Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About bhupalbobbadi
bhupalbobbadi
Path Finder
Member since:
07-12-2016
2 weeks ago
Community Statistics
| Posts | 31 |
| Solutions | 0 |
| Karma Given | 5 |
| Karma Received | 4 |
| Member Since | 07-12-2016 |
Activity Feed
- Posted Re: Search for non ascii characters on Splunk Search. 2 weeks ago
- Posted Re: Search for non ascii characters on Splunk Search. 2 weeks ago
- Posted Search for non ascii characters on Splunk Search. 2 weeks ago
- Got Karma for Splunk dashboard studio: Why is Schedule PDF Delivery not available, how can I fix it?. 10-20-2023 06:00 AM
- Posted Why is my CSV index renaming the first field to some random field name? on Splunk Enterprise. 04-03-2023 07:06 AM
- Tagged Why is my CSV index renaming the first field to some random field name? on Splunk Enterprise. 04-03-2023 07:06 AM
- Tagged Why is my CSV index renaming the first field to some random field name? on Splunk Enterprise. 04-03-2023 07:06 AM
- Posted How to use Splunk forwarder host to route the monitor data to specific tcpout? on Getting Data In. 03-28-2022 09:57 AM
- Got Karma for Splunk dashboard studio: Why is Schedule PDF Delivery not available, how can I fix it?. 03-11-2022 12:03 AM
- Posted Splunk dashboard studio: Why is Schedule PDF Delivery not available, how can I fix it? on Dashboards & Visualizations. 09-24-2021 10:30 AM
- Posted Download dashboard in PNG using CLI on Getting Data In. 09-23-2021 11:47 AM
- Tagged Download dashboard in PNG using CLI on Getting Data In. 09-23-2021 11:47 AM
- Tagged Download dashboard in PNG using CLI on Getting Data In. 09-23-2021 11:47 AM
- Posted Re: Error while adding search head member on Deployment Architecture. 01-17-2021 10:08 AM
- Posted Error while adding search head member on Deployment Architecture. 01-17-2021 09:51 AM
- Posted Re: EXTRACT-field regex in props.conf not extracting multiple values for the match. on Splunk Search. 08-04-2020 12:51 PM
- Karma Re: EXTRACT-field regex in props.conf not extracting multiple values for the match. for thambisetty. 08-04-2020 12:48 PM
- Posted EXTRACT-field regex in props.conf not extracting multiple values for the match. on Splunk Search. 08-04-2020 10:44 AM
- Karma Re: How can regex extract multiple values? for MuS. 07-30-2020 04:59 PM
- Posted Activity Triggered Alerts and the results can be see by other users who does not have privileges. on Security. 06-10-2020 03:24 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
2 weeks ago
Yes, that is correct, I'm looking for splunk search using rex or any other built in function which will select the event if that has any of those spoofing English letters. You analysis for the problem is great. thank you for the analysis and suggestion here.
... View more
2 weeks ago
For example, I have some events with a field has the following content and other events has just palin ascii content. I need to search the events which has any special (non ascii) characters in the event field. JP-Morgan - Υοսr Саrⅾ hаѕ bееո սѕеⅾ tο сhаrցе $242.45 аt TARGET,MA ⅾаtеⅾ 04/29/2024. Іf уоս ⅾіⅾո't аttеⅿрt thіѕ trаոѕасtіοո, ⅴіѕіt https://cutt.ly/Zeqkaq14 tο саոсеІ ոоԝ.
... View more
2 weeks ago
Is there any way to search for events which has any special characters? thanks in advance for any help.
... View more
Labels
- Labels:
-
rex
04-03-2023
07:06 AM
Couple of my CSV indexes in Splunk (UF to Indexers) have been creating/renaming the first field in CSV with special prefixes for example Id is becoming xE2_x81, and ReportID becoming xE2_x81ReportID or xE2_x90ReportID, and it is changing to new name automatically after few days. Any help in fixing is appreciated. Thanks in advance.
... View more
Labels
- Labels:
-
configuration
-
using Splunk Enterprise
03-28-2022
09:57 AM
Hi Team,
I've multiple monitors on multiple forwarders and multiple tcpouts, I need to use forwarder hostname to route the monitor to respective tcpout, is there a configuration which can provide this forwarder host based routing ?
Thanks in advacne.
... View more
Labels
- Labels:
-
host
-
Linux
-
universal forwarder
09-24-2021
10:30 AM
2 Karma
Hi
Can someone please guide me how to Schedule PDF Delivery in Splunk dashboard studio.
Thanks in advance.
... View more
- Tags:
- Schedule PDF
Labels
- Labels:
-
Dashboard Studio
09-23-2021
11:47 AM
Hi There, I need to download the dashboard in PNG file using CLI, is there any way to do this? Splunk Version: 8.2, Dashboard type: Dashboard Studio. Thank you in advance for your help.
... View more
Labels
- Labels:
-
other
01-17-2021
10:08 AM
Just found the fix. Instead of adding the new SH to cluster from new Sh, add the new SH from captain SH. splunk add shcluster-member -new_member_uri <URI>:<management_port> that solved the problem.
