About Zacknoid

Zacknoid · ‎08-01-2023

I tried changing the timezone of the app from the "preferences" option, its not reflecting, also only this particular dashboard having the different timezone.

Zacknoid · ‎08-01-2023

Hello Splunkers, I am trying to change the last updated time on the IT essential work dashboard, ( attached screenshot ). the following time zone is not coming from the servers and also the timezone in splunk is not this. I am trying to change this to +4 GMT,

Zacknoid · ‎10-03-2022

facing this issue second time, and tried almost every possible way out in last 2 months, so here is the csv file we're which is getting referesh in every 1 hour, ( it may or may not contain new events ) We observed after few hours file stop getting into splunk and after splunk restart again it start ingesting data. In the splunkd logs its says ignoring path, I have tried crcSalt, initCrcLenth but non worked in my case All i want splunk is to read new file always no matter is there is new events or not, just stay updated with file ( i cannot add counter in file )

Zacknoid · ‎07-14-2022

Still looking for resolution, ingestion latency error

Zacknoid · ‎06-28-2022

Upgraded to version 9.0 facing similar issue : Root Cause(s) Indicator 'ingestion_latency_gap_multiplier' exceeded configured value. did you find out any solution for this ?? Thanks

Zacknoid · ‎05-20-2022

We're using intermediate forwarders to send data from one level to another, as in between there are firewall and communication though one HF to another HF on another level. we're collecting all data from UF's and using HF to push it to another level with all firewall rules and policies. I am trying with DEST_KEY is _MetaData:Index . Use upper case on the left side of the = in transforms.conf. Do you have any document link referring to the same ? | THANKS

Zacknoid · ‎05-09-2022

Hello everyone, I am trying to separate data getting into the main index from particular hosts. I am trying Transforms.conf [windows_ot] DEST_KEY = _metadata_index Regex = HOst123 Format = host_wineventlog Source_key = Metadata:Host Props.conf [wineventlog] Transforms-setindex = windows_ot Do we have another way to separate 26 host's data ( without accessing the host machines ) The following data flow level 2 (Heavyforwarder) sending data to ---> level 3 (heavy forwarder) ---> main HF Is it a way to separate data in the main HF ?? also is trans conf correct ??

Posts	7
Solutions	0
Karma Given	7
Karma Received	1
Member Since	‎03-17-2022

Online Status	Offline
Date Last Visited	‎03-01-2024 05:50 AM

How to change the time of ITEW Dashboard?

File Monitroring issue- Why did csv file stop gett...

How to Separate data from main index/HF?

Re: I am trying to change the time of ITEW Dashboa...

How to change the time of ITEW Dashboard?

File Monitroring issue- Why did csv file stop gett...

Re: Why are we receiving this Ingestion Latency er...

Re: Why are we receiving this Ingestion Latency er...

Re: How to Separate data from main index/HF?

How to Separate data from main index/HF?