Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About snigdhasaxena
snigdhasaxena
Communicator
Member since:
07-18-2018
08-18-2020
Community Statistics
| Posts | 49 |
| Solutions | 2 |
| Karma Given | 10 |
| Karma Received | 3 |
| Member Since | 07-18-2018 |
Activity Feed
- Posted All sourcetypes not getting thawed on Getting Data In. 08-17-2020 11:41 PM
- Karma Re: Sending Akamai logs via S3 buckets to Heavy forwarder for nickhills. 06-05-2020 12:51 AM
- Karma Re: Splunk Cloud: How to ingest data using API? for woodcock. 06-05-2020 12:50 AM
- Karma Re: Datamodel status building since long for harsmarvania57. 06-05-2020 12:50 AM
- Karma Re: Datamodel status building since long for harsmarvania57. 06-05-2020 12:50 AM
- Got Karma for Re: How can I make my data go from warm to cold after 3 months?. 06-05-2020 12:50 AM
- Got Karma for Splunk Cloud: How to ingest data using API?. 06-05-2020 12:50 AM
- Got Karma for Re: How to sort search and get rid of the count from LAST_MODIFIED_DATE and have them shown by ACTUAL_START_DATE?. 06-05-2020 12:50 AM
- Karma Re: Total Karma Points not updating properly for niketn. 06-05-2020 12:49 AM
- Karma Populating dropdown error : Could not create search for Naren26. 06-05-2020 12:49 AM
- Karma Re: Query to display average cpu usage for all splunk search heads & indexers for somesoni2. 06-05-2020 12:48 AM
- Karma Re: How can i query to get all alerts which are configured? for woodcock. 06-05-2020 12:48 AM
- Karma Re: "bucket _time span=..." has no affect on search results for stephanefotso. 06-05-2020 12:47 AM
- Karma Re: How do I determine a users current disk quota? for _d_. 06-05-2020 12:46 AM
- Posted Re: Check Deployer and search head status in internal logs on Deployment Architecture. 06-03-2020 06:07 AM
- Posted Check Deployer and search head status in internal logs on Deployment Architecture. 06-03-2020 05:17 AM
- Posted Re: Report not exporting all events on Installation. 04-22-2020 12:51 AM
- Posted Report not exporting all events on Installation. 04-21-2020 09:12 AM
- Posted Sending Akamai logs via S3 buckets to Heavy forwarder on Getting Data In. 02-06-2020 08:04 PM
- Posted On-premise Splunk to AWS Cloud migration on Splunk Dev. 01-26-2020 11:04 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
08-17-2020
11:41 PM
I had to thaw data from index abc from 1 Dec 2019-30 Dec 2019 Steps performed: 1. Copied buckets into thaweddb folder 2. splunk rebuild bucket_name 3. Rolling restart indexer cluster I reviewed the data in index=abc and noticed only 1 sourcetype events got thawed. However, there are 4 more sourcetype listed in SourceType.data file bucket after rebuilding it. Any suggestions why not all sourcetypes data got thawed ?
... View more
- Tags:
- thaw
Labels
- Labels:
-
index
06-03-2020
06:07 AM
@gcusello Thanks for responding. The query that I have built is generating status report for all other Splunk components (indexer, search heads, deployment server) but is not fetching events for Cluster master and deployer.
I am looking for a field value parameter in internal logs that could help me determine the status of CM and deployer.
... View more
06-03-2020
05:17 AM
I am trying to monitor deployer and search head service status using _internal logs. Which fields should I consider to monitor whether Splunk service on deployer and SH are up and running?
Note: I am building a dashboard to monitor splunk service status
... View more
- Tags:
- splunk-enterprise
Labels
- Labels:
-
search head
04-21-2020
09:12 AM
When search query for report is run in Splunk, it shows 15000 events for last 7 days (example 4/14-4/21) but when I export results in csv, it exports events only for 4/21.
I have reset dispatch.max_count to 0 but still it doesn't retrieve all events in csv when report runs.
... View more
- Tags:
- splunk-enterprise
02-06-2020
08:04 PM
We have to configure Akamai logs into Splunk. As per the cloud team's recommendation , use of S3 buckets in mandatory.
How can we send akamai logs to S3 buckets ? Once S3 buckets receive the logs, they are pulled by heavy forwarder.
... View more
- Tags:
- splunk-enterprise
01-26-2020
11:04 PM
Hi, we have on-premise Splunk deployment and we are planning to migrate Splunk to AWS Cloud.
We are looking forward to propose the hybrid deployment, means , forwarders lying on-prem and other Splunk components moving to Cloud.
Can someone please suggest how can we achieve this with one license ?
Thank you !
... View more
- Tags:
- splunk-enterprise
09-12-2019
09:16 AM
This is a dependent dropdown. since the token in query,ac_domain has value, customer_name.
index has fields aws_account_id and Account_Name.
Lookup has fields customer_name and aws_account_id.
We want our dropdown to populate values for field Account_Name.
