Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Nisha18789
Nisha18789
Builder
Member since:
10-23-2013
08-19-2022
Community Statistics
| Posts | 140 |
| Solutions | 21 |
| Karma Given | 10 |
| Karma Received | 41 |
| Member Since | 10-23-2013 |
Activity Feed
- Posted Re: SmartStore with HCP - delete fails on Splunk Enterprise. 08-19-2022 03:17 AM
- Karma Re: SmartStore with HCP - delete fails for lmichalski_2. 08-19-2022 03:17 AM
- Posted Re: SmartStore with HCP - delete fails on Splunk Enterprise. 10-26-2021 09:14 AM
- Tagged Re: SmartStore with HCP - delete fails on Splunk Enterprise. 10-26-2021 09:14 AM
- Posted Re: Issue with ITSI service_health_monitor saved search on Splunk Search. 10-19-2021 07:19 AM
- Tagged Re: Issue with ITSI service_health_monitor saved search on Splunk Search. 10-19-2021 07:19 AM
- Posted Re: Health Check - Orphaned Objects False Positive Detection on Knowledge Management. 04-14-2021 04:11 PM
- Posted Re: Setting duration in search and save as an alert on Alerting. 01-13-2021 05:09 AM
- Posted Re: Setting duration in search and save as an alert on Alerting. 01-11-2021 03:32 PM
- Got Karma for Re: Extracting multiple values from Rex. 10-20-2020 01:04 AM
- Got Karma for Re: Extracting multiple values from Rex. 10-18-2020 09:29 AM
- Posted Re: Extracting multiple values from Rex on Reporting. 10-18-2020 07:13 AM
- Posted Re: Extracting multiple values from Rex on Reporting. 10-16-2020 02:25 PM
- Karma Humans That Splunk: Meet Rich Galloway for sensitive-thug. 10-16-2020 02:20 PM
- Posted Re: Search auto canceling on Security. 10-16-2020 02:18 PM
- Got Karma for Re: How to transform data base on the value of the field?. 10-16-2020 02:41 AM
- Posted Re: Charting timeframes from a lookup table. on Dashboards & Visualizations. 10-08-2020 03:33 PM
- Posted Re: I want to index fieldName which contains square brackets on Splunk Search. 10-08-2020 02:45 PM
- Got Karma for Re: The percentage of high priority searches delayed. 10-08-2020 08:01 AM
- Posted Re: I want to index fieldName which contains square brackets on Splunk Search. 10-07-2020 03:16 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-19-2022
03:17 AM
thanks @lmichalski_2 , we actually have a distributed environment, so in case case shall we add remote.s3.supports_versioning = true in server.conf and restart?
... View more
10-26-2021
09:14 AM
hello @lmichalski_2 , could you please advise if you were able to make the delete work? We are facing exactly the same problem. Any help is much appreciated.
... View more
- Tags:
- l
10-19-2021
07:19 AM
hi @pagillar , yes we identified the issue was due to some of the services have unicode character in the service name, which was causing the service health monitor search skipping. We identified those services and renamed them which fixed the issue. Now, I am not sure if its easy to identify that in our environment or not. But here is how we identified it - get list of all service name using rest api query or lookup and use any online unicodelookup tool to find the ones. Hope this helps!
... View more
- Tags:
- pa
04-14-2021
04:11 PM
hi @O815163 , just wanted to confirm - if those active users are able to login to Splunk? Are they assigned a custom role or Splunk role? Also, are these searches showing as disabled or enabled? Are they running?
... View more
01-13-2021
05:09 AM
Great @pdreef , could youplease mark my response as solution.
... View more
01-11-2021
03:32 PM
hi @pdreef , looking at query and requirement, this should work by replacing 24h@h by 1h in below line considering you want to check that there should be data every 1 hour duration irrespective of the mm value in hh:mm. | where now()>relative_time(LastFileXfer, "+1h") Hope this helps!
... View more
10-18-2020
07:13 AM
2 Karma
Hi @nirmeshsolanki , can you try this and let me know if it works |rex field=_raw "operation=\"(?<IP_Block_Type>.\w+)\"" |where isnotnull(IP_Block_Type)
... View more
10-16-2020
02:25 PM
Hi @nirmeshsolanki , my bad but I am not sure what result you are expecting in field IP_Block_Type in final output, can you share the expected output you are looking for.
... View more
10-16-2020
02:18 PM
@msplunk33 Have you tried looking into the splunk internal logs for any errors or warnings that might be logging for this. index=_internal sourcetype=splunkd log_level!=INFO *<your splunk login userid>*
... View more
10-08-2020
03:33 PM
Hi @TooManyQuestion , by "line chart that illustrates the events status over its time frame" do you mean count of events status over time? What does the number represent on the Y-axis? If above is true, try this, it will need additional logic for sequential date representation on the x-axis, but let me know first what is expected here. |inputlookup <yourlookupname> |stats count(Status) as count by Opened Date
... View more
10-08-2020
02:45 PM
hi @pallavikarpaklu , could you please also provide the current props.conf/transforms.conf stanza you are using for indexing this data.
