Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About srinathd
srinathd
Contributor
Member since:
07-31-2013
09-13-2022
Community Statistics
| Posts | 100 |
| Solutions | 5 |
| Karma Given | 41 |
| Karma Received | 9 |
| Member Since | 07-31-2013 |
Activity Feed
- Got Karma for Re: plot a graph. 03-14-2024 10:20 AM
- Posted Re: Tenable Add-On for Splunk no longer working - not ingesting data on All Apps and Add-ons. 06-02-2022 01:06 AM
- Karma Tenable Add-On for Splunk no longer working - not ingesting data for jwalzerpitt. 06-02-2022 01:05 AM
- Karma Re: Why do so few apps support search head clustering? for lguinn2. 06-18-2020 06:23 AM
- Karma Re: Why do so few apps support search head clustering? for dbizzle. 06-18-2020 06:19 AM
- Karma Splunk DB Connect: How to resolve error "ERROR org.easybatch.core.job.BatchJob - Unable to open record reader java.io.IOException: Push back buffer is full"? for carlkennedy. 06-05-2020 12:48 AM
- Karma First and Last Business Day for diegosainz. 06-05-2020 12:47 AM
- Karma Is it possible to use commands like makemv or nomv in data models? for visa87. 06-05-2020 12:47 AM
- Karma Re: How to extract and assign a timestamp from a multiline event? for woodcock. 06-05-2020 12:47 AM
- Karma Is there any way to manually load a Windows event log into Splunk? for Sam2. 06-05-2020 12:47 AM
- Karma Re: Joining two indexes based on a common value for Runals. 06-05-2020 12:47 AM
- Karma Dashboard Input Error When Time Is Set As "All Time" for LuiesCui. 06-05-2020 12:47 AM
- Karma Re: How to convert time format of 20090930 to 30-Sep-2009? for richgalloway. 06-05-2020 12:47 AM
- Karma Adding a Field from a Subsearch Using Join - Inaccurate Results for rescobar713. 06-05-2020 12:47 AM
- Karma Re: get epoch time from string time example from 20090930 to epoch time? for MuS. 06-05-2020 12:47 AM
- Karma Re: Need to show a report by extracting multivalued lines for tom_frotscher. 06-05-2020 12:47 AM
- Karma Splunk DB Connect 2: How to fetch and read XML data from BLOB and CLOB fields in MS SQL and Oracle database tables? for moshere. 06-05-2020 12:47 AM
- Karma Possible bug with DB Connect 2.0.5 on Splunk 6.2.6? for brandonf. 06-05-2020 12:47 AM
- Karma Re: Possible bug with DB Connect 2.0.5 on Splunk 6.2.6? for arorajagmeet. 06-05-2020 12:47 AM
- Karma Re: Splunk DB Connect 2: Why am I getting a JDBC connection error trying to connect to a DB2 database on ZOS? for Lazarix. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-02-2022
01:06 AM
Are you able to fix it?
... View more
10-27-2017
05:08 AM
I am getting "HttpListener - Socket error from 127.0.0.1 while accessing /servicesNS/-/-/admin/LDAP-groups: Broken pipe" error while trying to get the ldap groups using the rest api as below
| rest /servicesNS/-/-/admin/LDAP-groups splunk_server=* | search roles=* | table strategy title roles
Splunk settings are like this
ulimit -n : 65535
ulimit -Hn and ulimit -Sn: 65535
ulimit -u: 1032358
[httpServer]
maxThreads = 100000
maxSockets = 50000
How to fix this error?
... View more
08-08-2017
12:44 AM
Please check this and search for SPL-99110
https://docs.splunk.com/Documentation/Splunk/6.6.2/ReleaseNotes/Knownissues
... View more
05-03-2017
02:42 AM
I am getting error as "Lookup table does not exist. It is referenced by configuration", but i have the lookup on the search head with Global permissions and also it is replicated to indexers( i can see the file on indexer as well). Why it is giving error ?
... View more
- Tags:
- lookups
02-07-2017
11:44 PM
Actually i tried with | eval Range=split(replace(Range,"(\d{4}\/\d{2}\/\d{2})","#LB#$1"),"#LB#"), later got it. Thanks.
