About Harish2

Harish2 · ‎03-08-2023

hi @Tom_Lundie okay now i installed new app ta-jira-issue-input but while adding newinput there is a filed called "jira account" what i should give there??? form this app, if i want to get the comments, worklog, activity details, how can i do so???

Harish2 · ‎03-07-2023

thank you for that. As i said before we are seeing jira data in splunk. but now if i want to see the jira comments , Worklog, history, activity data in splunk. how can i do this?

Harish2 · ‎03-07-2023

hi @Tom_Lundie , folder name is TA-jira-issues-collector

Harish2 · ‎03-07-2023

Hi @Tom_Lundie i am not sure how to tell that exactly, but in splunk i see the app name as "Jira Issue collector" when i searched in google with this appname i got this https://splunkbase.splunk.com/app/4814 but i am not sure the same is used in my splunk environment. is there any way to check and confirm.

Harish2 · ‎03-07-2023

I have splunk base app called jira issue collector, inputs has been configured, and we are receiving data from jira into splunk. But i want to know from where it is taking data, like any rest api is mentioned for it, if so how can i check what api they used for this data to come into splunk. how can i check that in splunk.

Harish2 · ‎03-05-2023

perfect!!! Thank you @sjringo , i got the expected result.

Harish2 · ‎03-03-2023

index=acs-app-log sourcetype=iccim_bwm_servicename processname=response_AM |stats count by verificationstatus Results: verificationstatus count Failed 100 Success 230 pending 456 i need to get the percentage of failed success and pending. how can i do that?

Harish2 · ‎01-29-2023

I checked there is no permission issue, i can see other files with the same permission. But not able to see data from mentioned sources

Harish2 · ‎01-28-2023

Hi @richgalloway how can i check that, can u please tell me????

Harish2 · ‎01-28-2023

Hi My sources: 1. /app/splunkser/ShiftNonMinJMC/ShiftNonMinJMC.log 2. /app/splunkser/ShiftNonMinJMC/ShiftNonMinJMC-show.log 3. /app/splunkser/ShiftNonMinJMC/ShiftNonMinJMC-ignored-sms.log 4. /app/splunkser/ShiftMinJMC/ShiftMinJMC.log 5. /app/splunkser/ShiftMinJMC/ShiftMinJMC-show.log 6. /app/splunkser/ShiftMinJMC/ShiftMinJMC-ignored-sms.log 7. /app/splunkser/ShiftBDRecordJMC/ShiftBDRecordJMC.log 8. /app/splunkser/ShiftBDRecordJMC/ShiftBDRecordJMC-show.log 9. /app/splunkser/ShiftBDRecordJMC/ShiftBDRecordJMC-ignored-sms.log I am receive the data from the above sources in SIT and PROD environment but not receiving logs from the below sources: 1. /app/splunkser/ShiftNonMinJMC/ShiftNonMinJMC.log 4. /app/splunkser/ShiftMinJMC/ShiftMinJMC.log 7. /app/splunkser/ShiftBDRecordJMC/ShiftBDRecordJMC.log Note: i am getting logs in SIT from all 9 sources but in production the mentioned 1, 4 and 7th sources are not showing up in Production env. Inputs.conf [monitor:///app/splunkser/ShiftNonMinJMC/ShiftNonMinJMC-*.log] disabled=0 index=app-jmc-shift-sms sourcetype=app:jmcshift:logs blacklist=\.(?:tar|gz)$ crcSalt=<SOURCE> [monitor:///app/splunkser/ShiftNonMinJMC/ShiftNonMinJMC-show-*.log] disabled=0 index=app-jmc-shift-sms sourcetype=app:jmcshift:logs blacklist=\.(?:tar|gz)$ crcSalt=<SOURCE> [monitor:///app/splunkser/ShiftNonMinJMC/ShiftNonMinJMC-ignored-*.log] disabled=0 index=app-jmc-shift-sms sourcetype=app:jmcshift:logs blacklist=\.(?:tar|gz)$ crcSalt=<SOURCE> [monitor:///app/splunkser/ShiftMinJMC/ShiftMinJMC-*.log] disabled=0 index=app-jmc-shift-sms sourcetype=app:jmcshift:logs blacklist=\.(?:tar|gz)$ crcSalt=<SOURCE> [monitor:///app/splunkser/ShiftMinJMC/ShiftMinJMC-show-*.log] disabled=0 index=app-jmc-shift-sms sourcetype=app:jmcshift:logs blacklist=\.(?:tar|gz)$ crcSalt=<SOURCE> [monitor:///app/splunkser/ShiftMinJMC/ShiftMinJMC-ignored-*.log] disabled=0 index=app-jmc-shift-sms sourcetype=app:jmcshift:logs blacklist=\.(?:tar|gz)$ crcSalt=<SOURCE> [monitor:///app/splunkser/ShiftBDRecordJMC/ShiftBDRecordJMC-*.log] disabled=0 index=app-jmc-shift-sms sourcetype=app:jmcshift:logs blacklist=\.(?:tar|gz)$ crcSalt=<SOURCE> [monitor:///app/splunkser/ShiftBDRecordJMC/ShiftBDRecordJMC-show-*.log] disabled=0 index=app-jmc-shift-sms sourcetype=app:jmcshift:logs blacklist=\.(?:tar|gz)$ crcSalt=<SOURCE> [monitor:///app/splunkser/ShiftBDRecordJMC/ShiftBDRecordJMC-ignored-*.log] disabled=0 index=app-jmc-shift-sms sourcetype=app:jmcshift:logs blacklist=\.(?:tar|gz)$ crcSalt=<SOURCE> Props.conf [app:jmcshift:logs] TIME_PREFIX=^ TIME_FORMAT=%Y-%m-%d %H:%M:%S.%3N MAX_TIMESTAMP_LOOKAHEAD=30 LINE_BREAKER=([\r\n]+)\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}.\d{3} SHOULD_LINEMERGE=false TRUNCATE=99999 Sample logs: From all 9 sources the events starts with date as shown below: 2023-01-12 23:24:50.245 [error]........................................... Same inputs.cong and props.conf in SIT and Production env. Not sure what could be the issue.