... View more
01-17-2021
09:51 AM
Anybody have faced this issue? $ /opt/splunk/bin/splunk add shcluster-member Deserialization failed. Could not find expected key 'current_member_uri' Fresh SH installation, all SH, Master running same version 7.2.0. Thanks in advance.
... View more
Labels
- Labels:
-
search head clustering
08-04-2020
12:51 PM
Thank you for quick help. It worked. What I did is as follows. 1. Moved the regex to tranforms.conf --> where we can add MV_ADD =1 for REGEX. 2. Added Field Extraction with reference to transforms stanza.
... View more
08-04-2020
10:44 AM
Hi There, Thank you for stop by and helping. I've a regex which extracts all URLs and domains from given field, this regex is working fine with the following search query | makeresults |eval body="An issue on an object you are monitoring-- details here: https://SOME1-ORIONWB01:443/Orion/View.aspx?NetObje?a=b&c=dct=I:54020.<br/>View full alert details here: https://SOME2-ORIONWB01:443/Orion/View.aspx?NetObject=AAT:90460" |rex max_match=0 field=body "(?<URL>(?<proto>(((https?|ftp|gopher|telnet|file)(:\/\/))|(www\.)))(?<domain>[:\w\.-]+)[\w\&\=\/\?\.\:]+)" but, when I put the same regex in props.conf (Settings>> Fields » Field extractions » domain_extractor, it is extracting only first URL and domain. I see the manual search "has max_match=0", I could not find similar config for "Filed extractions", Any suggestions? if there is any such config OR do we need to do this in different way? TIA.
... View more
Labels
- Labels:
-
field extraction
-
rex
06-10-2020
03:24 PM
Splunk Enterprise List of jobs in Activity >> Triggered Alerts are visible and the results also can be see by other users who does not have privilege. Anybody observed this and controlled this for a given user/role?
... View more
Labels
- Labels:
-
access control
05-20-2020
11:11 AM
sounds reasonable. Thanks.
... View more
05-19-2020
11:29 AM
Splunk forwarder is re-indexing files when I edit them with vi.
Has anybody seen this before?
I have used the below configs, still it is re-indexing again and again.
crcSalt =' <' SOURCE '>'
initCrcLength = 2560
TIA for your help.
... View more
03-02-2020
08:51 PM
I've singe SPF forwarding to 3 indexers in a cluster, after changing the file permissions to rw from rwx the splunk forwarder stopped indexing files from input dirs. have seen logs no clues found. Any suggestions when to look for errors/exceptions. TIA.
... View more
- Tags:
- splunk-enterprise
03-01-2020
09:19 AM
I need to hide "Settings" in splunk bar on a given App and for a given role. Any suggestions? TIA.
... View more
03-01-2020
08:31 AM
I need to restrict the user to not to see indexes which are created in a specific App from Search App. Any suggestion how to achieve this? TIA.
... View more
03-01-2020
08:28 AM
A user with role which does not have read to "Search" app could not access "Account Settings" to change his password. Any idea how to get "Account Settings" without Search app grants? TIA.
... View more
10-15-2019
04:21 PM
I'm coding dashboard and I'm trying to have js and css which are working fine with single table id, but I want to use the same styles for all tables which have the same class. I do not want to use array of ids in .js and iterate them. Anybody know how how to achieve this? TIA.
... View more
10-05-2019
02:31 PM
Hello Splunk Developers
I need to call a custom command on click of a drilldown on a table cell in dashboard. The action should call the custom command behind the screen and upon completion of command execution should be able to update another cell in the table.
Have anybody came across this kind of requirement and able to code the requirement? Any guide/help is appreciated. Thanks in Advance.
... View more
08-28-2019
09:56 AM
Thanks diogofgm, After placing "startwebserver = 1" in ../system/local/web.conf and restart command started splunk-web.
... View more
08-28-2019
09:55 AM
Thanks diogofgm, After placing "startwebserver = 1" in ../system/local/web.conf and restart command started splunk-web.
... View more
08-27-2019
05:45 PM
Splunk Web not starting with restart command on RHEL, I was working on "App Management" and "Access Control" section before the splunk web gone. Any help to find the root cause for lost of web appreciated. TIA.
... View more
- Tags:
- splunk-enterprise
08-08-2019
05:52 PM
Thanks Naresh, Your query producing results, but my requirement is get and assign all roles (comma separated string value) for the current user and set it to a field in main query.
... View more
08-08-2019
05:00 PM
I need to get the roles assigned to current logged in user and set the value to filed in search. Anybody has any idea. I tried the following and got the error.
|makeresults|eval rls=[|rest /services/authentication/current-context |eval rls="\"".roles."\""|eval user="\"".username."\""|eval rlss=mvjoin(roles,",")|return $rlss]
but got the error : Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression
not much details in logs.
Anybody has any idea how to fix this?
TIA.
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
2 weeks ago
|
