Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About payl_chdhry
payl_chdhry
Path Finder
Member since:
03-12-2020
07-17-2024
Community Statistics
| Posts | 35 |
| Solutions | 1 |
| Karma Given | 7 |
| Karma Received | 2 |
| Member Since | 03-12-2020 |
Activity Feed
- Got Karma for Re: How to Get License Count by Cluster Peer. 07-17-2024 01:08 AM
- Posted Re: How to Get License Count by Cluster Peer on Installation. 07-16-2024 10:33 PM
- Posted Re: How to Get License Count by Cluster Peer on Installation. 07-16-2024 10:25 PM
- Posted Smartstore storage requirement for rf/sf as 2 on Splunk Enterprise. 07-16-2024 10:18 PM
- Tagged Smartstore storage requirement for rf/sf as 2 on Splunk Enterprise. 07-16-2024 10:18 PM
- Tagged Smartstore storage requirement for rf/sf as 2 on Splunk Enterprise. 07-16-2024 10:18 PM
- Posted Indexer acknowledgment and multisite clustering failure on Deployment Architecture. 06-21-2024 08:29 PM
- Tagged Indexer acknowledgment and multisite clustering failure on Deployment Architecture. 06-21-2024 08:29 PM
- Got Karma for Re: Transfer protocol used by Splunk. 06-08-2024 09:15 AM
- Karma Re: Is there a way to reset client list on Deployment server without restarting for manjunathmeti. 06-06-2024 12:27 AM
- Posted Re: Is there a way to reset client list on Deployment server without restarting on Deployment Architecture. 06-06-2024 12:26 AM
- Posted Re: Transfer protocol used by Splunk on Splunk Enterprise. 06-05-2024 10:34 PM
- Karma Re: Transfer protocol used by Splunk for PickleRick. 06-05-2024 10:34 PM
- Karma Re: Transfer protocol used by Splunk for tscroggins. 06-05-2024 10:33 PM
- Posted Is there a way to reset client list on Deployment server without restarting on Deployment Architecture. 06-05-2024 10:32 PM
- Posted Transfer protocol used by Splunk on Splunk Enterprise. 05-26-2024 10:21 AM
- Posted Re: Anonymization not working for extracted field with space in name on Getting Data In. 11-17-2022 11:06 AM
- Posted Anonymization not working for extracted field with space in name on Getting Data In. 11-14-2022 04:41 AM
- Tagged Anonymization not working for extracted field with space in name on Getting Data In. 11-14-2022 04:41 AM
- Tagged Anonymization not working for extracted field with space in name on Getting Data In. 11-14-2022 04:41 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-16-2024
10:33 PM
1 Karma
I can see "i" which is the guid for indexer. Can check if that works. You would have to first manually note down the guid for each indexer and map which cluster it belongs to.
... View more
07-16-2024
10:25 PM
You would need to create a pool and assing indexers based on pool so get it by cluster.
... View more
07-16-2024
10:18 PM
What would be the storage requirement for SmartStore when rf is 2 for indexer cluster. Would it be double that of traditional for one indexer or only primary buckets would move to smartstore? Antyhing specifically mentioned in Splunk docs? (I have tried to find but did not see anything) Consider following scenarios: 1) 2 onprem Indexers with dedicated storage, rf is 2. Each indexer has 5 TB of data. So combined would be 10 TB 2) 4 indexers - 2 sites, 2 on each site. Each site will maintain 1 copy of bucket. Again combined storage would be 10 TB When migrating to SmartStore, what would be the expected storage utilization?
... View more
- Tags:
- smartstore
- storage
Labels
- Labels:
-
using Splunk Enterprise
06-21-2024
08:29 PM
What happens if indexer acknowledgment is enabled and there is multisite clustering or minimum rf is not met due to indexer failure. If I understand it right, no acknowledgement will be sent till data has been replicated as per rf value and in such scenario UF will hold the data block in its queue. Would ingestion stall when queue is full (it's default size is only few MBs) even though data ingestion is working on another site. And if so, ingestion would completely stop even when ingestion is working fine only replication is impacted. I am looking for below journeys: UK --> Intermediate Heavy Forwarder --> Indexer pcf microservices --> Intermediate Heavy Forwarder --> Indexer
... View more
- Tags:
- acknowledgment
Labels
- Labels:
-
indexer clustering
06-06-2024
12:26 AM
Thanks @manjunathmeti For some reason thought that would not work but it does! 🙂
... View more
06-05-2024
10:34 PM
1 Karma
Thank you for your responses @tscroggins @PickleRick
... View more
06-05-2024
10:32 PM
Looking for ways to refresh client list that phone homes to Deployment server without restarting splunk service or taking access of server. We have few sources onboarded that recycles their instances every 24 hours, within few days the count of clients becomes 4 times our usual number and unless done something DS will become slower, the only way to reset this list seems to be via splunk restart which we want to avoid. Anyone face something similar?
