Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About devsru
devsru
Explorer
Member since:
08-03-2023
02-13-2025
Community Statistics
| Posts | 36 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 08-03-2023 |
Activity Feed
- Posted Re: How to Parse raw events with some json data to JSON format on Getting Data In. 02-13-2025 11:32 AM
- Posted How to Parse raw events with some json data to JSON format on Getting Data In. 02-13-2025 10:32 AM
- Tagged How to Parse raw events with some json data to JSON format on Getting Data In. 02-13-2025 10:32 AM
- Tagged How to Parse raw events with some json data to JSON format on Getting Data In. 02-13-2025 10:32 AM
- Tagged How to Parse raw events with some json data to JSON format on Getting Data In. 02-13-2025 10:32 AM
- Tagged How to Parse raw events with some json data to JSON format on Getting Data In. 02-13-2025 10:32 AM
- Posted Re: How to send hard coded message as an email from Splunk on Splunk Search. 12-20-2024 12:49 AM
- Posted How to send hard coded message as an email from Splunk on Splunk Search. 12-19-2024 07:26 AM
- Posted How to pass multiple fields in Case or IF commands on Splunk Search. 09-04-2024 06:45 PM
- Tagged How to pass multiple fields in Case or IF commands on Splunk Search. 09-04-2024 06:45 PM
- Tagged How to pass multiple fields in Case or IF commands on Splunk Search. 09-04-2024 06:45 PM
- Posted Re: Setup an alerts with events from Timestamp format on Splunk Search. 07-01-2024 07:37 AM
- Posted Setup an alerts with events from Timestamp format on Splunk Search. 07-01-2024 06:34 AM
- Posted Splunk OTEL Collector throwing Timeout and Authentication error. on Getting Data In. 09-26-2023 07:54 AM
- Tagged Splunk OTEL Collector throwing Timeout and Authentication error. on Getting Data In. 09-26-2023 07:54 AM
- Posted Re: How to change color of a Panel based on String on Splunk Search. 08-10-2023 06:05 AM
- Posted Re: How to change color of a Panel based on String on Splunk Search. 08-10-2023 12:55 AM
- Posted Re: How to change color of a Panel based on String on Splunk Search. 08-09-2023 11:54 PM
- Posted Re: How to change color of a Panel based on String on Splunk Search. 08-09-2023 11:13 PM
- Karma Re: How to change color of a Panel based on String for ITWhisperer. 08-09-2023 08:10 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-13-2025
11:32 AM
Hi. Thanks for your reply but input is firehose AWS and we don’t have inputs. Is it possible for you to review my props.conf and if you can test in any dummy environment
... View more
02-13-2025
10:32 AM
Hi All, I am trying to parse raw data with json elements to proper JSON format in Splunk. I have tried multiple props.conf but failed to parse it as per expected output. Below I have attached the data coming as a single event on Splunk and expected data what we want to see. Can someone please correct my props.conf ? Events on Splunk with default sourcetype {"messageType":"DATA_MESSAGE","owner":"381491847064","logGroup":"tableau-cluster","logStream":"SentinelOne Agent Logs","subscriptionFilters":["splunk"],"logEvents":[{"id":"38791169637844522680841662226148491272212438883591651328","timestamp":1739456206172,"message":"[2025-02-13 15:16:41.413885] [110775] [error] full_file_overwrite_flag: failed to stat /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24388.tmp: stat failed on path: /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24388.tmp: No such file or directory\n[2025-02-13 15:16:42.213970] [110823] [error] full_file_overwrite_flag: failed to stat /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/hyper_transient.112335.24390.tmp: stat failed on path: /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/hyper_transient.112335.24390.tmp: No such file or directory\n[2025-02-13 15:16:42.214870] [110830] [error] full_file_overwrite_flag: failed to stat /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24389.tmp: stat failed on path: /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24389.tmp: No such file or directory\n[2025-02-13 15:16:42.218488] [110823] [error] full_file_overwrite_flag: failed to stat /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24391.tmp: stat failed on path: /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24391.tmp: No such file or directory\n[2025-02-13 15:16:43.815051] [110827] [error] full_file_overwrite_flag: failed to stat /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24392.tmp: stat failed on path: /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24392.tmp: No such file or directory\n[2025-02-13 15:16:44.617525] [110773] [error] full_file_overwrite_flag: failed to stat /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24394.tmp: stat failed on path: /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24394.tmp: No such file or directory\n[2025-02-13 15:16:45.413954] [110823] [error] full_file_overwrite_flag: failed to stat /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24393.tmp: stat failed on path: /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24393.tmp: No such file or directory"},{"id":"38791169749325947928296247310685546917181598051987750913","timestamp":1739456211171,"message":"[2025-02-13 15:16:47.014642] [110770] [error] full_file_overwrite_flag: failed to stat /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/hyper_transient.112335.24395.tmp: stat failed on path: /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/hyper_transient.112335.24395.tmp: No such file or directory\n[2025-02-13 15:16:47.813934] [110823] [error] full_file_overwrite_flag: failed to stat /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24396.tmp: stat failed on path: /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24396.tmp: No such file or directory\n[2025-02-13 15:16:47.814459] [110828] [warning] DV process create: Couldn't fetch grandparent process of process 26395 from the data model\n[2025-02-13 15:16:47.815399] [110828] [warning] DV process create: Couldn't fetch grandparent process of process 26396 from the data model\n[2025-02-13 15:16:47.816855] [110827] [error] full_file_overwrite_flag: failed to stat /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24397.tmp: stat failed on path: /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24397.tmp: No such file or directory\n[2025-02-13 15:16:48.616944] [110825] [error] full_file_overwrite_flag: failed to stat /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream Expected Output with fiedls extraction {
"messageType": "DATA_MESSAGE",
"owner": "381491847064",
"logGroup": "tableau-cluster",
"logStream": "SentinelOne Agent Logs",
"subscriptionFilters": ["splunk"],
"logEvents": [
{
"id": "38791169637844522680841662226148491272212438883591651328",
"timestamp": 1739456206172,
"message": "[2025-02-13 15:16:41.413885] [110775] [error] full_file_overwrite_flag: failed to stat /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24388.tmp: stat failed on path: /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24388.tmp: No such file or directory\n[2025-02-13 15:16:42.213970] [110823] [error] full_file_overwrite_flag: failed to stat /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/hyper_transient.112335.24390.tmp: stat failed on path: /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/hyper_transient.112335.24390.tmp: No such file or directory\n[2025-02-13 15:16:42.214870] [110830] [error] full_file_overwrite_flag: failed to stat /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24389.tmp: stat failed on path: /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24389.tmp: No such file or directory\n[2025-02-13 15:16:42.218488] [110823] [error] full_file_overwrite_flag: failed to stat /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24391.tmp: stat failed on path: /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24391.tmp: No such file or directory\n[2025-02-13 15:16:43.815051] [110827] [error] full_file_overwrite_flag: failed to stat /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24392.tmp: stat failed on path: /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24392.tmp: No such file or directory\n[2025-02-13 15:16:44.617525] [110773] [error] full_file_overwrite_flag: failed to stat /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24394.tmp: stat failed on path: /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24394.tmp: No such file or directory\n[2025-02-13 15:16:45.413954] [110823] [error] full_file_overwrite_flag: failed to stat /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24393.tmp: stat failed on path: /app/tableau/tableau_data/data/tabsvc/temp/hyper_0.20233.24.0718.1630/copyexternalstream.112335.24393.tmp: No such file or directory"
}
]
} Props.conf [json_splunk_logs]
# Define the source type for the logs
sourcetype = json_splunk_logs
# Time configuration - Parse the timestamp in your message
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6N
TIME_PREFIX = \["message"\] \[
# Specify how to break events in the multiline message
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
# Event timestamp extraction
DATETIME_CONFIG = NONE
# JSON parsing - This tells Splunk to extract fields from JSON automatically
KV_MODE = json
# The timestamp is embedded in the message, so the following configuration is necessary for time extraction.
EXTRACT_TIMESTAMP = \["messageType":"DATA_MESSAGE","owner":"\d+","logGroup":"\w+","logStream":"\w+","subscriptionFilters":\[\\"splunk\\"\],\s"timestamp":(\d+),".*?
