Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About payl_chdhry
payl_chdhry
Explorer
Member since:
03-12-2020
03-15-2022
Community Statistics
| Posts | 25 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 0 |
| Member Since | 03-12-2020 |
Activity Feed
- Posted Assign value to multiple fields in an event based on single if condition on Splunk Search. 07-22-2021 05:58 AM
- Posted Multiple certificates in receiving port 9997 on Security. 06-23-2021 11:02 AM
- Tagged Multiple certificates in receiving port 9997 on Security. 06-23-2021 11:02 AM
- Tagged Multiple certificates in receiving port 9997 on Security. 06-23-2021 11:02 AM
- Posted Re: Change colour of input choice in dashboard on Dashboards & Visualizations. 06-03-2021 04:00 AM
- Posted Re: Change colour of input choice in dashboard on Dashboards & Visualizations. 06-02-2021 11:31 PM
- Posted Change colour of input choice in dashboard on Dashboards & Visualizations. 06-02-2021 08:26 PM
- Posted Re: In a dashboard, can we change background color for the Splunk input choices ? on Dashboards & Visualizations. 06-02-2021 07:51 PM
- Karma Re: Creating HEC token for clustered environment for isoutamo. 05-31-2021 03:49 AM
- Posted Re: Creating HEC token for clustered environment on Security. 05-31-2021 02:47 AM
- Posted Creating HEC token for clustered environment on Security. 05-30-2021 10:31 PM
- Tagged Creating HEC token for clustered environment on Security. 05-30-2021 10:31 PM
- Posted Re: How to send data to Splunk clsuters from Windows without UF on Security. 05-30-2021 10:25 PM
- Posted How to send data to Splunk clsuters from Windows without UF on Security. 05-27-2021 02:57 AM
- Tagged How to send data to Splunk clsuters from Windows without UF on Security. 05-27-2021 02:57 AM
- Karma Re: Does one search uses one CPU core (indexer) by default or does it depend on indexes being searched for gjanders. 03-08-2021 07:58 AM
- Posted Re: Does one search uses one CPU core (indexer) by default or does it depend on indexes being searched on Splunk Enterprise. 02-26-2021 06:53 AM
- Posted Does one search uses one CPU core (indexer) by default or does it depend on indexes being searched on Splunk Enterprise. 02-25-2021 10:22 PM
- Tagged Does one search uses one CPU core (indexer) by default or does it depend on indexes being searched on Splunk Enterprise. 02-25-2021 10:22 PM
- Tagged Does one search uses one CPU core (indexer) by default or does it depend on indexes being searched on Splunk Enterprise. 02-25-2021 10:22 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-22-2021
05:58 AM
Hi, I have an use case where I have an if condition involving multiple comparisons. Based on its outcome, I want to re-assign values in multiple fields. Consider below example: My fields are: A1, B1, C1, A2, B2, C2 and few other fields I have an if condition and when it is true to assign value as below and if false do nothing: A1=A2 B1=B2 C1=C2 Now my query is, right now if I want to do this, I would have to write 3 different eval commands like below doing exact same comparisons: | eval A1=if(<condition>, A2, A1) | eval B1=if(<condition>, B2, B1) | eval C1=if(<condition>, C2, C1) Is there a way so that if I only use if once and when true, all three fields would get assigned value in one go. If there is a way, in terms of performance is above still better, I would be running this for more than hundred thousand records ?
... View more
06-23-2021
11:02 AM
Hi, We are using self-signed certs for connection between HF and UF for receiving data on HF on port 9997. Now we need to start using 3rd party certificates but we will not be able to place new cert on all UFs in one go. Is there a way for us to have multiple server.pem and cacert.pem on HF for ingestion until we are able to update certs on all our UFs. Thanks!
... View more
- Tags:
- Splunk Enterprise
- ssl
Labels
- Labels:
-
SSL
06-03-2021
04:00 AM
@ITWhisperer I have updated my response.
