Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About vinaykata
vinaykata
Path Finder
Member since:
11-15-2017
06-05-2020
Community Statistics
| Posts | 35 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 4 |
| Member Since | 11-15-2017 |
Activity Feed
- Got Karma for Mint users review?. 06-05-2020 12:50 AM
- Got Karma for Re: graph of avg, p95 and p5 on same graph. 06-05-2020 12:50 AM
- Got Karma for How to replace the response code value in a dashboard panel. 06-05-2020 12:50 AM
- Karma How to troubleshoot why a file in monitored folder is not being indexed in Splunk Light Free 6.3.0? for gbeddow. 06-05-2020 12:47 AM
- Got Karma for Re: How to troubleshoot why a deployment client is unable to phone home to the deployment server?. 06-05-2020 12:47 AM
- Posted Re: How to replace the response code value in a dashboard panel on All Apps and Add-ons. 12-10-2018 03:30 PM
- Posted Re: How to replace the response code value in a dashboard panel on All Apps and Add-ons. 12-10-2018 03:26 PM
- Posted How to replace the response code value in a dashboard panel on All Apps and Add-ons. 12-10-2018 11:01 AM
- Tagged How to replace the response code value in a dashboard panel on All Apps and Add-ons. 12-10-2018 11:01 AM
- Tagged How to replace the response code value in a dashboard panel on All Apps and Add-ons. 12-10-2018 11:01 AM
- Tagged How to replace the response code value in a dashboard panel on All Apps and Add-ons. 12-10-2018 11:01 AM
- Posted Re: Splunk skips or delays indexing of the log file during the rotation occassionaly on Splunk Search. 12-04-2018 02:02 PM
- Posted Mint users review? on All Apps and Add-ons. 11-16-2018 12:48 PM
- Tagged Mint users review? on All Apps and Add-ons. 11-16-2018 12:48 PM
- Posted Re: Does Splunk Mint is compatible with 6.6? on Splunk Search. 11-16-2018 09:55 AM
- Posted Does Splunk Mint is compatible with 6.6? on Splunk Search. 11-16-2018 09:17 AM
- Tagged Does Splunk Mint is compatible with 6.6? on Splunk Search. 11-16-2018 09:17 AM
- Posted Why are my IIS Logs indexing more slowly than other kinds of logs? on Getting Data In. 11-15-2018 02:03 PM
- Tagged Why are my IIS Logs indexing more slowly than other kinds of logs? on Getting Data In. 11-15-2018 02:03 PM
- Tagged Why are my IIS Logs indexing more slowly than other kinds of logs? on Getting Data In. 11-15-2018 02:03 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-10-2018
03:30 PM
How do I accept this answer, I am not seeing any options below to accept this answer
... View more
12-10-2018
03:26 PM
Wonderful!!! That was a perfect call!! Thank you sir
... View more
12-10-2018
11:01 AM
1 Karma
Hi,
I wanted to replace the response code (401) with 200 for a specific url in the website monitoring app. please see the attached screenshot for the reference. The colored fields has IIS service name and url. Lets say If I have a 100 URL inputs in the website monitoring app, I wanted to replace the 401 value only for specific single URL but not for all of the 100 URL's.
... View more
12-04-2018
02:02 PM
Hi, I am having the same issue with IIS logs and right now we are in 6.6.3. We are not able to upgrade our versions sooner because of some other issues we are having. So my question is, is this issue resolved for 6.6.3 or is it just above 6.6.4. we have tried adding "time_before_close = 10" in our inputs.conf, but we did not see any improvements or changes. Thanks everyone!!!
... View more
11-16-2018
12:48 PM
1 Karma
Hi Splunk Mint users,
we are planning to use Splunk Mint for our banking App, We would like to know how is it working for you all.
Is it easy to deploy and maintain through the future?
How about the upgrades, is this app following through the new Mobile OS upgrades.
Is it secure?
Do we need any extra hardware to maintain this?
Overall how is it performing?
And any other recommendations will be appreciated.
Thank you all 🙂
... View more
- Tags:
- mint
- splunk-mint
11-16-2018
09:17 AM
Does Splunk Mint is updated and compatible with enterprise 6.6?
... View more
- Tags:
- mint
11-15-2018
02:03 PM
What is the behavior of IIS logs different than regular logs.
Splunk is lagging a lot of time to index IIS logs while other logs are indexing as soon as they have generated.
My IIS Logs Inputs stanza
[monitor://E:\IISLogs\W3SVC*\*.log]
disabled = false
sourcetype = iis
index = weblogs
ignoreOlderThan = 1d
initCrcLength = 1024
crcSalt =
... View more
11-13-2018
12:56 PM
Correction it is 10KB file, But still do we have any option like that indexing files with specific size.
... View more
11-13-2018
11:51 AM
Hi all,
Is there any way that we can write an inputs.conf stanza with file size. I wanted to archive the files which have a size of 10 MB or more.
Ex:
[monitor://filePath\filename.json]
disabled = false
sourcetype = STname
archivefilesize >= 10Mb (somthing like this or any other way to whitelist or blacklist the files with file size)
Thank You All!!!
... View more
- Tags:
- filesize
- inputs.conf
11-08-2018
04:52 PM
Thanks Inventseker!! This worked for me
... View more
10-31-2018
12:20 PM
Hi all,
What's the exact way we can use blacklist in the inputs.conf file? Below is my example, and I am not sure if I should use regex or the path directly.
