Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About vaibhavagg2006
vaibhavagg2006
Communicator
Member since:
09-30-2012
02-08-2021
Community Statistics
| Posts | 79 |
| Solutions | 1 |
| Karma Given | 8 |
| Karma Received | 22 |
| Member Since | 09-30-2012 |
Activity Feed
- Got Karma for Re: Trigger SendAlert Command for multiple results. 12-01-2021 03:54 PM
- Posted Re: Trigger SendAlert Command for multiple results on Alerting. 02-08-2021 03:16 AM
- Posted Trigger SendAlert Command for multiple results on Alerting. 02-04-2021 10:50 PM
- Posted Re: Reset Textbox input on changing selection of a radio button on Dashboards & Visualizations. 01-31-2021 11:57 PM
- Karma Re: Reset Textbox input on changing selection of a radio button for scelikok. 01-31-2021 11:57 PM
- Posted Reset Textbox input on changing selection of a radio button on Dashboards & Visualizations. 01-31-2021 10:03 PM
- Tagged Reset Textbox input on changing selection of a radio button on Dashboards & Visualizations. 01-31-2021 10:03 PM
- Karma Re: How to enable and disable Rest End Point? for inventsekar. 06-05-2020 12:49 AM
- Karma Re: How to enable and disable Rest End Point? for inventsekar. 06-05-2020 12:49 AM
- Got Karma for Re: How to embed a Splunk dashboard in an iframe?. 06-05-2020 12:48 AM
- Got Karma for How to embed a Splunk dashboard in an iframe?. 06-05-2020 12:48 AM
- Got Karma for How to embed a Splunk dashboard in an iframe?. 06-05-2020 12:48 AM
- Got Karma for How to embed a Splunk dashboard in an iframe?. 06-05-2020 12:48 AM
- Got Karma for How to embed a Splunk dashboard in an iframe?. 06-05-2020 12:48 AM
- Karma Re: How can I pass a default value to the map command? for woodcock. 06-05-2020 12:47 AM
- Karma Re: This report cannot be accelerated. for masonmorales. 06-05-2020 12:47 AM
- Got Karma for Re: Simple xml charting-Does it support flashchart configurations????. 06-05-2020 12:47 AM
- Got Karma for How to print a PDF of a dashboard with dynamic chart titles that are generated by tokens from JavaScript?. 06-05-2020 12:47 AM
- Got Karma for How to print a PDF of a dashboard with dynamic chart titles that are generated by tokens from JavaScript?. 06-05-2020 12:47 AM
- Got Karma for How to print a PDF of a dashboard with dynamic chart titles that are generated by tokens from JavaScript?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-08-2021
03:16 AM
1 Karma
Thanks for your response. I want to use sendalert command inside the query. I believe trigger for each result is available when we select alert action from the UI.
... View more
02-04-2021
10:50 PM
Dear Experts I am using sendalert command to invoke a custom alert action. It currently only triggers once irrespective of no of results. Is it possible to trigger it for each result.
... View more
- Tags:
- sendalert
Labels
- Labels:
-
alert action
01-31-2021
11:57 PM
It worked, Thanks!
... View more
01-31-2021
10:03 PM
Hi Experts I have a textbox and 2 radio buttons in a dashboard. I want to reset the textbox to empty on click of the radio button. I am able to unset the token by using the set/unset token but the text in the textbox does not go away. Is it possible to change/remove the text of the textbox on click of the radio button. Thanks in Advance!
... View more
Labels
- Labels:
-
simple XML
11-11-2019
09:32 AM
HI Experts
I am having an issue in indexing the log file which gets rotated ever hour. The log file error.log gets rotated every hour at top of the hour and a new file is created with the same name(error.log). The old file gets renamed and zipped to error.log._timestamp.gz.
Sometimes splunk does not index the file for an hour and resumes the indexing once the file is again rotated so the complete 1 hour logs gets skipped. Before splunk resumes the indexing following error message is logged.
WatchedFile - Checksum for seekptr didn't match, will re-read entire file
Every file has a different content because each event has a timestamp so first 256 characters should not much the fishbucket.
[monitor:///data/logs/]
_TCP_ROUTING = indexers123
index = indexname
sourcetype = sourcetypename
initCrcLength = 1024
whitelist=\.log$
disabled = 0
Splunk version is 7.0.3
... View more
08-23-2018
12:15 AM
Update- It works on the private alert but not on the shared alert.
... View more
08-22-2018
03:22 AM
Thanks for reminding about the up vote.
I will try to reach out to splunk and raise this as a bug.
... View more
08-21-2018
10:02 PM
yes thats right.. This is what I see in the Splunk UI.
... View more
08-21-2018
06:38 AM
Found an interesting thing.. When we hit the disable endpoint, Splunk creates another alert with same name and same search,with private permission and disables it..
