Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About vinoth_raj
vinoth_raj
Path Finder
Member since:
10-14-2022
07-06-2023
Community Statistics
| Posts | 18 |
| Solutions | 1 |
| Karma Given | 5 |
| Karma Received | 2 |
| Member Since | 10-14-2022 |
Activity Feed
- Posted output queues to get filled on Getting Data In. 07-06-2023 11:44 AM
- Posted Re: Each row of a table as pie chart without drilldown on Splunk Search. 06-02-2023 05:42 AM
- Posted Re: How to change the width of the column in the classic dashboard's panel? on Dashboards & Visualizations. 05-12-2023 04:51 AM
- Tagged Re: How to change the width of the column in the classic dashboard's panel? on Dashboards & Visualizations. 05-12-2023 04:51 AM
- Karma Re: Extract fields from CSV log file without header for ashvinpandey. 05-10-2023 01:28 AM
- Posted How to change the width of the column in the classic dashboard's panel? on Dashboards & Visualizations. 05-05-2023 03:15 AM
- Posted Re: Combine multiple values of a field into a single value on Splunk Enterprise Security. 05-04-2023 03:14 AM
- Posted How to combine multiple values of a field into a single value? on Splunk Enterprise Security. 05-04-2023 02:26 AM
- Got Karma for Re: Lookup update field value question. 05-01-2023 03:50 PM
- Posted Re: Bucket replication to GCP cloud storage failed due to GCPCredentials - credentials not found for gcs volume error on Splunk Enterprise. 05-01-2023 12:02 AM
- Posted Re: Lookup update field value question on Splunk Search. 04-30-2023 11:22 PM
- Posted Re: Why am I receiving warning in Splunk log for timedout? on Getting Data In. 04-30-2023 01:09 AM
- Got Karma for Re: Health Check: Intelligence download of "Phishtank" has failed on host "Splunksh01" at :Fri Apr 1. 04-28-2023 04:08 PM
- Posted Using delete command for hadoop archived index? on Getting Data In. 04-20-2023 04:59 AM
- Posted SSL & SAN- Is it possible to enable the below parameters in the web.conf file while using a self signed certificate? on Security. 04-03-2023 08:20 AM
- Karma Re: Phantom license page for smurf. 03-27-2023 10:19 PM
- Posted Phantom license page- What is the difference between Phantom License Information and Splunk License Information? on All Apps and Add-ons. 03-27-2023 01:03 AM
- Posted Has anyone else experienced this ConfObjectManagerDB Error in internal logs? on All Apps and Add-ons. 03-02-2023 05:40 AM
- Karma Re: Splunk DB Connect 2 ConfPathMapper and ExecProcessor Errors for rmsit. 03-02-2023 05:37 AM
- Posted Re: Health Check: Intelligence download of "Phishtank" has failed on host "Splunksh01" at :Fri Apr 1 on Getting Data In. 12-19-2022 10:42 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-06-2023
11:44 AM
Hi folks, What are reasons for my output queues to get filled???? I have my HF on azure cloud.It was working properly and sending data to the splunk cloud.Suddenly, out of the blue, the hf stooped sending all logs( internal and configured ones )to my splunk cloud .I have noticed that my output queue is full and blocked data for a week after that it got fixed up on its own.Now there in no issue. There was no difference in terms of events for that issue period. My architecture: UFs to hf on azure to splunk cloud. Any thoughts?
... View more
Labels
06-02-2023
05:42 AM
Hi folks, Any idea about the "_mkv_child" row created. I cannot find anything related to it in Splunk docs. Thanks, in advance.
... View more
05-12-2023
04:51 AM
Hi, Thanks for the reply. Sorry, let be a little clearer, my use case is to show only the four columns in the table. The rest of the columns should appear while I scroll rightwards. As of now, the solution provided produces a result similar to the below screenshot.
... View more
- Tags:
- hi
05-05-2023
03:15 AM
Hi folks,
My use case is to change the width of the column in the classic dashboard's panel. I tried the below configuration in xml. But this method only works for up to four columns. Not working as expected for 13 columns where I want only the first four columns to be viewed without scrolling right.
Any ideas?
<html depends="$alwaysHideCSSPanel$">
<style>
#tableColumWidth table thead tr th:nth-child(1){
width: 80% !important;
overflow-wrap: anywhere !important;
}
</style>
</html>
<table id="tableColumWidth">
Note:
I also tried including more '#tableColumWidth table thead tr th:nth-child(n)'.
