Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Find Answers
- :
- About csharm21
csharm21
Loves-to-Learn
Member since:
11-25-2018
07-28-2022
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 11-25-2018 |
Activity Feed
- Posted Re: I need to know which index and app has been access how many time in last one month on Splunk Search. 01-27-2020 05:29 AM
- Posted Re: I need to know which index and app has been access how many time in last one month on Splunk Search. 01-27-2020 04:24 AM
- Posted I need to know which index and app has been access how many time in last one month on Splunk Search. 01-27-2020 04:19 AM
- Tagged I need to know which index and app has been access how many time in last one month on Splunk Search. 01-27-2020 04:19 AM
- Posted Re: Need to ingest structured data on Getting Data In. 04-26-2019 07:50 AM
- Posted Need to ingest structured data on Getting Data In. 04-26-2019 05:17 AM
- Tagged Need to ingest structured data on Getting Data In. 04-26-2019 05:17 AM
- Tagged Need to ingest structured data on Getting Data In. 04-26-2019 05:17 AM
- Tagged Need to ingest structured data on Getting Data In. 04-26-2019 05:17 AM
- Tagged Need to ingest structured data on Getting Data In. 04-26-2019 05:17 AM
- Posted Re: Why am I not able to ingest logs from a NAS mapped drive? on Getting Data In. 03-26-2019 04:16 AM
- Posted Why am I not able to ingest logs from a NAS mapped drive? on Getting Data In. 03-25-2019 06:08 AM
- Tagged Why am I not able to ingest logs from a NAS mapped drive? on Getting Data In. 03-25-2019 06:08 AM
- Posted Re: Why am I not getting value in a new created field? on Splunk Search. 01-08-2019 01:32 AM
- Posted Re: Why am I not getting value in a new created field? on Splunk Search. 01-07-2019 11:51 PM
- Posted Why am I not getting value in a new created field? on Splunk Search. 01-07-2019 11:08 PM
- Tagged Why am I not getting value in a new created field? on Splunk Search. 01-07-2019 11:08 PM
- Tagged Why am I not getting value in a new created field? on Splunk Search. 01-07-2019 11:08 PM
- Posted Re: Some time we are getting same event more then 5 time, However that log is only available once in log file on Alerting. 12-14-2018 03:07 AM
- Posted Re: Some time we are getting same event more then 5 time, However that log is only available once in log file on Alerting. 12-14-2018 02:20 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-27-2020
05:29 AM
Thanks p_gurav, this is working. I also need to filter this by application name. would you be able to help on this.
... View more
01-27-2020
04:24 AM
@broberge yes i need to pull detail how many time some one searched the index. if that index has not been searched more then one month, we will do clean up. I tried multiple things using _Audit but still no luck.
... View more
01-27-2020
04:19 AM
I need to know how many time all the indexes in my splunk has been accessed in last 30 days by app name(I tried so many posts but none of the post resolved my issue). can anyone help me to get this fixed.
... View more
- Tags:
- splunk-enterprise
04-26-2019
07:50 AM
Thanks @somesoni2 I was following this document but still confused how to start. would it be possible for you to share one example for me to create props and input with above data to remove #Fields:
... View more
04-26-2019
05:17 AM
Hi Team,
I need to ingest the structure data but the file is not in csv format. however data inside it is structured. below is the log format which i want to index. can anyone help me with the instruction how we can do this.
#Fields: event,computer,operator,source,sourceid,executionid,starttime,endtime,datacode,databytes,message
PackageStart,pppep2413,MS\test,Spettl_tset,{43474344gfg94341B9-4186-gfC4-102E3fgfg0},{cgfgfg-bgfdf-4FFA-gggg-0C57996},2/17/2015 11:37:30 AM,2/17/2015 11:37:30 AM,0,0x,Beginning of package execution.
OnPreExecute,pppep2413,MS\test,Spettl_tset,{43474344E55-94341B9-4186-B5C4-C1fgfgfgfg0},{fgdfgdf-ggfgfD-gdf-A679-0C546CC47996},2/17/2015 11:37:30 AM,2/17/2015 11:37:30 AM,0,0x,(null)
OnPreExecute,pppep2413,MS\test,Get Trigger ID,{4A50954F-137E-4CDD-A20F-fgfg},{fsdfgfgfsdf5-CedD-4FFA-A679-0436CC47996},2/17/2015 11:37:30 AM,2/17/2015 11:37:30 AM,0,0x,(null)
g
... View more
03-26-2019
04:16 AM
Thanks for the response. I not that good in windows could you please help me to uderstand " COMPUTERNAME$ account have to be used to grant access rights" who can we grant this access
... View more
03-25-2019
06:08 AM
Hi all,
I am trying to ingest data from a Windows server from one mapped NAS drive. But i am not able to do it due to the below reason.
First i mapped the NAS drive on the Windows machine but the Splunk forwarder is not able to see the drive.
Then i also tried using the UNC path, but in this case, Splunk is trying to read the NAS files but it give "Permission denied issue"
I also tried creating shortcut of NAS drive. In this case, also Splunk forwarder is able to read the file system but says "Permission denied issue". Can anyone help me to fix this?
Thanks in advance.