... View more
02-07-2017
01:30 AM
I have a field which have multilines, how to split this field delimited by timestamp into separate lines
2017/02/06 04:11:27|Test1|Test|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User1|c:\users\User1\appdata\roaming\microsoft\Test.exe||0|1|0|0| 2017/02/06 18:00:37|MTest2|VTest|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User2|c:\users\User2\appdata\roaming\microsoft\test2.exe||0|1|0|0| 2017/02/07 05:46:32|VTest3|VHost|Virus on hard disk (web download, copy or install)|RDN/Generic PUP.x|User3|c:\users\User3\appdata\roaming\microsoft\Test4.exe||0|1|0|0|
... View more
02-03-2017
12:15 AM
search head is not loading the search bar in any app and also not showing results in a dashboard, but if i look at the jobs manager, it is running all the scheduled searches. I have checked replication bundles, dispatch folder etc but no issues there.
How to find the root cause?
... View more
07-06-2016
02:18 AM
While trying to setup TA-QualysCloudPlatform, I'm getting the below error. I have the correct proxy and the Qualys server details set up.
Encountered the following error while trying to update: In handler 'localapps': Error while posting to url=/servicesNS/nobody/TA-QualysCloudPlatform/qualys/qualys_configure/setupentity
Why it is giving this error and how to resolve this?
... View more
04-17-2016
05:47 AM
How to extract xml data contained in AUDDET_STR field in the following event using transforms.conf settings?
"2016-04-17 12:04:38:935" REC_TS="2016-04-17 12:04:38:935", USERID="sysadmin", AUDTENTRYSEQNUM="0", AUDTSEQNUM="1", DATASRC="NONE", AUDTENTRYTYP="OBEY", SRVCID="DA", AUDDET_STR="<Audit_loggingRq><Timestamp>2016-04-17T12:23:38.93533Z</Timestamp><ContextDescr>SECURE-DA</ContextDescr><Ticket><UserID>SysAdmin</UserID><SessionNumber>1</SessionNumber><TerminalID>dci.exe#529</TerminalID></Ticket><ErrorData>OK</ErrorData><ActivityGroup><ActivityType>OB</ActivityType><TableGroup><TableName>NONE</TableName></TableGroup><KeyGroup><Key><KeyColumn><ColumnName>RowCount</ColumnName><Value>0</Value></KeyColumn></Key></KeyGroup></ActivityGroup></Audit_loggingRq>"
... View more
04-06-2016
07:41 AM
sending forwarder has the following configuration
inputs.conf file
[default]
host = hostname
index= indexname
[monitor:///data/perfdata/*.nmon]
disabled = false
outputs.conf file
[tcpout:fwdr]
sendCookedData = false
server = lm-fwdr:9817
... View more
04-05-2016
12:15 PM
This is the outputs.conf on receiving forwarder
[tcpout]
defaultGroup = splunkssl
[tcpout-server://idxr-01:9997]
[tcpout:splunkssl]
disabled = false
server = idxr-01:9997
useACK = true
... View more
04-05-2016
11:08 AM
Index is correctly specified. And in the main index sourcetype is coming differently, as splunk is identifying the metadata and assigning it to the events.
... View more
04-05-2016
07:05 AM
Events sent from one Universal Forwarder to another UF are going directly into the main index, even after I have specified index and sourcetype in the inputs.conf file on the receiving forwarder. How to avoid this?
inputs.conf on receiving forwarder
[splunktcp://9817]
index=test_logs
sourcetype=testlogs
... View more
02-22-2016
12:02 PM
No. on Linux machine
... View more
02-22-2016
05:21 AM
Operations tab is not loading while creating a db input in Splunk DB Connect 2. What might be the issue? Other tabs are working fine.
... View more
- Tags:
- Splunk DB Connect
02-22-2016
01:00 AM
I am connecting to DB2 database on Z/OS using Splunk DB Connect 2. However, DB Connect is not fetching timestamp and xml fields properly. It is showing values as "## NOT SUPPORTED TYPE ##". How do I get the timestamp and xml fields properly?
... View more
02-17-2016
06:01 AM
Any answer for this
... View more
02-15-2016
02:31 AM
This needs to be done on Splunk side?
... View more
02-11-2016
12:45 PM
From database i am fetching ipaddress which is in binary format. so i have used HEX(ipaddr,16) to convert binary to HEX in database query. Then In splunk i am trying to convert this ipaddress to decimal.
... View more
02-11-2016
12:44 PM
From database i am fetching ipaddress which is in binary format. so i have used HEX(ipaddr,16) to convert binary to HEX in database query. Then In splunk i am trying to convert this ipaddress to decimal.
