Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About saad_siddiqi
saad_siddiqi
Path Finder
Member since:
05-09-2013
04-11-2023
Community Statistics
| Posts | 28 |
| Solutions | 0 |
| Karma Given | 17 |
| Karma Received | 2 |
| Member Since | 05-09-2013 |
Activity Feed
- Posted Re: Azure Event hub input error in Microsoft Cloud Services add on on All Apps and Add-ons. 03-01-2021 12:49 AM
- Karma Re: Azure Event hub input error in Microsoft Cloud Services add on for bhsakarchourasi. 03-01-2021 12:48 AM
- Posted Re: Azure Event hub input error in Microsoft Cloud Services add on on All Apps and Add-ons. 02-28-2021 03:19 PM
- Posted Re: Issue with INDEXED_EXTRACTIONS for Microsoft Exchange Server Message Tracking log files on Getting Data In. 09-08-2020 01:43 AM
- Karma Re: Help with eval and wildcards for twinspop. 06-05-2020 12:50 AM
- Karma Re: Feature Request: How to embed a dashboard (not a report) that is updated every hour in a webpage? for MuS. 06-05-2020 12:47 AM
- Karma How to create a dashboard with dynamic charts/panels based on the number of hosts and hide panels if there is no data? for jamesmonico. 06-05-2020 12:47 AM
- Karma Re: Why does splunk need to be installed as root? for jrodman. 06-05-2020 12:47 AM
- Karma Re: timechart OTHER column for linu1988. 06-05-2020 12:47 AM
- Karma Re: Splunk GUI Rest API Twitter Integration for aaronkorn. 06-05-2020 12:46 AM
- Karma Re: TimePicker: Limit the choices on a specifique Dashboard for jlhamlet. 06-05-2020 12:46 AM
- Karma Re: TIME_FORMAT in Epoch for dwaddle. 06-05-2020 12:46 AM
- Karma Re: Concurrent Historical Searches still set to old value for linu1988. 06-05-2020 12:46 AM
- Karma Re: Regex to ignore [\r][\n] for sbrant_splunk. 06-05-2020 12:46 AM
- Karma Re: What's the meaning of aggregration queue? for _d_. 06-05-2020 12:46 AM
- Karma Re: An instance of fill_summary_index is already running for app=search for MarioM. 06-05-2020 12:46 AM
- Karma Re: TIME FORMAT for gfuente. 06-05-2020 12:46 AM
- Karma Re: TIME FORMAT for Ayn. 06-05-2020 12:46 AM
- Karma Re: Time format having pipe "|" for kristian_kolb. 06-05-2020 12:46 AM
- Got Karma for Re: [indexer] Streamed search execute failed because: User 'nobody' could not act as:. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-01-2021
12:49 AM
Yay! that did the trick! Thanks a lot for your quick response.
... View more
02-28-2021
03:19 PM
Can you please tell me what entitlements you have given to get this working? I am encountering the same errors LinkDetach("ErrorCodes.UnauthorizedAccess: Unauthorized access. 'Listen' claim(s) are required to perform this operation
... View more
09-08-2020
01:43 AM
Hi There, Were you able to get this sorted? I have a similar issue where my CSVs are getting translated as a bunch of EXTRA_FIELD_##
... View more
11-20-2019
05:54 PM
Hi There
Just wanted to check if anyone has tried running this app with Splunk 8.0 and/or Python 3 ?
I was looking to install this but not quite sure if it would work with Python 3.
... View more
10-29-2019
01:20 PM
Hi There,
Are there any plans on updating the Addon to be python3 compatible, with Splunk 8.0+?
Thanks
... View more
01-06-2014
07:57 PM
2 Karma
I too am looking for the solution to this, and have already logged couple of tickets with Splunk support.
I have just got confirmation that it is fixed in 6.0.1.
Going to upgrade now.
BUT, if you cannot upgrade, as a work around please add below mentioned lines in your search head
/opt/splunk/etc/system/local/distsearch.conf
[replicationSettings]
allowDeltaUpload = false
... View more
10-29-2013
08:41 PM
below is my inputs.conf
[rest://twitter]
auth_type = oauth1
endpoint = https://api.twitter.com/1.1/search/tweets.json
http_method = GET
index = twitter
index_error_response_codes = 1
oauth1_access_token = 35662991-XXXXXXXXXBF0hL6yffzzZrkZvxFISQGR
oauth1_access_token_secret = 2dXXXXXXXXXOR5ppHJVQroREXRPUjBRpNK
oauth1_client_key = zLxCXXXXXXXXPljW00A
oauth1_client_secret = fXKvtn0XXXXXXXX0od2zcMD7EtJsnY
polling_interval = 30
response_handler = TwitterEventHandler
response_type = json
sourcetype = rest_twitter
streaming_request = 0
url_args = since_id=395371736725598208,q=XXXX
disabled = 0
... View more
10-29-2013
07:22 PM
Hi Damien,
Thanks for your reply,
I am using REST API V1.3.1 and the stanza looks the same as you have suggested in this updated answer including the TwitterEventHandler
along with props.conf entry
[rest_twitter]
TIME_PREFIX = "created_at": "
MAX_TIMESTAMP_LOOKAHEAD = 40
... View more
10-29-2013
05:13 PM
I also am facing the same issue of getting duplicate tweets. Does anyone have a finding on that?
