About SanjayReddy

SanjayReddy

Hi @tv00638481 following post help to understand stpes need to followed befroe upgrade. https://community.splunk.com/t5/Installation/What-s-the-order-of-operations-for-upgrading-Splunk-Enterprise/td-p/408003 in this case you need to upgrade first deploymentserver then HF and UF. compatbility between Splunk cloud and forwaders https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/Service/SplunkCloudservice#Supported_forwarder_versions ---- Regards, Sanjay Reddy ---- If this reply helps you, Karma would be appreciated

SanjayReddy

Hi @Ismail_BSA you can use following restcall to find caluclated fields created by you | rest splunk_server=local services/data/props/calcfields/ | search author = <yourid> | table attribute field.name eai:acl.app author eai:acl.sharing ---- Regards, Sanjay Reddy ---- If this reply helps you, Karma would be appreciated

SanjayReddy

Hi @wberkowicz Can you try with powershell with refernece to following post. https://community.splunk.com/t5/Installation/Handy-commands-for-uninstalling-SplunkUniversalForwarder-from/m-p/542627

SanjayReddy

Hi @Manasa_401 response provided by @richgalloway , will work. https://localhost:8000/en-US/account/login?loginType=splunk In addition to rich reponse. if your existing URL contains 8000 number keep that as well. sometimes it might be issue with language en-us or en-gb , kindly try with language for URL with SAML auth

SanjayReddy · ‎02-15-2024

Hi you can enable debug mode for splunkd.log file before taking diag. Enable debug logging on all of splunkd.log Splunk software has a debugging parameter (--debug) that you can use when you start Splunk software from the CLI in *nix. This command outputs logs to the $SPLUNK_HOME/var/log/splunk/splunkd.log file. This option is not available on Windows. To enable debugging on Splunk software running on Windows, enable debugging on a specific processor. See Enable debug logging in Splunk Web or Enable debug logging using log.cfg. Navigate to $SPLUNK_HOME/bin. Stop the Splunk platform instance, if it is running. Save your existing splunkd.log file by renaming it, like splunkd.log.old. Restart the instance in debug mode with splunk start --debug. When you notice the problem, stop the instance. Move the new splunkd.log file elsewhere and restore the old file. Stop or restart the instance normally (without the --debug flag) to disable debug logging. Not all messages marked WARN or ERROR indicate actual problems with Splunk software; some indicate that a feature is not being used. for splunk diag run following command *nix example Windows example ./splunk diag splunk diag @raghunandan1

SanjayReddy · ‎02-12-2024

Hi @LearningGuy folllwing XML worked for me <dashboard version="1.1" theme="light"> <label>Test</label> <row> <panel id="DisplayPanel"> <single id="datestyle"> <search> <query>| makeresults | addinfo | eval text = "How to align this text to left?" | table text </query> </search> <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option> </single> </panel> <panel depends="$alwaysHideCSS$"> <title>Single value</title> <html> <style> #DisplayPanel { width: 40% !important; font-size: 16px !important; text-align: left !important; float: left; } </style> </html> </panel> </row> </dashboard>

SanjayReddy · ‎02-11-2024

Hi @LearningGuy In html code open bracket is missing highlited in RED and width value set accrodingly to keep left <html> <style> #DisplayPanel { width: 40% !important; font-size: 16px !important; text-align: left !important; float: left; } </style> </html>

SanjayReddy · ‎02-09-2024

Hi @pm11 please follow below steps to reset password go to <SPlunk installation directory>/splunk/etc/ under this location file called passwd rename it to passwd.backup go to following location <SPlunk installation directory>/splunk/etc/system/local create new file user-seed.conf inside user-seed file add following contents [user_info] USERNAME = admin PASSWORD = <newpassword> and restart splunk from cmd <SPlunk installation directory>/splunl/bin/ splunk restart ---- Regards, Sanjay Reddy ---- If this reply helps you, Karma would be appreciated

SanjayReddy · ‎02-06-2024

Hi @michaeler26 Thank you posting your query in splunk community, to answer your query. 1.Courses 2 to 4 are mandatory if you want to go for Architect certification. 2. For cloud certification courses 1 and 2 are not mandatory , you can attempt the exam without taking course 1 and 2. but if you want to learn cloud , I would recommend course 1 , it's for new admins(for you). on the flip side. if want to get experience on topics ,you can always refer to splunk documentation and also learn by doing. following is the topic wise document links which really helps to get started. https://docs.splunk.com/Documentation/Splunk/9.1.3/Overview/Administering https://docs.splunk.com/Documentation/Splunk/9.1.3/Overview/Searchingandreporting https://docs.splunk.com/Documentation/Splunk/9.1.3/Overview/ManagingKnowledge https://docs.splunk.com/Documentation/Splunk/9.1.3/Overview/Extending https://docs.splunk.com/Documentation/Splunk/9.1.3/Overview/Troubleshooting

SanjayReddy · ‎12-04-2023

Hi @pm2012 you can use following query index=_internal source="*license_usage.log" type=Usage h="<forwader name>" | rename _time as Date | eval Date=strftime(Date,"%b-%y") | stats sum(b) as license by Date h | eval licenseGB =round(license/1024/1024/1024,3) | rename licenseGB as TB

SanjayReddy · ‎12-04-2023

Hi @uagraw01 it seems ,533 is milliseconds 2023-12-05T04:21:21,533+00:00 %Y-%m-%dT%H:%S,%3Q+00:00

