Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About impurush
impurush
Contributor
Member since:
05-29-2017
07-18-2023
Community Statistics
| Posts | 105 |
| Solutions | 14 |
| Karma Given | 44 |
| Karma Received | 19 |
| Member Since | 05-29-2017 |
Activity Feed
- Got Karma for Re: multiple host input listing in splunk query (search & Reporting). 01-06-2023 12:27 AM
- Karma Re: How do you disable/enable alerts via the REST API? for tmontney. 05-31-2022 02:25 PM
- Karma Re: reducing splunk fishbucket size for gjanders. 05-12-2022 12:50 PM
- Posted Re: Is there a way in Splunk to get the information of dashboard visits, hits, or unique users visitor? on Splunk Enterprise. 05-12-2022 12:48 PM
- Posted Re: Clearing fishbucket in UF on Getting Data In. 05-02-2022 02:20 PM
- Karma Re: Clearing fishbucket in UF for gcusello. 05-02-2022 02:16 PM
- Posted Re: reducing splunk fishbucket size on Getting Data In. 05-02-2022 06:44 AM
- Posted Re: reducing splunk fishbucket size on Getting Data In. 04-13-2022 11:59 AM
- Posted Re: Trigger Alert and avoid false p[positives on Splunk Enterprise. 02-07-2022 09:37 AM
- Posted Re: Trigger Alert and avoid false p[positives on Splunk Enterprise. 02-04-2022 06:45 PM
- Got Karma for Re: Trigger Alert and avoid false p[positives. 02-04-2022 04:16 PM
- Karma Re: Trying to find host that send logs over the last 7 days for PickleRick. 02-04-2022 05:56 AM
- Posted Re: Add export button on top of a dashboard on Splunk Dev. 02-04-2022 05:53 AM
- Posted Re: Trigger Alert and avoid false p[positives on Splunk Enterprise. 02-04-2022 05:50 AM
- Karma Re: why user with same role not able to see data for isoutamo. 08-10-2021 07:05 AM
- Karma Re: Need help: Stack 2 panels left, and have 1 panel on the right. for richgalloway. 08-10-2021 06:27 AM
- Posted Re: splunk add on for salesforce on Splunk Cloud Platform. 08-10-2021 06:26 AM
- Posted Splunk Covid Dashboard on Splunk Dev. 07-22-2021 01:12 PM
- Tagged Splunk Covid Dashboard on Splunk Dev. 07-22-2021 01:12 PM
- Tagged Splunk Covid Dashboard on Splunk Dev. 07-22-2021 01:12 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
05-12-2022
12:48 PM
Hi, @deepikagooty, You can use the below query to get the number of unique users who accessed the dashboard. You can embed this in your dashboard index=_internal source=*splunkd_ui_access.log uri_path="*/<dashboard_url_name>" NOT user="-" |stats dc(user) Thanks, Purush User Monitoring for Splunk - https://splunkbase.splunk.com/app/5484/
... View more
05-02-2022
02:20 PM
Hi @gcusello, Is there any mechanism to clear the entries from the fish bucket after some time or let's say if I set the limit in the fish bucket, which part of the fish bucket gets reduced to like 1 GB fish bucket, and if I set 500 MB and what would be deleted? Increasing the space for the fish bucket is not the solution I am looking for because it may not have the entries from the old as the retention period in the server is less but the number of rotated files is more.
... View more
05-02-2022
06:44 AM
Hi, @gjanders, Yes, you are right, however, if we reduce the fish bucket size, then there is a high chance that the files get reindexed if the file is still in the server. That is the reason, I want to see the contents of the file. Also, we have identical servers and the fish bucket size is too much on one server and it is very low on another server. That is why I am curious to know what is the contents of the fish bucket.
... View more
04-13-2022
11:59 AM
I have the exact same question but I did not see any answer for this. @damucka, by any chance, did you solve the issue?
... View more
02-07-2022
09:37 AM
Hi @shashank_24, Yes, the time chart will fail because when you use BY in the time chart which has multiple columns, then the result will have a column along with the API service name. I tried something like this and you can try like below (Instead of time chart, you can bucket command which will help in that case) index=myapp_prod source=myapp "message.logPoint"=OUTGOING_RESPONSE (message.httpResponseCode=50* OR message.httpResponseCode=20*)
| rename message.serviceName as serviceName message.httpResponseCode as httpResponseCode
| bucket span=5m _time
| stats count as totalrequests count(eval(httpResponseCode=200)) as successrequest count(eval(httpResponseCode=500 OR httpResponseCode=502 OR httpResponseCode=503)) as failedrequest BY _time,serviceName
| eval failureRatePercentage = round(((failedrequest/totalrequests) * 100),2)
| where failureRatePercentage > 10 AND failedrequest > 200
| eventstats count by serviceName
| where count>4
| field - count
... View more
02-04-2022
06:45 PM
Hi @shashank_24 I have the same scenario in my environment. I selected the trigger option "Once" instead of "For each result". So that, it will trigger only once irrespective of the number of rows and also it will trigger only more than 4 rows comes. Hope this will solve the problem.
... View more
02-04-2022
05:53 AM
Hi @BakaFon I am trying to understand why you need to add a button to export when it is already available in Splunk. If you have access to export the dashboard, then you should have an export button in the dashboard by default.
