Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Vijeta
Vijeta
Influencer
Member since:
10-30-2017
3 weeks ago
Community Statistics
| Posts | 652 |
| Solutions | 95 |
| Karma Given | 66 |
| Karma Received | 74 |
| Member Since | 10-30-2017 |
Activity Feed
- Posted Re: Duplicate Notable Events on Splunk Enterprise Security. 3 weeks ago
- Got Karma for Re: Where should I put my JavaScript and CSS files in Splunk Enterprise?. a month ago
- Got Karma for Re: How to find dashboards not in use by the amount of days?. 03-08-2021 07:31 AM
- Posted Re: Alert on user activity past 7 days and today on Splunk Search. 12-17-2020 12:16 PM
- Posted Re: Alert on user activity past 7 days and today on Splunk Search. 12-17-2020 11:49 AM
- Posted Re: Alert on user activity past 7 days and today on Splunk Search. 12-17-2020 10:56 AM
- Karma Re: How do you extract a timestamp from JSON logs that are being sent to an HTTP Event Collector? for hernanb. 10-23-2020 09:48 AM
- Got Karma for Re: How to split stats values() into other rows?. 09-16-2020 07:50 AM
- Got Karma for Re: Knowledge Objects for Orphaned searches. 07-24-2020 04:27 AM
- Got Karma for Re: Splunk Connect for Zoom. 07-06-2020 05:59 AM
- Posted Re: Splunk Connect for Zoom on All Apps and Add-ons. 07-04-2020 12:22 PM
- Karma Splunk SAML authentication issue when combining SAML and scripted inputs together for Splunk Cloudgateway implementation for pv063910. 06-05-2020 12:51 AM
- Karma Re: Rest call SPL to change ownership of a saved search for harsmarvania57. 06-05-2020 12:51 AM
- Got Karma for Re: What can be done when the parsing and aggregation queues are filled up?. 06-05-2020 12:51 AM
- Got Karma for Re: Count values delimited by "," in a field. 06-05-2020 12:51 AM
- Got Karma for Re: Why are my processing queues full on some indexers, and nearly empty on others?. 06-05-2020 12:51 AM
- Got Karma for Re: Why are my processing queues full on some indexers, and nearly empty on others?. 06-05-2020 12:51 AM
- Karma Re: Can you help me build a search that finds scheduled reports that are running? for mayurr98. 06-05-2020 12:50 AM
- Karma Re: Why am I getting multiple email notices per minute from Splunk? for richgalloway. 06-05-2020 12:50 AM
- Karma Re: Covert Object name into column name using back slash for whrg. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
12-17-2020
12:16 PM
What is the output you are getting with that search. Also that is for last day and not in last 60 minutes. If you want to check if user was infected in last 60 min, please change span to span=1m instead of span=1h and also change now() - (3600 * 24) to now() - 3600. Also share the result once you update.
... View more
12-17-2020
11:49 AM
@wtaylor149 Please try the search I posted, for you it would be. You can avoid sub-search by using below query. index=av_logs sourcetype="av" "Risk_Action"="Virus found" earliest=-8d@d latest=now
| bin span=1h _time|stats count by user Server_Name signature action _time|
eval flag=if(_time>=now()-(3600*24), 1,0)|eventstats sum(flag) as flag by user| where flag > 0
... View more
12-17-2020
10:56 AM
@wtaylor149 you can do something like, I am considering userswho had an infection in last 7 days and also in last 1 hour. This search needs to run over last 7 days, in case you want to run for users who had infection in last 7 days and today change the time calculation accordingly. <your search> |bin span=1m _time|stats count by user _time| eval flag=if(_time>=now()-3600, 1,0)|eventstats sum(flag) as flag by user| where flag > 0
... View more
07-04-2020
12:22 PM
1 Karma
Hi @lim2 The issue which I was seeing is when configuring Data inputs for Zoom on Splunk Heavy forwarder UI, it was creating passwords.conf file in the et/apps/search folder instead of Zoom app. After raising the ticket with Splunk, they provided with an updated python script to be used in the Zoom app instead of previous one. Post the update the issue related to file creation in search app was not there, but I am still getting 500 error from the Zoom web hook. This can be seen in marketplace.zoom.us under Webhook logs, it shows all the responses but with status code 500, so nothing gets ingested to Splunk. I have opened ticket with Zoom but haven't received any response. It does not seem to be a Splunk issue any more but may be a firewall issue or something not sure. I would suggest you to open support ticket with Splunk, and they can provide you updated python or look into your issue.