... View more
Labels
- Labels:
-
deployment server
05-26-2024
10:21 AM
What transfer protocol splunk uses like FTP, sFTP.. That is what transfer method is used to transfer data via TCP when sending data from UF to Splunk core cluster (enterprise)
... View more
Labels
- Labels:
-
using Splunk Enterprise
11-17-2022
11:06 AM
Thank you for your response @PaulPanther I tried what you suggested but if did not work. extracted field still has unmasked data. Below is the type of event we expect: Product Assembly Name Product Version Class Name Timestamp Severity Hostname User name User ID WebEngine Request ID Connection ID Task ID Execution ID Report ID Request ID Transformation ID Message Exception Stacktrace
Qlik.NPrinting.Repo 00.00.0.0 Qlik.NPrinting.Repo.Service.AuthenticationService 20221118T163152.532+00:00 INFO GBW22223451 John Smith 0 0 0 0 0 0 0 0 Windows login successful. The user with id n45675643h456556l5c7bu5jw5esd4 has been correctly identified as a Windows domain user with sid S-1-4-10-123457890-1234543-13243554-344545
Qlik.NPrinting.Repo 21.14.5.0 Qlik.NPrinting.Repo.Service.AuthenticationService 20221118T163152.532+00:00 INFO GBW22223451 12345678 0 0 0 0 0 0 0 0 Windows login successful. The user with id n45675643h456556l5c7bu5jw5esd4 has been correctly identified as a Windows domain user with sid S-1-4-10-123457890-1234543-13243554-344545
Qlik.NPrinting.Repo 21.14.5.0 Qlik.NPrinting.Repo.Service.ImportExport.DataConnectionsMatchingService 20221118T163152.532+00:00 WARN GBW22223451 12345678 John Smith 0 0 0 0 0 0 0 0 Trying to import connection Horizon Scanning Rapid 2 MI Connection. Data connection NPrinting Rapid2 does not match↓Missing objects from template: O\fghjy, O\123457890-1234543-13243554-344545, O\123457890-1234543-13243554-344545, O\ttyte, O\fgfggf, O\erewff, O\sdfdf, O\dfdgfg, O\zfgfg, O\DfAd, O\dsfdfh, O\dfdfD, O\dfdZ↓
Qlik.NPrinting.WebEngine 21.14.5.0 Qlik.NPrinting.WebEngine.WebEngineWindowsService 20221118T163152.532+00:00 INFO GBW22223451 0 0 0 0 0 0 0 0 Windows authentication server listening on http://localhost:port/
... View more
11-14-2022
04:41 AM
We have requirement to mask data in index time. While below works to mask data in raw, it does not work for extracted field "User name". My SED is on universal forwarder (windows) and it works fine for raw data: s/(GBW\d{8}\t)(\d{8}\s){0,1}(\w.*?)(\t)/\1\2(masked)\4/g My props.conf: [sourcetype] SEDCMD-username=s/(GBW\d{8}\t)(\d{8}\s){0,1}(\w.*?)(\t)/\1\2(masked)\4/1 FIELD_DELIMITER=tab HEADER_FIELD_DELIMITER=tab HEADER_FIELD_LINE_NUMBER=1 MAX_TIMESTAMP_LOOKAHEAD=300 TIMESTAMP_FIELDS=Timestamp TIME_FORMAT=%Y%m%dT%H%M%S.%3N+%z TRANSFORMS-anonymize = username-anonymizer However, Transforms does not work. Have tried by placing on Universal forwarder as well as Intermediate heavy forwarder. Have created based on response from Solved: How can I anonymize fields of data that has underg... - Splunk Community transforms.conf: [username-anonymizer] REGEX = (?m)^(.*User name\:\:)(\d{8}\s){0,1}(\w.*?)$ FORMAT = $1(masked) WRITE_META = false SOURCE_KEY = _meta DEST_KEY = _meta Related info: We are expecting tab-delimited data. The field User name is in the middle and follows hostname and hence GBW is this example. "User name" could be combination of id and name and we only want to mask name: Value : 12345678 firstname lastname 12345678 firstname firstname lastname firstname expected masked value 12345678 (masked) 12345678 (masked) (masked) (masked) It could be blank as well.
