About meenu_2017

meenu_2017

Thank you for the response! I didnt had access to internal logs so didn't had a way to check what's going on even though the alerts were triggering. This documentation took me to the right spot for logs and pinpointed my issue - https://splunk.github.io/splunk-alerts-for-microsoft-teams/Configuration/

meenu_2017

Thank you for the pointers! The docs for the Splunk alert for Teams took me to the logging and showed me that the channel I was trying to hit is a private channel and hence failed to send the notifications. Tried pointing to a different channel and is working as intended.

meenu_2017 · ‎05-20-2026

I’m trying to configure a Splunk alert to post notifications to Microsoft Teams, but I’m running into issues with both the webhook option and the ‘MS Teams: Publish to Channel’ method. I’d really appreciate any guidance or best practices on getting this set up.

meenu_2017 · ‎02-14-2023

We have been using this add-on with Splunk enterprise and jira service desk on-prem.. And we are moving to splunk cloud soon. Wondering if this app works with splunk cloud and the on-prem version of jira service desk. Anyone who was able to successfully configure it this way

meenu_2017 · ‎04-14-2020

To answer your question,David I did try on a different browser and didnot work there either. So i think its a security feature for the website. But thanks for the details. [Updated the comment for clarity]

meenu_2017 · ‎04-11-2020

I'm checking to see if i can embed an external web page which requires a login to the splunk dashboard. I'm able to add the web page to a panel using iframe, but it is not letting me log in. Any idea what might be happening? I otherwise have access to the external website.

meenu_2017 · ‎09-04-2019

Is there any difference if we specify the cron with schedule = or interval=?

meenu_2017 · ‎04-08-2019

Qn on custom trigger condition for alerts. Does the secondary search executes if the primary search returns no results?

meenu_2017 · ‎03-01-2019

Its getting executed once immediately after forwarder restart! We have a big set of machines working as expected with the same config and a few which is showing duplicate events from multiple runs.

meenu_2017 · ‎03-01-2019

I have a scripted input that runs on the schedule 0 9 * * * (once a day at 9 am). This is a powershell scripted input and observing that this gets triggered multiple times if the server gets rebooted and hence the forwarder restarts. Any idea why would this happen? Universal Forwarder version - 6.6.6

meenu_2017 · ‎10-26-2018

I'm trying to represent Store#s in cluster map using geostats command. I'm able to get Store# on the label, but it shows as number formatted( with a comma). eg :Store : 1,000. Wondering if there is a way to render this as a text. Any one who has dealt with something similar?

meenu_2017 · ‎07-10-2018

Thanks for the suggestions. I might have to work with the admin here for some of these. But since they both returns almost the same no.of records, is it that Instance 2 is calculating the size wrongly or so?

meenu_2017 · ‎07-10-2018

These search heads are not clustered. They are set separately for each of the instances. As they both are returning approximately the same no. of records, i couldn't think of a permission issue .

meenu_2017 · ‎07-09-2018

They both are running in fast mode.

meenu_2017 · ‎07-09-2018

Hello Fellow Splunkers, Need help to understand a scenario that I came across in my org. Why would the same search running on 2 different instances shows a huge difference in job size. for eg , Instance 1 returns 13,647,640,178 results with job size 36.61 MB Instance 2 returns 13,669,171,100 results with job size 84KB. I don't care about the difference in event counts but wondering about the huge variation in size. Any guidance as to what i should look?

meenu_2017 · ‎05-29-2018

I've few questions regarding indexing xml data onto Splunk. 1. The log file is a combination of normal text data and xml based on the log level(debug/info). Can i use the setting kvmode=xml for such a log file?Will it get indexed correctly with xml fields identified? Does kvmode=xml setting improves search performance, when we need to report out of few(may be 3 or 4) xml tag values? Without this setting, it would be regex and i'm trying to understand which is better? 3.What should be the line breaker setting if there are multiple date values in xml .

meenu_2017 · ‎05-24-2018

Is INDEXED_EXTRACTIONS=XML setting still valid? I got an error for this setting in 7.0

Posts	17
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎09-14-2017

Online Status	Offline
Date Last Visited	3 weeks ago

Splunk alert to post a notification in Teams

Does Add-on for Atlassian JIRA Service Desk alert ...

Embed an external webpage with login to splunk das...

custom trigger condition

scripted input not following the cron schedule

cluster map marker label

Why would a same search running on 2 different ins...

Questions on indexing xml data

Re: Splunk alert to post a notification in Teams

Re: Splunk alert to post a notification in Teams

Splunk alert to post a notification in Teams

Does Add-on for Atlassian JIRA Service Desk alert ...

Re: Embed an external webpage with login to splunk...

Embed an external webpage with login to splunk das...

Re: scripted input not following the cron schedule

custom trigger condition

Re: scripted input not following the cron schedule

scripted input not following the cron schedule

cluster map marker label

Re: Why would a same search running on 2 different...

Re: Why would a same search running on 2 different...

Re: Why would a same search running on 2 different...

Why would a same search running on 2 different ins...

Questions on indexing xml data

Re: Has anybody parsed HL7 version 3 records (XML)...

Join the Conversation