Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About Splunkerninja
Splunkerninja
Path Finder
Member since:
11-07-2023
11-27-2024
Community Statistics
| Posts | 34 |
| Solutions | 0 |
| Karma Given | 10 |
| Karma Received | 0 |
| Member Since | 11-07-2023 |
Activity Feed
- Posted Re: Send email to multiple users with respective data based on the result from search on Splunk Cloud Platform. 11-21-2024 05:21 AM
- Posted Send email to multiple users with respective data based on the result from search on Splunk Cloud Platform. 11-19-2024 05:03 AM
- Tagged Send email to multiple users with respective data based on the result from search on Splunk Cloud Platform. 11-19-2024 05:03 AM
- Posted Throttling not working on alert in Splunk Cloud on Splunk Cloud Platform. 09-12-2024 02:00 AM
- Karma Re: expression to capture all the delimiters and replace with space for richgalloway. 09-12-2024 01:48 AM
- Posted expression to capture all the delimiters and replace with space on Splunk Cloud Platform. 05-15-2024 12:38 AM
- Tagged expression to capture all the delimiters and replace with space on Splunk Cloud Platform. 05-15-2024 12:38 AM
- Posted Data ingestion stopped from Splunk Add-on for Microsoft Office 365 on Splunk Cloud Platform. 05-08-2024 03:28 AM
- Karma Re: How to add download button while hiding the result s of the panel for renjith_nair. 04-30-2024 01:28 AM
- Posted Fields extracted not appearing while searching on Splunk Search. 04-25-2024 11:21 AM
- Tagged Fields extracted not appearing while searching on Splunk Search. 04-25-2024 11:21 AM
- Tagged Fields extracted not appearing while searching on Splunk Search. 04-25-2024 11:21 AM
- Posted Re: How to add download button while hiding the result s of the panel on Splunk Cloud Platform. 04-25-2024 06:12 AM
- Karma Re: How to add download button while hiding the result s of the panel for renjith_nair. 04-25-2024 06:11 AM
- Posted Re: How to add download button while hiding the result s of the panel on Splunk Cloud Platform. 04-25-2024 12:06 AM
- Posted Re: Daily Ingest per index for last 7 days on Monitoring Splunk. 04-24-2024 04:26 AM
- Posted Re: Daily Ingest per index for last 7 days on Monitoring Splunk. 04-24-2024 02:45 AM
- Posted Daily Ingest per index for last 7 days on Monitoring Splunk. 04-24-2024 01:28 AM
- Tagged Daily Ingest per index for last 7 days on Monitoring Splunk. 04-24-2024 01:28 AM
- Posted Re: How to add download button while hiding the result s of the panel on Splunk Cloud Platform. 04-23-2024 11:31 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-21-2024
05:21 AM
Thanks for the response. The thing is this alert should trigger every day once and it should be dynamic as the result keeps changing. Based on your comment it looks like I need to redo every time I have to send the reports 'Once the done_sending_email.csv and list_all_emails.csv lookup tables are almost the same size, (done_sending_email.csv will be +1 bigger if it has the filler value) then the emails are all sent out. You can then disable the alert, or you can empty the done_sending_email.csv file if you'd like to send another wave of emails.'
... View more
11-19-2024
05:03 AM
Hi, I have search which populates results with email address for 1000+users. I need to send ONLY the result tagged to appropriate user via email.I have tried couple of solutions from the community, but it didn't help me. I want to combine all the results assosciated for indivual user and send them one single email as the data will be more, I don't want to spam their inbox. For example: result having 4, 5, 6 should be send in one email only to malik@gmail.com and so on for other users. Please suggest
... View more
Labels
09-12-2024
02:00 AM
I have an alert which I am trying to throttle based on few fields from the alert on condition if it triggers once then it shouldn't trigger for next 3 days unless it has different results. But the alert is running every 15 mins and I can see same results of the alert every 15 mins. My alert is outputting the results to another index Example: blah blah , , , , , , , , | collect index=testindex sourcetype=testsourcetype Based on my research, I came across a post where it says Since a pipe command is still part of the search, throttling would have no effect o because the search hasn't completed yet and can't be throttled. I think this because the front end says After an alert is triggered, subsequent alerts will not be triggered until after the throttle period, but that doesn't say "they aren't run" Is it the case? If so how can I stop updating the duplicate values in my index
... View more
Labels
- Labels:
-
Splunk Investigate
-
troubleshooting
05-15-2024
12:38 AM
Hi, I have to replace all the possible delimiters in the field with space so that I capture each word separately. Example: 5bb2a5-bb04-460e-a7bc-abb95d07a13_Setgfub.jpg I need to remove the extension as well it could be anything so .csv or .xslx or .do I need the output as below 5bb2a8d5 bb04 460e a7bc bb995d07a13 Setgfub I came up with expression which works fine but i need this either in regular expression or eval expression as I am using it for data model. | makeresults
| eval test="ton-o-mete_r v4.pdf"
| rex field=test mode=sed "s/\-|\_|\.|\(|\)|\,|\;/ /g"
| eval temp=split('test'," "
... View more
05-08-2024
03:28 AM
Hi, We have stopped getting o365 logs when looked for the errors I see the below error. Does it mean client secret is expired? level=ERROR pid=22156 tid=MainThread logger=splunk_ta_o365.modinputs.management_activity pos=utils.py:wrapper:72 | datainput=b'xoar_Management_Exchange' start_time=1715152233 | message="Data input was interrupted by an unhandled exception."
