About khreddy

khreddy · ‎08-24-2023

I mean to run the search or script as soon as the data enters into the splunk indexer ... like applying transforms or sed on incoming data .... similarly can we trigger a script and do get additional info and index them into splunk while indexing ........not running on the splunk UI as realtime job.

khreddy · ‎08-24-2023

I have a requirement to process and correlate the data as soon as things come in. The data has some triggering events, which can be identified and used. Is that possible in splunk to run something based on the incoming data.

khreddy · ‎03-02-2021

I have a parameterized query which returns results. I have an alert action to send the results to some location as configurable item Based on the different criterion.....I should call the alert action passing different location values. I am currently creating manually all the different criterion wrappers and attach specific location values. If there is a way either in spl or command line to call the alert action on top of the results returned then instead of creating wrapper savedsearches, I could easily script and pass appropriate values and invoke the splunk command to execute the spl. In nutshell: Calling alert action from spl or using command line on the query results.

khreddy · ‎03-26-2019

You could use "in" function to check the static value list to the above query: index=foo (my_field=1 OR my_field=2 OR my_field=3 OR my_field=4 OR my_field=5 OR my_field=6) | eval status=case(in(my_field,1,2,3),"Start",in(my_field,4,5,6),"End",1==1,NULL) | stats count by status

khreddy · ‎02-22-2019

if we select a time range in splunk then it will bring the results based on the time range applying user's timezone. Displays all the results with dates based on the user's profile. I have a dashboard where user can select list of timezones in the dashboard. Based on his timezone selection, can we change the user profile timezone (without going to the settings and adjusting preferences) In summary....whatever action the settings--> preferences does in the UI......can I do the same through the dashboard? When we apply after changing the preferences, what all actions does splunk perform?

khreddy · ‎03-15-2018

I have a delimited header file of the below format: A ~~ B ~~ C ~~ D ~~ E 1 ~~ 2 ~~ 3 ~~ 4 ~~ 5 2 ~~ 3 ~~ 4 ~~ 5 ~~ 6 1 ~~ 3 ~~ 2 ~~ 3 ~~ 4 The above has 3 events and five fields A,B,C,D,E I tried HEADER_FIELD_LINE_NUMBER = 1 in props.conf DELIMS = "~~" in transforms.conf This did not do the trick. what am I missing here?

khreddy · ‎06-22-2016

Is there any documentation on how to generate PDFs by passing search query/chart/dashboard/form details. When I log into Splunk Web, I get the option to schedule a PDF report to be sent via email. I am looking for similar PDF generation functionality via command line storing as a file (not via email) in some directory. What command to execute? What are the parameters used and how to pass them?

khreddy · ‎05-09-2016

instead of searchA | join user [searchB] use searchA | join type=left user [searchB] By default join means inner join. It will display only the matching records in searchA and searchB

khreddy · ‎05-29-2015

We are planning to use Splunk DB Connect2 to talk to different databases like oracle, timesten, mysql and postgresql etc from splunk for lookups. We tested for the databases which are available in the Database Types already provided. We have a requirement to connect to timesten database.....which is not part of the list. What is the process to connect to the database, like timesten, which is not in the list? if someone can provide the required jars/drivers for timesten then that would be really appreciated.

Posts	9
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎10-16-2012

Online Status	Offline
Date Last Visited	‎08-24-2023 08:08 PM

can we execute a script or savedsearch as soon as ...

invoking alert action from spl query or command li...

How to change the timezone of user profile using D...

How do I load the custom delimited file with heade...

Is it possible to generate a PDF file using Splunk...

Can Splunk DB Connect talk to TimesTen database?

Re: can we execute a script or savedsearch as soon...