... View more
- Tags:
- splunk-enterprise
01-08-2019
01:32 AM
Thanks @niketnilay this worked for me.
... View more
01-07-2019
11:51 PM
Hi Kamlesh,
Even if i run
index=throwaway sourcetype=GIC-EMR-Wrapper-log_V1 | stats count(eval("errorResponse.ResponseCode"="CCEABR")) as "CCEABR Count"
I get only 0 count
but if i use i get some output like below.
index=throwaway sourcetype=GIC-EMR-Wrapper-log_V1 errorResponse.ResponseCode="*" |stats count by errorResponse.ResponseCode
errorResponse.ResponseCode count
CCEAIT 2
CPLOB 3
null 6
... View more
01-07-2019
11:08 PM
Hi Team,
I am trying to create one SPL search and create a new field with the eval command, but I am not getting any value count on the newly created field.
Please find my query below.
index=throwaway sourcetype=GIC-EMR-Wrapper-log_V1
| stats
count(eval(errorResponse.ResponseCode=CCEABR)) as "CCEABR Count"
count(eval(errorResponse.ResponseCode=CCEAIT)) as "CCEAIT Count"
count(eval(errorResponse.ResponseCode=CCEAEE)) as "CCEAEE Count"
count(eval(errorResponse.ResponseCode=AESCND)) as "AESCND Count"
count(eval(errorResponse.ResponseCode=AESCEE)) as "AESCEE Count"
count(eval(errorResponse.ResponseCode=AERCEE)) as "AERCEE Count"
count(eval(errorResponse.ResponseCode=CPDNA)) as "CPDNA Count"
count(eval(errorResponse.ResponseCode=CPMNF)) as "CPMNF Count"
count(eval(errorResponse.ResponseCode=CPLOB)) as "CPLOB Count"
count(eval(isnull(errorResponse.TimeStamp))) as "Timeout Count"
count(eval(errorResponse.JsonResponse="" or isnull(errorResponse.JsonResponse))) as "Success/No Error Code Count"
by requestSpecificElements.clientID requestSpecificElements.locationID
| rename requestSpecificElements.clientID as "Client ID"
requestSpecificElements.locationID as "Location ID
... View more
12-14-2018
03:07 AM
Hi @Harsmarvania57
event time and index time is looks different. and even no error on logs.
12/13/18
10:05:45.000 PM
2018-12-14T04:05:45+00:00 at=info correlates="faffb766d5337ef24ec8e7eae95f6753" session="0aa63c66-ee21-4f16-a412-dae26f475854" method=GET path="/unavailable" host=host.com port=443 took=30111ms status=500 bytes=75405 uuid=ilike2skip0w
host = pr1-app-89-cta3k source = /log/pr1-app-89-cta3k.log sourcetype = ose:engageui:prd status = 500
12/13/18
10:05:45.000 PM
2018-12-14T04:05:45+00:00 at=info correlates="faffb766d5337ef24ec8e7eae95f6753" session="0aa63c66-ee21-4f16-a412-dae26f475854" method=GET path="/unavailable" host=host.com port=443 took=30111ms status=500 bytes=75405 uuid=ilike2skip0w
host = pr1-app-89-cta3k source = /log/pr1-app-89-cta3k.log sourcetype = ose:engageui:prd status = 500
10:05:45.000 PM
2018-12-14T04:05:45+00:00 at=info correlates="faffb766d5337ef24ec8e7eae95f6753" session="0aa63c66-ee21-4f16-a412-dae26f475854" method=GET path="/unavailable" host=host.com port=443 took=30111ms status=500 bytes=75405 uuid=ilike2skip0w
... View more
12-14-2018
02:20 AM
Hi Harsmarvania57,
Yes you understand my issue correctly, but we are using forwarder to send the data from openshift POD,s
OSE containers uses indexer discovery using cluster master connection
[indexer_discovery:prod_cm]
pass4SymmKey = YEhYu124eAfdfdf
master_uri = https://chandra-splunk-cm.test.com:8089
[tcpout:Forward_To_chandra_Splunk_Indexers]
disabled = 0
indexerDiscovery = prod_cm
useClientSSLCompression = true
sslVersions=*,-ssl2
clientCert = $SPLUNK_HOME/etc/apps/chandra_outputs/certs/forwarderCertificate.pem
sslPassword = splunk_forwarder
sslVerifyServerCert = true
sslAltNameToCheck = chandra-splunk-idx.test.com
[tcpout]
defaultGroup = Forward_To_chandra_Splunk_Indexers
... View more
12-13-2018
11:31 PM
Some time we are getting same event more then 5 time, However that log is only available once in log file.
... View more
- Tags:
- splunk-enterprise
11-25-2018
11:32 PM
404 Not Found
Return to Splunk home page
Page not found!
View more information about your request (request ID = 5bfb9d271d7fae6d956b90) in Search
New URL redirected after clicking on object.
https://xyz.com/en-US/app/test_services/orx_portalmobile_web_access_log_report?form.by_clause=uri_path&form.search_string=%2Frb_b01e4ef6-8017-40a8-aff2-199e2d7dade9&form.timerange.earliest=-60m%40m&form.timerange.latest=now
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-28-2022
10:20 AM
|