Hence, we used join command.
query:
index=abc* | table aws_account_id Account_Name
|join type=left aws_account_id
[|inputlookup aws_customer_lookup |fields aws_account_id customer_name ]
|table aws_account_id customer_name Account_Name
| where customer_name=$ac_domain$
| mvexpand Account_Name |dedup Account_Name
| table Account_Name
Field for label = Account_Name
Field for Value=Account_Name
It shows error as "Could not create search"
... View more
09-05-2019
08:53 PM
@richgalloway What I found is if my search doesn't retrieve any events it doesn't show trend settings and says "No result found" while if it shows events , it shows the trend, sparkline,etc. What can we do to fix "No result found" and get indicators for 0 events as well ?
... View more
09-05-2019
08:40 PM
Query for the panel that doesn't show trend indicator settings :
index=xyz EventCode=4624 OR EventCode=4625 |timechart span=24h count by user
Query for the panel that shows trend indicator settings:
index=xyz (sourcetype=linux_secure eventtype="sshd_authentication" ) OR (eventtype=wineventlog_security AND EventCode=4625) |timechart span=4h values(src_ip) by user| timechart span=24h count
... View more
09-05-2019
10:50 AM
I have added timechart and span in my query for dashboard panel (single value visualization). While panel shows trend settings for other panels with similar query, the 2 panels do not get it
... View more
09-02-2019
11:47 PM
@nanachu change trigger alert when to "once per result" and this will enable field "Per result throttling field" and there you can put your field value pairs for throttling
... View more
08-28-2019
05:23 AM
1 Karma
@theodorel
earliest = -7d@w1 (looks at the first day of the week)
latest = now
| sort by earliest, latest
try using this
... View more
08-28-2019
05:13 AM
@mik990 using the search as told by solarboyz1 , | bin span=15m your_time_field
| chart count over your_time_field by hostname, in the vizualization tab you can pick line chart and you'll get it as per the _time
... View more
08-27-2019
11:18 PM
@bhavneeshvohra raise the priority of your alert, disable the jobs are that running on regular basis and no longer needed or kill the jobs that are already running that have been in queue for long.
... View more
08-26-2019
10:55 PM
When I look at constraints, it has macro that has definition , index=NULL, I was suspecting that's the error.. so I had changed the constraint to index=* but it still doesn't work
... View more
08-26-2019
03:34 AM
I have Email datamodel that ships alongwith Splunk ES. It's in building status and it's accelerated too. How to troubleshoot it ?
Does it depends on any lookups ? after checking constraints, I can see macros and tags.. and no lookups.
... View more
07-23-2019
05:51 AM
Hi @MedralaG ,
Refer below:
http://dev.splunk.com/view/event-collector/SP-CAAAE6Q
http://docs.splunk.com/Documentation/Splunk/latest/Data/Usepersistentqueues
... View more
07-23-2019
05:47 AM
Hi @ashutoshab,
Is it possible to make your query generic and share ?
... View more
07-23-2019
05:32 AM
1 Karma
Hi @christianubeda ,
I believe data is rolled on the size basis from warm to cold.
So you can estimate the per day data traffic and then for 90 days and set the parameter, maxWarmDBCount accordingly and data will start rolling automatically from warm to cold depending on size.
Also, yes data reduction/compression happens while data retention.
Please refer below link :
https://docs.splunk.com/Documentation/Splunk/6.6.3/Indexer/Configureindexstorage#Attributes_that_affect_index_buckets
https://conf.splunk.com/files/2017/slides/splunk-data-life-cycle-determining-when-and-where-to-roll-data.pdf
https://docs.splunk.com/Documentation/Splunk/7.3.0/admin/Indexesconf
... View more
07-23-2019
04:48 AM
Hi @edwardrose ,
I think you should use a TA for the type of log you're ingesting in order to get the timestamp and log content in right format.
Are you using a TA already ?
Regards,
Snigdha
... View more
07-19-2019
05:40 AM
1 Karma
Is there a way to ingest data in Splunk using API (and without universal forwarder) if data is captured by native agent for source.
*Note this is for Splunk Cloud
... View more
07-02-2019
01:46 AM
Hi @christianubeda
When you run alert in real time, alerts are skipped/ do not get triggered because of the alerts in queue.
Suppose there's a huge traffic while splunk generates alert for current event, there may be several other alerts in queue since it is running for real time. this in turn leads splunk to not to generates alerts due to too many searches in pipeline (skipped searches).
My suggestions :
1. Run alert as scheduled search using cron schedule.
2. Pick a wider time range
3. You can use throttle to avoid duplicate alerts
... View more
07-02-2019
01:26 AM
Hi @tariqazeem123 ,
There are 2 ways:
1. You can run your command and use sort command
index=main sourcetype=app | sort program_name by _time
2.You can use top command and you can limit it to no. of events you want
index=main sourcetype=app | top limit=0 program_name
... View more
07-02-2019
01:19 AM
Hi,
Since | stats count as "<85%" this will create a field named ,"<85%" and field name should not start with a relational operator hence it doesn't work. Try naming the count field as something "Lessthan85" and it will work
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-18-2020
07:39 AM
|
