Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About Nilesh3110
Nilesh3110
Explorer
Member since:
01-09-2020
06-05-2020
Community Statistics
| Posts | 13 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 01-09-2020 |
Activity Feed
- Karma Re: Extract all fields from a log file for gcusello. 06-05-2020 12:51 AM
- Karma Re: Install SSL certificate on Splunk Index cluster master web for nickhills. 06-05-2020 12:51 AM
- Posted Re: need to have a list of users who did not login to splunk indexer for more than 30 days on Security. 03-01-2020 07:33 PM
- Posted Re: need to have a list of users who did not login to splunk indexer for more than 30 days on Security. 02-27-2020 08:59 PM
- Posted ITSI - Unable to update the Action Rule in Configure on All Apps and Add-ons. 02-27-2020 07:55 PM
- Tagged ITSI - Unable to update the Action Rule in Configure on All Apps and Add-ons. 02-27-2020 07:55 PM
- Tagged ITSI - Unable to update the Action Rule in Configure on All Apps and Add-ons. 02-27-2020 07:55 PM
- Posted Install SSL certificate on Splunk Index cluster master web on Security. 02-26-2020 10:06 PM
- Tagged Install SSL certificate on Splunk Index cluster master web on Security. 02-26-2020 10:06 PM
- Tagged Install SSL certificate on Splunk Index cluster master web on Security. 02-26-2020 10:06 PM
- Tagged Install SSL certificate on Splunk Index cluster master web on Security. 02-26-2020 10:06 PM
- Posted Re: need to have a list of users who did not login to splunk indexer for more than 30 days on Security. 02-23-2020 03:33 AM
- Posted Script to copy all customization in splunk on All Apps and Add-ons. 02-18-2020 10:08 AM
- Tagged Script to copy all customization in splunk on All Apps and Add-ons. 02-18-2020 10:08 AM
- Posted Extract all fields from a log file on Splunk Search. 02-17-2020 12:36 AM
- Tagged Extract all fields from a log file on Splunk Search. 02-17-2020 12:36 AM
- Tagged Extract all fields from a log file on Splunk Search. 02-17-2020 12:36 AM
- Tagged Extract all fields from a log file on Splunk Search. 02-17-2020 12:36 AM
- Tagged Extract all fields from a log file on Splunk Search. 02-17-2020 12:36 AM
- Posted Re: need to have a list of users who did not login to splunk indexer for more than 30 days on Security. 01-30-2020 10:41 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-01-2020
07:33 PM
Hi @manjunathmeti
This is what i had been trying to do the same thing, Its working fine for splunk users but not for LDAP users. We have alot of LDAP users who rarely use our box. I want to remove the LDAP users who do not use our Splunk Web.
For all LDAP users i see last_successful_login as blank. Can you please help
... View more
02-27-2020
08:59 PM
This is what i had been trying to do the same thing, Its working fine for splunk users but not for LDAP users. We have alot of LDAP users who rarely use our box. I want to remove the LDAP users who do not use our Splunk Web.
For all LDAP users i see last_successful_login as blank. Can you please help
... View more
02-27-2020
07:55 PM
I am trying to update the ITSI action rule in the messages, with some different body of the message. Even after saving it, the message is not saved and returns to original.
The steps taken are
ITSI -> Configure -> Notable Event Aggregation Policies -> Service Level Event Grouping -> Action Rule —> Click on If a specific event occurs, then send an email for the episode -> Configure -> Edit the message column -> Ok -> Save
Even after this when i click back to the event , it shows the same values in the messages
... View more
02-26-2020
10:06 PM
I need to install SSL certificate on splunk Index cluster master web. I created the csr and key on the server and got the certificate from the CA. the certificate provided is in .CRT format. I then got the .PEM format using the below.
cat server_name.csr server_name.key ca_provided_certificate.com.crt > certificate.com.pem
Have updated the web.config file in the local with the below settings .
[settings]
enableSplunkWebSSL = true
serverCert = /application/splunk/etc/auth/splunkweb/certificate.com.pem
After saving, when i try restarting the splunk . It stucks starting the web with the below error
Waiting for web server at https://10.0.1.1:8000 to be available...
can someone please help
... View more
02-23-2020
03:33 AM
HI @gcusello : I am not getting any result when i am executing this SPL. Actually the action does not contain anything with
index=_audit action=login*
there is nothing in the action with login. I need to get the list of LDAP users last login date/time.
... View more
02-18-2020
10:08 AM
I need to copy all the customizations in splunk like Apps, saved searches, User Profile and all the config files . Everything thats customized so that whenever i do a fresh build of spunk i can push back all the customizations in one shot to the new build. Any script/wayout would be of real help. Thanks
... View more
- Tags:
- splunk-cloud
02-17-2020
12:36 AM
Hello Gurus, I have a log file which is almost structured . I need to extract all the fields from it. Its working fine for few of the fields but not all the fields are not present in the interesting field corner. I need to extract fields like (PID , TID , PROC , INSTANCE )
Below is the log.
2020-01-27-15.00.10.349880-480 I930031A600 LEVEL: Error
PID : 30868490 TID : 180042 PROC : db2sysc 0
INSTANCE: db2prd2 NODE : 000 DB : PRODDW_2
APPHDL : 0-55088 APPID: 170.2.78.74.45949.200127223832
UOWID : 101 ACTID: 1
AUTHID : DWFLDREP HOSTNAME: db2udb04.us164.corpintra.net
EDUID : 180042 EDUNAME: db2agnts (PRODDW_2) 0
FUNCTION: DB2 UDB, runtime interpreter, sqlrisrt, probe:3312
DATA #2 : Hexdump, 4 bytes
0x0A000000A83FD4C4 : 800F 0003 ....
Collapse
host = ip-172-31-46-255.us-east-2.compute.internalsource = db2diag.sample.logsourcetype = Swaroop_task
I tried using Regex but was not able to as its not working for all. Can someone please help.
... View more
01-30-2020
10:41 AM
I’m not getting any field login attempt . I’m getting a zero value . That’s what the issue is .
... View more
01-29-2020
10:29 PM
I need to find out the list of users who did not login to splunk for more than 30 days. I need to know when the user last login. I tried the below but did not get any result. can someone please help
index=_audit action="login attempt" | stats max(timestamp) by user
... View more
01-14-2020
09:17 AM
I tried the above but did not get any results. I searched it on the indexer serach head. Where do i need to search this query.
... View more
01-13-2020
08:33 AM
Thanks a lot jarizeloyola. I m bit confused, whats the index for the above . Or do i need to run it with Curl. If possible can u pls give me the complete command or the way i can run the above search , as the above given search does not run give anything . Thanks
... View more
01-10-2020
06:38 AM
This is more of theory , I m going through them ... actually i am looking for some script which pulls up these information and gives me a report for all the related knowledge objects for an application .
... View more
01-09-2020
10:11 AM
I have multiple apps on shcluster, "/application/splunk/etc/shcluster/apps" . I need to check if there are any Knowledge objects related to these apps, that is to say if these apps are actually requred or not. Is there a way i can get the details of all the Knowledge objects related to an application. Any Shell script which gives me this information ?
... View more
- Tags:
- splunk-enterprise
