Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About pradeepkumarg
pradeepkumarg
Influencer
Member since:
09-22-2012
10-20-2021
Community Statistics
| Posts | 541 |
| Solutions | 84 |
| Karma Given | 140 |
| Karma Received | 223 |
| Member Since | 09-22-2012 |
Activity Feed
- Got Karma for Re: What does "show source" under "event actions" do?. 06-03-2024 04:52 PM
- Got Karma for Re: How can I bypass the License Agreement on startup after a new install?. 05-27-2024 03:01 AM
- Got Karma for Re: How to list all lookup files from an app?. 12-06-2023 01:41 PM
- Got Karma for Re: How can I bypass the License Agreement on startup after a new install?. 03-04-2023 01:16 PM
- Got Karma for Re: How can I bypass the License Agreement on startup after a new install?. 09-23-2022 04:00 AM
- Got Karma for Re: see users logging in from more than one country. 06-09-2022 12:33 PM
- Got Karma for Re: How can I verify if the boot-start is already enabled?. 03-09-2022 02:45 AM
- Got Karma for Re: Search to get the license usage per a single host?. 01-19-2022 12:09 PM
- Got Karma for Re: How can I identify which dashboards include a specific string?. 11-03-2021 07:20 AM
- Got Karma for Re: How to remove columns from search results table?. 10-27-2021 07:56 AM
- Got Karma for Re: Why is my search skipping?. 10-06-2021 11:00 AM
- Got Karma for Re: How to increment the field based on the previous value based on the condition?. 08-09-2021 06:27 AM
- Got Karma for Re: How to track the bundle size on indexers over time. 04-16-2021 06:56 AM
- Got Karma for Re: Does the splunk_archver app need to be distributed to the search peers via the knowledge bundle?. 02-09-2021 12:27 AM
- Got Karma for How to add custom message in place of "Search is waiting for input" for a dashboard panel?. 10-02-2020 08:35 AM
- Got Karma for Re: How to remove columns from search results table?. 09-17-2020 05:04 AM
- Got Karma for Re: How to count by DIFFERENT values of a field?. 08-27-2020 06:07 AM
- Posted Re: Data Onboarding Strategy on Getting Data In. 08-10-2020 09:17 AM
- Posted Data Onboarding Strategy on Getting Data In. 08-08-2020 10:41 AM
- Karma Re: rex - matching everything until a tab for Ayn. 07-25-2020 09:06 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
07-03-2018
12:59 PM
How do your individual queries look like? You can combine all your individual queries into one search and then run statistics on the result set to generate a piechart
Eg:
mysearch1 |table field1 count | append [mysearch2 |table field1 count ] | append [mysearch3 |table field1 count] | stats sum(count) by field1
... View more
07-03-2018
10:55 AM
1 Karma
You must be in Statistics tab. Change to Visualizations tab?
The tabs are just below the search.
... View more
07-03-2018
08:11 AM
base search ... | eval Status=case('Step Start Date' == "" AND 'Step Date Completed' == "", "Not Started", 'Step Start Date' != "" AND 'Step Date Completed' == "", "Started", 'Step Start Date' != "" AND 'Step Date Completed' != "", "Completed" )| autoregress "Step Date Completed" as prev_step_date_completed | eval "Projected Start Date"=if(Status == "Not Started", prev_step_date_completed , 'Step Start Date')
autoregress - http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Autoregress
... View more
07-02-2018
11:09 AM
so, that looks like the forwarder is unable to communicate to the indexers. Verify your outputs.conf and check for any errors in splunkd.log $SPLUNK_HOME/var/log/splunk/splunkd.log
... View more
07-02-2018
10:36 AM
You mentioned the index stanza is located on the master. I assume you created in an app under master-apps and did a bundle push. You can login to the indexer and go to settings -> indexes to see if the index is actually created on the indexer.
Do you see partial data missing or all data?
