About RichaSingh

RichaSingh · ‎05-30-2016

This one was such a saviour ! Thanks for sharing this...

RichaSingh · ‎01-05-2016

esix [Splunk] , Thanks for your inputs here. Yes, the DAT file contains ACII value in readable format. thanks

RichaSingh · ‎01-05-2016

Hi, I need inputs from a timely scheduled script from a remote server. Can I configure this script on deployment server, placing the script in $SPLUNK_HOME$/deploymentapps/<app_name>/bin/ & the respective inputs, props, and other conf files in $SPLUNK_HOME$/deploymentapps/<app_name>/local/ . Then push these settings to respective hosts with Splunk universal forawrders installed

RichaSingh · ‎01-03-2016

Hi, I have configured an app being pushed from deployment server to a remote Windows host to read DAT files. Links already referenced: http://splunk-base.splunk.com/answers/60643/archiveprocessor-bypassing-normal-systemlocalpropsconf-processing-for-dat-files-inside-archives-434 https://answers.splunk.com/answers/55279/handling-text-dat-files-how-can-i-override-splunks-system-default-props-conf-configuration-for-just-a-single-app.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev The configuration looks like this : props.conf [source::....(dat)] sourcetype = mysourcetype inputs.conf [default] index = app sourcetype = mysourcetype [monitor://D:\folder\folder\Server34\encyc\status\*\*] [monitor://C:\Anupama\status\...\...] [monitor://C:\folder\status\*\*] [monitor://C:\folder\status\*.dat] It is weird that all the files in the folder getting read, except for the required DAT files. Can someone help with the best configurations, please ?

RichaSingh · ‎11-01-2015

Hi, Can anyone help me with best configurations for timestamp parsing (where "DateTime" is the actual time) for following JSON format : { [-] AccessKey: ---------------------- Account: some-value AccountId: somevalue Action: GetInstances Class: ---------------------------------------------------------- **DateTime: 2007-10-27T00:51:57.91Z** ElapsedTime: 00:00:00 File: null Level: Trace Line: null LogId: ID-347t58734534-6565ghmhmm Message: Vapor URL - https://www.randomURL.com,ImageId) Header - { "Signature": "$^%$#@)(#4t4r65gvjhloojk", "AccessKey": "123854y3957349534-0fdjvbkjds90234u02394-23940=dsffsvbkdjadsvfnk0923480", "RequestType": 0, "SkipOwnerLookup": false, "UserAgent": "456934", "UserAgentVersion": null, "Timestamp": "2007-10-27T00:51:57Z", "User": "3254832564873`12", "TestMode": false, "ScheduledAction": false } What I have already tried in props.conf is: [API] TIMESTAMP_FIELDS=DateTime INDEXED_EXTRACTIONS=json NO_BINARY_CHECK=true KV_MODE=none And also: [API] TIME_PREFIX = "\"DateTime\":\" INDEXED_EXTRACTIONS=json Also, I have been through the link: https://answers.splunk.com/answers/104500/transforming-timestamps.html None of the two seem to be working. Any comments/ suggestions will be highly appreciated.

RichaSingh · ‎08-29-2015

Hi, I am facing the problem while trying dynamic recipients for sendmail command. If you could share your script and relevant commands.conf file so that I check the arguments and options the sendmail.py, it will be great. Thanks

RichaSingh · ‎08-03-2015

I have application data being collected on following shared folders over network : \qlikviewt1\east\torage\ \qlikviewt1\adscv\abck\ \qlikviewt1\asdfg\storage\ To monitor them, is it necessary to install splunk UF at qlikviewt1 or there is a workaround ? If there is a work around how can I modify my input stanza for same?

RichaSingh · ‎07-31-2015

All Splunk Alerts log into another monitoring tool called Zenoss. A shell script (running one splunk search head) passes all the information as an alert is triggered, & sends to zenoss at port 8081,. Recently firewall change led to blocking all ports. Now which ports should I request to be enable so that the same shell script is able to communicates & send data to zenoss:8081 ?

