About Gayatri

Gayatri · ‎09-21-2023

Thank you @shnmugam Will try the same

Gayatri · ‎09-21-2023

Can someone help me to understand my above query please?

Gayatri · ‎09-20-2023

Hi Team, We are using Alert manager enterprise to receive the alert notifications. As we are new to this alert manager enterprise, we would like to understand few features about it. Firstly, we have use cases with threshold criteria. So, we would like to understand that if we have events which are with inside the threshold limit but not with exact threshold match (i.e) we set an alert to trigger if we encounter 5 failure attempts for any user within 5minutes. But in real time, we noticed that 5 failure attempts for user within 2 minutes, as we set up threshold as 5 minutes, even though we have 5 failure attempts within 2 minutes, will it trigger an alert?

Gayatri · ‎07-16-2023

Can someone please provide the steps to replace expired SSL certificate with renewed one in Splunk UF's version 8.2.8

Gayatri · ‎07-12-2023

Hi @dural_yyz , Thank you for the suggestion. But in our current setup, there is no option to switch to HTTP destination configuration as we are in process of migration phase and these are about to decommission soon. But, since we received vulnerability report on these UF's on those servers, we are in process of replacing SSL certificate. So, if could able to provide detailed steps on how to upload renewed certificate in universal forwarder which would be really help get rid of this issue

Gayatri · ‎07-12-2023

Hi, CAn someone please look into my above listed query and share your response ASAP

Gayatri · ‎07-11-2023

Hi, we are using syslog-ng to collect logs at syslog server and where we have installed Universal forwarder component with version 8.2.8 to forward the logs to Cribl workers. Now, during VA scan we received report stating that SSL certificate expired/with wrong hostname. So, we received renewed SSL certificate from the project and replaced it under cacert.pem which is located under /opt/splunkforwarder/etc/auth folder and I have restarted the service. Once done, we informed team to perform scan again. AGain its still pointing to old one and getting same vulnerability. So, we are not sure whether we need to update any other .pem files such as server.pem or ca.pem. Can you please help us here? Regards, Gayathri

Gayatri · ‎06-30-2023

Thank you @isoutamo

Gayatri · ‎06-19-2023

Hi Team, We are now migrated to Splunk cloud platform version 9.0.x and the logs we are collecting from different log sources by installing Splunk components (universal forwarders) which is with the version 8.1. Now, due to vulnerability report we would like to upgrade Splunk Universal Forwarder version to 9.0.x or 9.4.x. Could you please confirm whether can we perform such upgradation directly from 8.1 to 9.4.x directly? or will it have any impacts? if yes, please let us know what are pre-requisites needs to be looked into? and also let us know the steps/procedures as well. Thank you!!

Gayatri · ‎08-11-2021

Hi, @rjthibod will this work in Splunk version 7.6.0, because I have tried it but it still displays $label$ instead of value. Below is my query where I want to fetch TraWeek and should get used as under label in single value chart. Please help me to achieve this. <row> <panel> <title>Transaction points processed</title> <single> <search> <query>index=* sourcetype=member.csv |dedup TraWeek | eventstats max(TraWeek) as Max_TransWeek|where TraWeek=Max_TransWeek|eval PAM1=round(PointsAmountInMillion,2)|timechart latest(PAM1) as TransactionPoints by TraWeek</query> <earliest>0</earliest> <latest></latest> <sampleRatio>1</sampleRatio> <refresh>30s</refresh> <refreshType>delay</refreshType> <done> <condition match=" 'job.resultCount' > 0"> <set token="title">$result.TraWeek$</set> <set token="label">$result.TraWeek$</set> </condition> <condition> <set token="title">"No Data"</set> <set token="label">"No Data"</set> </condition> </done> </search> <option name="drilldown">all</option> <option name="numberPrecision">0.00</option> <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option> <option name="underLabel">$label$</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">large</option> <option name="unit">M</option> <option name="underLabel">$label$</option> </single> </panel>

Gayatri · ‎08-08-2021

your search | streamstats count as serial | stats values(*) as * by serial | fields - serial Could you please explain how this command helps to hid columns which has null values in Splunk.

Posts	11
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎08-08-2021

Online Status	Offline
Date Last Visited	‎09-21-2023 05:11 AM

Alert manager enterprise feature

Wht are steps to replace expired SSL certificate i...

Upgrade Splunk Universal forwarder version from 8....

Re: Steps to replace expired SSL certificate in Sp...

Re: Alert manager enterprise feature

Alert manager enterprise feature

Re: Steps to replace expired SSL certificate in Sp...

Re: Steps to replace expired SSL certificate in Sp...

Re: Steps to replace expired SSL certificate in Sp...

Wht are steps to replace expired SSL certificate i...

Re: Upgrade Splunk Universal forwarder version fro...

Upgrade Splunk Universal forwarder version from 8....

Re: Access search field for Dashboard title

Re: How to hide a column in a table if every value...