About hiteshkanchan

hiteshkanchan · ‎09-13-2016

Has there been any progress on this issue in the recent times. I am trying to do a similar thing and not able to send the data through the proxy.

hiteshkanchan · ‎09-02-2015

I tried using the same but when I use "change" and "condition" it is not able to get the query and i get the message as "No search query Provided". Any idea if it is version issue or something else. I am currently using 6.1.

hiteshkanchan · ‎07-30-2015

I installed the Heavy Forwarder (instead of UF) and enabled the Forwarding to the Indexer/SH. It is working for me. And the python is listening on port 8008.

hiteshkanchan · ‎07-29-2015

I installed the Heavy Forwarder (instead of UF) and enabled the Forwarding to the Indexer/SH. I was earlier enabling 8008 port explicitly but then I stopped listening on this port. It is working for me now. Thanks.

hiteshkanchan · ‎07-25-2015

I am getting the following error when I execute: index=_internal sourcetype=splunk_ta_ontap_api* OR sourcetype=hydra* ERROR I don't see any data in index=ontap or any of the other NetAppdashboards. I am using the Universal Forwarder (instead of LWF or HF) as Data Collection Node (DCN) and installed python in that. Is that fine? Also enabled port 8008 on the DCN to receive the data from the storage devices. 2015-07-24 19:59:42,832 ERROR [ta_ontap_collection_scheduler://nidhogg] Problem with hydra scheduler ta_ontap_collection_scheduler://nidhogg: 'job_aggregate_execution_info' Traceback (most recent call last): File "/opt/splunk/etc/apps/SA-Hydra/bin/hydra/hydra_scheduler.py", line 2136, in run collection_manifest.sprayReadyJobs(self.node_manifest) File "/opt/splunk/etc/apps/SA-Hydra/bin/hydra/hydra_scheduler.py", line 735, in sprayReadyJobs available_work_load, balanced_load = self._calculateLoadDistribution(active_workers, ready_jobs, node_job_infos) File "/opt/splunk/etc/apps/SA-Hydra/bin/hydra/hydra_scheduler.py", line 535, in _calculateLoadDistribution self._update_execution_time(node_job_info["job_aggregate_execution_info"]) KeyError: 'job_aggregate_execution_info'

hiteshkanchan · ‎07-24-2015

Did you install python separately on a Universal Forwarder as Universal Forwarder doesn't come with python. I am facing issues as I am getting the following error with Universal Forwarder. I intstalled python as well using yum install python. So was curious to know. 2015-07-24 19:59:42,832 ERROR [ta_ontap_collection_scheduler://nidhogg] Problem with hydra scheduler ta_ontap_collection_scheduler://nidhogg: 'job_aggregate_execution_info' Traceback (most recent call last): File "/opt/splunk/etc/apps/SA-Hydra/bin/hydra/hydra_scheduler.py", line 2136, in run collection_manifest.sprayReadyJobs(self.node_manifest) File "/opt/splunk/etc/apps/SA-Hydra/bin/hydra/hydra_scheduler.py", line 735, in sprayReadyJobs available_work_load, balanced_load = self._calculateLoadDistribution(active_workers, ready_jobs, node_job_infos) File "/opt/splunk/etc/apps/SA-Hydra/bin/hydra/hydra_scheduler.py", line 535, in _calculateLoadDistribution self._update_execution_time(node_job_info["job_aggregate_execution_info"]) KeyError: 'job_aggregate_execution_info'

hiteshkanchan · ‎03-12-2014

Thanks nfilippi. The restarting of splunk has done the trick. It works for other fields but if I use source instead of sourcetype like "index=_internal | stats count by source", the source are getting listed as source="C:\Program Files\Splunk\var\log\splunk\first_install.log" but the drilldown seems to be blank with "No results found". Do you think any additional setting is required for windows source.

