About shashankD

shashankD · ‎11-11-2025

Rather then using the time zone stanza in props.conf, use timezone stanza in inputs.conf, this will resolve the future time stamp issue. I was facing the same issue with my multi site UF (specificially APAC region - Japan, australia, india) and this helped me.

shashankD · ‎11-11-2025

Do you have the license for IT service intelligence,. ITSI is considered as the premium app for Splunk and without license you wont be able to use. Try to check with your account manager and Splunk account manager so they can convert you enterprise license to entity license, where you have right to access. Also If you have ES installed in the search head where you have installed ITSI, it wont work. ES will require dedicated search head to use and ITSI too required dedicated search head to run. Both the premium app cant be run on a single search head.

shashankD · ‎11-11-2025

Increase maxkbps value to 0 (unlimited) and maxThruput to 5mb, this will resolve the issue

shashankD · ‎11-11-2025

You can also use the add-on Splunk Add-on for Microsoft Cloud Services

shashankD · ‎11-11-2025

You can read/create dashboard using _audit logs, where all this info can be seen, else you can use the below query index=your_index sourcetype=your_sourcetype | eval hour=strftime(_time,"%H") | stats count by user hour | eventstats avg(count) as avg stdev(count) as std by user | eval zscore=(count-avg)/std | where abs(zscore)>2 OR hour<9 OR hour>17

shashankD · ‎11-11-2025

Try to fetch API from the recent time like from last hour, or a day. This API comes with the limitation and if the number of events are huge in numbers then the API will fail to pull the events. try to fetch the event from recent time rather then a large interval of old data.

shashankD · ‎11-11-2025

You have to do this manually, or if you able to build a python script, then you can build and disable the searches.

shashankD · ‎11-11-2025

Configure SC4S in your environment, and manually you can manually configure the parser for the cisco related logs from the Splunk SC4S github, you just need to copy paste the parser and the logs will start parsing. SC4S github - Splunk Connect for Syslog Master srcrpit to configure sc4s - raw.githubusercontent.com/J-C-B/community-splunk-scripts/master/SC4S-Splunk-Connect-for-Syslog-centos8.sh Do modify the related details.

Posts	8
Solutions	1
Karma Given	0
Karma Received	2
Member Since	‎11-11-2025

Online Status	Offline
Date Last Visited	‎11-11-2025 01:04 AM

Re: Events in the Future from a UF

Re: ITE work stuck on loading page

Re: SplunkForwarder flooding splunkd.log with reco...

Re: Risky Signin and Risky user from Azure Identit...

Re: Anomalous event detection by date/time

Re: Data collection stops after initial API pull f...

Re: disable automatic search execution when time r...

Re: Cisco FMC/FTD log parsing issue

Join the Conversation