... View more
05-24-2020
06:12 PM
The Splunk connect for Zoom, had a bug which creates a password.conf file in your search app causing errors for reading password in logs. We opened a ticket with Splunk and they are working on fix, updated version shall soon be released. Hence closing this thread.
... View more
05-07-2020
09:46 PM
@ohhhvictor Check your web.conf in system/local has httpport=8000 , also check your server.conf for sslConfig stanza and see if it has sslPassword or not. In past trying to remove sslPassword and restarting splunk has worked for me.
... View more
05-06-2020
08:17 AM
The only WARN message I see is "Socket error from while accessing /services/storage/passwords/..". There is no passwords.conf in this app folder although it gets created under search app, which I don't understand why.
... View more
05-05-2020
05:59 PM
Not sure about the query, if the field name is correct it should get the value in $result.sourcetype$ when you add this in the alert action title . Where are you passing this variable?
... View more
05-05-2020
04:43 PM
Try using in alert name $result.sourcetype$
... View more
05-05-2020
04:31 PM
@rashi83 - In the distributed environment, you need to deploy this app on Search head as well along with the Heavy forwarder. May be this documentation will help https://raw.githubusercontent.com/mbegan/Okta-Identity-Cloud-for-Splunk/master/README/Okta%20Identity%20Cloud%20Add-on%20for%20Splunk.pdf
... View more
05-05-2020
04:27 PM
@t874560 Use this search
index="iptv_rdkb" [|inputlookup usersfile.csv]
| fields _time Source device.make model userId
| stats count by Source make model userId _time
| eventstats max(_time) AS max min(_time) AS min by userId
| eval max=strftime(max, "%Y/%m/%d %T.%3Q")
| eval min=strftime(min, "%Y/%m/%d %T.%3Q")
| stats earliest(min) as min earliest(max) as max first(make) as make first(model) as model first(userId) as user by userId
... View more
05-05-2020
04:09 PM
Is anyone able to pull logs using Splunk Connect for Zoom. I have installed the app and configured as per documentation , also have created webhook only app in Zoom and subscribed the events for Splunk endpoint, I still cannot see anything in my index. Please let me know if it is working for you.
... View more
04-14-2020
10:16 AM
@burakatabay any update on this? I am having similar issue.
... View more
03-03-2020
09:09 AM
1 Karma
You can check Search Activity- Deployment - Indexers dashboard on monitoring console and see if there are some long running or real time searches running. Also sometimes when the disks are old the issue comes due to saturation and IOPS performance is slow. You can run some tests to check the IOPS for your indexers. >50% is high utilization . Also splunk support can help you confirm if its IOPS issue if no long running or real time searches are running.
... View more
03-03-2020
08:41 AM
1 Karma
Usually this problem occurs when there is disk IOPS performance issues. Also some long running searches can coz queues to get filled up as read operations may be blocking the input queue. Check the Monitoring Console -> Resource Usage Machine dashboard. If you see high IOPS bandwidth utilization , it indicated problem with IOPS. What is the current disk IOPS for the indexer having issues?
... View more
02-20-2020
09:22 AM
1 Karma
@habrhi - assuming A and B are your field names
your query |eval newB=B| makemv delim="," newB| mvexpand newB| stats count(eval(LIKE(newB,"%s%"))) as c by A B
... View more
02-10-2020
08:27 AM
You can extract the name as below
[sourcetype_X]
EXTRACT-XYZ = username="(?<name>[^+\"]*)@"
... View more
02-10-2020
08:01 AM
1 Karma
@newsplunker1 If the object is both orphaned and Private it cannot be reassigned as you will not be able to see it under Reassign Knowledge Objects, you will have to reassign from the conf files.
... View more
02-07-2020
10:27 AM
May be the field is not parsed or extracted , its part of raw event only. In order to use it you need to create a field extraction. Can you share some sample log please.
... View more
