Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About payl_chdhry
payl_chdhry
Explorer
Member since:
03-12-2020
12-09-2022
Community Statistics
| Posts | 27 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 0 |
| Member Since | 03-12-2020 |
Activity Feed
- Posted Re: Anonymization not working for extracted field with space in name on Getting Data In. 11-17-2022 11:06 AM
- Posted Anonymization not working for extracted field with space in name on Getting Data In. 11-14-2022 04:41 AM
- Tagged Anonymization not working for extracted field with space in name on Getting Data In. 11-14-2022 04:41 AM
- Tagged Anonymization not working for extracted field with space in name on Getting Data In. 11-14-2022 04:41 AM
- Tagged Anonymization not working for extracted field with space in name on Getting Data In. 11-14-2022 04:41 AM
- Tagged Anonymization not working for extracted field with space in name on Getting Data In. 11-14-2022 04:41 AM
- Posted Assign value to multiple fields in an event based on single if condition on Splunk Search. 07-22-2021 05:58 AM
- Posted Multiple certificates in receiving port 9997 on Security. 06-23-2021 11:02 AM
- Tagged Multiple certificates in receiving port 9997 on Security. 06-23-2021 11:02 AM
- Tagged Multiple certificates in receiving port 9997 on Security. 06-23-2021 11:02 AM
- Posted Re: Change colour of input choice in dashboard on Dashboards & Visualizations. 06-03-2021 04:00 AM
- Posted Re: Change colour of input choice in dashboard on Dashboards & Visualizations. 06-02-2021 11:31 PM
- Posted Change colour of input choice in dashboard on Dashboards & Visualizations. 06-02-2021 08:26 PM
- Posted Re: In a dashboard, can we change background color for the Splunk input choices ? on Dashboards & Visualizations. 06-02-2021 07:51 PM
- Karma Re: Creating HEC token for clustered environment for isoutamo. 05-31-2021 03:49 AM
- Posted Re: Creating HEC token for clustered environment on Security. 05-31-2021 02:47 AM
- Posted Creating HEC token for clustered environment on Security. 05-30-2021 10:31 PM
- Tagged Creating HEC token for clustered environment on Security. 05-30-2021 10:31 PM
- Posted Re: How to send data to Splunk clsuters from Windows without UF on Security. 05-30-2021 10:25 PM
- Posted How to send data to Splunk clsuters from Windows without UF on Security. 05-27-2021 02:57 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-17-2022
11:06 AM
Thank you for your response @PaulPanther I tried what you suggested but if did not work. extracted field still has unmasked data. Below is the type of event we expect: Product Assembly Name Product Version Class Name Timestamp Severity Hostname User name User ID WebEngine Request ID Connection ID Task ID Execution ID Report ID Request ID Transformation ID Message Exception Stacktrace
Qlik.NPrinting.Repo 00.00.0.0 Qlik.NPrinting.Repo.Service.AuthenticationService 20221118T163152.532+00:00 INFO GBW22223451 John Smith 0 0 0 0 0 0 0 0 Windows login successful. The user with id n45675643h456556l5c7bu5jw5esd4 has been correctly identified as a Windows domain user with sid S-1-4-10-123457890-1234543-13243554-344545
Qlik.NPrinting.Repo 21.14.5.0 Qlik.NPrinting.Repo.Service.AuthenticationService 20221118T163152.532+00:00 INFO GBW22223451 12345678 0 0 0 0 0 0 0 0 Windows login successful. The user with id n45675643h456556l5c7bu5jw5esd4 has been correctly identified as a Windows domain user with sid S-1-4-10-123457890-1234543-13243554-344545
