About santosh_sshanbh

santosh_sshanbh · ‎08-13-2022

How and where to check this? Check if ServiceNow's incident modinput is running.

santosh_sshanbh · ‎07-15-2022

I want to monitor the critical services running status on a Windows server. Need to trigger ticket if any of the critical service is stopped for x number of minutes. Can this be implemented as normal alert or needs episode to be created? Normal alert have drawback of triggering again and again in case of service is down for longer time.

santosh_sshanbh · ‎03-24-2022

I am also facing the same problem on newly setup VM's running Windows 2019. Tried all the options suggested here but no success.

santosh_sshanbh · ‎05-10-2021

Hi @aasabatini for your response. However, I am not clear on how I can get the incident number from this search. Basically I have an aggregation policy with 2 action rules 1. Creates SNOW incident using one of the action of Splunk add-on for ServiceNow 2. Calls send email alert action Now my requirement is I need to embed the number of the incident (INCXXX) just created as a result of action #1 above in the body or subject line of the email.

santosh_sshanbh · ‎05-10-2021

I am using Splunk add-on for ServiceNow in my ITSI instance. I have configured Create SNOW incident action for the episode which is successfully creating incident in ServiceNow. As a next step I wan to inform the operations team about the recently created incident so I have configured another action for the same episode to send email. But I dont know how I can get the number of the recently created incident which I can send in the email subject line? Can anyone guide me on this?

santosh_sshanbh · ‎03-17-2021

I have a glass table which I want to add as a drill down to a button. So I have specified a URL of the glass table to the button click. However, I want the glass table to be opened in Full Screen mode by default. So how it is possible to do this?

santosh_sshanbh · ‎02-17-2021

I have a entity navigation configured for a custom entity. I want to pass the name of the selected KPI as a URL parameter to the dashboard associated with the entity navigation. How can I do this as selected KPI is not part of entity information.

santosh_sshanbh · ‎11-13-2020

I want to create an Accelarated Data Model. For that I have created a Base Search which has a join command. However, I am getting below error while accelarting the DM. Acceleration Warning You can only accelerate data models that include at least one event-based dataset or one search-based dataset that does not use reporting commands. How can I use a Join command in the base search?

santosh_sshanbh · ‎11-06-2020

Thanks alonsocaio for your response. I have changed SPL as per your comments as below host="Server1" index="performance_data" instance IN ("C:","D:","E:","F:","G:","H:") source="PerfmonMk:LogicalDisk" sourcetype="PerfmonMk:LogicalDisk" | fields _time, host, instance, Avg._Disk_Queue_Length | eval instance = substr(instance, 1, len(instance)-1) | eval Host_Instance = 'host'."-".'instance' | timechart eval(round(avg('Avg._Disk_Queue_Length'),2)) AS "Avg. Disk Queue Length" BY Host_Instance limit=0 But still the SPL took around 10 mins to load and the chart keeps on dancing while it loads. Even if I just fetch the events using base search and without any further command after |, still it takes significant amount of time. Job takes "This search has completed and has returned 7 results by scanning 9,184,627 events " Is this normal for these many count of events? The index has data for various sourcetypes and its size is 700+ GB. Could there be any problem with index or need additional IX in the cluster. Currently there are 4 indexers in cloud deployment which is managed by Splunk.

santosh_sshanbh · ‎11-06-2020

I have a dashboard to show disk read/write data for a server on a area chart. I have wrote below SPL for the same host="Server1" index="performance_data" instance=*: source="PerfmonMk:LogicalDisk" sourcetype="PerfmonMk:LogicalDisk" | eval instance = substr(instance, 1, len(instance)-1) | eval Host_Instance = 'host'."-".'instance' | timechart eval(round(avg('Avg._Disk_Queue_Length'),2)) AS "Avg. Disk Queue Length" BY Host_Instance limit=0 When I run this SPL for a weeks time and I have the disk data collected at every 30 s interval, the dashboard takes 10-15 mins to load. My Splunk instance is in Splunk managed cloud. Still it loads very slow. Is there any issue with the SPL or I have to use some optimization technique here to improve performance?

santosh_sshanbh · ‎07-16-2020

Thanks for the help. Your solution worked successfully and I also got to know that tokens are not available in Init part of dashboard.

santosh_sshanbh · ‎07-16-2020

I have 2 custom apps as App_A and App_B. I want to hide a panel based on the current app. For that I have used $env:app$ token. Now I want to eval a new token in the Init part of the dashboard which will compare the $env:app$ with App_A or App_B and then generate the value for new token. I tried various options like case, if but no success. Can any one help me in this scenario?

