Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About nithin204
nithin204
Explorer
Member since:
11-03-2016
02-14-2024
Community Statistics
| Posts | 17 |
| Solutions | 0 |
| Karma Given | 3 |
| Karma Received | 2 |
| Member Since | 11-03-2016 |
Activity Feed
- Karma Re: Trying to pass time range to the splunk search in drilldown table to open in a new window for gcusello. 02-13-2024 07:24 AM
- Posted Re: Trying to pass time range to the splunk search in drilldown table to open in a new window on Dashboards & Visualizations. 02-13-2024 06:42 AM
- Posted Trying to pass time range to the splunk search in drilldown table to open in a new window on Dashboards & Visualizations. 02-12-2024 10:50 PM
- Posted Unable to get the information from the website to Splunk using website input app on Getting Data In. 02-01-2024 01:22 PM
- Tagged Unable to get the information from the website to Splunk using website input app on Getting Data In. 02-01-2024 01:22 PM
- Tagged Unable to get the information from the website to Splunk using website input app on Getting Data In. 02-01-2024 01:22 PM
- Tagged Unable to get the information from the website to Splunk using website input app on Getting Data In. 02-01-2024 01:22 PM
- Tagged Unable to get the information from the website to Splunk using website input app on Getting Data In. 02-01-2024 01:22 PM
- Posted Unable to receive data from Splunk add-on for Microsoft cloud service on Getting Data In. 01-30-2023 09:08 PM
- Got Karma for Website monitoring http vs https. 06-05-2020 12:50 AM
- Got Karma for Website monitoring http vs https. 06-05-2020 12:50 AM
- Karma Re: What is the harm of using auto_high_volume on smaller indexes? for somesoni2. 06-05-2020 12:48 AM
- Posted Splunk DBConnect and retention on Getting Data In. 11-18-2019 09:05 AM
- Tagged Splunk DBConnect and retention on Getting Data In. 11-18-2019 09:05 AM
- Tagged Splunk DBConnect and retention on Getting Data In. 11-18-2019 09:05 AM
- Posted Website monitoring http vs https on All Apps and Add-ons. 11-30-2018 12:13 PM
- Tagged Website monitoring http vs https on All Apps and Add-ons. 11-30-2018 12:13 PM
- Tagged Website monitoring http vs https on All Apps and Add-ons. 11-30-2018 12:13 PM
- Tagged Website monitoring http vs https on All Apps and Add-ons. 11-30-2018 12:13 PM
- Posted Re: Can I use Splunk DB Connect to monitor the Database Connections and can I use the same feature to use in another app? on All Apps and Add-ons. 05-05-2017 12:00 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-13-2024
06:42 AM
Hi @gcusello , I have to use the second $ as well after drilldown_srch as that is token. <link>search?q=$drilldown_srch$?earliest=$field1.earliest$&latest=$field1.latest$|u$</link> If I skip the second "$" after the drillwon_srch, and if I click the value the new search opens as $drilldown_srch in the search bar in new window. If I use the $drilldown_srch$ , the search is working correct but it is not taking the time variables. It always have a default of 15mins. Thanks
... View more
02-12-2024
10:50 PM
Hi All,
I am trying to pass time variables to the search when I click on a value in drilldown dashbaord. Below is the the source of the dashboard
<form version="1.1">
<label>test12</label>
<fieldset submitButton="false">
<input type="time" token="field1">
<label>Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<title>test12</title>
<table>
<search>
<query>index=_internal status=* sourcetype=splunkd
|lookup test12 name AS status OUTPUT value | stats count by value</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">row</option>
<option name="refresh.display">progressbar</option>
<drilldown target="_blank">
<set token="drilldown_srch">index=_internal status=* sourcetype=splunkd |lookup test12.csv name as status output value | where value=$row.value$</set>
<link>search?q=$drilldown_srch|u$</link>
</drilldown>
</table>
</panel>
</row>
</form>
I tried adding the time variables in the link as below but no luck
<link>search?q=$drilldown_srch?earliest=$field1.earliest&latest=$field1.latest$|u$</link>
Thanks
... View more
Labels
- Labels:
-
Classic dashboard
-
drilldown
02-01-2024
01:22 PM
Hi All,
I am trying to get ratings and reviews information of an app in Google play store into splunk using website input app. Unlike in apple playstore, I am unable to identify the CSS selector for the values of reviews and ratings.
Could someone please help. TIA
Nithin
... View more
01-30-2023
09:08 PM
Hi Splunkers, We have a splunk HF on Azure and we have installed the add-on for Microsoft cloud services on the HF. I am able to connect to the storage account on Azure from the connection section with a SAS token. When I have created the inputs to collect the data from the blobs in the storage account, I don't see any data coming into splunk. I have tried leaving the blob filed empty and added wildcard(*) but still I don't see any data. The only error message that I see in the corresponding logs is the "AuthorizationResourceTypeMismatch" error. Not really sure what the error means and what permissions needs to be changed. Has anyone faced this issue? Can someone please help
... View more
Labels
- Labels:
-
heavy forwarder
11-18-2019
09:05 AM
Hi All,
I am wondering how does the retention works when I am ingesting data which is older than the actual retention period.
