About vigneshnarendra

vigneshnarendra

Have you included search head captain in your search? I believe only the scheduler node will get the failed logs. If you have included them, follow my next steps. Do you find them in your logs and they aren't extracted? Append the below SPL to extract them. | rex field=_raw "status=(?<status>\w+)" Do you get them when you do stats count on status? If not then you have 100% success rate on the searches.

vigneshnarendra

HI @munang. The risky command warning is only a safeguard for many commands which could be a potential risk if users run them without knowing what they are doing. https://docs.splunk.com/Documentation/Splunk/9.3.0/Security/SPLsafeguards You could set commands.conf as below and restart splunk to remove the warning. [<your_command_name>] is_risky = false

vigneshnarendra · ‎03-12-2024

How do I read which account is selected or get the username and password of the selected account? I am not able to find any document on this. I am only hardcoding the account name in my code. # get_auth = helper.get_user_credential_by_id('account0')

vigneshnarendra · ‎03-12-2024

I have the same issue, Did you manage to find a solution for it? I right now do helper.get_user_credential_by_id(' <id_name>')

vigneshnarendra · ‎04-02-2023

Hi @manuelcliment @jeyasuriya-m, Right now i am converting CSV to JSON and indexing them. And a saved search makes a lookup out of it. Which is a very inefficient way of uploading a csv. Have you found any solution for this?

vigneshnarendra · ‎02-23-2023

In the email alert action, choose trigger for each result under Trigger conditions. and use the a variable in the email to list.

vigneshnarendra · ‎09-09-2022

What values have you set at props.conf for this source? Do you have a regex based extraction? If you haven't configured any props, I suggest you to write one.

vigneshnarendra · ‎11-18-2021

Hello, You are missing a key parameter. ./splunk diag --upload --case-number=<casenumber> --upload-user=<username>--upload-description="blah blah"

vigneshnarendra · ‎10-12-2020

You can use ignoreOlderThan = 5d at Universal Forwarder to restrict indexing of logs older than 5 days.

vigneshnarendra · ‎09-25-2020

I find these in splunkd.log and the inputs.conf doesn't seem to be working INFO ViewstateReaper - Failed to reap viewstate flashtimeline:fwkfntuv (user: nobody, app:xxx, root: xxxxxxxxx\SplunkUniversalForwarder\etc): Not removable: /nobody/xxxxxx/viewstates/flashtimeline:fwkfntuv INFO ViewstateReaper - Failed to reap viewstate *:fwkg4tq9 (user: nobody, app:XXXXX, root:XXXXXXX\SplunkUniversalForwarder\etc): Not removable: /nobody/XXXXXX/viewstates/*:fwkg4tq9

Posts	10
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎04-12-2017

Online Status	Offline
Date Last Visited	a week ago

Failed to reap viewstate

Re: Skipped search

Re: Why is the map command a risky command?

Re: Splunk Add-on Builder: Global Account settings

Re: Splunk Add-on Builder: Global Account setting ...

Re: Is it possible to create CSV in splunk addon b...

Re: How to separate daily quarantine email report ...

Re: Data quality issues

Re: Splunk diag upload outbound traffic

Re: props.conf MAX DAYS AGO editing on indexer or ...

Failed to reap viewstate