... View more
02-10-2016
01:12 AM
How do I convert an IP address in hex format "00000000000000000000FFFF0A15856E" into a normal dotted IP address
I tried like this, but it is not giving correct address:
| eval x="00000000000000000000FFFF0A15856E" | eval IP_ADDR1=tonumber(x,16) | table IP_ADDR1 | eval firstoctet = floor(IP_ADDR1/pow(256,3)) |
eval IP_ADDR1 = IP_ADDR1-(firstoctet*pow(256,3)) |
eval secondoctet = floor(IP_ADDR1/pow(256,2)) |
eval IP_ADDR1 = IP_ADDR1-secondoctet*pow(256,2) |
eval thirdoctet = floor(IP_ADDR1/pow(256,1)) |
eval IP_ADDR1 = IP_ADDR1-thirdoctet*pow(256,1) |
eval SRC_IP = firstoctet+"."+secondoctet+"."+thirdoctet+"."+IP_ADDR1 | table SRC_IP
... View more
02-09-2016
11:36 AM
Make sure that the user that you log into Splunk Enterprise as has the admin_all_objects capability. This capability must be present because the configuration page saves passwords as storage passwords, and only this capability allows users to read storage passwords.
If you cannot grant the admin_all_objects capability, as a workaround, you can use a clear-text password and obfuscate that password with base-64 encoding(password prefixed with {64} will encode). In this case, however, you can not use the configuration page to save the password nor can you test the connection. This is because the configuration page moves any clear-text passwords to storage passwords when you save the configuration.
You must edit ldap.conf with a text editor and save the password(s) that way, and then use the ldaptestconnection command to test the configuration.
... View more
02-05-2016
06:49 AM
Thanks. These settings only work on search head to extract properly? or it will work if i give these settings on heavy forwarder?
... View more
02-02-2016
08:11 AM
I am trying to extract multivalue fields from XML events by using transforms.conf and props.conf.
<Event><System><Provider Name="Netapp-Security-Auditing"/><EventID>4624</EventID><EventName>Logon Attempt</EventName><Version>101.1</Version><Source>CIFS</Source><Level>0</Level><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><Result>Audit Success</Result><TimeCreated SystemTime="2016-02-02T15:47:18.408488000Z"/><Correlation/><Channel>Security</Channel><Computer>CN</Computer><Security/></System><EventData><Data Name="IpAddress" IPVersion="4">xx.xx.xx.xx</Data><Data Name="IpPort">39963</Data><Data Name="TargetUserSid">UID</Data><Data Name="TargetUserName">UN</Data><Data Name="TargetUserIsLocal">false</Data><Data Name="TargetDomainName">US</Data><Data Name="AuthenticationPackageName">NTLM_V1</Data><Data Name="LogonType">3</Data></EventData></Event>
props.conf
[parse_xml]
TIME_PREFIX=SystemTime
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
KV_MODE=XML
TRANSFORMS-null1 = null_queue_nasxml_filter
SEDCMD-fillnull = s/><\/Data>/>NoValue<\/Data>/g
REPORT-xmlext = xml-extr
Transforms.conf
[null_queue_nasxml_filter]
REGEX = ^<(Events\sxmlns|/Events>)
DEST_KEY = queue
FORMAT = nullQueue
#MV_ADD = true
[xml-extr]
#REGEX = <(w+)>([^>]*)<1>
REGEX = <Data Name="([^>]+)">([^<]+)</Data>
FORMAT = $1::$2
MV_ADD = true
#REPEAT_MATCH = true ( tried with and without this option)
I have used above conf settings, but it is not extracting multivalue fields enclosed within tags like TargetDomainName
What I am missing here?
... View more
02-02-2016
02:41 AM
While trying to connect to DB2 on a ZOS database, I'm getting the following error:
Validating connection with URL [jdbc:db2://ServerName:5124/DBName] failed: com.ibm.db2.jcc.am.SqlSyntaxErrorException:com.ibm.db2.jcc.am.SqlSyntaxErrorException: [jcc][t4][10509][13454][4.19.26] Connection to the data server failed. The IBM Data Server for JDBC and SQLJ license was invalid or was not activated for the DB2 for z/OS subsystem. If you are connecting directly to the data server and using DB2 Connect Unlimited Edition for System z, perform the activation step by running the activation program in the license activation kit. If you are using any other edition of DB2 Connect, obtain the license file, db2jcc_license_cisuz.jar, from the license activation kit, and follow the installation directions to include the license file in the class path. ERRORCODE=-4230, SQLSTATE=42968
I have installed db2jcc4.jar file on the Splunk machine to connect to the DB2 database. What steps do I have to follow on the Database machine to allow jdbc connections?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-13-2022
04:00 AM
|
Karma given to