Harish2 · ‎01-19-2023

hi @yeahnah , Thanks for your help, it really worked.

Harish2 · ‎01-18-2023

Hi @richgalloway it worked, thank you

Harish2 · ‎01-17-2023

hi @yeahnah If it does show there then a Splunk admin should be able to disable or share the saved search. Once shared you should also be able to reassign ownership under Reassign Knowledge objects.---> here also i am not able to see the orphaned alerts to disable or reassign In my environment, authentication is LDAP based. When a user is removed (no longer appears under Settings > Users) we sometimes have to create a temp local user, with the exact same username, log on as that user and then disable/share their private saved search. Once done the temp local user can be deleted again.---> yes i am an admin, but i am not sure how to create this user and delete again can you please provide complete steps to do this activity.

Harish2 · ‎01-17-2023

i have few orphaned searches, which i need to reassign or disable or delete it. i am not able to do any of these. 1. The orphaned searches which can see in splunk/app/search/orphaned_scheduled_searches.............. here the sharing is in user level. but i am not able to see the same in settings>All configurations>Reassign Knowledge objects. when i search the alert name by selecting the orphaned i am not getting any results. 2. When i checked the owner name in internal index it is showing that user has been disabled. Now how can i reassign or disable or delete this searches. is there any chance to do via CLI. please help on this.

Harish2 · ‎01-12-2023

From here i need to extarct the identification=MLAS, MLA, LAS and VAM My sample logs: [12/12/21] 12:10:112 GMT] I6789HIOO applicattion authenticationid=100| |35467577889999| |67775-ghhgfrt-6788h-7667788; clientid="7689-jhgg-8765r-kkjggt"; app=" "; QueryLetter="yard=MS&identification=MLAS&timeRange=EVERYDAY&timePeriod=MINUTES [12/12/21] 12:10:112 GMT] I6789HIOO applicattion authenticationid=100| |35467577889999| |67775-ghhgfrt-6788h-7667788; clientid="7689-jhgg-8765r-kkjggt"; app=" "; QueryLetter="yard=MS&identification=MLA&timeRange=EVERYDAY&timePeriod=MINUTES [12/12/21] 12:10:112 GMT] I6789HIOO applicattion authenticationid=100| |35467577889999| |67775-ghhgfrt-6788h-7667788; clientid="7689-jhgg-8765r-kkjggt"; app=" "; QueryLetter="yard=MS&identification=LAS&timeRange=EVERYDAY&timePeriod=MINUTES [12/12/21] 12:10:112 GMT] I6789HIOO applicattion authenticationid=100| |35467577889999| |67775-ghhgfrt-6788h-7667788; clientid="7689-jhgg-8765r-kkjggt"; app=" "; QueryLetter="yard=MS&identification=VAM&timeRange=EVERYDAY&timePeriod=MINUTES in my selected fileds or intresting fileds indeentification fileds should appear has below: MLAS MLA LAS VAM