... View more
06-02-2021
11:31 PM
@ITWhisperer This is what we are using. My requirement is to only fill the box/tab with color (that is area within the border defined below) and not the whole input field set : <form>
<label>Data review test - payal</label>
<fieldset submitButton="false">
<input type="link" token="source_type" searchWhenChanged="true" id="source_tab1">
<label>Type of Source</label>
<choice value="source_type1" >Source1</choice>
<choice value="source_type2" >Source2</choice>
<choice value="source_type3" >Source3</choice>
<choice value="source_type4" >Source4</choice>
<change>
<condition value="source_type1">
<unset token="home_token"></unset>
<set token="source_type1_token"></set>
<unset token="source_type2_token"></unset>
<unset token="source_type3_token"></unset>
<unset token="source_type4_token"></unset>
</condition>
<condition value="source_type2">
<unset token="home_token"></unset>
<unset token="source_type1_token"></unset>
<set token="source_type2_token"></set>
<unset token="source_type3_token"></unset>
<unset token="source_type4_token"></unset>
</condition>
<condition value="source_type3">
<unset token="home_token"></unset>
<unset token="source_type1_token"></unset>
<unset token="source_type2_token"></unset>
<set token="source_type3_token"></set>
<unset token="source_type4_token"></unset>
</condition>
<condition value="source_type4">
<unset token="home_token"></unset>
<unset token="source_type1_token"></unset>
<unset token="source_type2_token"></unset>
<unset token="source_type3_token"></unset>
<set token="source_type4_token"></set>
</condition>
<condition>
<set token="tokLabel">$label$</set>
<set token="home_token"></set>
</condition>
</change>
</input>
<html>
<style>
/* This Layout Panel Bottom Padding removed to merge Link Input with horizontal line */
#panel_layout .fieldset{
padding: 10px 12px 0px 12px !important;
}
/* Increase width of Link input to have options in Single Line */
#source_tab1.input-link{
width:100%;
}
/* Change from flex to -webkit-box for side by side layout */
#input_radio_split_by.input-link div[data-component="splunk-core:/splunkjs/mvc/components/LinkList"]{
display: -webkit-box !important;
}
/* Create Button Border to make them appear as Tabs */
#source_tab1.input-link busplutton{
/*width: 120px !important;*/
border-top-color: rgb(255, 255, 255);
border-top-style: solid;
border-top-width: 1px;
border-right-color: rgb(255, 255, 255);
border-right-style: solid;
border-right-width: 1px;
border-left-color: rgb(255, 255, 255);
border-left-style: solid;
border-left-width: 1px;
border-top-left-radius: 10px;
border-top-right-radius: 10px;
}
/* Hide link input bottom message section to merge with Horizontal line */
.dashboard-panel #input_link_split_by label,
#source_tab1 .splunk-choice-input-message{
display: none !important;
}
/* Remove padding from horizontal line */
#panel_layout .panel-body.html{
padding: 0px !important;
}
</style>
<hr style="height:1px;border-width:0;color: black;background-color: white;margin: 0px;"/>
</html>
</fieldset>
<row>
<panel depends="$initial_token$" id="initial_panel">
<title>Click on input values to view results</title>
<html>
<style>
/* #initial_panel .dashboard-panel{
background-color:#F0F0F0 !important;
}*/
.dashboard-row #initial_panel .dashboard-panel h2.panel-title {
font-size: 20px !important;
color:#1A237E !important;
allign: center;
}
</style>
</html>
</panel>
</row>
</form>
... View more
06-02-2021
08:26 PM
Hi all, I am using linked list as input and have made it to look like tab by following one of the answer in the forum. Now i want to change the color colour of the input tab (each choice). Is that possible, please help.
... View more
06-02-2021
07:51 PM
@VI371887 know this is very old post, but were you ever successful in doing this?
... View more
05-30-2021
10:31 PM
Hi All, We have a clustered environment where we want to enable and add HEC on Heavy Forwarder but I am not able to figure out how to do this via deployment server. I need the exact steps you can do from server (not web) and without login into HF, should only login to DS. I would prefer it to be done just by updating configuration files and not via web as we are also looking to automate this in future. The basic issue i have a how to generate the token itself, is this something we can give on our own or do we need to generate each time? This page does not tell how i can generate a token value: https://docs.splunk.com/Documentation/Splunk/8.2.0/Data/UseHECusingconffiles I addition we are not going to use the default httinputs app but create new app for each index if required, like splunk_httpinput_<appname> Please help! Thanks,
... View more
- Tags:
- hec
Labels
- Labels:
-
Other
05-30-2021
10:25 PM
Thanks gcusello! We do not want to pull the logs, windows team would send the logs to us and they will take care of filtering out data if required. I am looking at enabling HEC on our Heavy forwards. I will create another question for this as I am a bit confused how it will work for clustered environment. Thanks, Payal
... View more
05-27-2021
02:57 AM
Hi, I am new to working without splunk agents/universal forwards for ingesting data into Splunk. I need to know how application can send data to Splunk indexer/HF, is there exact step provided. Would it via HEC or by TCP port. And how could users set this up in this way to continuously send data. Thanks!
