About svasani_splunk

svasani_splunk · ‎07-08-2022

You can try adding Splunk cloud SH IP to allow list in ServiceNow

svasani_splunk · ‎07-15-2020

Alternative is to use http event collector (HEC) raw endpoint directly along with allowQueryStringAuth setting. This will allow you to specify HEC token directly in the URL. More info here https://www.splunk.com/en_us/blog/tips-and-tricks/splunking-webhooks-with-the-http-event-collector.html Note: On cloud you'll have to open a support ticket to set allowQueryStringAuth to true on your HEC endpoint

svasani_splunk · ‎09-04-2018

You can take a look at new health endpoints available in Splunk v7.1 http://docs.splunk.com/Documentation/Splunk/7.1.2/DMC/Usefeaturemonitoring#Query_the_server.2Fhealth.2Fsplunkd_endpoint

svasani_splunk · ‎12-21-2017

I've updated the add-on to v1.0.3 to add the host.

svasani_splunk · ‎10-31-2017

Did you restart splunk?

svasani_splunk · ‎10-31-2017

change stderr_dest = log from strderr_dest=true in commands.conf and post the error if there are any.

svasani_splunk · ‎05-31-2017

You can format the email result by modifying the _raw field. To number the events use accum command and for new line between fields press shift+enter in empty quotes. Example SPL index=apache uri_path=* | eval event_count = 1 | accum event_count | eval _raw="Event " . event_count . " " . "uri_path:".uri_path." "."Source:".source Make sure to check Inline box and select raw in email alert settings Email Result

svasani_splunk · ‎05-31-2017

How do I format the email result to display the result in following format instead of table format? Event 1 field1: value field2: value Event 2 field1: value field2: value Event 3 field1: value field2: value Event 4 field1: value field2: value . . .

svasani_splunk · ‎04-21-2017

You could do that by setting up the proxy server which listens for application/x-www-form-urlencoded type requests and post's application/json type data. So you direct your request to proxy server which will do post request in application/json type.

svasani_splunk · ‎02-02-2017

Thanks! Fixed it.

svasani_splunk · ‎01-12-2017

For this you will have to override the default datetime.xml with your own datetime.xml file 1) Create a new file called datetime.xml in /etc/apps/search/local/ and add this to your file: <datetime> <define name="_datetimeformat1" extract="month, day, year, hour, minute"> <text>Date Of Incident\:\s(\d{2})\/(\d{2})\/(\d{4})\s\d{1,2}:\d{2}:\d{2}\s[A-Z]{2},\s[^\d]*(\d{2})(\d{2})</text> </define> <timePatterns> <use name="_datetimeformat1"/> </timePatterns> <datePatterns> <use name="_datetimeformat1"/> </datePatterns> </datetime> 2) Add this in your props.conf DATETIME_CONFIG = /etc/apps/search/local/datetime.xml

Posts	11
Solutions	2
Karma Given	2
Karma Received	2
Member Since	‎01-12-2017

Online Status	Offline
Date Last Visited	‎07-08-2022 07:37 PM

How to change the alert email result format?

Re: Splunk Cloud Integration with ServiceNOW

Re: Ingest Zoom logs in Splunk Cloud without a Hea...

Re: What's the best way to monitor Splunk itself?

Re: How to differentiate between different redis h...

Re: Custom Search Command Fails to Return Results

Re: Custom Search Command Fails to Return Results

Re: How to change the alert email result format?

How to change the alert email result format?

Re: How do I Configure a Workflow to POST JSON En...

Re: How to construct a TIME_FORMAT that will extra...

Re: How to construct a TIME_FORMAT that will extra...