About sankardevarajan

sankardevarajan

I started work with splunk itsi platform, interested to learn itsi tool, looking for study resources. Topics Create service Entity management KPI Service Analyzer Glass Table.

sankardevarajan · ‎01-21-2026

Run these to confirm: Do the events really have a source at index time? | metadata type=sources index=<your_windows_index> `` If you see WinEventLog:Security, WinEventLog:Microsoft-Windows-PowerShell/Operational, etc., that proves the indexers know the true source. Compare what search-time shows vs metadata index=<your_windows_index> sourcetype=WinEventLog* | stats count by source sourcetype | head 20 If source is blank or looks wrong here while (1) shows real sources, you have an override at search time. Where to fix it 1) Field Extractions & Aliases Go to Settings → Fields → Field Extractions Filter for: sourcetype=WinEventLog:* or XmlWinEventLog:* Output field equals source (case-insensitive) Also check Settings → Fields → Field Aliases for any: FIELDALIAS-... = Provider_Name AS source FIELDALIAS-... = Source AS source Fix: Disable or change the target field to something else (e.g., event_source, win_provider, provider_name).

sankardevarajan · ‎11-17-2025

how to validate Heavy forwarder certificate installation successful on linux platform? what are commands to verify?

sankardevarajan · ‎07-03-2025

I am looking for learning splunk ITSI training & certification, can any one guide and share the resource materials.?

sankardevarajan · ‎05-16-2025

i want to onboard application logs into splunk cloud. Hyland.Logging can be configured to send information to Splunk as well as the Diagnostics Console by modifying the .config file of the server. To configure Hyland.Logging to send information to Splunk: <Route name="Logging_Local_Splunk" > <add key="Splunk" value="http://localhost:SplunkPort"/> <add key="SplunkToken" value="SplunkTokenNumber"/> <add key="DisableIPAddressMasking" value="false" /> </Route> Configuring Hyland.Logging for Splunk • Application Server • Reader • Product Documentation i am not understanding where we need to configure above config in Splunk. Much appreciated anyone guide me.

sankardevarajan · ‎05-14-2024

No. i dont have customized dasboard, can you please share some reference query?

sankardevarajan · ‎05-14-2024

Need a report based on previous day I have source ip segment xx.xx.xx.xx/28, & destination ip segment xx.xx.xx/24 outcome of query should provide below Date and start + end time of the connection USERNAME APPLICATION:PORT & PROTOCOL APPLICATION SEGMENTS ACCESS POLICY NAME ACTION how can i create customized dashboard, please suggest.

sankardevarajan · ‎03-21-2024

We have multiple firewalls and different locations and each location we have syslog collector server and its forward the logs to splunk indexer. Pan: traffic count 27,644,629 83% Pan:threat count 3,224,543 9.77% Pan:firewall_cloud 2,034,183 6.18% last one hour data. it looks like over utilization, so we want to validate receiving logs are legitimate or not? Planning to reduce consumption of firewall logs. Please guide me how can i validate firewall logs we are reciving correct logs or any excessive or not needed?

sankardevarajan · ‎03-21-2024

Yes. you are correct. working with windows team, but we are looking for solution in the forum.

sankardevarajan · ‎03-18-2024

Hello Freinds, Current setup - we have multiple locations in Europe, and each location we have multiple windows servers and those servers' forwarding logs to windows log collector server. from log collector to collect the logs on splunk cloud. few sites we are not receiving logs from windows servers, we checked in the GPO policy and its properly configured. while checking gpresult some of the settings not properly applied. i tried gpupdate and tried again. but issue still to be continued.

sankardevarajan · ‎01-25-2024

I have enterprise network and we have Splunk enterprise license. Question: while troubleshooting source type or host if checking, it needs to show past history of particular user or source in the dashboard. Past history like how many alerts triggered the same user, those alert details if click the link it must be show past troubleshooting history.

Posts	17
Solutions	1
Karma Given	3
Karma Received	1
Member Since	‎01-18-2024

Online Status	Offline
Date Last Visited	a week ago

Splunk ITSI - create service & Glass Table, KPI

Heavy forwarder validate certificate installation ...

SPLK-3001: Splunk Enterprise Security Certified Ad...

Splunk Enterprise Certified Admin Exam

SPLUNK ITSI course

onbase application log onboarding into splunk

Splunk Customized dashboard creation

Firewall logs validation in SPlunk

Windows event logs not sending to splunk log colle...

Splunk dashboard customization

Splunk ITSI - create service & Glass Table, KPI

Re: Source metadata disappeared from Windows Event...