Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About adityapavan18
adityapavan18
Contributor
Member since:
10-08-2011
06-05-2020
Community Statistics
| Posts | 150 |
| Solutions | 13 |
| Karma Given | 90 |
| Karma Received | 101 |
| Member Since | 10-08-2011 |
Activity Feed
- Got Karma for Re: couldn't send SIGTERM to pid 5632: Operation not permitted. 02-01-2024 05:53 AM
- Got Karma for Re: couldn't send SIGTERM to pid 5632: Operation not permitted. 01-03-2024 12:50 AM
- Got Karma for Re: couldn't send SIGTERM to pid 5632: Operation not permitted. 04-03-2023 11:29 AM
- Got Karma for Why couldn't I send SIGTERM to pid 5632: Operation not permitted?. 07-15-2022 05:12 PM
- Got Karma for Re: couldn't send SIGTERM to pid 5632: Operation not permitted. 07-15-2022 05:12 PM
- Got Karma for Re: couldn't send SIGTERM to pid 5632: Operation not permitted. 05-02-2022 04:50 AM
- Got Karma for Re: couldn't send SIGTERM to pid 5632: Operation not permitted. 10-28-2021 07:34 AM
- Got Karma for Converting Duration Field value to seconds. 07-13-2021 05:14 PM
- Got Karma for Re: Is there a way to count the number of dashboard views per day or per hour for a particular dashboard?. 02-19-2021 01:37 AM
- Got Karma for Re: couldn't send SIGTERM to pid 5632: Operation not permitted. 10-13-2020 10:03 AM
- Got Karma for Why couldn't I send SIGTERM to pid 5632: Operation not permitted?. 09-04-2020 11:18 AM
- Got Karma for Re: couldn't send SIGTERM to pid 5632: Operation not permitted. 09-04-2020 11:18 AM
- Karma Re: OutputCSV result is different than Splunk display for esix_splunk. 06-05-2020 12:47 AM
- Karma Re: How do I search specified fields with the same keyword list without searching the entire index? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: How to sort data in chronological order by month, not alphabetically? for Ayn. 06-05-2020 12:47 AM
- Karma Re: Calculate a value based on multiple events for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: How can I configure splunk to read dates in dd/mm/yyyy format? for MarioM. 06-05-2020 12:47 AM
- Karma Re: Need help with multiple field extractions for MuS. 06-05-2020 12:47 AM
- Karma Re: How do I search for events where a specific field value in a multivalue field is NOT the first value per event? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: How do optimizations for field-based searches work? for jrodman. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 |
12-12-2018
09:52 AM
The logs ingested from endpoint "https://manage.office.com/api/v1.0/tenantid/ServiceComms/CurrentStatus" in splunk via Splunk Addon from Cloud Services & Splunk Addon for Microsoft Office 365 both are a day old.
Logs for CurrentStatus endpoint show events which have a 24 hour old timestamp. Is this a bug in the add-on? or does Microsoft Current Status Logs from API can only give you details for 24hours old data.
Indextime shows current datettime - 2018-12-11 12:45:19.207
But the actual _time on the event shows 2018-12-11 12:45:19.207
Is this a splunk bug?
... View more
03-26-2018
12:03 PM
Hi All
I am having a weird issue where I am trying to update certain attributes for a saved search - it does update few attributes, but not all attributes.
curl -k -u admin:pass -d action.email=0 -d alert.severity=2 https://splunkserver:8089/servicesNS/nobody/search/saved/searches/SAMPLE%20REST%20API%20ALERT
Running this updates the alert.severity to "2" but not setting action.email=0
Am I using it wrong? any help is greatly appreciated
... View more
02-14-2017
09:04 AM
Hi, please let us know how to setup a channel GUID for HTTP event collector to send raw data
... View more
05-25-2016
11:42 PM
Hi Luke,
I ran all commands using the admin user itself.
... View more
05-25-2016
05:35 AM
I am using the latest version 2.1.2 for app & splunk is on 6.3.0
Is it working for you now? which version are you using?