Traceback (most recent call last):
File "/opt/splunk/etc/apps/splunk_ta_o365/lib/splunksdc/utils.py", line 70, in wrapper
return func(*args, **kwargs)
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/management_activity.py", line 135, in run
executor.run(adapter)
File "/opt/splunk/etc/apps/splunk_ta_o365/lib/splunksdc/batch.py", line 54, in run
for jobs in delegate.discover():
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/management_activity.py", line 225, in discover
self._clear_expired_markers()
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/management_activity.py", line 294, in _clear_expired_markers
checkpoint.sweep()
File "/opt/splunk/etc/apps/splunk_ta_o365/lib/splunksdc/checkpoint.py", line 86, in sweep
return self._store.sweep()
File "/opt/splunk/etc/apps/splunk_ta_o365/lib/splunksdc/checkpoint.py", line 258, in sweep
indexes = self.build_indexes(fp)
File "/opt/splunk/etc/apps/splunk_ta_o365/lib/splunksdc/checkpoint.py", line 189, in build_indexes
indexes[key] = pos
File "/opt/splunk/etc/apps/splunk_ta_o365/lib/sortedcontainers/sorteddict.py", line 300, in __setitem__
dict.__setitem__(self, key, value)
MemoryError
... View more
Labels
- Labels:
-
administration
-
troubleshooting
04-25-2024
11:21 AM
Hi, I have extracted fields manually in Splunk cloud, The regex works perfectly in the field extraction preview page but while seraching fields are not showing up. I have kept the permission to global, searching in verbose mode,set the coverage to All fields. I am trying to extract 6 fields(all the regex are working in preview page)out of which only one field(IP address) is showing in search.I have debugged and refreshed the page bumped it as well. Funny part if i use default regex expression in Splunk instead of writing my own regex then fields pops in search. Also, I have observed couple of fields showing up and then disappearing while searching Sample data : nCountry: United States\nPrevious Country nCountry\:\s(?<country>.+?)\\\nPrevious\sCountry I have referred almost all the splunk answers but none of the solution fixed my problem. I am intruiged to know why is it not working? Thanks in advance
... View more
Labels
- Labels:
-
metadata
-
search job inspector
04-25-2024
06:12 AM
@renjith_nair Thank You for the response. I keep getting check "network internet connection" when I click on download button and it is failing to download. I was able to download the report once but later I keep getting this error? I know for a fact it is not internet issue because I able to download the other panels data directly when i click the default export button which is there in Splunk. Is it something related to my code? <row depends="$hide_this_always$">
<panel>
<table>
<search>
<done>
<eval token="date">strftime(now(), "%d-%m-%Y")</eval>
<set token="sid">$job.sid$</set>
</done>
<query>index=_internal</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
<row>
<panel>
<html>
<a href="/api/search/jobs/$sid$/results?isDownload=true&maxLines=0&count=0&filename=Vulnerability_$date$.csv&outputMode=csv" class="button js-button">Download</a>
<style>
.button {
background-color: steelblue;
border-radius: 5px;
color: white;
padding: .5em;
text-decoration: none;
}
.button:focus,
.button:hover {
background-color: #2A4E6C;
color: White;
}
</style>
</html>
</panel>
</row>
... View more
04-25-2024
12:06 AM
@ITWhisperer++++ Any suggestions pls?
... View more
04-24-2024
04:26 AM
@gcusello @bowesmana We are on splunk cloud and we use workload based management for licenseing i.e SVC . So the query which you are giving is not giving aggregate daily ingest per index for last 7 days
... View more
04-24-2024
02:45 AM
The first query is not giving me any results. Even i replaced the macro with actualy query it gives zero result. I basically want the total of daily ingest of each index over 7 days index=_internal [ rest splunk_server=local /services/server/info | return host] source=*license_usage.log* type="Usage" | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=1d | stats sum(b) as b by _time, pool, s, st, h, idx | timechart span=1d sum(b) AS volumeB by idx fixedrange=false | join type=outer _time [ search index=_internal [ rest splunk_server=local /services/server/info | return host] source=*license_usage.log* type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | dedup _time stack | stats sum(stacksz) AS "stack size" by _time] | fields - _timediff | foreach * [ eval <>=round('<>'/1024/1024/1024, 3)]
... View more
04-24-2024
01:28 AM
Hi , I came across many queries to calculate daily ingest per index for last 7 days but I am not getting the expected results. Can you please guide me with the query to calculate the daily ingest per index in GB for last 7 days?
... View more
04-23-2024
11:31 PM
I get this error if i add in different row as you mentioned above @ITWhisperer Any suggestions pls?
... View more
04-23-2024
05:31 AM
I want to add a download/export button which I am able to do so but the issue is the result of the csv is also visible in the panel like below. I want to show only the download button while hiding the results panel which I am not able to do.
