About ips_mandar

ips_mandar · ‎02-08-2021

Hi I have one index -"main" which has index time extracted field-"status" and for status field I have included fields.conf as indexed=true. Now I have created one summary index (abc) by populating data in using collect command and this summary index(abc) also contain "status" field. Now when I try to search index=abc status="good" it won't provide me any results may be because it is trying to seach in metadata fields. So what solution I could apply to see results. Note- If I use index=abc| search status="good" will give me results. Thanks,

ips_mandar · ‎01-19-2021

Hi, some time my server takes time to load dashboard although I checked splunk query search duration which was normal.. so i am assuming that it might be due to network issue. but I want to confirm it by checking response time of spl query. So how can I get response time? is it present in any internal logs? Thanks,

ips_mandar · ‎01-08-2021

Thanks @richgalloway After mapping SAML groups to Splunk roles do I need to delete local authentication for all users? and which will take precedence while loging in?

ips_mandar · ‎01-07-2021

Hi, currently I have local splunk accounts for all users. Now I am setting up SAML (okta) authentication for all those user. So how can I transition each user local account to SAML account without losing there knowledge objects created including any private knowledge objects as well. Consider I have same username in both i.e. in local as well as SAML account. What process I should follow please help. Thanks,

ips_mandar · ‎01-04-2021

@richgalloway I get message " This report cannot be accelerated. "

ips_mandar · ‎01-04-2021

I have tried below sample search for acceleration but they are not allowed. index="_internal"| table host source index=_internal|streamstats sum(bytes) as byte by sourcetype|stats count by host source byte as per splunk docs, it should contain transforming commands and I hope table is transforming commands. so first query should be able to accelerate but it won't accelerate. Can you please help me to understand why those searches are not allowed to be accelerated? Thanks

ips_mandar · ‎12-17-2020

Thanks @renjith_nair I am using the same query already but it runs very slow .. streamstats vs accum --> accum command runs very fast but the disadvantage is that it does not group by arguments. thanks.

ips_mandar · ‎12-17-2020

@renjith_nair I tried with by clause for accum command but it does not support ..so is there any other way to achieve by clause Thanks

ips_mandar · ‎12-17-2020

@renjith_nair for ex. source="file1.txt" contain below data a source 1 file1.txt 2 file1.txt 3 file1.txt 4 file1.txt 0 file1.txt 5 file1.txt 8 file1.txt and another source="file2.txt" a source 2 file2.txt 3 file2.txt 0 file2.txt 2 file2.txt 0 file2.txt 2 file2.txt 4 file2.txt From above two sample file it should extract below - a source 4 file1.txt 8 file1.txt 3 file2.txt 2 file2.txt 4 file2.txt Could you please explain what logic can be applied to group by source

ips_mandar · ‎12-16-2020

@renjith_nair Thanks for your answer. Sorry I haven't mention in question that this data is present in one file and I have hundreds of file. so I want the result by source for each file separately. hence above solution will not work.

ips_mandar · ‎12-16-2020

ips_mandar · ‎12-14-2020

@richgalloway Total data including hot/warm and cold data is 3TB for particular index and usually search run for last 14 days . and the searched index get data 100GB/day. (I am talking about one specific index here and my environment has multiple index and total ingestion rate is 600GB/day which will grow in future) server is not doing anything apart from splunk service. and splunk is not running high number of searches. Regarding transforms i am using heavy forwarder where all the transformation will be happening. as you said The batch_search_max_pipeline setting has no effect on standalone servers, so on which splunk environment it has effect. Also is there any reason why it has no effect on standalone server. Thanks for help.

ips_mandar · ‎12-14-2020

@richgalloway I have windows server with 35GB RAM, 16 core pprocessor and currently Memory usage is below 40% and I want to get search results faster rather than waiting few minutes to get results. And as per my understanding each search takes only one core per search even though multiple cores are not in use so I also want to utilize core for each search to get results faster. I already looked to improve/optimize searches and also I am using summary indexes for long running dashboard queries. So my question is can I increase batch_search_max_pipeline to 2 on my standalone server? will it work? Thanks

ips_mandar · ‎12-13-2020

Hi, I have standalone server which acting as search head and indexer . And the server is under utilized so I want to increase batch_search_max_pipeline=2 which will also improve search performance as well. I want to confirm before making changes that is it applicable this change on my standalone server. Or this change is applicable only for indexer cluster. so can I make this change on my standalone server? Thanks,

ips_mandar · ‎12-12-2020

Is it possible to change below splunk logo?- Can any one please guide me how to change this logo? Thanks,

ips_mandar · ‎12-10-2020

I have power role and i have created one report then went to permission and tried to change display as to all apps but display apps button is disabled . How can I enable it for power role? though for admin role it is enable and I want it to be enable for power role as well. please advice Thanks,

ips_mandar · ‎12-09-2020

Hi I am using db connect latest version on splunk 8.0.1 and I want to update host field based on one of column name instead of static value. How can I achieve this? Also does it improve search performance while searching using host field over the column field name value search? Thanks,

ips_mandar · ‎12-09-2020

I was working with where command like below- index=abc|where (id=1ORid=2ORid=3) In between id field I have used OR operator and by mistake I haven't used space before and after OR. still I get same results like below query results. index=abc|where (id=1 OR id=2 OR id=3) so does it not matter to have space before and after OR operator?

ips_mandar · ‎11-18-2020

Thanks @richgalloway some of my index data is coming from database using db connect app. so can I apply ingest-eval on that index as well? One more issue I am facing is that- I have summary index (test_summary_index) and I have abc fieldname in summary index as well. but problem is when I set fields.conf - [abc] indexed=true then splunk will try to search fieldname abc in metadata but it won't find any results for summary index . for ex. index="test_summary_index" abc="123" This query won't return any results. What could be solution for this issue? Can CIM be useful?

ips_mandar · ‎11-17-2020

Hi I have currently 5-6 index setup where consider abc as fieldname , which is extracted at index time and same fieldname is called with different name in different indexes like cde, efg . Now I want to create common field name for all these different fieldnames extracted at indextime. -What would be best way to achieve it and I want to take advantage of index time extracted fields? I checked CIM model but does not fit as per my data. so even if I created data model including all my index and then if I calculate fields to use one common name but it will not take any advantage of index time extracted fields.

Posts	290
Solutions	4
Karma Given	33
Karma Received	13
Member Since	‎02-02-2018

Online Status	Offline
Date Last Visited	‎02-08-2021 11:36 PM

index time extracted field vs summary index field

get response time of spl query

transition from local splunk authentication to sam...

report cannot be accelerated

get max value before becoming zero and last value

can batch_search_max_pipeline increase on standalo...

can splunk logo be customized as shown in below i...

Power role Knowledge object unable to share to all...

db connect host field update from one column field

where command clarificaion

index time extracted field vs summary index field

get response time of spl query

Re: transition from local splunk authentication to...

transition from local splunk authentication to sam...

Re: report cannot be accelerated

report cannot be accelerated

Re: get max value before becoming zero and last va...

Re: get max value before becoming zero and last va...

Re: get max value before becoming zero and last va...

Re: get max value before becoming zero and last va...

get max value before becoming zero and last value

Re: can batch_search_max_pipeline increase on stan...

Re: can batch_search_max_pipeline increase on stan...

can batch_search_max_pipeline increase on standalo...

can splunk logo be customized as shown in below i...

Power role Knowledge object unable to share to all...

db connect host field update from one column field

where command clarificaion

Re: Splunk CIM model

Splunk CIM model