Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About nnimbe1
nnimbe1
Path Finder
Member since:
01-29-2018
11-06-2023
Community Statistics
| Posts | 26 |
| Solutions | 0 |
| Karma Given | 14 |
| Karma Received | 0 |
| Member Since | 01-29-2018 |
Activity Feed
- Posted DB Connect error, database connection is invalid, Login failed for the user on All Apps and Add-ons. 11-06-2023 05:47 AM
- Posted Re: [Errno 13] Permission denied on Security. 07-08-2022 06:00 AM
- Karma Re: [Errno 13] Permission denied for woodcock. 07-08-2022 05:59 AM
- Posted Re: Why the KVstore process is being started as a root? on Knowledge Management. 01-10-2022 06:03 AM
- Posted Re: Kvstore taking more space on Splunk Dev. 01-10-2022 06:02 AM
- Karma Re: AWS Guardduty & Splunk for amiracle. 08-30-2021 10:44 AM
- Posted Next Scheduled Time for all alerts is showing none on Alerting. 07-19-2021 11:37 AM
- Tagged Next Scheduled Time for all alerts is showing none on Alerting. 07-19-2021 11:37 AM
- Posted Linux Server Shutdown and Reboot Alert on Alerting. 04-08-2021 06:15 AM
- Tagged Linux Server Shutdown and Reboot Alert on Alerting. 04-08-2021 06:15 AM
- Tagged Linux Server Shutdown and Reboot Alert on Alerting. 04-08-2021 06:15 AM
- Tagged Linux Server Shutdown and Reboot Alert on Alerting. 04-08-2021 06:15 AM
- Posted Re: How do I get a count of applications deployed to forwarders? on Getting Data In. 03-23-2021 03:28 AM
- Karma Re: How do I get a count of applications deployed to forwarders? for gcusello. 03-23-2021 03:28 AM
- Posted DMC Alert - Near Critical Disk Usage on Splunk Enterprise. 12-01-2020 08:28 AM
- Tagged DMC Alert - Near Critical Disk Usage on Splunk Enterprise. 12-01-2020 08:28 AM
- Posted Re: Need help on rtrim command on Splunk Search. 09-07-2020 07:05 AM
- Posted Re: Need help on rtrim command on Splunk Search. 09-07-2020 07:04 AM
- Posted Re: Need help on rtrim command on Splunk Search. 09-07-2020 07:00 AM
- Posted Need help on rtrim command on Splunk Search. 09-04-2020 08:14 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-06-2023
05:47 AM
Hi Team, We are using DB Connect 3.14.1 and Splunk enterprise version 9.1.1, we have installed DB connect APP, drivers and when we are configuring the database we are getting the error as database connection is invalid , Login failed for the user, but using same user name and pw we are able to login to Database directly ... can anyone please suggest the answer for this
... View more
Labels
- Labels:
-
configuration
07-08-2022
06:00 AM
@woodcock this was the same issue which i was facing...and now using your steps it resolved thanks a lot
... View more
01-10-2022
06:03 AM
Can we delete old dated .ns files from $Splunk Directory$\Splunk\var\lib\splunk\kvstore\mongo folder to increase the SH drive space...whether it will have any impact on SH performance
... View more
01-10-2022
06:02 AM
Can we delete old dated .ns files from $Splunk Directory$\Splunk\var\lib\splunk\kvstore\mongo folder to increase the SH drive space...whether it will have any impact on SH performance
... View more
07-19-2021
11:37 AM
Hi All, One of our team mate, disabled and enabled some apps on SH, post which we are seeing Next Scheduled Time for all alerts is showing none for all the alerts in SH, in alert setting we can see that cron job is scheduled, due to which none of the alerts are triggering from our SH, can anyone suggest which setting or parameter to be checked , below screenshot FYR
... View more
- Tags:
- alert
Labels
- Labels:
-
alert action
04-08-2021
06:15 AM
Hi Team, I Need to create an alert whenever a Linux Server shutdown and whenever a Linux server reboot, can you please help me with query condition, which parameter i need to search to get this alert implemented PS: We have RHEL,SUSE,Oracle Linux servers in our environment.
... View more
Labels
- Labels:
-
alert condition
03-23-2021
03:28 AM
@rholm01 Excellent, but along with this if you can add "last logs reported time for each host" then it will be excellent, because sometime host will report to deployment servers but will not send any logs...
... View more
12-01-2020
08:28 AM
Hi All, We are getting DMC Alert - Near Critical Disk Usage on all our four indexers, we are running Splunk on distributed environment on AWS windows servers, and now due AWS disk space 16 TB limit, we are unable to extend the drive, can you please suggest suitable solution for this issue.