For example, I have an index with a rention period of 1yr. I now have a requirement to ingest the data from the database which is older than 1.5yr to Splunk. What happens to the data when I onboard? Will it stay for another 1.5yr or will that become unsearchable soon after ingestion to Splunk.
Thanks in Advance.
... View more
11-30-2018
12:13 PM
2 Karma
Hello Team,
I am using the Website monitoring app to monitor a bunch of uRL's. This app is working as expected for all the external URL's ( not within the organization) and also it is working fine for the URL's with http which are internal to organization. But the issue occurs when the URL is connecting on https and which is internal to organization - All I see is a "connection failed" reposne.
In the logs, there is SSL connectivity error and also firewall/block error. I couldn't able to open the troubleshooting doucment link that is there in the error logs.
Appreciate your help on this
Thanks,
... View more
05-05-2017
12:00 PM
Thanks .
I was referring to " our project customized dashboard/app " that am developing .
It was a thought to embedding the similar health check dashboard where the feature of it would help end users to know if the Databases are up and running .
... View more
05-04-2017
01:54 PM
Can the Splunk DB Connect add-on be used to monitor database connections and can i use the same feature/dashboard implemented to our own customized dashboard to monitor the domains associated database server connections?
If yes, please suggest steps? Appreciate your reply and suggestions.
Thanks
NRR
... View more
04-25-2017
10:14 AM
Are there any scenarios's where the license master is on lower end say 6.4.5 and all the splunk instance Search head , indexers , deployment server are on higher end say 6.5.1 and working with out any issues .
As per the document it says that " A license master must always be of equal or later version than its license slaves."
https://docs.splunk.com/Documentation/Splunk/6.5.3/Admin/Configurealicensemaster .
plz suggest , as we are unable to upgrade the license master .
... View more
02-13-2017
01:10 PM
It got this error : Unknown search command 'makeresults'
... View more
02-13-2017
11:55 AM
Thanks for your comment. Yes, This was my approach as well. But I have 4 apps and 4 hosts. So the result will have 16 rows. If I set up a condition if number of events < 16 the alert will trigger but I don't want the users to go and find what server is missing from the lists. I want to send the details of the appId and host in the alert rather than the complete list of results when alert was triggered. Is this possible with lookup's ? Appreciate your help on this.
... View more
02-13-2017
11:42 AM
The count=0 will not be displayed in the stats table(result). I guess it works only when there is atleast one event. If host=123 is down, the result will be app A host 234 count and app B host 234 count. There will not be any records for host=123 I believe.
... View more
02-13-2017
11:42 AM
The count=0 will not be displayed in the stats table(result). I guess it works only when there is atleast one event. If host=123 is down, the result will be app A host 234 count and app B host 234 count. There will not be any records for host=123 I believe.
... View more
02-13-2017
11:07 AM
I'm looking for a query which write count=0 in the stats result when there are no events for that app and host.
My search query:
index=XYZ (appid=A OR appId=B) ( host=123 OR host =234 ) | stats count by appid,host
An alert should be triggered when the count is 0 from the result. I have tried using appendpipe but it didn't work for me.
Example: I have added a new host=000 in the above search
index=XYZ (appid=A OR appId=B) ( host=123 OR host =234 OR host=000) | stats count by appid,host | appendpipe [ stats count by appid,host | count=0 | where count==0]
The result is same as the result from first query. I was expecting two extra rows in the result ,something like appId A host=000 count=0 and appid=B host=000 count=0
Is there any other way I can trigger an alert when count=0 for the above scenario.
Thanks
... View more
11-26-2016
06:58 AM
1) ##SPlunkFileHeader## ************************* LF
2) {"name": *****Json msg***** "} Destination= ' < value of field from header> ' LF
3) CR LF
4) { "client-name":******* ,Json msg>******"} Destination = ' Value' LF
5) CR LF
.....
There is a LF after every line and the next line has CR LF
... View more
11-20-2016
12:57 PM
Yes jsie, I did add the capture group in my regex. It didn't work
... View more
11-20-2016
12:12 PM
Hi,
I have JSON msgs in my log which has Carriage Return Line Feed character at the end of each line and the next line.
It looks as follows..
Line 1: "Message 1......." [CRLF]
Line 2: [CRLF]
Line 3 : " message 2......"[ CRLF]
Line 4: [CRLF]
Line 5: " Message 3 .... " [ CRLF]
I've configured my props.conf as
[sourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = [\r\n]+
KV_MODE= json
N0_BINARY_CHECK=1
If I view my logs from UI, few of my events are single lines and others are combination of two lines, three lines or even more. Can some one help me fix this. What is the regex we must use to match CRLF at the end of line and in the next line ( this line is empty)
Thanks
... View more
- Tags:
- linebreak