... View more
05-25-2016
04:44 AM
Hi
I have created a kvstore collection as below in collections.conf
[samplecollection]
replicate = true
Then I created a lookup based on the above kvstore collection in transforms.conf
[samplekv_lookup]
collection = samplecollection
external_type = kvstore
fields_list = _key,field1,field2
Now I ran the search below to load data onto my kvstore lookup
|inputlookup old_data,csv | table field1,field2 | outputlookup samplekv_lookup
When I run | inputlookup samplekv_lookup | eval Key = _key | table _key,field1,field2 , I see the data with columns key, field1 & field2
Now I want to edit the data in this kvstore. I tried using the Lookup File Editor App for Splunk Enterprise. When opened in the list of lookups, I found "samplecollection" instead of "samplekv_lookup" (I was hoping to see this in the list).
Once I open "samplecollection" to edit in the Lookup Editor app, it only shows me _key column and it doesn't show me the field1, field2 columns which I want to edit.
Is my understanding correct that tje Lookup Editor app can be used to edit kvstore data? What am I doing wrong?
Any help is much appreciated.
... View more
03-17-2016
06:30 AM
Hi
I have a custom app, it is a simple app which contains a few dashboards and nothing more.
When i click app it's supposed to open the search page, but it redirects to setup page(which is not available)
what i mean is clicking the app is supposed to open
https://splunk.company.com/en-US/app/NewApp/search
but open
https://splunk.company.com/en-US/app/NewApp/setup
Note: I dont have any view named setup, i am not sure why it is redirecting there.
This was working well in 6.1.4, we recently upgraded to 6.3.3 and we see this issue
Can anyone help me with what might be the issue.
... View more
03-16-2016
05:05 AM
Ok. Thanks
... View more
03-14-2016
05:45 AM
@douglashurd can you help me with this
... View more
03-14-2016
05:44 AM
The estreamer app provides UI to configure a single Defence Center IP/hostame. Is it possible to configure more than one Defence Centers?
... View more
09-07-2015
10:18 PM
6 Karma
You can use the data from splunkd_access.log and get those metrics
source="*splunkd_access.log" "*/ui/views/*" | rex "\/ui\/views\/(?.*?)\?" | stats count by dashboard
... View more
07-13-2015
10:06 PM
I am trying to generate report daily to monitor changes in knowledge objects (changes in permissions/new artifacts created/deleted/edited so on...) in Splunk. Is there any place they will be logged?
... View more
07-01-2015
12:30 AM
I want to schedule a saved search to run on Sunday 1 AM every 2 weeks.
i.e. I need a search query to run
July 12,2015 01:00:00 earliest:06/28/2015:00:00:00 latest:07/12/2015:00:00:00
July 26,2015 01:00:00 earliest:07/12/2015:00:00:00 latest:07/26/2015:00:00:00
and so on.
Can anyone help me set up cron and earliest/latest for this scenario.
Thanks
... View more
- Tags:
- cron
- savedsearch
03-02-2015
08:19 PM
2 Karma
As of now when email alerts are sent, the from address is the hostname of server sending the alert.
Is it possible to change that to a generic one like the internal splunk support team.
eg: As of now the from in email alerts is
splunk@reportingserver.com
Can i get it changed to
splunksupport@company.com
... View more
02-25-2015
11:55 PM
2 Karma
Found that the i missed sequence in blacklist.. Hence was not allowing the reload of serverclass.
After correcting that issues got resolved
... View more
02-09-2015
11:24 PM
Hi All
I am facing a issue where I am not able to reload server class.
I get the following error
Cannot reload serverclass if DSM
itself is not loaded; BUG!
Can anyone help me with this?
... View more
- Tags:
- deploy
- serverclass
02-09-2015
11:20 PM
Thank you.
... View more
02-04-2015
03:28 AM
Hi All
I have a dashboard as following:
Panel 2 is a table I am enabling drilldown on column "general_exception_type" using a condition tag.
I am expecting the drilldown to happen when a value in general_exception_type column is clicked, and nothing should happen when I click any value in count column.
After adding the condition tag, the drilldown is working on the general_exception_type column value when clicked, but when i click on a value in the count column (i expected nothing to happen), it's opening a search window. How do I disable that behavior?
I only need the drilldown to work when clicking on any value in column1 and nothing when clicked on any other value in column.