... View more
Labels
09-07-2020
07:05 AM
@ITWhisperer ,thanks but unfortunately its not working, if you can help me with rex expression using which i can exclude everything from _-D in ARGS field then it will be helpful
... View more
09-07-2020
07:04 AM
@vijetagalani , thanks but unfortunately its not working, if you can help me with rex expression using which i can exclude everything from _-D in ARGS field then it will be helpful
... View more
09-07-2020
07:00 AM
@richgalloway Thanks, but if you can help with rex expression using which if i can exclude everything from _ -D in all values then it will be helpful
... View more
09-04-2020
08:14 AM
Hi Team, I am using rtrim command to trim some values, but its not working for all the values,as per below screenshot i need to trim everything from _-D in all values, its working for first one for remaining values its not working, can anyone please provide some solution to it. Or in case of any regex please suggest
... View more
Labels
- Labels:
-
field extraction
05-20-2020
10:48 AM
Hi All,
I need to create a Splunk License usage report on a daily basis for all the reporting hosts. Can someone please help me with creating search?
Host Source Sourcetype Index count of events License Used in MB
abc pqr xyz main 16405 27
bcd rrs yza wineventlog 123 20
cde rsp urv cisco 2345 105
... View more
03-24-2020
10:47 AM
Hi All,
Could we use Splunk to monitor the CPU health of Palo Alto Firewalls?, there is below add-on which is Present in Splunk Base
https://splunkbase.splunk.com/app/3732/ but which is unofficial and not supported by Splunk, whether someone used this and got the desired result or
can anyone suggest any other method from which we can monitor CPU health of Palo Alto Firewalls
... View more
09-17-2019
06:31 AM
Hi ,
We are building a new Splunk infrastructure in which daily 300 GB data will be ingested, we are running with 2 indexers in cluster, just want to know what would be the best index storage configuration in indexes.conf.
Like hot,warm,cold storage configurations, i have gone through multiple Splunk documentation but its confusing.
We want to save total of 1 year of logs on disk, in which we need 3 months logs online searchable, and remaining 9 months logs will be on disk(whether it can be compressed if yes then we want 3rd to 6th month logs will be in uncompressed form and from 9th Month to 12th Month logs to be compressed if possible),
Can someone will help with suitable configuration, and what would be the disk space required to storage this logs
... View more
- Tags:
- splunk-enterprise
09-13-2019
06:27 AM
Hi Team,
We have 300+ azure storage account and on daily basis new accounts will be created and deleted, its difficult to integrate each and every account one-one time, do we have any method through which we can integrate all this account in one shot, please suggest
... View more
- Tags:
- splunk-cloud
05-22-2019
06:44 AM
ya but its a future program, but currently do we have any system or model to achieve this
... View more
05-17-2019
04:20 AM
Hi All,
Can we translate our plain English queries to Search Processing Language i.e. SPL, does Splunk provide any free app or model apart from Security Insights Cyber Security investigator which is paid App.
... View more
04-17-2019
06:18 AM
Hi All,
We are planning to move our Splunk environment 7.2.4 which is on Windows OS to CentOS, we are having distributed environment containing Indexers(2), search heads(2), master node, deployment server and license master,
Could anyone can help us with migration steps and best practices to be followed, it will be helpful
... View more
- Tags:
- splunk-enterprise
04-19-2018
06:57 AM
I have DHCP logs and a csv which contains hostnames of devices..
I need to check the DHCP logs for the hostnames that are not present in the csv lookup list.
Can you please suggest a query to perform this check without using subsearch? CSV has some 55K rows
... View more
03-29-2018
05:53 AM
We were using below script to connect and download csv and store it in folder. But now website has changed and it asks for the username and password. Can somebody suggests any required changes where we can connect to URL, Authenticate with username and password, and download the file?
import os
import urllib2
response = urllib2.urlopen('URL')
data = response.read()
filename = os.path.join(os.environ['SPLUNK_HOME'], 'etc', 'apps', 'SPLAPP', 'lookups', "Splunk_Monitored_Hosts.csv")
file_ = open(filename, 'w')
file_.write(data)
#file_.close()
... View more
02-08-2018
03:40 AM
Hi All,
we have installed fresh setup of 6.6.5 in our test environment and post which we have run the searches, but again we have faced same issue of alternative rows blank.
In meantime we have observed whenever searches are rerunning while exporting we use to get the alternative rows blank in the result, If search didn’t rerun we use to get the export properly
he search is rerun when the search head believes that it cannot retrieve all of the events from the job artifact. The search head determines when to rerun the search based on the following logic:
• If the search is not a report, and one of the following is true.
• The search is not done
• The search is using a remote timeline
• The search head believes that the search has not retained all of events
... View more
01-31-2018
05:00 AM
Can we use directly Dynamic disk and increase the indexer space drive
... View more
01-29-2018
11:34 AM
Thanks Adonio,
Now the question is can we directly add another drive when the application is up or we have to stop splunk service while adding and secondly how to make new drive indexable and sink with old drive for searching....
... View more
01-29-2018
05:57 AM
Hi All,
We have observed whenever we are exporting search results in .csv format in the results alternative rows will be blank. We have checked for multiple log types but for all the exported logs alternative rows are blank.
Splunk vesrion 6.3.1
Please suggest
... View more
- Tags:
- csv
- splunk-enterprise