... View more
Labels
- Labels:
-
field extraction
-
inputs.conf
-
JSON
-
props.conf
12-20-2024
12:49 AM
Thanks for the query. I need to send an alert a day before daylight savings in europe i.e Sun, Mar 30, 2025 – Sun, Oct 26, 2025 Could you please tell me how to update this query. Lets say run at 2 PM the day before with the message.
... View more
12-19-2024
07:26 AM
Hi Everyone, I need to send a hard coded message to the users just before every daylight savings of the year saying "Daylight savings is scheduled tomorrow, please be alerted " and i don't want to use any index for the that but just hard coded message. Is it possible to create an alert based on the requirement.
... View more
09-04-2024
06:45 PM
Hi Everyone,
I have some events with the field Private_MBytes and host = vmt/vmu/vmd/vmp
I want to create a case when host is either vmt/vmu/vmd and Private_MBytes > 20000 OR when host is vmp and Private_MBytes > 40000 then it should display the events with severity_id 4. Example
eval severity_id=if(Private_MBytes >= "20000" AND host IN [vmd*,vmt*,vmu*],4,2)
eval severity_id=if(Private_MBytes >= "40000" AND host ==vmp*,4,2)
Note : if Private_MBytes > 40000, and then if there is any vmd/vmu/vmt it should display severity_id 4 only and for vmp also.
... View more
07-01-2024
07:37 AM
Thanks for your answer but in my case _time may only appear once in 2 days when we have a new update and incident resolve state change to true. Can we do something that my startDateTime checks with the latest time of the scheduled alert and raise an alarm if it is more than 4 hours ?
... View more
07-01-2024
06:34 AM
Dear All, I want to setup an alert in an event. The event contains three timestamps, New Event time, Last update, and startDate time. So these are the logs coming from MS365. I want the Alert if one of the field "Incident Resolved = False" is satisfied even after 4 hours of startDate time. So we receive first event at startDate but we don't want an alert until 4 hours of startDate . startDateTime: 2024-07-01T09:00:00Z
... View more
Labels
- Labels:
-
eval
-
field extraction
-
regex
-
stats
09-26-2023
07:54 AM
We are seeing some Timeout and Authentication error while collecting data from OTEL kubernetes collector through HEC, Could anyone please let me know if there is a need to change limits in config files. Below are the errors 2023-09-26T14:47:17.613Z info exporterhelper/queued_retry.go:433 Exporting failed. Will retry the request after interval. {"kind": "exporter", "data_type": "metrics", "name": "splunk_hec/platform_metrics", "error": "Post \"https://xyz:8088/services/collector\": net/http: request canceled (Client.Timeout exceeded while awaiting headers)", "interval": "2.769200676s"} 2023-09-26T14:47:11.590Z error exporterhelper/queued_retry.go:401 Exporting failed. The error is not retryable. Dropping data. {"kind": "exporter", "data_type": "metrics", "name": "splunk_hec/platform_metrics", "error": "Permanent error: \"HTTP/1.1 401 Unauthorized\\r\\nContent-Length: 148\\r\\nCache-Control: private\\r\\nConnection: Keep-Alive\\r\\nContent-Type: text/xml; charset=UTF-8\\r\\nDate: Tue, 26 Sep 2023 14:47:11 GMT\\r\\nServer: Splunkd\\r\\nVary: Authorization\\r\\nX-Content-Type-Options: nosniff\\r\\nX-Frame-Options: SAMEORIGIN\\r\\n\\r\\n<?xml version=\\\"1.0\\\" encoding=\\\"UTF-8\\\"?>\\n<response>\\n <messages>\\n <msg type=\\\"WARN\\\">call not properly authenticated</msg>\\n </messages>\\n</response>\\n\"", "dropped_items": 31}
... View more
- Tags:
- hec
Labels
- Labels:
-
data
-
HTTP Event Collector
-
indexer
-
JSON
08-10-2023
06:05 AM