<dashboard>
<label>Error Token Dashboard</label>
<description/>
<row>
<panel>
<single>
<title>Tokens Found</title>
<option name="classField">range</option>
<searchString>index=sample | stats count by general_exception_type | stats count</searchString>
<earliestTime>@d</earliestTime>
<latestTime>now</latestTime>
<option name="drilldown">all</option>
<option name="beforeLabel">Number Of Error Tokens found in the logs today</option>
<drilldown>
<set token="tk">$click.value$</set>
</drilldown>
</single>
</panel>
<panel>
<table depends="$tk$">
<title>Tokens List</title>
<searchString>index=sample | stats count by general_exception_type</searchString>
<earliestTime>@d</earliestTime>
<latestTime>now</latestTime>
<option name="drilldown">row</option>
<drilldown>
<condition field="general_exception_type">
<set token="exception">$row.general_exception_type$</set>
</condition>
</drilldown>
</table>
</panel>
</row>
<row>
<panel>
<event depends="$exception$">
<title>Token Events</title>
<searchString>index=sample general_exception_type=$exception$</searchString>
<earliestTime>@d</earliestTime>
<latestTime>now</latestTime>
<option name="drilldown">none</option>
</event>
</panel>
</row>
</dashboard>
... View more
01-22-2015
09:31 PM
Hey Niveditha..any luck with this??
... View more
01-12-2015
06:22 AM
<form>
<label>SYBASE TEST</label>
<description></description>
<searchTemplate><My Search></searchTemplate>
<fieldset submitButton="true">
<input type="time" token="field1"><label></label><default><earliestTime>-1d@d</earliestTime><latestTime>@d</latestTime></default></input></fieldset>
<row>
<panel>
<table><searchPostProcess<My PostProcess 1></searchPostProcess><option name="wrap">true</option>
<option name="rowNumbers">true</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="count">30</option>
<drilldown>
<condition field="SERVER">
<set token="SERVER">$click.value$</set>
</condition>
</drilldown>
</table></panel>
<panel>
<table depends="$SERVER$">
<title>SERVER BACKUP : $SERVER$</title>
<searchPostProcess><My Post Process 2></searchPostProcess>
<earliestTime>-1d@d</earliestTime><latestTime>@d</latestTime>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="count">30</option>
</table>
</panel>
</row>
</form>
Even though I have my timepicker defaulted to "Yesterday" data, when the search is executed, it is still considering "All Time" for search execution. Could someone help me with where I am doing it wrong??
Thanks
Aditya
... View more
01-12-2015
03:59 AM
I have a scenario where in the splunk servers(Search Heads & Indexers) the server time is set as UTC
But when a user in Americas is using splunk (EST/CST) the date time picker in splunk search should pick logs according to EST timezone and not in UTC timezone.
What i mean is if a user in EST TZ selects "Last 24 hours" - he should see the logs of last 24 hours wrt to EST TZ and if a user in GMT TZ selects "Last 24 hours" - he should see the logs of last 24 hours wrt to GMT TZ
Can anyone help me with this?
Thanks
Aditya
... View more
- Tags:
- timepicker
- timezone
12-25-2014
11:47 PM
Its took me a while to come up with this. Please see if something like this helps
<pre search> | eval x = if(match(field_1,"XXX"),1,if(match(field_1,"YYY"),0,-1)) | accum x AS total_x | table _time,field_1,x,total_x | eval y = if(x=0,total_x,NULL) |filldown y | fillnull value=0 y | delta y as z | eval z = if(z=0,NULL,z) | eval w = coalesce(z,x) | eval w = if(x=0,0-w,w)| accum w as total_w
Here total_w column would be your requested re-setted accum count.
where XXX is where the we assume 1 is added and YYY is event where after the reset is required
... View more
12-25-2014
10:58 PM
Try this way. create a field to extract processid.
Then try something like | stats latest(_time) as endtime earliest(_time) as starttime by processid .
... View more
09-19-2014
02:10 AM
By hiding do you mean hide chart untill drilldowm event occurs??
In that case you can use the depends-rejects while setting tokens.
Documentaion : http://docs.splunk.com/Documentation/Splunk/6.1.3/Viz/PanelreferenceforSimplifiedXML#set
You alsa have a similiar example in Splunk 6 Dashboard Examples App.
... View more
09-14-2014
09:35 PM
@Chrismok: As from your props file i dont see any configuration that tells splunk to index multiple lines together.
Could you please provide log sample.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma from