... View more
10-07-2020
03:16 AM
Hi @pallavikarpaklu , could you please give example of what is the actual key-value pair in log and what Splunk is indexing ?
... View more
10-06-2020
04:45 AM
@Allampally , can you provide the separate queries for both the data? If yes, could you provide that as well.
... View more
10-05-2020
09:48 AM
Hi @iamsplunker , you can do this by navigating to the "Advanced Edit" for your report , and find this field : action.email.reportFileName and remove the date part to get rid of date stamp in the report name. Attached is a screenshot for reference. Hope this helps!
... View more
10-03-2020
03:22 PM
2 Karma
hi @jdmclemore , you can use below notation for relative times earliest=-30d@d latest=-25d@d
... View more
09-30-2020
03:27 PM
1 Karma
Hi @aditsss , please try this index=ABC ns=XYZ app_name=api "ARC EVENT RECEIVED FROM SOURCE" | rex "RID:(?<RID>(\w+-){4}\w+)-(?<sourceagent>\w+-\w+)" | stats count(RID) as count by sourceagent| rename sourceagent as "Source"|fields Source count
... View more
09-29-2020
02:20 PM
1 Karma
@vamshiverma , can you try below and see if you getting the desired results index=myindex sourcetype=foo.bar.* |eval type=if(DETAIL="*error*" OR DETAIL="*exception*","Fail","other") |stats count(UNIQUE_ID) as Total sum(eval(status="Fail")) as Fail by sourcetype
... View more
09-29-2020
02:06 PM
1 Karma
Hi @aditsss , when you select last 7 days from the Presets options that actually mean timeframe between -7d@h to now. That's how its defined in the time range settings. So it does not matter if you click on the Last 7 days after click on any other time selection. Its just how Last 7 days behaves (its relative time wrt current time) Please see attached screenshot for reference. Hope this helps!
... View more
09-22-2020
02:49 PM
Hi @hongbo_miao , can you try running below query once, and see you get any results ? index="my_index" | search message.logType="Outgoing Response" | stats count as total, count(eval('message.logType'="Outgoing Response")) as outgoingCount by "log.request.url" | table "log.request.url", total, outgoingCount | sort - outgoingCount
... View more
09-18-2020
03:57 PM
1 Karma
Hi @mbasharat , above example dashboard works perfectly fine for me on Splunk Version 8.x Are you trying above example in a fresh dashboard or you are trying the logic in your dashboard when you say its not working?
... View more
09-18-2020
03:37 PM
Hi @hongbo_miao , could you please check if you are running your search in fast mode? If yes, try running in verbose mode and see if you get the results.
... View more
- Tags:
- hi
09-17-2020
09:00 AM
2 Karma
hi @splunkcol , sorry for the delay in response. Regarding the allow_skew value, please be careful, as any value you assign inside system/default will be applied globally and impact all your searches. For ex- if you set allow_skew=50%, and if there is search which runs every 5 mins, after allow skew it will run any time between 5 +2.5(50% of schedule interval)=7 mins. ---> which might be acceptable And if a search is running every 24 hours , it can run anywhere between 24+12=32 hours --> which should not be acceptable. What I am trying to say by this information is that , you should first start with allow_skew on a bunch of searches and see the behaviour to get an idea on how the scheduling changes for those searches. Once you are confident, and you want to implement this globally, you might want to start with a lower value of allow_skew like 5% and monitor your searches and increase/decrease this value based on your findings. Allow skew is a very good feature but needs to ve used with caution to avoid any delays on searches which are time sensitive and delays in alerting of which are not acceptable by your business. Hope this helps, let me know if you have any questions.
