Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Hema_Nithya
Hema_Nithya
Explorer
Member since:
07-01-2015
12-03-2023
Community Statistics
| Posts | 27 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 07-01-2015 |
Activity Feed
- Posted Re: Extract the fields user and service account on Splunk Search. 12-02-2023 08:14 AM
- Posted Re: Extract the fields user and service account on Splunk Search. 12-02-2023 07:47 AM
- Posted Re: How to extract a field from the text on Splunk Search. 12-02-2023 07:28 AM
- Posted Extract the fields user and service account on Splunk Search. 12-02-2023 07:26 AM
- Tagged Extract the fields user and service account on Splunk Search. 12-02-2023 07:26 AM
- Tagged Extract the fields user and service account on Splunk Search. 12-02-2023 07:26 AM
- Posted How to extract a field from the text on Splunk Search. 12-02-2023 06:42 AM
- Tagged How to extract a field from the text on Splunk Search. 12-02-2023 06:42 AM
- Tagged How to extract a field from the text on Splunk Search. 12-02-2023 06:42 AM
- Posted Re: Is there a way to extract fields which is : separated on Splunk Search. 11-27-2023 11:51 PM
- Posted field extraction for error message on Splunk Search. 11-27-2023 10:12 PM
- Posted I have a query to fetch Kernel version from all the Linux servers on Splunk Search. 11-07-2023 06:30 PM
- Posted Re: Highlight empty fields in color on Splunk Search. 11-07-2023 06:01 PM
- Posted Re: Is there a way to extract fields which is : separated on Splunk Search. 11-07-2023 11:16 AM
- Posted Highlight empty fields in color on Splunk Search. 11-07-2023 09:56 AM
- Posted Is there a way to extract fields which is : separated on Splunk Search. 11-07-2023 09:53 AM
- Tagged Is there a way to extract fields which is : separated on Splunk Search. 11-07-2023 09:53 AM
- Posted How extract the lines as failures from logs using splunk on Splunk Search. 11-02-2023 03:26 AM
- Posted How to create exception list by comparing two tables . on Splunk Search. 10-11-2023 09:19 AM
- Posted string fields with numbers to be compared on Splunk Search. 08-31-2023 03:22 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-02-2023
08:14 AM
I tried this working
| rex "COMMAND=\/[a-z]*\/[a-z]*\s-\s(?<service_account>[^ ]+)"
... View more
12-02-2023
07:47 AM
Hi Thanks I also want to extract another field from the below data "webadmin" as service_Account COMMAND=/bin/su - webadmin Dec 2 08:46:55 server1 sudo[3461907]: ib12345 : TTY=pts/0 ; PWD=/home/ib12345 ; USER=root ; COMMAND=/bin/su - webadmin
... View more
12-02-2023
07:28 AM
sudo: ib12345 Value ib12345 will change not constant . It is upi .
... View more
12-02-2023
07:26 AM
Dec 2 08:46:55 server1 sudo[3461907]: ib12345 : TTY=pts/0 ; PWD=/home/ib12345 ; USER=root ; COMMAND=/bin/su - webadmin I would like to extract the upi from above ib12345 upi ib12345 service_account webadmin Sometime after is empty COMMAND=/bin/su -
... View more
12-02-2023
06:42 AM
Dec 2 09:02:17 server1 sudo: ib12345 : TTY=pts/0 ; PWD=/home/ib12345 ; USER=root ; COMMAND=/bin/su - I need to extract ib12345 from the above data .
... View more
11-27-2023
11:51 PM
How to deal with the empty fields between . Example there is empty field between passwd and after home directory userid:passwd: :/home/John: :
... View more
11-27-2023
10:12 PM
I want to extract the following information make it as a field as "error message" . index=os source="/var/log/syslog" "*authentication failure*" OR "Generic preauthentication failure" Events example : Nov 28 01:02:31 server1 sssd[ldap_child[12010]]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Generic preauthentication failure. Unable to create GSSAPI-encrypted LDAP connection. Nov 28 01:02:29 server2 proxy_child[1939385]: pam_unix(system-auth-ac:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.177.46.57 user=hippm
... View more
Labels
- Labels:
-
field extraction
11-07-2023
06:30 PM
I have a query to fetch Kernel version from all the Linux servers . We update the Kernel Patch every quarter . I have to hardcode the kernel versions in the search query 3.10.0-1160.92.1.el7.x86_64 every quarter . There are 3 versions which I need to hardcode in the search query . Is there any specific way where we can update the query automatic .
... View more
11-07-2023
11:16 AM
Thank you , let me check and update you !