Qlik.NPrinting.Repo 21.14.5.0 Qlik.NPrinting.Repo.Service.ImportExport.DataConnectionsMatchingService 20221118T163152.532+00:00 WARN GBW22223451 12345678 John Smith 0 0 0 0 0 0 0 0 Trying to import connection Horizon Scanning Rapid 2 MI Connection. Data connection NPrinting Rapid2 does not match↓Missing objects from template: O\fghjy, O\123457890-1234543-13243554-344545, O\123457890-1234543-13243554-344545, O\ttyte, O\fgfggf, O\erewff, O\sdfdf, O\dfdgfg, O\zfgfg, O\DfAd, O\dsfdfh, O\dfdfD, O\dfdZ↓
Qlik.NPrinting.WebEngine 21.14.5.0 Qlik.NPrinting.WebEngine.WebEngineWindowsService 20221118T163152.532+00:00 INFO GBW22223451 0 0 0 0 0 0 0 0 Windows authentication server listening on http://localhost:port/
... View more
11-14-2022
04:41 AM
We have requirement to mask data in index time. While below works to mask data in raw, it does not work for extracted field "User name". My SED is on universal forwarder (windows) and it works fine for raw data: s/(GBW\d{8}\t)(\d{8}\s){0,1}(\w.*?)(\t)/\1\2(masked)\4/g My props.conf: [sourcetype] SEDCMD-username=s/(GBW\d{8}\t)(\d{8}\s){0,1}(\w.*?)(\t)/\1\2(masked)\4/1 FIELD_DELIMITER=tab HEADER_FIELD_DELIMITER=tab HEADER_FIELD_LINE_NUMBER=1 MAX_TIMESTAMP_LOOKAHEAD=300 TIMESTAMP_FIELDS=Timestamp TIME_FORMAT=%Y%m%dT%H%M%S.%3N+%z TRANSFORMS-anonymize = username-anonymizer However, Transforms does not work. Have tried by placing on Universal forwarder as well as Intermediate heavy forwarder. Have created based on response from Solved: How can I anonymize fields of data that has underg... - Splunk Community transforms.conf: [username-anonymizer] REGEX = (?m)^(.*User name\:\:)(\d{8}\s){0,1}(\w.*?)$ FORMAT = $1(masked) WRITE_META = false SOURCE_KEY = _meta DEST_KEY = _meta Related info: We are expecting tab-delimited data. The field User name is in the middle and follows hostname and hence GBW is this example. "User name" could be combination of id and name and we only want to mask name: Value : 12345678 firstname lastname 12345678 firstname firstname lastname firstname expected masked value 12345678 (masked) 12345678 (masked) (masked) (masked) It could be blank as well.
... View more
Labels
- Labels:
-
transforms.conf
07-22-2021
05:58 AM
Hi, I have an use case where I have an if condition involving multiple comparisons. Based on its outcome, I want to re-assign values in multiple fields. Consider below example: My fields are: A1, B1, C1, A2, B2, C2 and few other fields I have an if condition and when it is true to assign value as below and if false do nothing: A1=A2 B1=B2 C1=C2 Now my query is, right now if I want to do this, I would have to write 3 different eval commands like below doing exact same comparisons: | eval A1=if(<condition>, A2, A1) | eval B1=if(<condition>, B2, B1) | eval C1=if(<condition>, C2, C1) Is there a way so that if I only use if once and when true, all three fields would get assigned value in one go. If there is a way, in terms of performance is above still better, I would be running this for more than hundred thousand records ?
... View more
06-23-2021
11:02 AM
Hi, We are using self-signed certs for connection between HF and UF for receiving data on HF on port 9997. Now we need to start using 3rd party certificates but we will not be able to place new cert on all UFs in one go. Is there a way for us to have multiple server.pem and cacert.pem on HF for ingestion until we are able to update certs on all our UFs. Thanks!
... View more
- Tags:
- Splunk Enterprise
- ssl
Labels
- Labels:
-
SSL
06-03-2021
04:00 AM
@ITWhisperer I have updated my response.
