About senthild

senthild · ‎05-20-2024

data ingesting via Universal forwarder rawdata on host : user reported no broke with data eg: persistuser with proper time stamp and currently defaul config in props.conf

senthild · ‎05-17-2024

5/17/24 12:45:46.313 PM persistuse Environment = LTQ3 In the above event character "r" is missing on word persistuse ( but exist in raw_data on host ) hence the events are creating without timestamp and getting data quality issues how this can be fixed

senthild · ‎02-06-2024

i have my json data where sometimes we are unable to see the status: closed field in some of the events as i want to write a regex to bring this in event state: { [-] alert_id: orca-8452634 closed_reason: null closed_time: null created_at: 2023-07-06T11:41:18+00:00 high_since: null in_verification: null is_new_score: null last_seen: 2024-02-04T11:38:11+00:00 last_updated: 2024-02-05T13:45:45+00:00 low_since: 2024-02-05T13:45:45+00:00 orca_score: 7 risk_level: high rule_source: null score: 2 severity: imminent compromise status: closed status_time: 2024-02-05T13:45:45+00:00 verification_status: null Can anyone help us to close this

senthild · ‎01-17-2024

we have a log ingestion from aws cloud env via HTTP event collector to splunk , one of the user reporting some of the logs which is missing in splunk is there any log file to validate this or if there is any connectivity drop in http to cloud apps how to validate this

senthild · ‎01-10-2024

we have an scheduled alert configured in splunk which is working fine as per event from the user logs but its delayed in sending email as alert notification

senthild · ‎01-03-2024

splunk query "Orca High Alerts" is connected to snow TEST environment. It is showing many more close records than open records. When filtering the splunk query results with a wide time window and a unique event id on splunk side both open and close lines appear but both have exact same timestamp - suspect splunk only sends the close if the open and the close have the exact same timestamp - is there a way to validate this?

senthild · ‎01-02-2024

one for the search query from splunk AWS index="aws_cloud" | search eventname="value1" OR "value2" OR "value3" The above search query is giving the events for the all the above searched one also giving one more value which didn't searched eventName: LookupEvents ==> getting this field and value which didn't search

Posts	7
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎01-02-2024

Online Status	Offline
Date Last Visited	‎05-20-2024 07:18 AM

character is missing on word in splunk event

HTTP event collector log troubleshooting

Delayed Email Alert

Splunk integration with MTE not sending every reco...

one of the field value showing results which didn'...

Re: character is missing on word in splunk event

character is missing on word in splunk event

Re: Regular expression for json

HTTP event collector log troubleshooting

Delayed Email Alert

Splunk integration with MTE not sending every reco...

one of the field value showing results which didn'...

Join the Conversation