... View more
11-07-2023
09:56 AM
How to highlight empty fields in the dashboard in colours . Simple step pls
... View more
Labels
- Labels:
-
table
11-07-2023
09:53 AM
John:x:/home/John:/bin/bash is there a way to extract the field from above with colon separated. We have many users in the above format from /etc/passwd John - username x - passwd /home/John - path
... View more
- Tags:
- fields
Labels
- Labels:
-
field extraction
-
fields
-
regex
11-02-2023
03:26 AM
index=os source="/var/log/bitbucket" host=servera* Failed and evaluate them as failed packages to install. Failed: python-urllib3.noarch 0:1.10.2-3.el7 python-urllib3.noarch 0:1.10.2-7.el7 php subscription-manager-rhsm-1.24.51-1.el7_9.x86_64 subscription-manager-rhsm-1.24.52-2.el7_9.x86_64 python-syspurpose-1.24.52-2.el7_9.x86_64
... View more
Labels
- Labels:
-
eval
-
field extraction
-
regex
10-11-2023
09:19 AM
How to get the exception from the below tables. Exception is John who is not HR table . User list from the servers. Name ID Bill 23 Peter 24 john 25 HR Table Name ID Bill 23 Peter 24 Anita 27
... View more
08-31-2023
03:22 AM
I have another issue in comparing and want to compare should_be with server_installed_package . Sometime package installed is higher after patching . Example given below for git version if should_be== server_installed_package , the status should updated as Completed , Another case if server_installed_packages is greater than shouldbe to mark as complete 2 < 3 , also it should check for if first number is same , it should check for second digits . it should mark as completed , else it should check for the next digit if it is 2. and it should check for another number . CI Installed shouldbe server_installed_package Status server1 git-2.31.1-3.el8_7 git-2.39.3-1.el8_8 git-3.40.3-1.el8_8 Not complete
... View more
Labels
- Labels:
-
field extraction
-
regex
-
subsearch
-
table
08-30-2023
11:33 AM
I have another issue in comparing and want to compare should_be with server_installed_package . Sometime package installed is higher after patching . Example given below for git , if the number 2 < 3 , it should mark as completed , else it should check for the next digit if it is 2. and it should check for another number . CI Installed shouldbe server_installed_package server1 git-2.31.1-3.el8_7 git-2.39.3-1.el8_8 git-3.40.3-1.el8_8 Not complete
... View more
08-14-2023
04:36 AM
I tried the append , the final output display all the packages in "Server_Installed_Package. I want only the package name as in "shouldBe" CI_Name installed shouldBe Server_Installed_Package Vul_Status server1 nss-3.44.0-7.el6_10 nss-3.44.0-13.el6_10 nss-3.44.0-13.el6_10 Complete nss-devel-3.44.0-13.el6_10 nss-softokn-3.44.0-6.el6_10 nss-softokn-devel-3.44.0-6.el6_10 nss-softokn-freebl-3.44.0-6.el6_10 nss-softokn-freebl-3.44.0-6.el6_10.i686 nss-softokn-freebl-devel-3.44.0-6.el6_10 nss-sysinit-3.44.0-13.el6_10 nss-tools-3.44.0-13.el6_10 nss-util-3.44.0-1.el6_10 nss-util-devel-3.44.0-1.el6_10 nss_compat_ossl-0.9.6-2.el6_7
... View more
08-14-2023
12:56 AM
I want to match with second search field Server_Installed_Package abd shouldbe | eval match=if(Server_Installed_Package=shouldBe,"Complete","Not complete")
Server_Installed_Package from second query
shouldbe from first query
Common field between two search query is CI_Name
... View more
08-13-2023
11:42 PM
There are two searches with CI_Name as the common field . I have output and want compare the two columns installed and Server_Installed_Package based on CI_Name as common , if both are common mark it as "Completed" in another column. If there is no match mark it as Not completed.
first search output:
CI_Name
installed
shouldBe
match
Server1
nss-3.44.0-7.el6_10
nss-3.44.0-13.el6_10
Server1
nss-devel-3.44.0-7.el6_10
nss-devel-3.44.0-13.el6_10
Server1
nss-sysinit-3.44.0-7.el6_10
nss-sysinit-3.44.0-13.el6_10
Second search output :
CI_Name
Server_Installed_Package
Server1
libgdata-0.6.4-2.el6.x86_64
Server1
util-linux-ng-2.17.2-12.28.el6_9.2.x86_64
Server1
rt73usb-firmware-1.8-7.el6.noarch
Server1
sssd-1.13.3-60.el6_10.2.x86_64
... View more
Labels
- Labels:
-
field extraction
-
fields
-
lookup
08-13-2023
08:51 PM
1 Karma
It worked , thanks a lot
... View more
08-13-2023
11:59 AM
Hi , I have two servers with plugin details . I want to evaluate a column as Package_installed and Package_shouldbe based on the hostname in separate column . server2 has multiple packages I want separate row and column for each package_shouldbe and package_installed and hostname field should be same . hostname Plugins server1 Plugin Output: Remote package installed : gnutls-3.6.16-5.el8_6 Should be : gnutls-3.6.16-6.el8_7 NOTE: The vulnerability information above was derived by checking the package versions of the affected packages from this advisory. This scan is unable to rely on Red Hat's own security checks, which consider channels and products in their vulnerability determinations. server2 Plugin Output: Remote package installed : httpd-2.4.6-98.el7_9.6 Should be : httpd-2.4.6-98.el7_9.7 Remote package installed : httpd-tools-2.4.6-98.el7_9.6 Should be : httpd-tools-2.4.6-98.el7_9.7 Remote package installed : mod_session-2.4.6-98.el7_9.6 Should be : mod_session-2.4.6-98.el7_9.7 NOTE: The vulnerability information above was derived by checking the package versions of the affected packages from this advisory. This scan is unable to rely on Red Hat's own security checks, which consider channels and products in their vulnerability determinations.
... View more
Labels
- Labels:
-
eval
-
field extraction
-
fields
-
regex
-
rex
01-06-2017
08:26 AM
yes , I used Join ...
index=itsm sourcetype=tsm_filespaces |join node_name [search sourcetype=tsm_nodes] | dedup node_name,filespace_name | table node_name, platform_name, filespace_name,backup_end,host
... View more
01-06-2017
07:09 AM
How can we join fields of two source types, when one field is the same in both source types?
... View more
07-01-2015
08:21 AM
Tivoli Storage Manager AIX machines are integrated and OS level logs are ingested in the splunk already , now we are planning get the Application (TSM) to the splunk , for example to get a dashboard report weekly occupancy report .. backup success rate , nodes data ..
... View more
07-01-2015
03:51 AM
1 Karma
Hi
We are trying integrate TSM servers with splunk and create a dashboard . Please assist what are logs we need to feed the splunk from the TSM server , fyi TSM servers are already integrated in the Splunk .
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-03-2023
06:35 PM
|