... View more
06-02-2021
11:31 PM
@ITWhisperer This is what we are using. My requirement is to only fill the box/tab with color (that is area within the border defined below) and not the whole input field set : <form>
<label>Data review test - payal</label>
<fieldset submitButton="false">
<input type="link" token="source_type" searchWhenChanged="true" id="source_tab1">
<label>Type of Source</label>
<choice value="source_type1" >Source1</choice>
<choice value="source_type2" >Source2</choice>
<choice value="source_type3" >Source3</choice>
<choice value="source_type4" >Source4</choice>
<change>
<condition value="source_type1">
<unset token="home_token"></unset>
<set token="source_type1_token"></set>
<unset token="source_type2_token"></unset>
<unset token="source_type3_token"></unset>
<unset token="source_type4_token"></unset>
</condition>
<condition value="source_type2">
<unset token="home_token"></unset>
<unset token="source_type1_token"></unset>
<set token="source_type2_token"></set>
<unset token="source_type3_token"></unset>
<unset token="source_type4_token"></unset>
</condition>
<condition value="source_type3">
<unset token="home_token"></unset>
<unset token="source_type1_token"></unset>
<unset token="source_type2_token"></unset>
<set token="source_type3_token"></set>
<unset token="source_type4_token"></unset>
</condition>
<condition value="source_type4">
<unset token="home_token"></unset>
<unset token="source_type1_token"></unset>
<unset token="source_type2_token"></unset>
<unset token="source_type3_token"></unset>
<set token="source_type4_token"></set>
</condition>
<condition>
<set token="tokLabel">$label$</set>
<set token="home_token"></set>
</condition>
</change>
</input>
<html>
<style>
/* This Layout Panel Bottom Padding removed to merge Link Input with horizontal line */
#panel_layout .fieldset{
padding: 10px 12px 0px 12px !important;
}
/* Increase width of Link input to have options in Single Line */
#source_tab1.input-link{
width:100%;
}
/* Change from flex to -webkit-box for side by side layout */
#input_radio_split_by.input-link div[data-component="splunk-core:/splunkjs/mvc/components/LinkList"]{
display: -webkit-box !important;
}
/* Create Button Border to make them appear as Tabs */
#source_tab1.input-link busplutton{
/*width: 120px !important;*/
border-top-color: rgb(255, 255, 255);
border-top-style: solid;
border-top-width: 1px;
border-right-color: rgb(255, 255, 255);
border-right-style: solid;
border-right-width: 1px;
border-left-color: rgb(255, 255, 255);
border-left-style: solid;
border-left-width: 1px;
border-top-left-radius: 10px;
border-top-right-radius: 10px;
}
/* Hide link input bottom message section to merge with Horizontal line */
.dashboard-panel #input_link_split_by label,
#source_tab1 .splunk-choice-input-message{
display: none !important;
}
/* Remove padding from horizontal line */
#panel_layout .panel-body.html{
padding: 0px !important;
}
</style>
<hr style="height:1px;border-width:0;color: black;background-color: white;margin: 0px;"/>
</html>
</fieldset>
<row>
<panel depends="$initial_token$" id="initial_panel">
<title>Click on input values to view results</title>
<html>
<style>
/* #initial_panel .dashboard-panel{
background-color:#F0F0F0 !important;
}*/
.dashboard-row #initial_panel .dashboard-panel h2.panel-title {
font-size: 20px !important;
color:#1A237E !important;
allign: center;
}
</style>
</html>
</panel>
</row>
</form>
... View more
06-02-2021
08:26 PM
Hi all, I am using linked list as input and have made it to look like tab by following one of the answer in the forum. Now i want to change the color colour of the input tab (each choice). Is that possible, please help.
... View more
06-02-2021
07:51 PM
@VI371887 know this is very old post, but were you ever successful in doing this?
