Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About ssadanala1
ssadanala1
Contributor
Member since:
12-28-2017
08-24-2020
Community Statistics
| Posts | 95 |
| Solutions | 2 |
| Karma Given | 17 |
| Karma Received | 17 |
| Member Since | 12-28-2017 |
Activity Feed
- Got Karma for Re: How do I "merge" events?. 06-08-2021 03:47 AM
- Posted Search using MAP COMMAND on Splunk Search. 07-13-2020 09:22 AM
- Karma Splunk Security Essential not loading correctly for promisingbank. 06-05-2020 12:51 AM
- Got Karma for Re: how can I display threshold values when hover over single value visualization in dashboard ?. 06-05-2020 12:51 AM
- Karma Microsoft Office 365 Reporting Add-on for Splunk not pulling data - exiting with 500 Internal Server Error for nmadhok. 06-05-2020 12:50 AM
- Karma Re: How do I get the lower and upper bound of a timechart and use these in an eval? for woodcock. 06-05-2020 12:50 AM
- Got Karma for Re: Calculate max TPS over period of time (2 months) everyday. 06-05-2020 12:50 AM
- Karma Re: data rebalance progresses is very poor or getting stuck for rbal_splunk. 06-05-2020 12:49 AM
- Karma Re: How to break events in this scenario for woodcock. 06-05-2020 12:49 AM
- Karma Re: Timechart Volume per hour same day over several weeks...Seeking alternative way. for woodcock. 06-05-2020 12:49 AM
- Karma Why is answers not working for tkwaller_2. 06-05-2020 12:49 AM
- Karma Re: How to create a field with more complicated values to be extracted? for woodcock. 06-05-2020 12:49 AM
- Karma Re: How to create a field with more complicated values to be extracted? for richgalloway. 06-05-2020 12:49 AM
- Karma Re: How to filter out results based on 2 values in an event? for kmaron. 06-05-2020 12:49 AM
- Karma Re: How to create a query for below scenarios? for woodcock. 06-05-2020 12:49 AM
- Karma Re: How to create a query for below scenarios? for damien_chillet. 06-05-2020 12:49 AM
- Karma Re: Help with Line Break for log for somesoni2. 06-05-2020 12:49 AM
- Got Karma for Re: Renaming field name having #. 06-05-2020 12:49 AM
- Got Karma for Re: splunk license. 06-05-2020 12:49 AM
- Got Karma for Re: Is there a way to look at CSV files in the lookup ?. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
07-13-2020
09:22 AM
I have dropdown which has to execute the two different searches based on token picker I am trying to implement the mechanism using the functionality below .Map is not returning any results |makeresults | eval a = "index=_internal|head1" |eval b = "index=main|head1"|eval search1 = case($tok$=1,a ,1=1,b) |map search = "search $search1$"
... View more
- Tags:
- map
Labels
- Labels:
-
eval
-
search job inspector
-
stats
04-12-2020
11:16 AM
1 Karma
Thanks Very Much for your help . Stay Safe
... View more
04-09-2020
06:49 AM
whhich version of sse is it ?3.0.6 ?
... View more
04-06-2020
05:54 AM
how can I display threshold values when hover over single value visualization in dashboard ?
I have referred to answers and figured out the below css . how can I implement the effect to single value visualization panel ?
<panel>
<html>
<style>
.custom-tooltip{
display: inline;
position: absolute;
}
.custom-tooltip:hover:after{
background: #333 ;
background: rgba(0,0,0,.8) ;
border-radius: 5px ;
bottom: 26px ;
color: #fff ;
content: attr(title) ;
left: 20% ;
padding: 5px 15px ;
position: absolute ;
z-index: 98;
width: 220px;
}
.custom-tooltip:hover:before{
border: solid;
border-color: #333 transparent;
border-width: 6px 6px 0 6px;
bottom: 20px ;
content: "" ;
left: 50% ;
position: absolute ;
z-index: 99 ;
}
</style>
<a title="Splunk" class="custom-tooltip">Splunk is great</a>
</html>
</panel>
<panel>
<single>
<title>testing</title>
<search>
<query>|makeresults |eval a ="100"</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</single>
</panel>
... View more
12-18-2019
09:18 AM
Hi,
I have created a KV Store lookup. When I try to edit the lookup using the Lookup File Editor app, I am unable to edit values for a specific field name.
Any thoughts ???
... View more
01-31-2019
01:25 PM
1 Karma
index=xyz host=xyz*web* NOT _ui AND NOT medias AND NOT "/backoffice" AND "HTTP/1.1\" 200"|bin _time span=1d | stats max(TPS) as c by _time .