@ITWhisperer That’s exactly what I want to achieve. I need separate panels for each host, then later I can merge them in 2-3 rows accordingly. this is exactly the situation right now in my dashboard but presently I am getting numbers(counts) for each server whereas I just want to display server name. I know it is a small SPL change but I am not able to fix it 😞
... View more
08-10-2023
12:55 AM
@ITWhisperer The requirement is attached. Right now we are displaying count of the Severity (Critical,OK,Medium) of the hosts but requirement is to display servernames. Requirement Present condition
... View more
08-09-2023
11:54 PM
@ITWhisperer This is the final code. There is a base search at top and the panel search query that we have modified together. There will be 20 servers but in the example I am showing only one panel with host = XYZ*. Right now it is displaying correct color but count of total "Severities". I want the same criteria to evaluate the colors but show "server name" instead of "Count" <dashboard version="1.1" theme="dark">
<search id="base_search">
<query>| inputlookup kv_cmdb_as_entity_kpi_lookup WHERE NOT kpi="*~~*" AND host IN (X,Y)
[
search index="itsi_grouped_alerts" kpi=* severity=* entity_name=* earliest=-60m@m
| stats latest(_time) as time latest(severity) as severity by entity_name kpi
| eval host=lower(mvindex(split(entity_name, "."), 0))
| table host kpi severity time
]
| eval severity=coalesce(severity, 2), n=now(), time=coalesce(time, n), time=strftime(time, "%Y-%m-%d %H:%M:%S")
| fields - n _key _timediff
| sort - severity host kpi
| eval severity=case(severity == 2, "OK", severity == 4, "MEDIUM", severity == 6, "CRITICAL")
| fields host kpi severity
| rename host as Host, kpi as KPI, severity as Severity
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<label>Application Dashboard</label>
<row>
<panel depends="$alwaysHide$">
<html>
<style>
#single_prd text {
fill: $single_text_colour$ !important;
}
</style>
</html>
</panel>
<panel>
<title>PRD</title>
<single id="single_prd">
<title>Server Name</title>
<search base="base_search">
<query>| search Host=xyz* Severity=*
| stats count count(eval(Severity=="CRITICAL")) as _critical count(eval(Severity=="OK")) as _ok count(eval(Severity=="MEDIUM")) as _medium
| eval _colour=case(_critical>0 AND _medium>0,"red",_critical=0 AND _medium>0,"yellow","_critical=0 AND _medium=0,"green",_critical>0 AND _medium=0, "red")
<done>
<set token="single_text_colour">$result._colour$</set>
</done>
</search>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="drilldown">all</option>
<option name="numberPrecision">0</option>
<option name="refresh.display">progressbar</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useColors">0</option>
<option name="useThousandSeparators">1</option>
</single>
</panel>
</row>
</dashboard>
... View more
08-09-2023
11:13 PM
Hi @ITWhisperer I have received a final change in requirement. Instead of Numbers to be colored , we need the server name to be colored. We are not interested in the count. Can you assist me how to display only colored server names based on SEVERITY. <query>| search Host=xyz* Severity=*
| stats count count(eval(Severity=="CRITICAL")) as _critical count(eval(Severity=="OK")) as _ok count(eval(Severity=="MEDIUM")) as _medium
| eval _colour=case(_critical>0 AND _medium>0,"red",_critical=0 AND _medium>0,"yellow","_critical=0 AND _medium=0,"green",_critical>0 AND _medium=0, "red")
... View more
08-09-2023
08:09 AM
@ITWhisperer If you can see the SPL's, I am passing a single token $host$ so If I am clicking on either OS, it automatically check which SPL it belongs to. This seems to be working except the Windows token where we are seeing additional fields apart from the correct data.
