About Nagalakshmi

Nagalakshmi · ‎03-25-2024

Hi, Currently working in Splunk ITSI, Can I do the Splunk IT Service Intelligence Certified Admin certification without completing the previous certifications like Splunk Core Certified Power User , Splunk Enterprise Certified Admin etc. Regards, Nagalakshmi A

Nagalakshmi · ‎03-05-2024

Hi @bowesmana , It is a classic dashboard, and time range is one of panel in the dashboard. I just used the below query for panel. Customer has access to the dashboard but only timerange panel is showing error. <panel ref="TimeRangePanel"></panel> Below is the error

Nagalakshmi · ‎03-04-2024

Hi, I have created the dashboard with multiple panels. I have created the time range panel to be reflected as last 4 hours from my end . it is perfectly working. When customer is trying to use the dashboard it is showing as TimeRangepanel not found. Please assist me

Nagalakshmi · ‎02-29-2024

Hi @richgalloway , I used the above query, it is showing 0 events

Nagalakshmi · ‎02-29-2024

Hi, Need your assistance below We have created new csv lookup and we are using the below query but we are getting all the data from the index & sourcetype . we need to get the events only for the hosts which mentioned on the lookup is the requirement Lookup name : Win_inventory.CSV used only one column called Server_name index=Nagio sourcetype=nagios:core:hard |lookup Win_inventory.CSV Server_name as host_name OUTPUTNEW Server_name. Server_name is not an existing interesting field

Nagalakshmi · ‎12-27-2023

Hi @gcusello , Yes, Hostname field is already exists in the event. Thank you for quick response! Mentioned query is a perfect solution for this issue. Regards, Nagalakshmi A

Nagalakshmi · ‎12-27-2023

Hi Team, Need your assistant for below We have created new csv lookup and we are using the below query but we are getting all the data from the index & sourcetype . we need to get the events only for the hosts which mentioned on the lookup is the requirement Lookup name : Palo_devices.csv, used only one column called Hostname index=security host=abc sourcetype = Palo |lookup Palo_devices.CSV Hostname OUTPUT Hostname Regards, Nagalakshmi

Nagalakshmi · ‎08-28-2023

Thanks for your suggestions!!

Nagalakshmi · ‎08-24-2023

Hi @bowesmana for example index=M365 type=logged in | stats count(username) as usernamecount by username,hostname. by this query we are getting expected results such as username,hostname. however we need a field where system count can be shown for the userloggedIn. By trying below command, we are getting the number of times users logged in to the systems, but we require system count a user logged in index=M365 type=logged in | stats count(username) as usernamecount by username,hostname | where usernamecount>1

Nagalakshmi · ‎08-24-2023

Hi, for example index=M365 type=logged in | stats count(username) as usernamecount by username,hostname. by this query we are getting expected results such as username,hostname. however we need a field where system count can be shown for the userloggedIn. By trying below command, we are getting the number of times users logged in to the systems, but we require system count a user logged in index=M365 type=logged in | stats count(username) as usernamecount by username,hostname | where usernamecount>1

Nagalakshmi · ‎08-23-2023

Hi Team, We have users logging in multiple devices. So, we need to showcase the count of devices and user logged in. Can you please advise the query for same. Regards, Nagalakshmi A

Nagalakshmi · ‎08-23-2023

Hi @isoutamo , Thank you for your help! We got the expected output by using the below mentioned command.

Nagalakshmi · ‎08-22-2023

Hi Team, We are trying to extract the hostname from the logs . but unable to get the exact output ( we need hostname as sample-987) . Please find the logs and tried command. Please assist us on high priority. Thanks logs:- Symptom: type DD Alert Sample-987: CRITICAL: DiskFailure: HardwareFailure Our Command:- | rex field=_raw "DD\s\Alert\s(?<HostName>\w+-\d+)" Regards, Lakshmi

Nagalakshmi · ‎07-20-2023

Hi @gcusello , Thanks for the quick response! The above query is perfectly working

Nagalakshmi · ‎07-20-2023

Hi Team, we are trying to add new field as a display name into interesting field from below raw event DisplayName: sample-Hostname We tried the below query but it is not working | rex field=_raw \"DisplayName", "Value":\s(?<DisplayName>\w+). And also please suggest us how to create a query if the user logged in one or more devices. Thanks in advance!

Posts	15
Solutions	1
Karma Given	7
Karma Received	0
Member Since	‎07-20-2023

Online Status	Offline
Date Last Visited	‎03-26-2024 07:25 AM

Splunk ITSI certification

Time range panel issue

Not getting results to lookup command

Unable to get the lookup values on the search quer...

How to showcase the count of devices and userlogge...

Why am I unable to get the exact rex output?

How to extract the new field into interesting fiel...

Splunk ITSI certification

Re: Time range panel issue

Time range panel issue

Re: Not getting results to lookup command

Not getting results to lookup command

Re: Unable to get the lookup values on the search ...

Unable to get the lookup values on the search quer...

Re: How to showcase the count of devices and userl...

Re: How to showcase the count of devices and userl...

Re: How to showcase the count of devices and userl...

How to showcase the count of devices and userlogge...

Re: Why am I unable to get the exact rex output?

Why am I unable to get the exact rex output?

Re: How to extract the new field into interesting ...

How to extract the new field into interesting fiel...