... View more
08-21-2018
06:28 AM
I am using my management port which is 9099
... View more
08-21-2018
05:50 AM
Yes, I got the following xml back.
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
<title>savedsearch</title>
<id>https://localhost:9099/servicesNS/admin/search/saved/searches</id>
<updated>2018-08-21T18:14:10+05:30</updated>
<generator build="b119a2a8b0ad" version="6.6.5"/>
<author>
<name>Splunk</name>
</author>
<link href="/servicesNS/admin/search/saved/searches/_new" rel="create"/>
<link href="/servicesNS/admin/search/saved/searches/_reload" rel="_reload"/>
<link href="/servicesNS/admin/search/saved/searches/_acl" rel="_acl"/>
<opensearch:totalResults>1</opensearch:totalResults>
<opensearch:itemsPerPage>30</opensearch:itemsPerPage>
<opensearch:startIndex>0</opensearch:startIndex>
<s:messages/>
<entry>
<title>test1234</title>
<id>https://localhost:9099/servicesNS/admin/search/saved/searches/test1234</id>
<updated>2018-08-21T13:54:46+05:30</updated>
<link href="/servicesNS/admin/search/saved/searches/test1234" rel="alternate"/>
<author>
<name>admin</name>
</author>
<link href="/servicesNS/admin/search/saved/searches/test1234" rel="list"/>
<link href="/servicesNS/admin/search/saved/searches/test1234/_reload" rel="_reload"/>
<link href="/servicesNS/admin/search/saved/searches/test1234" rel="edit"/>
<link href="/servicesNS/admin/search/saved/searches/test1234" rel="remove"/>
<link href="/servicesNS/admin/search/saved/searches/test1234/move" rel="move"/>
<link href="/servicesNS/admin/search/saved/searches/test1234/embed" rel="embed"/>
<link href="/servicesNS/admin/search/saved/searches/test1234/enable" rel="enable"/>
<link href="/servicesNS/admin/search/saved/searches/test1234/history" rel="history"/>
<content type="text/xml">
<s:dict>
<s:key name="eai:acl">
<s:dict>
<s:key name="app">search</s:key>
<s:key name="can_change_perms">1</s:key>
<s:key name="can_list">1</s:key>
<s:key name="can_share_app">1</s:key>
<s:key name="can_share_global">1</s:key>
<s:key name="can_share_user">1</s:key>
<s:key name="can_write">1</s:key>
<s:key name="modifiable">1</s:key>
<s:key name="owner">admin</s:key>
<s:key name="perms"/>
<s:key name="removable">1</s:key>
<s:key name="sharing">user</s:key>
</s:dict>
</s:key>
</s:dict>
</content>
</entry>
</feed>
... View more
08-21-2018
04:24 AM
No luck..The status of alert remains unchanged... Is this working in your environment. I am using Splunk 6.6.5
... View more
08-21-2018
01:19 AM
I guess the issue is not with the server name. The following Curl returns back the XML output but the alert is not disabling.
curl -X POST -k -u admin:xxx https://server:9099/servicesNS/admin/search/saved/searches/test1234/disable
... View more
08-21-2018
12:16 AM
Thanks for your input but unfortunately This throws curl: (6) Could not resolve host: disable; Unknown error
... View more
08-20-2018
04:41 AM
Hi Experts
I am trying to disable an alert using below rest API example provided in the documentation. It returns back a XML response with all the attributes of the alert but do not disable the alert.
Example:-
curl -k -u admin:pass https://localhost:8089/servicesNS/admin/search/saved/searches/TestSearch/ \
disable -X POST
My curl command
curl -X POST -k -u admin:xxx https://server:9099/servicesNS/admin/search/saved/searches/test1234/disable
Reference :- http://docs.splunk.com/Documentation/Splunk/6.6.5/RESTUM/RESTusing
Any inputs, what is wrong here?
... View more
06-22-2018
03:09 AM
I have an alert which performs 2 actions-Calls a Slack webhook and sends an email. But sometimes when it triggers it skips the slack webhook action and only triggers an email. There are no error in the logs. The alert_action field in the log only shows email. PFB the log for both scenarios. Any Pointers?