hiteshkanchan · ‎03-11-2014

I am trying to execute the example of "In-Page Drilldown with Perma-linking" in splunk 6.0, "index=_internal | stats count by sourcetype" When I click on any sourcetype it doesn’t reflect anything in Detail but when I type specifically in the sourcetype section,it gives the output for the query in Detail index=_internal sourcetype=$sourcetype$ | timechart count do i need to put the scripts inpage_drilldown_form.css and inpage_drilldown_form.js need to be in any specific folder. I have it currently in /etc/apps/search/appserver/static. But the example drilldown that I try doesn’t seem to work.

hiteshkanchan · ‎08-22-2012

My requirement is, I actually want to see if I can make any sense out of the data logs that I got from an Microsoft Exchange. So was checking if I could put this logs(Event Logs + IIS logs + Message Tracking logs) into any log path of Splunk_for_Exchange/... to understand the data. Not sure if I can get data from powershell scripts. Any idea abt the location or type of this data.

hiteshkanchan · ‎08-22-2012

I got the IIS Logs and the Message Tracking Logs as well. Does this help? Can I copy these logs to any location of /etc/apps/Splunk_For_Exchange/ to understand or get information from this log. Can I not proceed further without Power shell script info? How does this info look or what extension or type does it have?

hiteshkanchan · ‎08-22-2012

I have CAS, Hub and MBX logs (Application, System and Event Logs) which I got from a Microsoft Exchange server. Can I directly load it into the Exchange APP of splunk for understannding this data/log?. If yes, can someone tell me which path can I copy this log into so that I can check the information or get the details from this logs.

hiteshkanchan · ‎08-13-2012

I think Option 2 is more suitable for our application as I need process the search result after the populated dropdown info. Thanks for that. One more thing I would like to confirm is, does the Java/Javascript also provide dashboard or visualization development APIs. I would like to use the search query result to be shown in a dashboard for memory and cpu variations.

hiteshkanchan · ‎08-13-2012

Exactly this is what i have been looking for. But not finding any suitable examples done earlier. Are you also trying to say that I can use a combination of Java/Javascript SDK and Advance XML for performing the same operation to develop the custom UI. I am not sure about the integration between XML and Java/Javascript SDK.

hiteshkanchan · ‎08-13-2012

But is it possible to create dynamically populated dropdown from Java/Javascript SDK. I am looking for a customized UI APP, where there will be 2-3 dropdown list and upon selecting items from this dropdown list, a search query will run based on the selected items from the dropdown list. I feel this can be done well using Java/Javascript SDK. Am I correct?

hiteshkanchan · ‎08-13-2012

I am working on the Splunk APP for the first time. So would like to know if I can create a Customized UI where I can I have a dropdown (which is dynamically populated from my search query). And when one of the items from dropdown is clicked, some other search events run. I got links on how to use search query using Java SDK. Can anyone point me to the location from where I can use Java SDK to create an APP having dropdown and other related search, dashboard and report information.

hiteshkanchan · ‎06-26-2012

The above can be done by specifying a span=30s. There is another search which look something like this, sourcetype="WMI:PerfCPU" host="10..." earliest=-30m | append [search host="test_iis_data" source="\\10...\file1.log" earliest==-30m | eval Time_Taken=(Time_Taken/1000) | search Time_Taken>0] | timechart avg(Time_Taken) as AvgTime avg(PercentCommittedBytesInUse) as AvgProcTime Here the output comes only for one field at a time(but not for both AvgTime and AvgProcTime). Is there any way I can get both?

hiteshkanchan · ‎06-20-2012

I tried this, but it doesn't improve the performance by much. These 2 Events come one below the other, so may be transaction command can be changed if that is the culprit.

hiteshkanchan · ‎06-20-2012

This part(EventCode="0" OR EventCode="4624" earliest=-30m) takes close to 3 min to run. I tried adding source/sourcetype but it doesn't improve the performance by much. These 2 Events come one below the other, so may be transaction command can be changed if that is the culprit.

