Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About yanivdutt
yanivdutt
Explorer
Member since:
12-15-2011
03-04-2022
Community Statistics
| Posts | 17 |
| Solutions | 0 |
| Karma Given | 6 |
| Karma Received | 0 |
| Member Since | 12-15-2011 |
Activity Feed
- Posted Re: Splunk query to get number of panels or searches getting generated in each dashboard on Dashboards & Visualizations. 03-04-2022 01:51 PM
- Posted Splunk query to get number of panels or searches getting generated in each dashboard on Dashboards & Visualizations. 03-04-2022 01:02 PM
- Karma Re: Splunk Enterprise 6.5.0 and Splunk App for Windows Infrastructure for ntankersley_spl. 06-05-2020 12:48 AM
- Karma Re: Search formatting in Splunk 6.5.0 for easier readability for lquinn. 06-05-2020 12:48 AM
- Karma Re: List or View Scheduled searches for renjith_nair. 06-05-2020 12:47 AM
- Karma can splunkd.log be forwarded from Heavy Forwarder to Indexer? for fernandoandre. 06-05-2020 12:46 AM
- Karma Re: How do I pipe splunk query output to a file? for matt. 06-05-2020 12:45 AM
- Karma Re: Dynamic Sourcetype Extraction for southeringtonp. 06-05-2020 12:45 AM
- Posted Splunk props.conf on Getting Data In. 06-25-2017 05:22 PM
- Tagged Splunk props.conf on Getting Data In. 06-25-2017 05:22 PM
- Posted Re: How to edit my props.conf to make sure CSV file data gets indexed? on Getting Data In. 11-07-2016 07:21 PM
- Posted How to edit my props.conf to make sure CSV file data gets indexed? on Getting Data In. 11-04-2016 05:19 PM
- Tagged How to edit my props.conf to make sure CSV file data gets indexed? on Getting Data In. 11-04-2016 05:19 PM
- Tagged How to edit my props.conf to make sure CSV file data gets indexed? on Getting Data In. 11-04-2016 05:19 PM
- Tagged How to edit my props.conf to make sure CSV file data gets indexed? on Getting Data In. 11-04-2016 05:19 PM
- Tagged How to edit my props.conf to make sure CSV file data gets indexed? on Getting Data In. 11-04-2016 05:19 PM
- Posted Re: Windows custom events logs not showing up in Splunk on Getting Data In. 09-29-2016 01:18 PM
- Posted Re: Windows custom events logs not showing up in Splunk on Getting Data In. 09-28-2016 01:27 AM
- Posted Windows custom events logs not showing up in Splunk on Getting Data In. 09-27-2016 06:40 PM
- Tagged Windows custom events logs not showing up in Splunk on Getting Data In. 09-27-2016 06:40 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-04-2022
01:51 PM
It is giving me zero results though we have lot of dashboards
... View more
03-04-2022
01:02 PM
Hi, I am looking for splunk query which can display dashboard name and no of panels/queries it has got within it
... View more
Labels
- Labels:
-
chart
06-25-2017
05:22 PM
Hi,
My logs are not breaking correctly. Below is sample logs
16:40:13,732 INFO web Redeemed promotion=BI_500_POINTS for usa_id=2300000032458812 channel=OMS amount=500.0 offerId=2536374313674604550 termId=null dateSk=7484 locationSk=550 isCancel=true tier=ROUGE
16:40:13,747 INFO web Redeemed promotion=ROUGE_WELCOME_KIT for usa_id=2253998837903414 channel=atg amount=-0.0 offerId=3000000000000000001 termId=null dateSk=7484 locationSk=550 isCancel=false tier=ROUGE
16:40:13,748 INFO web Redeemed promotion=BI_100_POINTS for usa_id=2253998837903414 channel=atg amount=-100.0 offerId=2536374313674604552 termId=null dateSk=7484 locationSk=550 isCancel=false tier=ROUGE
16:40:29,553 INFO web Redeemed promotion=BD_GIFT for usa_id=2300000038257945 channel=atg amount=-0.0 offerId=2536374313674604551 termId=null dateSk=7484 locationSk=550 isCancel=false tier=BI
16:40:54,421 INFO web Redeemed promotion=BD_GIFT for usa_id=2300000045716715 channel=atg amount=-0.0 offerId=2536374313674604551 termId=null dateSk=7484 locationSk=2492 isCancel=false tier=ROUGE
16:40:58,121 INFO web Redeemed promotion=VIB_WK for usa_id=2300000026110754 channel=pos amount=-0.0 offerId=2536374313674604555 termId=null dateSk=7484 locationSk=341 isCancel=false tier=BI
I tried
[web]
TIME_FORMAT=%T,%L
SHOULD_LINEMERGE=false
... View more
- Tags:
- props.conf
11-07-2016
07:21 PM
SiteID Domain TotalRequests SavedRequests TotalBytes SavedBytes HitTime BitsPerSecond Human requests per second Bot requests per second Blocked requests per second BlockedRequests
1001602 linelink.yahoo.com 0 0 0 0
1028875 npe-facade.api.yahoo.com 0 0 0 0
1033027 ma.my.yahoo.com 3088 656 52976733 23001447 10/12/16 0:00 963 0 0 0 0
1033027 ma.my.yahoo.com 10/12/16 0:10 1350 0 0 0 0
1033027 ma.my.yahoo.com 10/12/16 0:20 91 0 0 0 0
1033027 ma.my.yahoo.com 10/12/16 0:30 251 0 0 0 0
1033027 ma.my.yahoo.com 10/12/16 0:40 581 0 0 0 0
1033027 ma.my.yahoo.com 10/12/16 17:50 74 0 0 0 0
1033027 ma.my.yahoo.com 10/12/16 18:00 25109 0 0 0 0
1033027 ma.my.yahoo.com 10/12/16 18:10 21946 0 0 0 0
1033027 ma.my.yahoo.com 10/12/16 18:20 73558 0 0 0 0
1033027 ma.my.yahoo.com 10/12/16 18:30 7011 0 0 0 0