... View more
Labels
- Labels:
-
transforms.conf
07-22-2021
05:58 AM
Hi, I have an use case where I have an if condition involving multiple comparisons. Based on its outcome, I want to re-assign values in multiple fields. Consider below example: My fields are: A1, B1, C1, A2, B2, C2 and few other fields I have an if condition and when it is true to assign value as below and if false do nothing: A1=A2 B1=B2 C1=C2 Now my query is, right now if I want to do this, I would have to write 3 different eval commands like below doing exact same comparisons: | eval A1=if(<condition>, A2, A1) | eval B1=if(<condition>, B2, B1) | eval C1=if(<condition>, C2, C1) Is there a way so that if I only use if once and when true, all three fields would get assigned value in one go. If there is a way, in terms of performance is above still better, I would be running this for more than hundred thousand records ?
... View more
06-23-2021
11:02 AM
Hi, We are using self-signed certs for connection between HF and UF for receiving data on HF on port 9997. Now we need to start using 3rd party certificates but we will not be able to place new cert on all UFs in one go. Is there a way for us to have multiple server.pem and cacert.pem on HF for ingestion until we are able to update certs on all our UFs. Thanks!
... View more
- Tags:
- Splunk Enterprise
- ssl
Labels
- Labels:
-
SSL
06-03-2021
04:00 AM
@ITWhisperer I have updated my response.
... View more
06-02-2021
11:31 PM
@ITWhisperer This is what we are using. My requirement is to only fill the box/tab with color (that is area within the border defined below) and not the whole input field set : <form>
<label>Data review test - payal</label>
<fieldset submitButton="false">
<input type="link" token="source_type" searchWhenChanged="true" id="source_tab1">
<label>Type of Source</label>
<choice value="source_type1" >Source1</choice>
<choice value="source_type2" >Source2</choice>
<choice value="source_type3" >Source3</choice>
<choice value="source_type4" >Source4</choice>
<change>
<condition value="source_type1">
<unset token="home_token"></unset>
<set token="source_type1_token"></set>
<unset token="source_type2_token"></unset>
<unset token="source_type3_token"></unset>
<unset token="source_type4_token"></unset>
</condition>
<condition value="source_type2">
<unset token="home_token"></unset>
<unset token="source_type1_token"></unset>
<set token="source_type2_token"></set>
<unset token="source_type3_token"></unset>
<unset token="source_type4_token"></unset>
</condition>
<condition value="source_type3">
<unset token="home_token"></unset>
<unset token="source_type1_token"></unset>
<unset token="source_type2_token"></unset>
<set token="source_type3_token"></set>
<unset token="source_type4_token"></unset>
</condition>
<condition value="source_type4">
<unset token="home_token"></unset>
<unset token="source_type1_token"></unset>
<unset token="source_type2_token"></unset>
<unset token="source_type3_token"></unset>
<set token="source_type4_token"></set>
</condition>
<condition>
<set token="tokLabel">$label$</set>
<set token="home_token"></set>
</condition>
</change>
</input>
<html>
<style>
/* This Layout Panel Bottom Padding removed to merge Link Input with horizontal line */
#panel_layout .fieldset{
padding: 10px 12px 0px 12px !important;
}
/* Increase width of Link input to have options in Single Line */
#source_tab1.input-link{
width:100%;
}
/* Change from flex to -webkit-box for side by side layout */
#input_radio_split_by.input-link div[data-component="splunk-core:/splunkjs/mvc/components/LinkList"]{
display: -webkit-box !important;
}
/* Create Button Border to make them appear as Tabs */
#source_tab1.input-link busplutton{
/*width: 120px !important;*/
border-top-color: rgb(255, 255, 255);
border-top-style: solid;
border-top-width: 1px;
border-right-color: rgb(255, 255, 255);
border-right-style: solid;
border-right-width: 1px;
border-left-color: rgb(255, 255, 255);
border-left-style: solid;
border-left-width: 1px;
border-top-left-radius: 10px;
border-top-right-radius: 10px;
}
/* Hide link input bottom message section to merge with Horizontal line */
.dashboard-panel #input_link_split_by label,
#source_tab1 .splunk-choice-input-message{
display: none !important;
}
/* Remove padding from horizontal line */
#panel_layout .panel-body.html{
padding: 0px !important;
}
</style>
<hr style="height:1px;border-width:0;color: black;background-color: white;margin: 0px;"/>
</html>
</fieldset>
<row>
<panel depends="$initial_token$" id="initial_panel">
<title>Click on input values to view results</title>
<html>
<style>
/* #initial_panel .dashboard-panel{
background-color:#F0F0F0 !important;
}*/
.dashboard-row #initial_panel .dashboard-panel h2.panel-title {
font-size: 20px !important;
color:#1A237E !important;
allign: center;
}
</style>
</html>
</panel>
</row>
</form>
... View more
06-02-2021
08:26 PM
Hi all, I am using linked list as input and have made it to look like tab by following one of the answer in the forum. Now i want to change the color colour of the input tab (each choice). Is that possible, please help.
