Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About maniu1609
maniu1609
Path Finder
Member since:
11-07-2017
08-05-2024
Community Statistics
| Posts | 43 |
| Solutions | 0 |
| Karma Given | 228 |
| Karma Received | 2 |
| Member Since | 11-07-2017 |
Activity Feed
- Got Karma for Re: Why am I unable to schedule PDF delivery dashboard as non-admin user?. 10-09-2024 09:47 PM
- Karma How to rename dynamic column name? for jiaqya. 06-05-2020 12:51 AM
- Karma To change the colour of the value in statistics table not the back ground for shruthiangadi. 06-05-2020 12:51 AM
- Karma How to calculate concurrent running builds in Jenkins and team city using Splunk? for Hemnaath. 06-05-2020 12:50 AM
- Karma Re: How do I sum all field values except one field and show the total in a new field? for Sukisen1981. 06-05-2020 12:50 AM
- Karma What's the order of operations for upgrading Splunk Enterprise? for jmulcaster_splu. 06-05-2020 12:50 AM
- Karma Re: What's the order of operations for upgrading Splunk Enterprise? for jmulcaster_splu. 06-05-2020 12:50 AM
- Karma Universal Forwarder is slow to manage large files for tomk1. 06-05-2020 12:50 AM
- Karma Create new rows from multi-value fields for robjackson. 06-05-2020 12:50 AM
- Karma Re: Create new rows from multi-value fields for VatsalJagani. 06-05-2020 12:50 AM
- Karma Can you help me with dedup and date field. How to get the latest record? for joesrepsolc. 06-05-2020 12:50 AM
- Karma How to add a new row to a lookup using a Splunk query? for agentsofshield. 06-05-2020 12:50 AM
- Karma How to reload a single panel with javascript? for pbalbasm. 06-05-2020 12:50 AM
- Karma Re: How can we convert multisite search head clustering into single site search head clustering? for adonio. 06-05-2020 12:50 AM
- Karma Export to csv on click of button for riya1. 06-05-2020 12:50 AM
- Karma Re: Export to csv on click of button for gaurav_maniar. 06-05-2020 12:50 AM
- Karma maxkbps on 10gb network for Jarohnimo. 06-05-2020 12:50 AM
- Karma Change background color in Single Value Visual? for dfrench151. 06-05-2020 12:50 AM
- Karma About autorun option in fieldset for tkdguq0110. 06-05-2020 12:50 AM
- Karma Re: What is the best Site_replication_factor and site_search_factor value to assign multisite indexer clustering? for amitm05. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
Also non-admin user role should have list_settings capability
... View more
03-11-2020
05:46 AM
reltime is the command available to get "The number of hours/days" from the _time field.
https://docs.splunk.com/Documentation/SplunkCloud/8.0.2001/SearchReference/Reltime#Examples
... View more
03-03-2020
07:16 AM
I'm struggling lot to learn dashboard/custom visualisation using Javascript and CSS. Could anyone please share materials or links please.
... View more
08-23-2019
10:09 AM
@jtacy Your answer to this question is really helpful for many people. Appreciate your effort. I have one doubt here.
I have enabled ssl in the splunk server that means splunk self signed ssl certificate is used.
Now I tried this url https://localhost:8443/ from postman tool with ssl certification validation enabled. But i didn't get 200 OK status instead i got below error:
"Self-signed SSL certificates are being blocked:
Fix this by turning off 'SSL certificate verification' in Settings > General"
Then i disabled ssl certification validation option in the tool and then hit this url again https://localhost:8443/. Now i'm getting 200 OK status.
So my question here is, Will the below health monitor be able to send HTTPS request to server from F5 and return 200 OK response even though we use self signed certification at server side?
Health Monitor Send String: GET /en-US/account/login HTTP/1.1\r\nHost: splunk.company.tld\r\nConnection: close\r\n\r\n
... View more
08-22-2019
10:33 AM
Hi Team
we're planning to use F5 in front of Splunk search cluster. and cluster has 5 search heads.
Now F5 team has told us to setup a simple index.html file to check health of each pool members. I'm not sure where to place this html file in Splunk search heads and i don't find any document root folder.
Many users have posted this question here but don't see proper solution for this. Could anyone please help me out how we can check pool member health please?
... View more
06-26-2019
10:21 AM
Do we need to remove site= site1 and multisite=true settings in server.conf file in all search heads?
... View more
06-26-2019
09:03 AM
Hi Team,
I could find Splunk doc for converting multisite indexer clustering into single site indexer clustering.
But I'm unable to find document for converting multisite search head clustering into single-site search head clustering.
Is this possible to convert?
Could you please help me here.
Thanks in advance
... View more
06-25-2019
10:59 PM
Thanks @amitm05 for your help. I'm happy that you have given me a direction. I'm clear with Site_replication_factor and site_search_factor value now.
So having odd number of indexers in site1 and even number of indexers in site2 isn't an issue. But we should be careful in choosing Site_replication_factor and site_search_factor. Am i correct?
... View more
06-25-2019
07:22 AM
Hi Team,
We are provided with 5 servers to be configured as indexers. So we're planning to keep 3 indexers in site1 and 2 indexers in site2.
So what is the best Site_replication_factor and site_search_factor value I can mention in cluster master?
Please give me little bit explanation if possible. That could be good learning to me.