1033027 ma.my.yahoo.com 10/12/16 18:40 7781 0 0 0 0
1033027 ma.my.yahoo.com 10/12/16 18:50 27902 0 0 0 0
1036959 e2e.commerce.digital.yahoo.com 0 0 0 0
... View more
11-04-2016
05:19 PM
Hi,
I am using below props file for CSV but data is not getting indexed or sent into Splunk. Need help in updating props
[data_csv]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = csv
HEADER_MODE = firstline
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = true
PREAMBLE_REGEX = ^\tDate
FIELD_NAMES = [SiteID,Domain,TotalRequests,SavedRequests,TotalBytes,SavedBytes,HitTime,BitsPerSecond,Human requests per second,Bot requests per second,Blocked requests per second,BlockedRequests]
Below is data from CSV
SiteID Domain TotalRequests SavedRequests TotalBytes SavedBytes HitTime BitsPerSecond Human requests per second Bot requests per second Blocked requests per second BlockedRequests
1001602 yahoo.com 0 0 0 0
1028875 yahoo2.com 0 0 0 0
1033027 yahoo1.com 3088 656 52976733 23001447 10/12/16 0:00 963 0 0 0 0
1033027 yahoo.com 10/12/16 0:10 1350 0 0 0 0
... View more
09-29-2016
01:18 PM
@javiergn
Yes Citrix delivery services is complete folder. Somehow i started seeing data after windows server reboot. Now I am adding couple more customized . Below is events I want to see and screenshot. Is path mentioned correct ? This event is underneath other events from events view, but exist in same folder structure
[WinEventLog://Citrix-CDF_ErrorReporter/Admin]
disabled = 0
start_from = oldest
current_only = 1
checkpointInterval = 5
index = wineventlog
... View more
09-28-2016
01:27 AM
Thanks for replying. It was typo in post. Was using correct syntax in my use case
[WinEventLog://Citrix Delivery Services]
disabled = 0
start_from = oldest
current_only = 1
checkpointInterval = 5
index = wineventlog
... View more
09-27-2016
06:40 PM
Hi ,
Below is custom event logs which I am configuring on windows forwarder but they are not showing up in Splunk. We can see events coming from default events like system,security etc. Below is syntax I am using
[WinEventLog://Citirix Delivery Services]
disabled = 0
start_from = oldest
current_only = 1
checkpointInterval = 5
index = wineventlog
Attached screenshot shows location of event logs
... View more
10-30-2015
05:10 PM
Even I have same issue. Heavy forwarders are not forwarding _internal logs
... View more
04-13-2015
05:48 PM
Hi,
We are seeing data different in splunk than actual logs.
Switch - di1-c-qcy 10.xxx.xxx.xx below is data from n/w device
2015 Apr 13 12:58:38.864 di1-c-qcy-new %ARP-4-INVAL_IP: arp [9746] Received packet with invalid source IP address (127.0.0.2) from 7269.e253.0ac8 on Vlan373
below is data from syslog server
Apr 13 12:58:39 10.xxx.xxx.xx 2015 Apr 13 12:58:39.622 PDT: %ARP-4-INVAL_IP: arp [9746] Received packet with invalid source IP address (127.0.0.2) from 7269.e253.0ac8 on Vlan373
below is what we are seeing on Splunk
Apr 13 12:58:39 10.153.142.16 2015 Apr 13 12:58:39.622 PDT: %ARP-4-INVAL_IP: arp [9746] Received packet with invalid source IP address (127.0.0.2) from 7269.e253.0ac8 on Vlan373" | table _time, host, _raw
... View more
03-12-2015
01:03 AM
I have installed cisco add on app on all indexers which fixed issue
... View more
03-10-2015
11:45 AM
Nope I dont see any events with cisco_ios*
I was asked to install cisco add on app on indexers which I am yet to do. Will keep you posted if results are changed after doing it
... View more
03-09-2015
01:04 PM
I have tried this settings but it does not work.
We have all our network devices sending logs to syslog-ng server(forwarder installed) from where logs are sent to Splunk indexers.
Do we need to do something on network devices to make this app work or above mechanism works?
can you please provide any documention for forwarders configurations to make this app work
... View more
03-09-2015
11:24 AM
index=network_syslog sourcetype=syslog results are displayed
index=network_syslog sourcetype=syslog eventtype="cisco_ios-ipsla" | eval state=case(state_to == "Up", 1, state_to == "Down", -1) | strcat dvc " " ip_sla_id dvc_ip_sla_id | timechart avg(state) AS state BY dvc_ip_sla_id | fillnull value=0 no results founds
Do we need to configure anything on routers or network devices?
... View more
05-14-2014
11:44 AM
nope. This is not working in 6.x
I have copied file from default search app to storage app and added index=storage
/opt/splunk/etc/apps/search/default/data/ui/views/flashtimeline.xml
... View more
05-14-2014
11:37 AM
I have tried it but did not help
index=storage
true
true
False
True
... View more
05-14-2014
11:22 AM
Hi,
I need abc search app created which is specific to index=abc
I don't want to do this as user/role based. Want to update a file within app itself to takecare.
Thanks
Vinay
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-04-2022
05:33 PM
|
Karma given to