santosh_sshanbh · ‎06-24-2020

However the savedsearch workaround defects the purpose of using base search. In my case the similar SPL is used multiple times so I have to use base search to optimize the dashboard. However, instead of that if I have to use SavedSearch at each place then its not giving any benefit in terms of performance. Splunk is very slow to fix this issue which is being there for long time. They should provide some alternative not at the cost of performance.

santosh_sshanbh · ‎06-18-2020

IS there any workaround for this issue? How can a product be so much constrained and not fixed the problem for long time? Splunk what is your plan for this?

santosh_sshanbh · ‎06-12-2020

This is not working in my case. How can I pass a field value as a parameter to a macro?

santosh_sshanbh · ‎05-21-2020

Thanks this worked for me.

santosh_sshanbh · ‎04-30-2020

No, ultimately I have to write a python script to create a object and set all its properties before I call the POST method.

santosh_sshanbh · ‎03-17-2020

I tried above solution. However I am facing problem in case of trellis. I am not able to apply seperate color range scheme for each guage. The values of token $greenLimit$, $yellowLimit$ from 1st row gets applied to all guages. Is there any solution for this?

santosh_sshanbh · ‎03-04-2020

This also looks to be a bit simple alternative. Thanks for your valuable inputs.

santosh_sshanbh · ‎03-04-2020

Thanks for such a detailed approach. One QQ about #c. Is this technically possible even if your SH and Application servers are not in the same domain? I mean one in Splunk Cloud and another in private network? The reason behind exploring this option vs running scripted input is because the data I want to get from UF is needed very rarely at random point in time. So don't see a value in indexing it at regular intervals. But I think I need to balance between solution complexity vs data availability here. Anyways, thanks once again for your comments.

santosh_sshanbh · ‎03-03-2020

I want to trigger the script when user clicks the Submit button on a dashboard. Does the purpose of the script matters how it can be done? Anyways, the script needs to read the server local time and few other details.

santosh_sshanbh · ‎03-02-2020

My splunk architecture is as below: UF - > HF -> IX - SH Here, UF and HF are in same network where as IX and SH are in Splunk cloud. I need to run certain script on UF only on user request. I can not schedule it on time basis. However, considering my SH is in AWS cloud and out of the network boundry, how can I run the script based on user demand. Is there any solution/workaround for this?

santosh_sshanbh · ‎03-02-2020

Thanks for the inputs. QQ, can you share some thoughts on how to get the time of NTP server?

santosh_sshanbh · ‎03-02-2020

I have more than 100 UF deployed and wan to know the date and time of each of the forwarders to be shown in real time basis on a dashboards. How I can read the clock data of a UF on a real time basis?

santosh_sshanbh · ‎02-14-2020

The workaround I used for this problem is by replacing the double quotes by null string using REPLACE function of SQL. The changes I have done in dbinput configuration only.

Posts	84
Solutions	0
Karma Given	3
Karma Received	2
Member Since	‎10-09-2017

Online Status	Offline
Date Last Visited	‎08-13-2022 06:55 AM

Windows Server Critical Service Status Change- Can...

How to get the incident number for alert action

How to Open ITSI Glass Table in Full Screen mode?

ITSI Entity navigation, pass selected KPI

Accelerated Data Model Base search

SPL optimization for timechart

How to eval a token in the Init part of dashboard ...

Demand based script execution of script on UF

Universal Forwarder Local Clock

Pass Time input value as default to another time i...

Re: Splunk ITSI Bidirectional Ticketing Isuue

Windows Server Critical Service Status Change- Can...

Re: Why am I getting error "Splunk Enterprise Setu...

Re: How to get the incident number for alert actio...

How to get the incident number for alert action

How to Open ITSI Glass Table in Full Screen mode?

ITSI Entity navigation, pass selected KPI

Accelerated Data Model Base search

Re: SPL optimization for timechart

SPL optimization for timechart

Re: How to eval a token in the Init part of dashbo...

How to eval a token in the Init part of dashboard ...

Re: Why export button is grayed out in some of my ...

Re: Why export button is grayed out in some of my ...

Re: Insert field value into macro parameter

Re: How to use CSS to increase the width of a drop...

Re: Can we setup alerts using REST API, with actio...

Re: Radial gauge and max value

Re: Demand based script execution of script on UF

Re: Demand based script execution of script on UF

Re: Demand based script execution of script on UF

Demand based script execution of script on UF

Re: Universal Forwarder Local Clock

Universal Forwarder Local Clock

Re: Escaping the double-quotes when ingesting data...