<row>
<panel>
<table>
<search>
<done>
<eval token="date">strftime(now(), "%d-%m-%Y")</eval>
<set token="sid">$job.sid$</set>
</done>
<query>index=test</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
<html>
<a href="/api/search/jobs/$sid$/results?isDownload=true&timeFormat=%25FT%25T.%25Q%25%3Az&maxLines=0&count=0&filename=test_$date$.csv&outputMode=csv" class="button js-button">Download</a>
<style>
.button {
background-color: steelblue;
border-radius: 5px;
color: white;
padding: .5em;
text-decoration: none;
}
.button:focus,
.button:hover {
background-color: #2A4E6C;
color: White;
}
</style>
</html>
</panel>
</row>
... View more
Labels
- Labels:
-
configuration
-
Splunk Investigate
03-12-2024
01:05 AM
Hi , I have two searches joined using join command. The first search i need to run earliest=-60mins and the second search is using summary index here i need to fetch all the results in summary index so I need to check and run summary index for "all time" . How can this be done? I am giving earliest=-60min in my first search and time range as "all time" while scheduling the report consisting of this two searches but it is not working. I have not used any time in my summary index. Search to populate my summary index index=testapp sourcetype=test_appresourceowners earliest=-24h latest=now | table sys_id, dv_manager, dv_syncenabled, dv_resource, dv_recordactive | collect addtime=false index=summaryindex source=testapp. my scheduled report search index=index1 earlies=-60m | join host [| search index=summaryindex earliest="alltime"] | tablehost field1 field2
... View more
Labels
- Labels:
-
configuration
02-23-2024
05:12 AM
Hello, I have requirement to get logs into Splunk from Snowflake. I have no idea where to start from. I came across Splunk docs using Splunk DB connect.https://docs.splunk.com/Documentation/DBX/3.15.0/DeployDBX/Installdatabasedrivers Can you'll guide me how do i get started here? How do I get logs from Snowflake into Splunk. Can I use HEC token to- get the logs?
... View more
Labels
- Labels:
-
configuration
-
Splunk Investigate
01-24-2024
03:33 AM
Hi, I have html tags like <p> <br> <a href="www.google/com target=_blank"> & so on in my raw data, I want to capture everything except these html tags . Please help me with regex sample raw data A flaw in the way Internet Explorer handles a specific HTTP request could allow arbitrary code to execute in the context of the logged-on user, should the <UL> <LI> The first vulnerability occurs because Internet Explorer does not correctly determine an obr in a pop-up window.</LI> <LI> The t type that is returned from a Web server during XML data binding.</LI> </UL> <P> "Location: URL:ms-its:C:WINDOWSHelpiexplore.::/itsrt.htm" <P> :<P><A HREF='http://blogs.msdn.com/embres/archive/20/81.aspx' TARGET='_blank'>October Security Updates are (finally) available!</A><BR>
... View more
Labels
01-10-2024
02:44 AM
Hi, I am fetching data from service now add on to splunk for one of the service now cmdb table. While fetching the field name is splitting as below How do i fix this
... View more
Labels
11-30-2023
12:39 AM
@tscroggins Thank you but is there way we can customize the colors Categorically based like i have 3 Grades A,B,C in legend label and i want to color the tile like(A=Green,B=Orange,C=red)
... View more
11-29-2023
05:46 AM
@tej57 Thanks but how can i include _time as well in the result since after mvcombine the _time data gets dropped
... View more
11-29-2023
05:22 AM
Hi, I have 3 values and i want to display it in a single value panel like the below image which is from Tableau,I want to replicate the same in Splunk. Can it be done? If not can we represent 2 values (GPA and website) in a single value and Grade in legend? Else please suggest what other representation can i go with which displays 3 values
... View more
Labels
11-29-2023
04:01 AM
Hi, I want to display the result only for users who has both ID AR9 & AD. Below is sample data, I have about 10k results being generated with multiple values but i need to display only those users who has ID both AR9 & AD USER ID John AD John AY9 Riya AD Toby AR9 Nathan AD Nathan AR9 Sam AD Sam AR9 Thanks!
... View more
Labels
11-28-2023
06:51 AM
@ITWhisperer I want display the Grade based on the avg GPA and the below condition is not giving the result | eval Grade=case(GPA=1,"D", GPA>1 AND GPA<=1.3,"D+")]
... View more
- Tags:
- avg
11-28-2023
05:15 AM
Hi, I want to find the grade based on my Case condition but my query is not working as expected. | eval Grade=case(Cumulative=1,"D", Cumulative>1 AND Cumulative<=1.3,"D+")] Example: My Grade should be based on the avg(GPA) If Avg(GPA) is 1 Grade at the bottom (Avg Grade)should be D , If it is between 1-1.3 then it should be D+
... View more
Labels
11-22-2023
12:14 AM
@gcusello Yes, I did reduce upto 20 kb but still the image is not loading.
... View more
11-22-2023
12:03 AM
@gcusello Yes the URL is referring to the image and it is of 76kb in png format.Still facing the issue
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-27-2024
04:07 AM
|
Karma given to