... View more
09-08-2020
03:11 PM
Hi @Manasi25 , one question- why you need so many appends? Can you try something like below, it will be quick and I think gives the same output. You have to include all the routing keys below, I have just added two sets and accordingly update the case statement as well. index=victorops routingKey=routingA OR routingKey=routingB OR routingKey=routingKeyC OR routingKey=routingKeyD OR routingKey=routingE OR routingKey=routingAA OR routingAB OR routingKey=routingAC OR routingKey=routingAD OR routingKey=routingAE
| eval routingKey=case(routingKey="routingA" OR routingKey="routingB" OR routingKey="routingKeyC" OR routingKey="routingKeyD" OR routingKey="routingE","IA",routingKey="routingAA" OR "routingAB" OR routingKey="routingAC" OR routingKey="routingAD" OR routingKey="routingAE","IB",1=1,"other")
| top routingKey limit=0
| addcoltotals labelfield=routingKey label=Total
... View more
09-07-2020
10:04 AM
Something weird started happening in our Splunk environment for ITSI native saved search : service_health_monitor This search started getting 100% skipped with reason: The maximum number of concurrent running jobs for this historical scheduled search on this cluster has been reached So, I checked the jobs section and found that the search was stuck running at x% < 100 and hence the next scheduled search could not start. So tried deleting that one, so that it can run in next run, but the next run showed the same behaviour ie, stuck halfway. Inspect job shows most of the time was spent on startup.handoff and below is what I can see in the end of savedsearch.log that after the noop process (BEGIN OPEN: Processor=noop) splunk seems stuck. Please provide any insights which can help in investigating further. 09-07-2020 17:41:05.680 INFO LocalCollector - Final required fields list = Message,_raw,_subsecond,_time,alert_level,alert_severity,app,index,indexed_is_service_max_severity_event,is_service_in_maintenance,itsi_kpi_id,itsi_service_id,kpi,kpiid,prestats_reserved_*,psrsvd_*,scoretype,service,serviceid,source,urgency
09-07-2020 17:41:05.680 INFO UserManager - Unwound user context: splunk-system-user -> NULL
09-07-2020 17:41:05.680 INFO UserManager - Setting user context: splunk-system-user
09-07-2020 17:41:05.680 INFO UserManager - Done setting user context: NULL -> splunk-system-user
09-07-2020 17:41:05.680 INFO UserManager - Unwound user context: splunk-system-user -> NULL
09-07-2020 17:41:06.105 INFO UserManager - Unwound user context: splunk-system-user -> NULL
09-07-2020 17:41:06.105 INFO UserManager - Unwound user context: splunk-system-user -> NULL
09-07-2020 17:41:06.105 INFO UserManager - Unwound user context: splunk-system-user -> NULL
09-07-2020 17:41:06.105 INFO UserManager - Unwound user context: splunk-system-user -> NULL
09-07-2020 17:41:06.105 INFO UserManager - Unwound user context: splunk-system-user -> NULL
09-07-2020 17:41:06.171 INFO ChunkedExternProcessor - Exiting custom search command after getinfo since we are in preview mode:gethealth
09-07-2020 17:41:06.177 INFO SearchOrchestrator - Starting the status control thread.
09-07-2020 17:41:06.177 INFO SearchOrchestrator - Starting phase=1
09-07-2020 17:41:06.177 INFO UserManager - Setting user context: splunk-system-user
09-07-2020 17:41:06.177 INFO UserManager - Setting user context: splunk-system-user
09-07-2020 17:41:06.177 INFO UserManager - Done setting user context: NULL -> splunk-system-user
09-07-2020 17:41:06.177 INFO UserManager - Done setting user context: NULL -> splunk-system-user
09-07-2020 17:41:06.177 INFO ReducePhaseExecutor - Stating phase_1
09-07-2020 17:41:06.177 INFO SearchStatusEnforcer - Enforcing disk quota = 26214400000
09-07-2020 17:41:06.177 INFO PreviewExecutor - Preview Enforcing initialization done
09-07-2020 17:41:06.177 INFO DispatchExecutor - BEGIN OPEN: Processor=stats
09-07-2020 17:41:06.209 INFO ResultsCollationProcessor - Writing remote_event_providers.csv to disk
09-07-2020 17:41:06.209 INFO DispatchExecutor - END OPEN: Processor=stats
09-07-2020 17:41:06.209 INFO DispatchExecutor - BEGIN OPEN: Processor=gethealth
09-07-2020 17:41:06.217 INFO DispatchExecutor - END OPEN: Processor=gethealth
09-07-2020 17:41:06.217 INFO DispatchExecutor - BEGIN OPEN: Processor=noop
09-07-2020 17:48:07.948 INFO ReducePhaseExecutor - ReducePhaseExecutor=1 action=PREVIEW
... View more
Labels
- Labels:
-
Other
09-04-2020
10:27 AM
Hi @yshen , I understand your point now. Try below with your log events I am assuming your _time field has format like : 2020-08-23T03:04:05.000-0700 and it represents the start time in each log event. your base search.... | transaction Agent_Hostname alarm startswith="raised" endswith="cleared" |eval end=_time+duration, start=_time |eval end=strftime(end,"%Y-%m-%dT%H:%M:%S.%3N-0700"),start=strftime(start,"%d-%m-%Y %H:%M:%S.%3N-0700") | table start,end ,Agent_Hostname , alarm, duration Try and let me know.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-19-2022
06:52 AM
|
Karma from
Karma given to
