using the "Included Parameters" option in the input and added the desired comma separated fields. However, I am not able to see those fields. What I see is only the two default id and time fields. I have included the following fields : dv_active,dv_assignment_group,dv_assigned_to,dv_number,dv_u_resolution_category But in the output I see only below fields: Is there anything that I am doing wrong? Regards, Himani.
... View more
Labels
- Labels:
-
configuration
-
using Splunk Enterprise
09-07-2023
12:35 AM
1 Karma
Hello, We are ingesting csv files from a S3 bucket using the Custom SQS based S3 input. Although, the data is pulled rightly, the fields are not getting extracted properly. The header line has been ingested as a different event and the header fields are not getting extracted. I have defined the Indexed_Extractions=csv in the props.conf Is there any other way to extract a csv file from the S3 bucket? Any work around?
... View more
Labels
08-16-2023
02:21 AM
Hello,
We are currently running splunk on 8.1 and we upgraded the cloudflare app for splunk to its latest version (2.0.0)
Although we see that the dashboards from the app is getting populated properly, we are getting this error related to the macro.
SearchParser - The search specifies a macro 'cloudflare_zt_index' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.
We have given the macro global permissions, added a setting in the distsearch.conf to ensure the data replication but still the error is showing up.
We have disabled the app for now. However, we are trying to investigate, what would be the issue.
Kindly help
... View more
- Tags:
- error
- splunk search
Labels
- Labels:
-
administration
-
troubleshooting
-
upgrade
07-19-2023
03:06 AM
Hello,
We have an alert which is configured to send emails to users through an SMTP server. We notice that yesterday that particular alert created 63 events and while others successfully sent emails, there was an error while sending one alert.
ERROR:root:Connection unexpectedly closed: [Errno 104] Connection reset by peer while sending mail to "XXX@domain.com"
We are not sure if this is related to Splunk or should we check this on the SMTP server side. Can someone please guide?
This error occurred only once. The email flow was restored after a while.
Regards.
... View more
- Tags:
- connection
- error
Labels
- Labels:
-
alert action
-
email
-
other
07-14-2023
09:25 PM
@richgalloway Thank you for your reply. I tried running the command "splunk.exe show servername" to check but I am still getting the same error. Can you help with the command that needs to be run? Many thanks!
... View more
07-14-2023
10:19 AM
Hello All, I had installed UF on a windows server in our environment which is reporting to our Deployment server, Recently the hostname on it got changed and it stopped reporting to DS. I referred to this link and tried to run the below commands on CLI: https://community.splunk.com/t5/Getting-Data-In/How-can-I-change-the-default-hostname-in-Splunk/m-p/117398 ./splunk set servername foo.domain.com ./splunk set default-hostname foo.domain.com However, it is not recognizing these commands on the windows CLI . Error : "'./splunk' is not recognized as an internal or external command, operable program or batch file." Can you all kindly help understand what could be the issue? I had ran these commands after going to the path where splunk UF is installed and under /etc/system/local/ directory. But I am still getting this error, I am not sure if I am missing any step, or is it the path error and why these commands are not working. We do not want to touch the configuration files, we would like to do the changes through CLI itself. Can someone please help me in understanding the steps needed to be followed. Thanks a ton in advance.
... View more
Labels
- Labels:
-
inputs.conf
-
source
-
universal forwarder
07-03-2023
03:31 AM
This worked for me, thanks. I was able to list out the searches by tweaking this query a little bit. We see that there are many searches running in at the same time, any ideas on how we can tune this?
... View more
06-30-2023
10:41 AM
Hello Splunkers, I had a question, I wanted to check the time on which my saved searches / scheduled reports and alerts are running. Is there a way we can list out the name of the searches and at what time are they running? Also, how can we find out which saved searches are running at the same time?
... View more
Labels
- Labels:
-
search job inspector
06-21-2023
10:40 PM
Thanks for your answer @isoutamo I checked the internal logs and found this error : ERROR:root:(421, b'4.4.2 Message submission rate for this client has exceeded the configured limit',")
... View more
06-21-2023
10:57 AM
Hello,
I have set an alert which generates around 50-60 events everyday. I have configured this alert to send mails to my email id, I have been observing that not all events generate emails and the count of the alert events and the mails received mismatches.
The alert mail is not fired intermittently. Can you please suggest some ways to troubleshoot the cause of this problem?
Thanks in advance
... View more
Labels
- Labels:
-
alert action
-
email
01-02-2023
07:58 PM
Thank you for your answer, it helped. Is there any way we can do it inline using a script?
... View more
01-02-2023
07:59 AM
Hi How can we find out the list of universal forwarders sending data to Splunk? Also, how do we ensure that all the UF that have been configured are sending data to Splunk? Thank you so much in advance
... View more
Labels
12-05-2022
03:20 AM
I have to whitelist fields based on 2 columns in a lookup, but the second column has multiple values. So we have to whitelist based on the condition that the username and the destinations are in two fields in the same event. In the event too, we have the field values(dest) so multiple destinations are in one cell. The condition is that the user with those destinations should be whitelisted. How can we achieve this?
... View more
Labels
- Labels:
-
lookup
11-02-2022
12:04 PM
Hello,
I have created a lookup definition for CIDR. The CIDR matching works just fine and I am able to whitelist the IPs in that particular subnet range.
However, I wanted to know if I can add single IP's to the same lookup file/definition(CIDR lookup) as well?
I want single IP matching in the same lookup table where I have added the IP subnet.
How to proceed about this?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-25-2024
01:52 PM
|
Karma given to