... View more
02-04-2022
05:50 AM
1 Karma
Hi @shashank_24 You can use timechart instead of stats to breakdown to 5 mins within 30 mins, then you can trigger an alert if the failure rate is greater than 10 for more than 20 mins. index=myapp_prod source=myapp "message.logPoint"=OUTGOING_RESPONSE (message.httpResponseCode=50* OR message.httpResponseCode=20*)
| rename message.serviceName as serviceName message.httpResponseCode as httpResponseCode
| where(serviceName LIKE "my-service")
| timechart span=5m count as totalrequests count(eval(httpResponseCode=200)) as successrequest count(eval(httpResponseCode=500 OR httpResponseCode=502 OR httpResponseCode=503)) as failedrequest
| eval failureRatePercentage = round(((failedrequest/totalrequests) * 100),2)
| where failureRatePercentage > 10 AND failedrequest > 200 You can try to use the above query and in the trigger condition, you can select, trigger an alert if the number of result rows greater than 4. Note: You can adjust the failed request based on your 5 mins threshold
... View more
08-10-2021
06:26 AM
Hi @biwfsplunk, There might be any reason but with the screenshot, we cannot find the root cause. This page shows that the app is not found in your instance, this may be either you might not have access to the app. Check your access and internal logs for more information.
... View more
- Tags:
- hi @
07-22-2021
01:12 PM
Hi, I have seen the dashboard which is running in Splunk but available publicly. https://covid-19.splunkforgood.com/coronavirus__covid_19_ I got the app and its source codes from the github. https://github.com/splunk/corona_virus I would like to on how the dashboard is available publicly and how the searches are running when we run this dashboard. Because it does need the authentication to view the dashboard and what happens when lot of people run this dashboard at the same time. #splunk4good
... View more
Labels
- Labels:
-
visualization
04-22-2021
12:51 PM
Hi @AllenZhang, Use the file name after the addcoltotals commands to calculate the totals only for the specified column. <your query> |table field1,field2,field3 |addcoltotals field2 field3 The above query will calculate the column totals for field2 and field3 only.
... View more
04-15-2021
05:52 AM
To me, looks like this one is a known issue with Splunk. There might dashboards which don't have a title. Please check and give some title, this issue should be fixed.
... View more
03-30-2021
01:38 PM
Hi @Ruchi, Happy to help. Could you please accept the answer, so that this thread can be marked as closed. Thanks
... View more
03-30-2021
12:57 PM
1 Karma
You can run the below command under the /etc/auth folder or where your certificate is placed. openssl x509 -in server.pem -text -noout|grep -i CN With the information, you can find out the certificate is Splunk default certificate or third party certificate. Splunk uses the Splunk self signed certificate for the SSL communication by default.
... View more
03-30-2021
12:47 PM
Hi @Ruchi, in the case of third-party certificates, it will be the same except for the renewal part. You need to renew the certificate with your employer or from which third-party certificate you got.
... View more
03-30-2021
12:08 PM
Follow this answer to find out the renewal of the SSL certificate. https://community.splunk.com/t5/Security/How-do-I-renew-an-expired-Splunk-Certificate/m-p/389701
... View more
03-30-2021
12:02 PM
If I understand the question correctly, you need to trigger the alert through your scripts. If this is the case, then you can add the alert action as "Run a Script" and give your script name in the field name. Then you need place the script in any of the location $SPLUNK_HOME/bin/scripts or $SPLUNK_HOME/etc/<app>/bin/scripts.
... View more
03-30-2021
11:56 AM
Hi @SamHTexas, As per my knowledge, if the data is from the file, then you no need to worry about the queue, Splunk will read from where it stopped. However, if the data is not from the file and it is generated data, then you need to increase the queue size to make the storage available to catch all the data during the forwarder offline.
... View more
03-30-2021
10:38 AM
The data is time-dependent, so I cannot do as you explained in the first part. However, still I agree, as @richgalloway said, the Splunk team should arrange something regarding the price or the way to solve this problem. I posted here to see if anyone has any idea or anyone faced this scenario already. I will keep this question open for some time to see if any other response is coming and I will access his answer after some days. Thanks, @Funderburg78 for the suggestions.
... View more
03-30-2021
09:40 AM
Hi @Funderburg78, Thanks for answering this question. Whatever you said is 100% correct to find the culprit which one is causing the spike in the license usage. However, let's say the client is from a retail seller, and every month starting the sale is high and the logs are generated high and the remaining days in the month will not be high as explained in my question. The point I am trying to make is, there is no culprit who is causing the issue. The design of the application is like that, every month starting the usage is high, so the logs generated by the application are high.
... View more
03-29-2021
12:33 PM
1 Karma
Hi @bzam, I tried your query and it looks working for me. I took one of the fields from the summary index and replaced the bytes in your query, it worked both ways. Please check whether the bytes field is there in your summary index and also tried to step by step, like run the query until, you calculate the GB and see your fields section whether the GB variable is extracted or not, then you can apply the stats function on top of that.
... View more
03-29-2021
11:48 AM
Hi @s2_splunk, Thank you for the valuable suggestion, Indeed, the tstats is very fast than the normal query which I provided. Hi @verifi81, Please use the below query to include the host too. | tstats count where index=main sourcetype=pan host=pa3250 by _time,host span=1d
... View more
03-29-2021
10:26 AM
Hi @verifi81, index=main sourcetype=pan host=pa3250|timechart span=1d count You can run the above query for the last 30 days and see the visualization as a line graph, then see when it stopped. And if you want to exact time, select the data when it stopped and change the span=1h to see when it exactly stopped.
... View more
03-24-2021
10:59 AM
Hi @aferns0804 , I understand 50% of your question, but I did not get what you are referring the result(stats) of the alert means? To implement the concept, you can use the drildown option for the respective panel to populate the token value and create a another panel which will use this token as input in the query.
... View more
03-23-2021
10:09 AM
Hi @sh254087 If you are running the below query in the dashboard, you can set the token in the dashboard. So, you can use the $token_a$ in your label where you want to display it. | rest /services/authentication/current-context splunk_server=local | where user = "admin" | table user ------------- <progress> <set token="token_a">$result.user$</set> </progress>
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-18-2023
04:20 PM
|