SanjayReddy · ‎11-30-2023

Hi @syazwani please follow below steps to reset password go to <SPlunk installation directory>/splunk/etc/ under this location file called passwd rename it to passwd.backup go to following location <SPlunk installation directory>/splunk/etc/system/local create new file user-seed.conf inside user-seed file add following contents [user_info] USERNAME = admin PASSWORD = <newpassword> and restart splunk from cmd <SPlunk installation directory>/splunl/bin/ splunk restart ---- Regards, Sanjay Reddy ---- If this reply helps you, Karma would be appreciated

SanjayReddy · ‎11-28-2023

Hi @Colloh I would suggest you to open in incognito or clearer your broswer cookies and loginto STEP this would be temporary issue

SanjayReddy · ‎11-27-2023

Hi @Simon1 I feel there is not direct way to change the app context in UI also you are using splunk cloud. otherway is go to searches reports and alerts from settings from their click on edit alet and clone then you can change the app context and , once clone the alert delete the alert with app in slack context

SanjayReddy · ‎11-11-2023

Hi @joe06031990 Usally what I usally follow is I will enable maintenance mode on cluster manager and once activity done on indexers and up and running, will disbale maintenance mode. then all bucket fixup activitys will complete. some use maintenance mode and splunk offline together.

SanjayReddy · ‎11-11-2023

Hi @iamsplunker from inputs.conf and log file last modified, there is an issue I see as log file modified last month and in inputs.conf you mentioned ignoreOlderThan = 7d Splunk will ignore log files which are modified more than 7 days ago. I would suggest comment ignoreOlderThan = 7d for first time and restart splunkd , once splunk reads older file then you can comment again.

SanjayReddy · ‎10-02-2023

Hi @sarit_s chart command will not work with multiple fileds , try using stats

SanjayReddy · ‎09-27-2023

Hi @sivakrishna instaed of changing rhe port, if 8191 is already used by splunk then please kill and start the splunk have you checked which process using 8191 , if you wan the change the port , you need to change port on rest search heads, which is not recomended

SanjayReddy · ‎09-27-2023

Hi @sivakrishna it seems KVstrore port 8191 is used by other application. can you check which process using 8191 port , ps -ef | grep -i 8191 if is used by other application check with os team to check and ask them use other port, then you can start splunk and kvstore will start on port 8191

SanjayReddy · ‎09-27-2023

Hi @karthi2809 Please find order of knowledge object in search time. You will same information in intro to knowledge objects.

SanjayReddy · ‎09-26-2023

Hi @AmirSA can you try accessing following URL to view certifications https://splunk.my.site.com/customer/s/list-views/certifications

SanjayReddy · ‎09-26-2023

Hi @gebr As 8.0.x no longer supporrted by splunk as per support policy from https://www.splunk.com/en_us/legal/splunk-software-support-policy.html#core I would suggest to upgarde your infra to last version of Splunk. e.g 9.0.x. if you are not able to upgrade for sometime , may be i would suggest to go for 8.0.1 splunk UF or same version as HF/Indexer you can download from older version from https://www.splunk.com/en_us/download/previous-releases-universal-forwarder.html

SanjayReddy · ‎09-24-2023

Hi @BoldKnowsNothin Did you see any warning/error messages in splunkd.log for file you intially monitored. log messages in splunkd.log will help to troubleshoot furthur

SanjayReddy · ‎09-10-2023

Hi @michael_vi for monotoring forwarders, no configuration is required from forwarders side. in the moniroting console MC > settings> Forwarder moniroting setup ---> forwarder monitoring--->enable and save after sometime in MC > Forwarders > Forwarders: Deployment shows the forwarders list and their health. P.S: deployment sevrer can not monitor forwarder health

SanjayReddy · ‎07-19-2023

Hi @Naji you can add new field using eval condition | eval Department =case(host IN("host1","host2","host3"),"Sales",host IN("host4","host5","host6"),"HR",host IN("host7","host8","host9"),"IT",1=1,"NoDept")

Posts	288
Solutions	47
Karma Given	19
Karma Received	106
Member Since	‎21-07-2021

Online Status	Offline
Date Last Visited	yesterday

Is there a way to increase dropdown input text fon...

Is it possible to run a Script From Splunk on Rem...

Why won't data parsing while sending data through...

How can I customize color for cell value based on ...

How to plot backlog data on timechart?

.conf 22 Registration

Splunk Log File Monitoring

Re: Splunk DS & HF upgrade from 9.0 to 9.1

Re: Difficulty Locating Newly Added Calculated Fie...

Re: Trying to uninstall Splunk Enterprise 7.0.1.0 ...

Re: Splunk access to External users

Re: How to get the diag files with debug files of ...

Re: How to align single value text to left in Dash...

Re: How to align single value text to left in Dash...

Re: password reset

Re: Certified Architect and Cloud Admin training r...

Re: How to calculate data ingestion from a specifi...

Re: Time format

Re: Reset password in splunk for admin

Re: Error while accessing the trainings

Re: Unable to Remove Slack Alert From the Slack Al...

Re: Splunk indexer cluster CPU upgrade

Re: Universal Forwarder is not reading the log fil...

Re: chart by 2 fields

Re: Splunk KV store Issue

Re: Splunk KV store Issue

Re: Search sequence knowledge object in splunk?

Re: Error message while accessing Splunk Support p...

Re: Splunk Universal Forwarder Compatibility to Sp...

Re: Data not incoming

Re: Connect Splunk Universal Forwarder to MC

Re: Add a custom column based on host value