About ssuluguri

ssuluguri · ‎08-07-2024

Appreciated for the time you spent on it , it worked .

ssuluguri · ‎08-05-2024

Overall our requirement is that " We are passing a lookup where both Primary and Secondary devices defined , if only both stopped sending the events then we need to display the hosts " this is the query I prepared , but not giving the exact requirement , can you optimize , help . | tstats count max(_time) AS latest_event_time where index=firewall sourcetype="cisco:ftd" [| inputlookup Firewall_list.csv | table Primary | Rename Primary AS host] groupby host | append [|inputlookup Firewall_list.csv | table Primary | Rename Primary AS host | eval count=0] | stats sum(count) as count max(latest_event_time) AS latest_event_time by host |rename host as Pri |append [| tstats count max(_time) AS latest_event_time where index=firewall sourcetype="cisco:ftd" [| inputlookup Firewall_list.csv | table Secondary | Rename Secondary AS host] groupby host | append [|inputlookup Firewall_list.csv | table Secondary | Rename Secondary AS host | eval count=0] | stats sum(count) as count max(latest_event_time) AS latest_event_time by host |rename host as Sec] Host are in lookup

ssuluguri · ‎08-05-2024

Thanks a lot it worked . Adding to that I m passing two values from lookup as below , if both hosts event count is zero then I need the result to display the host name which are passing from lookup . Can you help me here .

ssuluguri · ‎08-02-2024

This is not giving results which needed , I see 0 for each entry from lookup

ssuluguri · ‎08-02-2024

Thanks for your time , I see the data which is coming 0 for each entry coming from lookup but it should give only value 0 for the host which is not sending events .

ssuluguri · ‎08-01-2024

Hi Splunkers, My requirement is below . I have lookup where 7 hosts defined . when my search is running for both tstats and stats I only get 5 hosts count which are greater than 0 . Can someone help how can we get count 0 for the field which we are passing from lookup . Query : | tstats count max(_time) AS latest_event_time where index=firewall sourcetype="cisco:ftd" [| inputlookup Firewall_list.csv | table Primary | Rename Primary AS host] groupby host

ssuluguri · ‎01-12-2024

Hi Team, We have SH Cluster as below . 3 SHs members,1 Deployer. We have few alerts keep on firing with splunk@<> sender even though we configured our customised sender and also few alerts were disabled but still they are firing from same one SH cluster members and from other 2 not(which is expected). Raised multiple vendor cases but no help. Can someone help

ssuluguri · ‎10-23-2023

We are on splunk platform . We have server reporting to on prem Deployment servers and outputs configured to send cloud indexers .

ssuluguri · ‎10-20-2023

Hi All, We have various splunk UFs running on windows ,unix machines . We are planning to upgrade all the versions to latest universal forwarder . We have versions from : 6.5.0 to 8.2.7 . Our plan to upgrade to 9.x Can someone help intermediate versions to upgrade from 6.5.0 to 9.X

ssuluguri · ‎07-26-2023

Transparent Mode .

ssuluguri · ‎07-26-2023

Hi Team, I have created a federated provider and test connection successful . what will be our next steps ? is federated index mandatory to create ? if yes all the indexes across SHs should be created ?'

ssuluguri · ‎07-14-2023

Hi all , We have a scripted input and when its exaction started we are keep on getting "INFO prior run of stanza 'ExchangeClientExperience' is still in progress. Skip this one" . If anyone experiencing and got resolution , please help us too.

ssuluguri · ‎07-12-2023

You can also refer below screenshot.

ssuluguri · ‎07-12-2023

Thanks for the reply Meet. 1.Data is indexing on cloud 2.Data automatically populating for sometimes and going OFF. Backend raw data .

ssuluguri · ‎07-11-2023

Hi Team, We are ingesting data from syslot to splunk using Cyberark App . Data is going ON and OFF even though data available on /var/log/Cyberark . Can you suggest what can be the issue .

ssuluguri · ‎06-30-2023

I was getting same error, but after splunk restarted data started collecting

ssuluguri · ‎05-27-2023

ssuluguri · ‎05-27-2023

Hi Team, I have requested to turn on HSH and they shared the Manager_uri and pass key but when trying to add its getting failed . Can someone help .

ssuluguri · ‎05-01-2023

Hi , I have got similar request to configure between splunk cloud and powerBI , I am getting below error . "Verify the server URL. Error parsing JSON: Expect either an object or array at root" Can someone help on this .

ssuluguri · ‎04-25-2023

Hi Team, We have received a request to pull data from Rest API . Can you please help with any document which can help to configure .

ssuluguri · ‎04-24-2023

@VatsalJagani : Can you give more information on those two links you shared. which app best suits ? what are the prr-requisites? any mandatory configuration ? If you dont mind can you give step by step process .

ssuluguri · ‎04-19-2023

Hi team, We have got a requirement "some dashboarding in PowerBI and connecting it to Splunk for data." Is it possible in splunkcloud environment ? If yes , can you please help me with steps to configure

ssuluguri · ‎04-13-2023

Hi Team, We have a custom which is creating incident in SNOW , if the alert triggered from Splunk . But from past few days its not happening and getting this error . "ERROR sendmodalert [4016 AlertNotifierWorker-0] - action=sn_sec_incident_alert_admin STDERR - Failed to create an incident in snow". Your help is much needed and appreciated

ssuluguri · ‎04-10-2023

Hi Team, I have a custom app which is integrated to snow . Our upgrade readiness app shows it need update " Issue: File path contains an outdated Python SDK. Update to the latest Python SDK. " Can someone help how can I update custom app python SDK .

ssuluguri · ‎04-06-2023

My issues resolved after performing below steps. Issue on windows machine . 1.Removed splunk certificates from machine 2.Removed server.pem Restarted splunk and KV store READY. Thanks for your time.

Posts	40
Solutions	1
Karma Given	21
Karma Received	1
Member Since	‎01-23-2023

Online Status	Offline
Date Last Visited	‎08-07-2024 04:03 PM

How to get count 0 for the field value which is no...

Disabled alerts are triggering from SH cluster mem...

Universal forwarder upgrade matrix

Federated search head validation

Powershell script execution issue | INFO prior run...

Indexing issue- Why is data going on and off?

How to enable Hybrid Search head?

How to configure REST API to Splunk?

Is it possible to connect Splunk data to PowerBI?

Splunk to Service Now incident creation fail

Re: How to get count 0 for the field value which i...

Re: How to get count 0 for the field value which i...

Re: How to get count 0 for the field value which i...

Re: How to get count 0 for the field value which i...

Re: How to get count 0 for the field value which i...

How to get count 0 for the field value which is no...

Disabled alerts are triggering from SH cluster mem...

Re: Universal forwarder upgrade matrix

Universal forwarder upgrade matrix

Re: Federated search head validation

Federated search head validation

Powershell script execution issue | INFO prior run...

Re: Indexing issue

Re: Indexing issue

Indexing issue- Why is data going on and off?

Re: Why is KV Store initialization failing on one ...

Re: Not able to enable Hybrid Search head

How to enable Hybrid Search head?

Re: odbc connector

How to configure REST API to Splunk?

Re: Splunk data to PowerBI

Is it possible to connect Splunk data to PowerBI?

Splunk to Service Now incident creation fail

Issue: File path contains an outdated Python SDK....

Re: Kvstore failed on SHs and indexers

Are you a member of the Splunk Community?