Gives you maximum vlaues of TPS per day
or you can use
index=xyz host=xyz*web* NOT _ui AND NOT medias AND NOT "/backoffice" AND "HTTP/1.1\" 200"| timechart span=1d max(current_size) as c
... View more
01-31-2019
11:50 AM
The values with \x are garbage values coming into splunk which is making logs looks unformated .
usage of sed command in props will remove those garbage value and make logs look formatted .
Please include below in your props and test it
[sourcetype]
SEDCMD-null = s/\x82//g
... View more
01-31-2019
11:43 AM
Can you set the search mode to verbose and check fields
... View more
12-19-2018
03:18 PM
Execute command below to reset fishbucket
.\splunk.exe cmd btprobe -d "C:\Program Files\SplunkUniversalForwarder\var\lib\splunk\fishbucket\splunk_private_db" --file
... View more
12-19-2018
02:43 PM
Hope this helps
https://answers.splunk.com/answers/320978/how-to-extract-the-timestamp-from-a-filename-at-in.html
... View more
10-08-2018
11:57 AM
You can download now directly from splunk base .
... View more
10-08-2018
11:33 AM
Please have a look below
| makeresults
| eval percentage="100.00" "Your pecentae value"
| eval Target = "9%" " your target value"
| eval Target = substr(Target,0,len(Target)-1) " we are using substr to remove % sign from events , as values needed to be numberic only for next statement "
| eval score = case(percentage>Target, 1, percentage<=Target, 0) " You have used if and its supposed to be case statement"
... View more
10-08-2018
11:24 AM
Not sure may be contacted sales and able to download .
Another approach would be downloading latest 7.2 version and installing it .
Usually for every new release , splunk embed overview app in the install , it will get you access to overview app .
... View more
10-08-2018
11:17 AM
for the group base dn , you need specify ou attribute
Your ldap configuration should resemble like this
groupBaseDN = ou=Groups,dc=splunksupport,dc=com;
*This is the Base of your Groups in LDAP. You can also specify multiple bases. For example: ou=Management,ou=Groups,dc=Splunkers,dc=com;ou=Consultants,ou=Groups,dc=Splunkers,dc=com;
For more Info
https://www.splunk.com/blog/2009/08/13/ldap-auth-configuration-tips.html
Hope it helps
... View more
10-08-2018
11:04 AM
Hi ,
Please look at answer below Hope if answers you question
https://answers.splunk.com/answers/438218/error-tcpinputproc-message-rejected-received-unexp.html
Please check tcp ports on indexers and validate output config on forwarder has same port on forwarder as well .
Make sure that indexer has tcp port enabled .
... View more
10-08-2018
06:51 AM
Give it a shot
index=indexname1 | eval suser=user |table _time user act| eval first=_time |appendcols [ search index=indexname1 | eval duser=user | eval last=_time|table _time last act] | stats values(*) as * by user .
Please let know
... View more
10-08-2018
06:45 AM
You can try some this like this
index=ironport
| rename url AS indicator |appendcols [search index=crowdstrike* type=url earliest=0 | spath output=myfield path=relations.indicator{}.type{} | table indicator, type, ip_address_types, labels_name,malware_families]| stats values(*) as * by indicator
... View more
09-19-2018
06:43 AM
Change the password and give it a try . I believe you are using same password as GUI
... View more
09-19-2018
06:37 AM
Here is props.conf for the File
SHOULD_LINEMERGE=false
TIME_PREFIX = ^
LINE_BREAKER = ([\r\n]+)\d{2}:\d{2}:\d{2}.\d{3}
MAX_TIMESTAMP_LOOKAHEAD = 30
TRUNCATE = 10000
TIME_FORMAT = %H:%M:%S.%3Q
" Test and Validate before deploying"
Cheers
... View more
09-19-2018
06:33 AM
https://answers.splunk.com/answers/217714/why-am-i-getting-error-the-license-signature-is-no.html
... View more
09-19-2018
06:29 AM
Looks like search job is expired .
Check for search name in Activity --> Jobs Page
... View more
09-19-2018
06:21 AM
1 Karma
Navigate in GUI through this path to access reports
settings --> searches and reports --> search for your report --> Click on Edit --> Make changes you wish to
when you are saying report not generated does it have any alert action associated with it ?
... View more
08-06-2018
01:44 PM
Per documentation
[monitor://]
* This directs a file monitor input to watch all files in .
* can be an entire directory or a single file.
* You must specify the input type and then the path, so put three slashes in
your path if you are starting at the root on *nix systems (to include the
slash that indicates an absolute path).
... View more