... View more
08-09-2023
07:48 AM
@ITWhisperer There are two SPL queries combined. I am passing a token from another dashboard. When it is Linux server token, I want to see first SPL results, when it is Windows server Token , I want to see second SPL result but I want to retain one panel only and no combination of fields from these two searches which are appended.
... View more
08-09-2023
07:45 AM
@ITWhisperer I am not checking the query before replying 😞 I set it to red now. | eval _colour=case(_critical>0 AND _medium>0,"red",_critical=0 AND _medium>0,"yellow","_critical=0 AND _medium=0,"green",_critical>0 AND _medium=0, "red")
... View more
08-09-2023
07:43 AM
@ITWhisperer The problem is If I remove the fields after append then it will delete these fields for the first SPL which used these fields. Tricky
... View more
08-09-2023
07:31 AM
@ITWhisperer Thanks for pointing it out as i am new in SPL 😞 Is this alright ? | eval _colour=case(_critical>0 AND _medium>0,"red",_critical=0 AND _medium>0,"yellow","_critical=0 AND _medium=0,"green",_critical>0 AND _medium=0, "yellow")
... View more
08-09-2023
07:19 AM
@ITWhisperer | mstats latest(df_metric.Used_KB) as "Used_KB", latest(df_metric.Avail_KB) as "Avail_KB", latest(df_metric.UsePct) as "UsePct", WHERE (`itsi_entity_type_ta_nix_metrics_indexes`) AND host=$host$ (earliest="-5m" latest="now") by Filesystem, MountedOn, Type | eval UsePct=round(UsePct,2), Used_KB=round(Used_KB), Avail_KB=round(Avail_KB) |append [ | mstats min("LogicalDisk.%_Free_Space") prestats=true WHERE (`itsi_entity_type_windows_metrics_indexes`) AND host=$host$ span=1m AND NOT "instance"="_Total" by instance | timechart span=1m min("LogicalDisk.%_Free_Space") as val by instance | eval val=100-val | fields - Filesystem, MountedOn, Type | head 1]
... View more
08-09-2023
07:17 AM
@ITWhisperer Indeed it was a typo 🙂 | stats count count(eval(Severity=="CRITICAL")) as _critical count(eval(Severity=="OK")) as _ok count(eval(Severity=="MEDIUM")) as _medium | eval _colour=case(_critical>0 AND _medium>0,"red",_critical=0 AND _medium>0,"yellow","_critical=0 AND _medium=0,"green")
... View more
08-09-2023
07:07 AM
@ITWhisperer @yuanliu Below attached is the final result with append command. I want to ignore the fields with no data. How can it be done as fields - is not working.
... View more
08-09-2023
07:00 AM
@ITWhisperer I managed to do this with below query. Thanks for all your help | stats count count(eval(Severity=="CRITICAL")) as _critical count(eval(Severity=="OK")) as _ok count(eval(Severity=="MEDIUM")) as _medium | eval _colour=case(_critical>0 AND _medium>0,"red","green",_critical=0 AND _medium>0,"yellow","green",_critical=0 AND _medium=0,"green","red")
... View more
08-09-2023
06:36 AM
@ITWhisperer Can you tell me the correct quere based on the case mentioned in my previous reply. | stats count count(eval(Severity=="CRITICAL")) as _critical
| eval _colour=if(_critical>0,"red","green")</query>
... View more
08-09-2023
06:18 AM
@ITWhisperer so how can we ignore the fields ? They are not looking nice in the dashboard. I can’t remove before append because some searches are producing data using that SPL
... View more
08-09-2023
12:46 AM
@ITWhisperer The requirement is if we have atleast one Severity count as "CRITICAL" change the color to Red. No matter if we have "MEDIUM" or "OK" events. If "MEDIUM" and "OK" but no "CRITICAL" then AMBER if "OK" only then green
... View more
08-08-2023
11:35 PM
Hi @ITWhisperer Wonderful. The solution seems to be working. I have a small modification in requirement. If the Severity is "Critical" then it should display Red, If "OK" then green , if "Amber" then yellow. Can you please help me with that.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-13-2025
04:41 PM
|