... View more
- Tags:
- windows
Labels
- Labels:
-
Other
02-26-2021
06:53 AM
Thanks @scelikok for your response. Is there a way we might be able to determine (not necessary accurately) how many CPU cores a search might utilize on indexer (if we know approx bucket size). We are facing performance issue and so I would like to understand and hopefully explain to users regarding their search depending on the indexes they search on.
... View more
02-25-2021
10:22 PM
Hi, I am trying to understand a bit on how searches impact CPU usage on indexers. Does one search uses one CPU core by default or does it depend on indexes being searched Sometimes I have seen high CPU usage when large index is being searched or when users have multiple indexes as default and they do not specify, so multiple indexes are searched. Note: It is single query, no subqueries.
... View more
Labels
- Labels:
-
using Splunk Enterprise
02-22-2021
08:17 PM
We have TCP port open for a particular source. I have added persistent queue for this particular port as users were reporting random data loss. Is there a way to check persistent queue utilization in realtime and its historic values. Even after adding queue, users are still reporting some data loss and have not been able to confirm if this update had any positive impact due to retention period. I would like to see if: 1) persistant queue is beeing utilized 2) IS the queue filling up as well. I need to check this via queries preferably. Appreciate any help that could be provided!!
... View more
Labels
- Labels:
-
troubleshooting
11-12-2020
05:19 AM
Hi ramarcsight, Very old thread but did you manage to resolve this issue. Would be good if you are able to respond with any helpful information.
... View more
08-19-2020
03:08 AM
just did 🙂 https://community.splunk.com/t5/Getting-Data-In/Index-time-masking-maintaining-string-length-continue/m-p/514890#M87226
... View more
08-19-2020
03:08 AM
Posting a new question similar to my query from post: https://community.splunk.com/t5/Getting-Data-In/Index-time-masking-maintaining-string-length/td-p/514705 I have same requirement but for different format of string. I am trying to customize the rex/sed (SEDCMD=s/(?=[^\|]+\w{4}]$)./#/g) for this format but have not been able to achieve it yet. 2020-08-19T07:42:38,942 [Engine 9] TRACE MEHSegment WHERE "00" "00000123456 " 1 240 should give me: 2020-08-19T07:42:38,942 [Engine 9] TRACE MEHSegment WHERE "00" "0000012XXXX " 1 240
... View more
08-19-2020
01:19 AM
Sorry m new to posting here. How do I upvote a post once I have marked anther post as answer.
... View more
08-19-2020
12:45 AM
@cpetterborg Thank you for this. It worked 🙂 I had one more query in case you might be able to help. I have same requirement but for different format of string. I am trying to customize this rex/sed for this format as well but not able to achieve it yet. 2020-08-19T07:42:38,942 [Engine 9] TRACE MEHSegment WHERE "00" "00000123456 " 1 240 should give me: 2020-08-19T07:42:38,942 [Engine 9] TRACE MEHSegment WHERE "00" "0000012XXXX " 1 240
... View more
08-19-2020
12:32 AM
@to4kawa that would replace the whole matching string with single #, like below: 2020-08-19T07:28:32,032 [Engine 8] TRACE SegmentLocks V13 added [1|A454FFDPP01] To: 2020-08-19T07:28:32,032 [Engine 8] TRACE SegmentLocks V13 added [1|#PP01] My requirement is to replace each character (and not whole string) with X so the count of characters replaced before masking is equal to count of Xs. 2020-08-19T07:28:32,032 [Engine 8] TRACE SegmentLocks V13 added [1|XXXXXXXPP01]
... View more
- Tags:
- @
08-18-2020
09:13 PM
great. Let me try this. @cpetterborg
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-15-2022
08:28 AM
|