[monitor://C:\Program Files\Splunk*\etc...*.conf]
disabled = false
sourcetype = Conf
blacklist://C:\Program Files\Splunk*\etc...\app.conf
this stanza is to index all the Splunk config files. But I wanted to ignore the app.conf file under the same path. And also what's the correct format to use a second blacklist for another path?
Thank you all.
... View more
- Tags:
- blacklist
- inputs.conf
10-09-2018
10:39 PM
It worked for me with asterisk on both the sides, I have no idea why my screen hasn't shown up here. Anyway if you still need help try to post xml code here, Some one might take a look at it.
... View more
10-05-2018
01:22 PM
dropdown test
<input type="dropdown" token="host">
<label>host</label>
<choice value="*CVM*">*CVM*</choice>
<choice value="*VMUI*">*VMUI*</choice>
<fieldForLabel>host</fieldForLabel>
<fieldForValue>host</fieldForValue>
</input>
<panel>
<table>
<search>
<query>index=* source="*![alt text][1]" host=$host$| fields host| dedup host | table host</query>
<earliest>-15m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">true</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
... View more
10-05-2018
12:10 PM
Your search is almost correct try using sum(Total) instead of values.
Your search | stats sum(Total) as Total by host | addcoltotals labelfield="fieldName" label="GrandTotal" | your table command
... View more
10-05-2018
11:58 AM
1 Karma
....base search | timechart span=15d avg(field) as "field" p95(field) as "field" p5(field) as field by host or server
... View more
10-05-2018
11:38 AM
have you tried the basic searches
index="" OR index="_" | dedup index | table index
... View more
09-25-2018
02:31 PM
The same search hasn't worked earlier cause Server_Name field with all the server names are FQDN and the hosts in index are just a server names with out FQDN, SO the field values didn't match from lookup and the index. Then I have made another lookup with out FQDN ending to server names and it worked.
... View more
09-25-2018
12:16 PM
Hi,
I have a base search and I wanted to replace inputlookup instead of host=* in the below search
index=windows (sourcetype=WinHostMon OR sourcetype=WMI:CPU) host=*
| eval TotalPhysicalMemoryKB = round(TotalPhysicalMemoryKB/1024)
| eval TotalPhysicalMemoryKB = round(TotalPhysicalMemoryKB/1000,1)
| stats latest(NumberOfLogicalProcessors) as "CPU Count" latest(TotalPhysicalMemoryKB) as TotalPhysicalMemoryGB by host
| join host [ search index=perfmon object="LogicalDisk" counter="% Free Space" OR counter="Free Megabytes" | search instance=_Total
| eval TotalPhysicalMemoryKB = round(TotalPhysicalMemoryKB/1024)
| eval TotalPhysicalMemoryKB = round(TotalPhysicalMemoryKB/1000,1)
| eval diskInfoA = if(counter=="% Free Space",mvzip(instance,Value),null())
| eval diskInfoA1 = if(isnotnull(diskInfoA),mvzip(diskInfoA,counter),null())
| eval diskInfoB = if(counter=="Free Megabytes",mvzip(instance,Value),null())
| eval diskInfoB1 = if(isnotnull(diskInfoB),mvzip(diskInfoB,counter),null())
| stats list(diskInfoA1) AS "diskInfoA1", list(diskInfoB1) AS "diskInfoB1" by host, instance, _time
| makemv diskInfoA1 delim=","
| makemv diskInfoB1 delim=","
| eval freePerc = mvindex(diskInfoA1,1)
| eval freeMB = mvindex(diskInfoB1,1)
| eval usage=round(100-freePerc,2)
| eval GB = round(freeMB/1024,2)
| eval totalDiskGB = GB/(freePerc/100)
| stats max(totalDiskGB) AS "Total Disk Size (GB)" by host]
| table host,"CPU Count",TotalPhysicalMemoryGB,"Total Disk Size (GB)" | fillnull value=N/A | rename host As Server
Details of inputlookup:
it has 3 fields with names
Application_Name Server_Name Tier_Name
AAA xyz.fqdn web_Server
... View more
08-20-2018
12:20 PM
I have this input in my SplunkHome/etc/deployment-apps/appname/local/inputs.conf. And yes I have reloaded my deployment server after the config change.
... View more
08-20-2018
12:08 PM
it's going to default index (main) that's why I didn't mention it in the stanza
... View more
08-20-2018
11:55 AM
Sorry, that's my bad, I would have mentioned I wanted to index the earlier 7 days data, not older than 7days. Let's say today is 20th aug, So, I wanted to index data from 14th -19thAugust logs.
... View more
08-20-2018
11:42 AM
I wanted to index those 7days old logs and do a search on those for specific errors. Thanks for ur prompt response
... View more
08-20-2018
11:04 AM
I have a remote server which has 1 week older rolling logs. I wanted to monitor those logs so I have installed UF and set up inputs.conf. The newly created logs are showing up on Splunk search, but I am not able to search those 1week older files. Below is my inputs.conf. Is there any other way that I can import that logs to the same source type, same index and from the same host. Thank you
Sorry, that's my bad, I would have mentioned I wanted to index the earlier 7 days data, not older than 7days. Let's say today is 20th aug, So, I wanted to index data from 14th -19thAugust logs.
Splunk: 6.6.3
[monitor://D:\xxx*.log]
disabled = false
sourcetype = AAA
ignoreOlderThan = 7d
... View more