When it triggers both the action:-
06-19-2018 00:15:03.360 -0700 INFO SavedSplunker - savedsearch_id="nobody;app;Error Alert", search_type="", user="svc", app="app", savedsearch_name="Error Alert", priority=default, status=success, digest_mode=0, scheduled_time=1529392500, window_time=0, dispatch_time=1529392501, run_time=0.752, result_count=1, alert_actions="email,slack", sid="scheduler_c3ZjLmEuc3Bsay1jc3Rv__csrt__RMD54b798c035b9e1f03_at_1529392500_73133_C96C1272-59A3-4440-81F8-D95FEB00CFBB", suppressed=0, fired=1, skipped=0, action_time_ms=1138, thread_id="AlertNotifierWorker-0", message=""
When it triggers only email
06-22-2018 02:10:22.434 -0700 INFO SavedSplunker - savedsearch_id="nobody;app;Error Alert", search_type="", user="svc", app="app", savedsearch_name="Error Alert", priority=default, status=success, digest_mode=0, scheduled_time=1529658600, window_time=0, dispatch_time=1529658601, run_time=20.338, result_count=1, alert_actions="email", sid="scheduler_c3ZjLmEuc3Bsay1jc3Rv__csrt__RMD54b798c035b9e1f03_at_1529658600_10207_F9E9498D-8C03-4954-B482-65C8838AC967", suppressed=0, fired=1, skipped=0, action_time_ms=546, thread_id="AlertNotifierWorker-0", message=""
... View more
04-07-2018
07:40 AM
Rolling restart of My search head cluster resovled the issue for now.. though couldnt find the root cause of the issue.. trying looking for errors in any of the config file..
... View more
03-28-2018
10:40 PM
I want to call the storage endpoint to get the clear password for a service now user and use that password. The script is being called by an alert. Which section from the blog can be used?
... View more
03-28-2018
12:00 AM
Hi Experts
I am trying to retrieve the password which is stored in passwords.conf but it is returning blank. Below is the code which is being triggered by an alert. The alert is setup using the admin account. I have not set any realm while taking input from users in the setup page.
# Modify to fit your environment
CREDENTIAL_USER="user123"
# Set realm if entered with password
CREDENTIAL_REALM=""
# Update App Name
APP="app123"
# Search needs to be owned by someone with admin rights to access passwords
ALERT_OWNER="admin"
# Splunk Host
SPLUNK_HOST="localhost"
# Splunk Python
SPLUNK_PYTHON="$SPLUNK_HOME/bin/splunk cmd python"
# Read sessionKey from STDIN
read sessionKey
key=`echo $sessionKey | sed s/sessionKey=//g`
decoded_key=`$SPLUNK_PYTHON -c "import sys, urllib as ul; print ul.unquote_plus('$key')"`
clear_password=`curl -s -k -H "Authorization: Splunk $decoded_key" https://$SPLUNK_HOST:8089/servicesNS/$ALERT_OWNER/$APP/storage/passwords/$CREDENTIAL_REALM:$CREDENTIAL_USER: | grep clear_password | sed -re 's/^\s+<s:.*?>(.*?)<.*?>$/\1/g'`
The passwords.conf is below
[credential::user123:]
password = $1$7EScd0o=
Any inputs on this are appreciated.
... View more
03-18-2018
10:47 PM
Hi
I have 4 data models which have been working since months. 3 of them suddenly stopped updating couple of days back. I am seeing below warning for the data models in the internal logs. What can be the issue? Each of them has around 75 buckets and are accelerated for last 7 days.
WARN SummaryInProgressHelper - Internal - No running slot registered for summaryId
... View more
02-06-2018
11:23 PM
Yes the streaming command is equally spread. All the indexers and almost taking equal time.
My base search looks like something below ::
"index=idx1 (sourcetype=abc transactionID=) OR (sourcetype=xyz ("some search string") ) OR (sourcetype=blah (*search string))"
Also i tried to run normal index search vs tstats against accelerated data model for same set of data.
The response time is 168 seconds vs 138 seconds.
Event count:-19,821,855
Not able to run tstats against the index as I dont have indexed fields on which I am trying to group by
... View more
01-29-2018
03:48 AM
Yes, I checked the acceleration is fine.
It is taking maximum time in "command.tstats" and then "dispatch.stream.remote". Under "command.tstats" most of the time is taken by "command.tstats.query_tsidx"
Just curious what is invocations in the job inspector. It says 623 for "Command.tstats" and around 25 for each indexer.
... View more
01-29-2018
12:54 AM
Yes, the data model is accelerated for last 30 days.
Indexers are ok in terms of resources, this slowness is consistent and query takes same time to run across the day.
I am searching for "Yesterday". The event count I mentioned(12 M) is for 1 day. The logs are in key value formatl
... View more
01-28-2018
09:58 PM
I have an accelerated data model which is performing very slow. It takes more than 2 minutes to return just count of events and more than 4 minutes to do any statistical functions. For example below query takes 121 seconds to run:-
|tstats count from datamodel=mydatamodel where (nodename=mydatamodel.logs) (mydatamodel.tag=prod) groupby "mydatamodel.transactionID"
This returned around 4 Million rows after scanning 12 M events. Is there anything I can do to improve the performance. We have a search head cluster with good configuration and around 13 indexers.
... View more
09-28-2017
12:51 AM
Thanks for your inputs
I do not want to blacklist /logs/abc/abc-router.jar.log
Only want to blacklist /logs/router.jar.log
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-08-2021
07:52 AM
|
Karma from
Karma given to