Thanks in advance!!
... View more
04-11-2019
07:17 AM
Thanks @harsmarvania57. So whatever role we create should have user-level concurrent search limit less than number of concurrent search defined in limits.conf. Correct me if my understanding is wrong. Also I have one more query here. Should we define limits.conf at search head or in indexer?
... View more
04-11-2019
06:24 AM
Hi Everyone,
On my system, I have 2 CPU cores
In $SPLUNKHOME/etc/system/local/limits.conf file I got below details,
max_searches_per_cpu = 1
the base number of concurrent searches
base_max_searches = 6
max real-time searches = max_rt_search_multiplier x max historical searches
max_rt_search_multiplier = 1
on search head, Access controls » Roles » demorole
User-level concurrent search jobs limit = 10
now, the demorole role will choose which option? 8 or 10?
... View more
That's wonderful. I'm able to schedule it now. Thanks @harsmarvania57
... View more
Hi Everyone,
I'm trying to create a Scheduled PDF delivery of a dashboard and email that PDF to some internal users. I logged into Splunk as non-admin user, and then ran a query and saved as a dashboard panel. When I clicked on export option, I don't see "Schedule PDF delivery" option. But when I logged in as admin, I could see the option.
May I know what role or capabilities I should add to non-admin user to enable them to schedule the PDF delivery?
Can anyone please help me out here. Thanks in advance.
... View more
Labels
- Labels:
-
PDF
-
scheduled search
01-30-2019
12:11 AM
Thanks @jcrabb_splunk
... View more
01-29-2019
07:24 AM
Do we have same issue in 7.1.4 version?
... View more
09-30-2018
12:56 AM
Thanks @Sukisen1981 . Works perfectly.
... View more
09-29-2018
10:19 AM
Hi Friends,
I have the following statistics as below.
Query:
tag=web_app_access|timechart count by status
Result:
_time 200 400 403 404 503 505
2018-09-28 00:00:00 109 0 1 1 2 3
2018-09-28 00:30:00 79 6 0 0 2 4
2018-09-28 01:00:00 91 1 1 2 3 1
Now i'm trying to sum all field values except field values from '200' field using below query
Query:
tag=web_app_access|timechart count by status | eval total=('400'+'403'+'404'+'503'+'505')
Result:
_time 200 400 403 404 503 505 total
2018-09-28 00:00:00 109 0 1 1 2 3 7
2018-09-28 00:30:00 79 6 0 0 2 4 12
2018-09-28 01:00:00 91 1 1 2 3 1 8
In this case we have 5 fields to be summed up hence we used eval total=('400'+'403'+'404'+'503'+'505'). What if there are 100+ fields and we need to sum their values? Is there any way or method to sum the field values instead of manually mentioning them?
... View more
09-25-2018
07:57 AM
Thanks Viji. I have set frequency as 15 mins. Could you please with an example please.
... View more
09-25-2018
06:52 AM
You can use below SPL
Index=tanium | lookup nessus_assets.csv MAC Address as MAC_Address |table
... View more
09-25-2018
06:21 AM
How to create alert if specific event found first time in a day and ignore creating alert if the same event found second time in day?
We are indexing web services errors in Splunk. Here are some cases we are involved in.
We need to create an alert if we find an error text for a web service in a day. If we find the same error text for the same web service, then an alert shouldn't be created.
This scenario will be a tricky one. If the alert finds 2 error texts: For one error text , we already raise an alert as it is the first error in a day. For another error text we need to send alert as it's new now.
Please help me how we can handle this.
... View more
06-22-2018
02:00 AM
Now i did few changes:
Removed #! from #!/usr/bin/python line in system_python.path file
Added chunked = true in commands.conf file
Restarted splunk
After doing above changes, I again ran search command, Now I could see below error in job inspector:
06-22-2018 09:45:24.734 INFO ChunkedExternProcessor - Running process: /usr/bin/python getmetricdemo.py
06-22-2018 09:45:29.427 ERROR ChunkedExternProcessor - Failed attempting to parse transport header: _time,aaaa,bbbbb\r
06-22-2018 09:45:29.427 ERROR ChunkedExternProcessor - Error in 'getmetricdemo' command: External search command exited unexpectedly.
... View more
06-21-2018
06:41 PM
Hi @PowerPacked
Thanks for your help. I have added as you mentioned. But still no luck. I have configured this in deployer. Does this custom search command need to be configured only in search head and works only in search head?
... View more
06-21-2018
08:29 AM
I have created custom search command called "getmetricdemo". I have configured everything but I'm not getting output in splunk GUI when I run search query as "| getmetricdemo" . Here is my configuration details:
commands.conf:
[getmetricdemo]
filename = system_python.path
command.arg.1 = getmetricdemo.py
generating = true
supports_rawargs = true
Since I'm invoking external processor, I gave python interpreter name in system_python.path file
cat system_python.path
!/usr/bin/python
python program is running fine when I execute in Linux CLI:
python getmetricdemo.py
_time,aaaa,bbbbb
1529492520.0,1,1
1529492580.0,1,1
1529492400.0,1,1
1529492640.0,1,1
1529492460.0,1,1
Both system_python.path and getmetricdemo.py are located in /opt/splunk/etc/apps//bin directory.
Could anyone please help me out here. Thanks in advance!!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-05-2024
07:09 AM
|