Harish2 · ‎01-04-2023

Original query: index=att_acc_app source=applicationissues.log |timechart count by client_application_name span=1d results: _time ccs mop zse cfr 2023-01-02 00:00:00 10 223 100 12 2023-01-02 00:30:00 80 283 800 67 query using tstats: |tstats count where index=att_acc_app source=applicationissues.log by PREFIX(client_application_name=) _time span=1d |rename client_application_name= as client-application-name |timechart count by client-application-name span=1d results: _time ccs mop zse cfr 2023-01-02 00:00:00 5 23 0 11 2023-01-02 00:30:00 90 83 80 69

Harish2 · ‎01-04-2023

if i am using without tstats i am getting one value, when i am using tstats i am getting different value. both values are not matching.

Harish2 · ‎01-04-2023

Search: |tstats count where index=att_acc_app source=applicationissues.log by PREFIX(client_application_name=) _time span=1d |rename client_application_name= as client-application-name |timechart count by client-application-name span=1d When i am using this query i am not getting accurate results.

Harish2 · ‎12-29-2022

Hi , I have uploaded the lookupfile with application host and hostip details in the splunk. i am not sure where to add this inputlookup file so that when i run this query i should get application details. when i run this query i am getting only _time and ClientName responsetime data, i need application details as well. My Query: index=app_cust_ctl sourcetype=applicationdata |bin _time span=1s |rex "\d{2}:\d{2}:\d{2}:\d{3} (?<responsetime>;\d+) ms" |stats count(eval(Status="success")) as sucessapp, count(eval(Status="error")) as errorapp, avg(responsetime) as appresponsetime, max(responsetime) as maxresponsetime by _time application ClientName |eval record="location"

Harish2 · ‎12-27-2022

Hi All, I am struggling to add customized colours to the chart panel in the dashboard. Can any one please help on this. My dashborad panel query: <panel> <chart> <title> Response times more than 1000 ms by codes</title> <search> <query> index=avf-res-app code=all* OR code =ma21rt source=*application* |eval ipl=code+"_"+host_ip |stats avg(responseTime) as Avg_Rep by ipl, code |sort by Avg_Rep desc |where Avg_Rep > 1000 |eval Avg_Rep = round(Avg_Rep, 2)</query> <earliest>-1d@d</earliest> <latest>now</latest> </search> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisTitleY.visibility">collapsed</option> <option name="charting.axisTitleY2.visibility">collapsed</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY.abbreviation">auto</option> <option name="charting.chart">column</option> <option name="charting.chart.showDataLabels">all</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">1</option> <option name="charting.layout.splitSeries.allIndeoendentYRanges">1</option> <option name="charting.legend.placement">none</option> <option name="referesh.display">progressbar</option> <option name="trellis.enabled">1</option> <option name="trellis.splitBy">code</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <option name="charting.chart.columnSpacing">35<option> panel image: here as shown in the image there are multiple codes are displaying, i want to display each one in different colours.

Posts	20
Solutions	0
Karma Given	5
Karma Received	1
Member Since	‎12-27-2022

Online Status	Offline
Date Last Visited	‎03-08-2023 01:00 PM

What is the rest API in Splunk?

How to get the percentage?

Not receiving data from particular source

How to delete or disable the orphaned searches?

How to create rex to extract field?

When I am using this search, I am not getting accu...

How to add inputlookup file in the query

How to add customized color to a chart in dashboar...

Re: Need to know the Rest API in splunk

Re: Need to know the Rest API in splunk

Re: Need to know the Rest API in splunk

Re: Need to know the Rest API in splunk

What is the rest API in Splunk?

Re: Need to get the percentage

How to get the percentage?

Re: Not receiving data from particular source

Re: Not receiving data from particular source

Not receiving data from particular source

Re: how to delete or disable the orphaned searches

Re: Need rex to extract field.

Re: how to delete or disable the orphaned searches

How to delete or disable the orphaned searches?

How to create rex to extract field?

Re: Need assistance for one of the query

Re: Need assistance for one of the query

When I am using this search, I am not getting accu...

How to add inputlookup file in the query

How to add customized color to a chart in dashboar...