... View more
06-02-2021
07:51 PM
@VI371887 know this is very old post, but were you ever successful in doing this?
... View more
05-30-2021
10:31 PM
Hi All, We have a clustered environment where we want to enable and add HEC on Heavy Forwarder but I am not able to figure out how to do this via deployment server. I need the exact steps you can do from server (not web) and without login into HF, should only login to DS. I would prefer it to be done just by updating configuration files and not via web as we are also looking to automate this in future. The basic issue i have a how to generate the token itself, is this something we can give on our own or do we need to generate each time? This page does not tell how i can generate a token value: https://docs.splunk.com/Documentation/Splunk/8.2.0/Data/UseHECusingconffiles I addition we are not going to use the default httinputs app but create new app for each index if required, like splunk_httpinput_<appname> Please help! Thanks,
... View more
- Tags:
- hec
05-30-2021
10:25 PM
Thanks gcusello! We do not want to pull the logs, windows team would send the logs to us and they will take care of filtering out data if required. I am looking at enabling HEC on our Heavy forwards. I will create another question for this as I am a bit confused how it will work for clustered environment. Thanks, Payal
... View more
05-27-2021
02:57 AM
Hi, I am new to working without splunk agents/universal forwards for ingesting data into Splunk. I need to know how application can send data to Splunk indexer/HF, is there exact step provided. Would it via HEC or by TCP port. And how could users set this up in this way to continuously send data. Thanks!
... View more
- Tags:
- windows
02-26-2021
06:53 AM
Thanks @scelikok for your response. Is there a way we might be able to determine (not necessary accurately) how many CPU cores a search might utilize on indexer (if we know approx bucket size). We are facing performance issue and so I would like to understand and hopefully explain to users regarding their search depending on the indexes they search on.
... View more
02-25-2021
10:22 PM
Hi, I am trying to understand a bit on how searches impact CPU usage on indexers. Does one search uses one CPU core by default or does it depend on indexes being searched Sometimes I have seen high CPU usage when large index is being searched or when users have multiple indexes as default and they do not specify, so multiple indexes are searched. Note: It is single query, no subqueries.
... View more
Labels
- Labels:
-
using Splunk Enterprise
02-22-2021
08:17 PM
We have TCP port open for a particular source. I have added persistent queue for this particular port as users were reporting random data loss. Is there a way to check persistent queue utilization in realtime and its historic values. Even after adding queue, users are still reporting some data loss and have not been able to confirm if this update had any positive impact due to retention period. I would like to see if: 1) persistant queue is beeing utilized 2) IS the queue filling up as well. I need to check this via queries preferably. Appreciate any help that could be provided!!
... View more
Labels
- Labels:
-
troubleshooting
11-12-2020
05:19 AM
Hi ramarcsight, Very old thread but did you manage to resolve this issue. Would be good if you are able to respond with any helpful information.
... View more
08-19-2020
03:08 AM
just did 🙂 https://community.splunk.com/t5/Getting-Data-In/Index-time-masking-maintaining-string-length-continue/m-p/514890#M87226
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-17-2024
03:32 AM
|
Karma given to