... View more
Labels
- Labels:
-
simple XML
05-04-2023
03:14 AM
Thanks for the reply.I don't want to use stats in main search only because the above is a part of my SPL and using stats directly can limit my data required. I was able to resolve using something like the below in the join command. | join type=outer typeID [ search index=testing ("Access Control change on ObjectType" OR "Added IdentityType=Role") | rex field=_raw "^(:?\d{4}-\d{2}-\d{2}\w\d+\S\d+\S\d+,\d+)\s\w+\s+\[(?<ID>[0-9]+)]\s\d+:[A-Za-z@]+\s-\s[A-Za-z0-9\s]+=[A-Za-z0-9\s]+,\sName=(?<capability>[A-Z\sa-z0-9]+)" | eventstats values("capability") as test by ID | eval Capabilities=mvjoin(test,";") | fields Capabilities]
... View more
05-04-2023
02:26 AM
Hi folks, [Current scenario] When a role is created with capabilities, I am receiving one event for the role creation and each added capability is generated as an event. For example, one role with five capabilities will produce six events in total with similar 'ID'.
Event for role created: 2023-04-20T16:08:05,290 INFO [ID] 1234567:user - Added IdentityType=Role Name=<Role Name>, ObjId=<Object Id>.
Events for capability added: 2023-04-20T16:12:07,020 INFO [ID] 1234567:user - Access Control change on ObjectType=<Object type>, Name=<Capability>, ObjId=<Object Id>. 2023-04-20T16:12:07,020 INFO [ID] 1234567:user - Access Control change on ObjectType=<Object type>, Name=<Capability>, ObjId=<Object Id>. 2023-04-20T16:12:07,020 INFO [ID] 1234567:user - Access Control change on ObjectType=<Object type>, Name=<Capability>, ObjId=<Object Id>. 2023-04-20T16:12:07,021 INFO [ID] 1234567:user - Access Control change on ObjectType=<Object type>, Name=<Capability>, ObjId=<Object Id> 2023-04-20T16:12:07,021 INFO [ID] 1234567:user - Access Control change on ObjectType=<Object type>, Name=<Capability>, ObjId=<Object Id>.
My SPL: index=test |eval Info=case(Type="Role" AND Action="Added",'User'." "."has created the role named ".'Name'." with the following capabilities: ".'Capabilities')
In the above I need the values of the five capability in the field(Capabilities).
[Requirement] Any idea on how to include all the capability based on ID into a field called 'Capabilities'? Note:I dont want to use 'stats values()' directly in my main search.
... View more
Labels
- Labels:
-
other
05-01-2023
12:02 AM
Maybe reconfiguring the 'remote.gs.service_account_email' in indexes.conf located at $SPLUNK_HOME/etc/system/local for standalone or $SPLUNK_HOME/etc/manager or master-apps/_cluster/local for cluster(push the replication bundle) might resolve the issue. Note: Make sure the indexer is hosted on GCP and permissions for Splunk to access the remote store is given.
... View more
04-30-2023
11:22 PM
1 Karma
The 'append=true' along with the 'outputlookup' command will overwrite the data in the file.If you wish to keep the old data and append the new results , then something like the below might be more feasible. .. | inputlookup append=true agentsessions2.csv | outputlookup agentsessions2.csv But if the goal is to fetch new data and overwrite the CSV file , then it is ok. For duplicates, we can just add a dedup command before 'outputlookup'.
... View more
04-30-2023
01:09 AM
A similar issue is discussed in the link below: https://community.splunk.com/t5/Getting-Data-In/How-can-I-overcome-TCP-cooked-connection-timeout/m-p/628962 If it helps, give a karma.
... View more
04-20-2023
04:59 AM
Hi folks,
Can I delete the data in a virtual index like "Hadoop" using the delete command in the SPL.
Thanks, in advance.
... View more
Labels
- Labels:
-
other
04-03-2023
08:20 AM
Hi folks,
Is it possible to enable the below parameters in the web.conf file while using a self signed certificate? sslVerifyServerCert = [true|false] sslAltNameToCheck = <string>
When I tried with a working test environment configured with self signed SSL along with the above parameters, I got the following error while starting the SPLUNK.
ERROR: certificate validation: self signed certificate
Note: I also configured the openssl.cnf as per the below link:
Solved: How to generate CSR files with SubjectAltNames (SA... - Splunk Community So, I assume it is not possible to check SAN while using a self signed certificate?
... View more
Labels
- Labels:
-
SSL
03-27-2023
01:03 AM
Hi guys,
In the license page for the Splunk Phantom , What is the difference between the "PHANTOM LICENSE INFORMATION" & "SPLUNK LICENSE INFORMATION". I assume the "SPLUNK LICENSE INFORMATION" is about the amount of data that we can fetch from Splunk Enterprise and and ingest into the Splunk Phantom.
Am I correct?
... View more
Labels
- Labels:
-
administration
03-02-2023
05:40 AM
Hi guys, Anyone else has run in to a similar error? I found this in my internal logs.
ConfObjectManagerDB [55087 TcpChannelThread] - /opt/splunk/etc/apps/test_app/metadata/local.meta:
Refused forced reload:outstanding write
... View more
Labels
- Labels:
-
configuration
12-19-2022
10:42 PM
1 Karma
Any thoughts about this guys?
... View more
10-20-2022
12:17 AM
Guys, any thoughts on this??
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-06-2023
03:04 PM
|