... View more
05-30-2021
10:31 PM
Hi All, We have a clustered environment where we want to enable and add HEC on Heavy Forwarder but I am not able to figure out how to do this via deployment server. I need the exact steps you can do from server (not web) and without login into HF, should only login to DS. I would prefer it to be done just by updating configuration files and not via web as we are also looking to automate this in future. The basic issue i have a how to generate the token itself, is this something we can give on our own or do we need to generate each time? This page does not tell how i can generate a token value: https://docs.splunk.com/Documentation/Splunk/8.2.0/Data/UseHECusingconffiles I addition we are not going to use the default httinputs app but create new app for each index if required, like splunk_httpinput_<appname> Please help! Thanks,
... View more
- Tags:
- hec
Labels
- Labels:
-
other
05-30-2021
10:25 PM
Thanks gcusello! We do not want to pull the logs, windows team would send the logs to us and they will take care of filtering out data if required. I am looking at enabling HEC on our Heavy forwards. I will create another question for this as I am a bit confused how it will work for clustered environment. Thanks, Payal
... View more
05-27-2021
02:57 AM
Hi, I am new to working without splunk agents/universal forwards for ingesting data into Splunk. I need to know how application can send data to Splunk indexer/HF, is there exact step provided. Would it via HEC or by TCP port. And how could users set this up in this way to continuously send data. Thanks!
... View more
- Tags:
- windows
Labels
- Labels:
-
other
02-26-2021
06:53 AM
Thanks @scelikok for your response. Is there a way we might be able to determine (not necessary accurately) how many CPU cores a search might utilize on indexer (if we know approx bucket size). We are facing performance issue and so I would like to understand and hopefully explain to users regarding their search depending on the indexes they search on.
... View more
02-25-2021
10:22 PM
Hi, I am trying to understand a bit on how searches impact CPU usage on indexers. Does one search uses one CPU core by default or does it depend on indexes being searched Sometimes I have seen high CPU usage when large index is being searched or when users have multiple indexes as default and they do not specify, so multiple indexes are searched. Note: It is single query, no subqueries.
... View more
Labels
- Labels:
-
using Splunk Enterprise
02-22-2021
08:17 PM
We have TCP port open for a particular source. I have added persistent queue for this particular port as users were reporting random data loss. Is there a way to check persistent queue utilization in realtime and its historic values. Even after adding queue, users are still reporting some data loss and have not been able to confirm if this update had any positive impact due to retention period. I would like to see if: 1) persistant queue is beeing utilized 2) IS the queue filling up as well. I need to check this via queries preferably. Appreciate any help that could be provided!!
... View more
Labels
- Labels:
-
troubleshooting
11-12-2020
05:19 AM
Hi ramarcsight, Very old thread but did you manage to resolve this issue. Would be good if you are able to respond with any helpful information.
... View more
08-19-2020
03:08 AM
just did 🙂 https://community.splunk.com/t5/Getting-Data-In/Index-time-masking-maintaining-string-length-continue/m-p/514890#M87226
... View more
08-19-2020
03:08 AM
Posting a new question similar to my query from post: https://community.splunk.com/t5/Getting-Data-In/Index-time-masking-maintaining-string-length/td-p/514705 I have same requirement but for different format of string. I am trying to customize the rex/sed (SEDCMD=s/(?=[^\|]+\w{4}]$)./#/g) for this format but have not been able to achieve it yet. 2020-08-19T07:42:38,942 [Engine 9] TRACE MEHSegment WHERE "00" "00000123456 " 1 240 should give me: 2020-08-19T07:42:38,942 [Engine 9] TRACE MEHSegment WHERE "00" "0000012XXXX " 1 240
... View more
08-19-2020
01:19 AM
Sorry m new to posting here. How do I upvote a post once I have marked anther post as answer.
... View more
08-19-2020
12:45 AM
@cpetterborg Thank you for this. It worked 🙂 I had one more query in case you might be able to help. I have same requirement but for different format of string. I am trying to customize this rex/sed for this format as well but not able to achieve it yet. 2020-08-19T07:42:38,942 [Engine 9] TRACE MEHSegment WHERE "00" "00000123456 " 1 240 should give me: 2020-08-19T07:42:38,942 [Engine 9] TRACE MEHSegment WHERE "00" "0000012XXXX " 1 240
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-09-2022
01:10 AM
|