... View more
10-23-2013
03:31 PM
I have the similar setting but getting below mentioned error in my splunkd.log, has anyone encountered this?
10-23-2013 11:30:00.231 +1300 ERROR ExecProcessor - message from "python /app/splunk/etc/apps/rest_ta/bin/rest.py" Exception performing request: [Errno 8] _ssl.c:521: EOF occurred in violation of protocol
... View more
10-06-2013
04:40 PM
I actually want to show the performance stats with respect to time, that's why I want to create a timechart for every host.
... View more
10-06-2013
04:11 PM
I was wondering if there is any way through with we can generate graphs per hosts ( each host having different chart.
I need to have a report per server for performance stats in a more presentable manner and currently using sparkline format as below and sparkline formated to a line.
<table>
<option name="count">1000</option>
<title> Performance Summary</title>
<searchTemplate>
eventtype="windows_performance" host=* object="Processor" counter="% Processor Time"|rename Value AS CPU | append[search eventtype="windows_performance" host=* object="LogicalDisk" counter="% Free Space" instance="*"|rename Value AS Disk]| append[search eventtype="windows_performance" host=* object="Memory" counter="% Committed Bytes In Use"|rename Value AS Memory]| stats sparkline(avg(CPU)) as CPU, sparkline(avg(Disk)) as Disk,sparkline(avg(Memory)) as Memory by host | sort by host ASC
</searchTemplate>
<format field="host" type="text">
<option name="fontSize">14</option>
</format>
<format field="CPU" type="sparkline">
<option name="type">line</option>
<option name="height">100</option>
<option name="width">300</option>
<option name="lineWidth">2</option>
</format>
<format field="Disk" type="sparkline">
<option name="type">line</option>
<option name="height">100</option>
<option name="width">300</option>
<option name="lineWidth">2</option>
<option name="lineColor">green</option>
</format>
<format field="Memory" type="sparkline">
<option name="type">line</option>
<option name="height">100</option>
<option name="width">300</option>
<option name="lineWidth">2</option>
<option name="lineColor">red</option>
</format
Any help on this ??
Thanks
... View more
08-14-2013
02:33 AM
Thank you for looking into this
Below are some events
|CALLCONTROL|VMSIVR2|107|20130814|130224|130230|I
|CALLCONTROL|VMSIVR2|183|20130814|130224|130230|I
|CALLCONTROL|VMSIVR2|99|20130814|130124|130230|I
|PROVI|APS2|20130814|130240|
|PROVI|APS2|20130814|130253|
|SMSC|VMSIVR2||20130814|125501|
|SMSC|VMSIVR2||20130814|125511
|20130814|125959|202|12342|
|20130814|134950|203|12451|
Please note that the timestamp is moving here and there since this log is getting combined from various sources.
... View more
08-13-2013
06:01 PM
Hi There,
I am having trouble recognizing time format of %Y%m%d|%H%M%S (e.g. |20130813|235858 )
I have tried using the following settings in props.conf
TIME_PREFIX = \|
TIME_FORMAT = %Y%m%d\|%H%M%S
and
TIME_PREFIX = \|
TIME_FORMAT = %Y%m%d|%H%M%S
both not working.
Can anyone help me out here please.
... View more
08-12-2013
04:39 AM
Yeah i am referring to limits.conf and I thought the same but splunk still displayed the older limit even after increase of CPUs. Don't know why is that. Is there any time after which splunk recognizes new resources??
... View more
08-11-2013
10:28 PM
Hi There,
I have recently upgraded the Number of CPUs at the Search head from 2 to 4 but the Search limit is still set to the old value.
Is there anything which needs to be done after doing a hardware upgrade in order to make splunk recognize it?
Thanks
... View more
- Tags:
- cpu
- search-head
08-06-2013
07:48 PM
Hi,
The IT security guy here wants to review the splunk roles/users. I there any way by which I can give him access to Access Controls without giving the admin role.
Thanks
... View more
- Tags:
- access-control
08-06-2013
04:48 PM
Hi There,
I was wondering if there is any way of prioritize searches from a Specific Role/User.
Actually we have some automated checks/reports running via command line and they are failing since the System is approaching max concurrent historical searches limit.
Thanks
... View more
07-09-2013
05:33 PM
Hi there,
I have been trying to remove the below line which is a big part of one of the logs. Been trying with many regex types in transforms.conf but it doesn't recognize it when I a put in "[\r][\n]".
DEBUG - wire << "[\r][\n]"
I have tried many options like
"[\\r][\\n]"
"[\\r][\\n]\"
etc but still no luck.
Can anyone help me out with this.
Thanks
... View more
- Tags:
- regex
- transform.conf
06-11-2013
06:55 PM
Hi,
I am encountering a problem in lookups. The problem is that whenever the lookup file gets updated with new data, SPLUNK does not recognise the fields from the older data.
Say
older file had
ABC,RNC02,136,3G-000-001
New one has
ABC,RNC03,136,3G-000-001
and we do search for RNC02, is does not find the field description containing 3G-000-001
So, is there any way to bind the lookup with the data itself so as to keep the historical data consistent.
Thanks
... View more
- Tags:
- lookups
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-11-2023
10:05 PM
|