hiteshkanchan · ‎06-20-2012

There is one query that I am trying to execute, which gives the CPU and Memory Usage. But there is no sync in the time as shown in the attachment. i.e. The CPU and Memory usage are getting calculated at different times. Is there any way I can get both the parameter values at the same time. sourcetype="WMI:CPUTime" OR sourcetype="WMI:Memory" earliest=-30m | table _time, PercentProcessorTime, PercentUserTime, AvailableMBytes, PercentCommittedBytesInUse The output is coming at different times for both the sourcetypes. Is there any wany I can get both outputs at the same time?

hiteshkanchan · ‎06-14-2012

Currently I am writing events into a file on a continuous basis. The rate is about 5000 events every 5 min, which is about 60,000 events every 1 hour. And it continues. I am running a search query as below which is taking close to 7 min. Is there any way I can reduce this search time to few seconds. Can summary indexing help in this case? EventCode="0" OR EventCode="4624" earliest=-30m | transaction ComputerName startswith=(EventCode="4624") endswith=(EventCode="0") maxevents=2 | eval duration=round(duration,1) | search duration<30 AND duration>2| stats stdev(duration) as StdDevDuration avg(duration) as AvgDuration count(ComputerName) as count_value | table AvgDuration, StdDevDuration, count_value

hiteshkanchan · ‎05-30-2012

I tried this this command and it gives the error like "command="sendemail", Connection unexpectedly closed while sending mail to: user@domain.com

hiteshkanchan · ‎05-30-2012

I am trying this command --> sendemail to="user@domain.com" sendresults=true server="proxy.com:8080" and it gives the error like --> "command="sendemail", Connection unexpectedly closed while sending mail to: user@domain.com"

hiteshkanchan · ‎05-30-2012

Yes I am trying the same, but currently I am getting some error. "command="sendemail", [Errno 10061] No connection could be made because the target machine actively refused it while sending mail to: hitesh@domain.com"". Looks like some configuration issue. Kindly let me know if anyone has resolved this issue

hiteshkanchan · ‎05-29-2012

Yes right, I am doing the same thing and getting some error like command="sendemail", [Errno 10060] A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond while sending mail to: "username@mail.com"

hiteshkanchan · ‎05-28-2012

If sending mail based on condition like "if (AvearageLoginTime > 10) send an email" is not possible, then I tried using Manager/Searches and Reports. But it does not seem to send any mails. Any idea if I need to do any configuration.

Posts	44
Solutions	2
Karma Given	1
Karma Received	7
Member Since	‎03-05-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Splunk App for NetApp Data ONTAP: Why am I getting...

In-Page Drilldown with Perma-linking in splunk 6.0

Exchange App for Splunk

Splunk APPS using Java/JavaScript SDK

Synchronize between 2 sourcetypes over a time

Reducing Time taken for Search in splunk query

Alert Sending Email based on a if condition

Using Splunk REST API to run a search giving "401 ...

Calculate Time difference between 2 events

Re: Splunk Universal Forwarder through a proxy to ...

Re: How to change Inline Search based on the click...

Re: Netapp data collection hydra errors

Re: Splunk App for NetApp Data ONTAP: Why am I get...

Splunk App for NetApp Data ONTAP: Why am I getting...

Re: Netapp data collection hydra errors

Re: In-Page Drilldown with Perma-linking in splunk...

In-Page Drilldown with Perma-linking in splunk 6.0

Re: Exchange App for Splunk

Re: Exchange App for Splunk

Exchange App for Splunk

Re: Splunk APPS using Java/JavaScript SDK

Re: Splunk APPS using Java/JavaScript SDK

Re: Splunk APPS using Java/JavaScript SDK

Splunk APPS using Java/JavaScript SDK

Re: Synchronize between 2 sourcetypes over a time

Re: Reducing Time taken for Search in splunk query

Re: Reducing Time taken for Search in splunk query

Synchronize between 2 sourcetypes over a time

Reducing Time taken for Search in splunk query

Re: ERROR Sending email with sendemail, but alert ...

Re: Alert Sending Email based on a if condition

Re: Alert Sending Email based on a if condition

Re: Alert Sending Email based on a if condition

Re: Alert Sending Email based on a if condition