Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About kaushal21rajput
kaushal21rajput
New Member
Member since:
01-12-2018
06-05-2020
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 01-12-2018 |
Activity Feed
- Posted Re: Splunk Drill Down Option Issue on Splunk Enterprise. 08-08-2018 02:52 PM
- Posted Splunk Drill Down Option Issue on Splunk Enterprise. 08-08-2018 02:51 PM
- Tagged Splunk Drill Down Option Issue on Splunk Enterprise. 08-08-2018 02:51 PM
- Posted Re: Splunk Search content for a particular string on Splunk Search. 07-24-2018 01:01 AM
- Posted Splunk Search content for a particular string on Splunk Search. 07-18-2018 11:57 PM
- Tagged Splunk Search content for a particular string on Splunk Search. 07-18-2018 11:57 PM
- Posted Re: I have question regarding configuration of splunk heavy forwrader setup on Deployment Architecture. 01-12-2018 10:36 AM
- Posted Re: I have question regarding configuration of splunk heavy forwrader setup on Deployment Architecture. 01-12-2018 10:31 AM
- Posted I have question regarding configuration of splunk heavy forwrader setup on Deployment Architecture. 01-12-2018 06:34 AM
- Tagged I have question regarding configuration of splunk heavy forwrader setup on Deployment Architecture. 01-12-2018 06:34 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
08-08-2018
02:52 PM
Below is XML code-
Error or fail
<input type="dropdown" token="drop_down" searchWhenChanged="true">
<label>Select host</label>
<choice value="*">alll</choice>
<choice value="blankrhel6">host1</choice>
<choice value="searchhead">host2</choice>
<choice value="tip">host3</choice>
<fieldForLabel>here is output</fieldForLabel>
<fieldForValue>check</fieldForValue>
<search>
<query>Error OR fail* | stats count by $drop_dowm$</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<default>*</default>
</input>
<panel>
<chart>
<search>
<query>Error OR Fail host = $drop_down$| stats count by host</query>
<earliest>0</earliest>
<latest></latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<drilldown>
<link target="_blank">/app/search/error_or_fail?form.$drop_down$=$click.value$</link>
</drilldown>
</chart>
</panel>
<panel>
<single>
<title>Total Event</title>
<search>
<query>Error OR Fail host =$drop_down$ | stats count</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="drilldown">none</option>
<option name="height">92</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
<panel>
<event>
<search>
<query>Error OR fail* host="$drop_down$"</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="list.drilldown">none</option>
<option name="list.wrap">1</option>
<option name="raw.drilldown">none</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">0</option>
<option name="table.drilldown">none</option>
<option name="table.wrap">1</option>
<option name="type">list</option>
</event>
</panel>
... View more
08-08-2018
02:51 PM
Hi ,
I am trying to create a dashboard for Error OR fail* from application logs. There are three hosts from where data is reporting to splunk instance.
Now i have run search query Error OR fail* and from output result created three dashboards in single.
1. Pie chart shows count for all hosts
2. Total Number of events that have Error or fail*
3. Events for all hosts that have Error or fail*
I have 1 dropbox as well which have all three hosts. I have defined a token value "drop_box" and pass that value in search of each dashboard. Now when i am selecting any host ,data from all three dashboard shown for that host only.
Now my requirement is , when i will click pie chart for a particular host, i should get the data for that host only but i am not getting this and it shows error "could not create search". below is code.
... View more
- Tags:
- splunk-enterprise
07-24-2018
01:01 AM
Hi Ddrillic/FrankVI ,
I want to assign output value like "client 26 , client 36" to an another field .
These values should be visible in interesting fields.
That is my question.
... View more
07-18-2018
11:57 PM
Hi Team,
I have search in search head which gives output like in snapshot.
Now i want to assign a new field to client no like client 26 , client 31 . All these (client 26, client 31 etc) should have a particular field.
I have tried to used eval command but did not get exact function to be used.
Please help me . Snapshot is attached.
... View more
- Tags:
- splunk-enterprise
01-12-2018
10:36 AM
Hi Cusello,
Thank you very much for the reply. Your answers are very useful.
I have one more query -
Since i am not getting data in main indexer GUI.
Is there anything else we have to do to capture data from HF except forwarding and receiving at HF and receiving at Main indexer ?.
... View more
01-12-2018
10:31 AM
Thanks Nickhills,
However my issue/query is -
Heavy Forwarder sends data to main indexer. I have configured the forwarding and receiving at heavy forwarder and receiving at main indexer. but there is no any data in GUI.
1. Do i need to click on add data icon in GUI and add the directory or port to get the data from HF ?.
... View more
01-12-2018
06:34 AM
Hi ,
I am new in splunk and trying to set up a test environment with free license of splunk enterprise.
Below are some of points about test env.
1. It has 1 universal forwarders and fording data to heavy forwarder.
2. I have setup a heavy forwarder by installing a splunk enterprise free version and configured forwarding and receiving on instance (on 9997).
3. I have installed a splunk instance and only configured receiving for a particular port (9997).
Now my questions are -
1. Is it possible to set up such test env by free license ?
2. Which server i should configured as deployment server (i.e heavy forwarder or main splunk instance) ?
3. I can see in metrics.log that tcpconnection is there from heavy forwarder and throughput logs are also updating for heavy forwrader IP but no any data in GUI of main splunk instance ?.
4. Do i need to configure heavy forwarder as deployment server for universal forwarder and configure splunk instance as depoyment server for heavy forwarder ?
Thanks in advance.
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