Do you see internal data from the forwarder host? index=_internal host=your_forwarder_host
... View more
07-02-2018
07:33 AM
3 Karma
Yes, srchMaxTime in authorize.conf for the role you want to limit to.
srchMaxTime =
* Maximum amount of time that searches of users from this role will be
allowed to run.
* Once the search has been ran for this amount of time it will be auto
finalized, If the role
https://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Authorizeconf
... View more
07-02-2018
06:29 AM
This is possible when the alert is not created via splunkweb but pushed from a deployer in an SH Cluster. You have to remove it from the deployer instance and push the bundle.
... View more
06-28-2018
07:03 AM
You can do something like below
FIELDALIAS-winlogbeat_as_account_domain_target = winlogbeat_event_data_TargetDomainName as Account_Domain
FIELDALIAS-winlogbeat_as_account_domain_subject = winlogbeat_event_data_SubjectDomainName as Account_Domain
EVAL-winlogbeat_as_account_domain= coalesce(winlogbeat_as_account_domain_target , winlogbeat_as_account_domain_subject )
Calculated fields
https://docs.splunk.com/Documentation/Splunk/7.1.1/Knowledge/definecalcfields
... View more
06-14-2018
12:56 PM
so | head 2 will give you the latest 2 entries for the host you specified.
by making host=* and adding | dedup 2 host, you are retaining the latest 2 entries for every host
... View more
06-14-2018
09:48 AM
Can you not do dedup host?
index=foo host=* sourcetype=netstat
| dedup 2 host
... View more
06-14-2018
08:11 AM
do you see any crash*.log inside var/log/splunk/ ?
... View more
06-13-2018
08:17 AM
It should still work without the explicit | search command.
... View more
06-13-2018
07:39 AM
You are not comparing. But using lookup as a subsearch to filter LUFieldA. That's the reason I renamed LUFieldA to fieldA so that the field matches between your lookup and index. Did you try running the search?
... View more
06-13-2018
07:18 AM
1 Karma
index= "index1" sourcetype="ST1" [| inputlookup Mylookup.csv | rename LUFieldA as fieldA | table fieldA | format ] | table fieldA fieldB fieldC
... View more
06-12-2018
10:28 AM
Append this to your search
| eval message = if(server1=server2,"same","not_same")
... View more
06-12-2018
07:48 AM
How will you know what rows from result 1 relate to what rows in result 2? Is there not a common field between the two datasets?
... View more
06-08-2018
11:31 AM
Is this index created on the indexer? windows_index. Unless you create the index on the indexer, the events end up no where.
... View more
06-07-2018
01:34 PM
Something like this
(index="cms_vm") host=$hostnamefield$ IP=$ipfield$ | append [ (index="cms_host") host=$hostnamefield$ IP=$ipfield$ | rename IP as host_ip] | stats values(IP) as VM_IP values(host_ip) as HOST_IP values(MacAddress) as MacAddress values(OperatingSystem_Code ) as OperatingSystem_Code values(Cluster) as Cluster by host
... View more
06-06-2018
05:27 PM
Try setting MAX_TIMESTAMP_LOOKAHEAD to a lower value in the props.conf for the sourcetype so that it doesn't reach to the point where you have the long integers? There could be other elegant solutions.
... View more
06-06-2018
05:09 PM
This is the other way around, Splunk posts the response to the URL you specify.
... View more
06-05-2018
07:43 PM
Can you add a static value as All and set that as default ?
... View more
06-05-2018
07:40 PM
Yes, you can use webhook and Specify an URL to send JSON payload via HTTP POST. Refer below documentation.
http://docs.splunk.com/Documentation/Splunk/7.1.1/Alert/Webhooks
... View more
06-05-2018
01:35 PM
got it, you might be using your splunk.com username and password. That won't work
Below will work
username: admin
password: changeme
... View more
06-05-2018
01:32 PM
Take a look at this thread - https://answers.splunk.com/answers/180660/how-to-convert-a-timestamp-field-to-epoch-format.html
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-20-2021
03:38 PM
|
Karma given to