RichaSingh · ‎07-23-2015

Hi, Can anyone suggest a document to refer to for best practices on installing any app in a distributed clustered environment. All Splunk instances are in version 6.0.3 Thanks

RichaSingh · ‎12-13-2014

Appreciate the response! But I have already tired those. Any other work around if anyone could direct me to ?

RichaSingh · ‎11-25-2014

Hi , I have a log file with series of DFS path. Another csv file with an array of strings (which I refer to as Qtree). I would like to do a string search for each value of the field Qtree. This is what I have tried: index=qt | eval search_id=Qtree | join search_id type=inner [search source=C:\Users\risingh\Desktop\qtree\dfsback.txt $search_id$ | fields _raw ] This shows no results found. Can someone please help me with this string array search and joining the two results? I have been trying for a really long to make a way out, but couldn't .... need to get this sorted!

RichaSingh · ‎11-20-2014

I am having a similar set up where I have integrated a script to accept field values from live streaming events. The whole system integration works just fine. For instance, when I run as , " | script python script-name singleIP " where IP address is that picked from a single event; it works fine. But my only concern is to automate this for all the events in the selected time range & the field rather than a single value. I already tried luck with " *| script python script-name $IP$ * ", where IP is the extracted field holding over 2000 IPs. But script doesn't seem to identify & read values in there then. I am just bothered if any splunk event streaming input-output APIs I am missing to include in the script before automating this? Kindly help me to figure the best & optimal path.

RichaSingh · ‎11-17-2014

it says The external search command 'asd' did not return events in descending time order, as expected.

RichaSingh · ‎11-17-2014

Here is my edited script. But I still get the same error. import sys, getopt import os import urllib import urllib2 import csv import splunk.Intersplunk (isgetinfo, sys.argv) = splunk.Intersplunk.isGetInfo(sys.argv) results = [] results,dummyresults,settings = splunk.Intersplunk.getOrganizedResults() for arg in sys.argv: print arg url='https://%s' %arg results = os.system('curl -u "username:password" %s' %url) results = splunk.Intersplunk.readResults(None, None, True) splunk.Intersplunk.outputResults(results)

RichaSingh · ‎11-16-2014

Hi, I wrote a python script to read the external IP from event logs and pass that as the parameter to the command(script) which is designed to do a CURL lookup . I made sure to include all the splunk libraries within to stream the data, and meet the environment dependencies for CURL on windows. Just to make sure I tested the python script with an IP passed as an argument out of Splunk framework& it works fine. But returns Error code 1, when integrated with splunk as follows: import sys, getopt import os import urllib import urllib2 import csv import sys,splunk.Intersplunk (isgetinfo, sys.argv) = splunk.Intersplunk.isGetInfo(sys.argv) results = [] results,dummyresults,settings = splunk.Intersplunk.getOrganizedResults() for arg in sys.argv: print arg url='https:///%s?' %arg maxm = os.system('curl -u "username:password" %s' %url) result = splunk.Intersplunk.generateErrorResults(None, None, True) splunk.Intersplunk.outputResults(results) "External search command 'asd' returned error code 1." Please let me know what I am missing on and the likely solution for this. Thanks

RichaSingh · ‎10-31-2014

Posts	16
Solutions	0
Karma Given	33
Karma Received	1
Member Since	‎07-23-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Can a scripted input be deployed on universal forw...

Why are DAT files not being read with my current m...

Timestamp Parsing in JSON

How to monitor network file share drive ?

Which ports should be opened on Splunk sever, to l...

Can anyone recommend documentation for best practi...

How to join two log files with matching strings?

Why am I getting Error code 1 for my python script...

Can someone guide me with Splunk SDK integration? ...

Re: How to split multiple lines of data into indiv...

Re: Why are DAT files not being read with my curre...