Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About krishnab
krishnab
Path Finder
Member since:
02-28-2017
05-03-2021
Community Statistics
| Posts | 15 |
| Solutions | 1 |
| Karma Given | 7 |
| Karma Received | 0 |
| Member Since | 02-28-2017 |
Activity Feed
- Karma Example for Splunk HEC using GCP Cloudfunctions and Pub/subs for lovedjohnysmith. 06-05-2020 12:50 AM
- Karma Data not showing up on Search Head - Distributed environment for shubham87. 06-05-2020 12:49 AM
- Karma Re: How to calculate time difference in statistics using another field for woodcock. 06-05-2020 12:49 AM
- Karma Re: How to calculate time difference in statistics using another field for aholzer. 06-05-2020 12:49 AM
- Karma Re: adding a dynamic time to a panel title for jtrujillo. 06-05-2020 12:46 AM
- Karma Re: How to match and filter by substr? for lukejadamec. 06-05-2020 12:46 AM
- Karma Re: How split up a string into multiple fields for somesoni2. 06-05-2020 12:46 AM
- Posted Re: Why can't we login in to index search peer? on All Apps and Add-ons. 04-18-2019 06:07 AM
- Posted Re: Why can't we login in to index search peer? on All Apps and Add-ons. 04-18-2019 06:06 AM
- Posted Why can't we login in to index search peer? on All Apps and Add-ons. 04-13-2019 02:57 AM
- Tagged Why can't we login in to index search peer? on All Apps and Add-ons. 04-13-2019 02:57 AM
- Tagged Why can't we login in to index search peer? on All Apps and Add-ons. 04-13-2019 02:57 AM
- Tagged Why can't we login in to index search peer? on All Apps and Add-ons. 04-13-2019 02:57 AM
- Posted Re: How to calculate time difference in statistics using another field on Splunk Dev. 05-11-2018 12:18 AM
- Posted How to calculate time difference in statistics using another field on Splunk Dev. 05-10-2018 06:38 AM
- Tagged How to calculate time difference in statistics using another field on Splunk Dev. 05-10-2018 06:38 AM
- Tagged How to calculate time difference in statistics using another field on Splunk Dev. 05-10-2018 06:38 AM
- Posted Monitoring deploymentclient.conf in etc\system on Getting Data In. 04-27-2018 12:12 AM
- Tagged Monitoring deploymentclient.conf in etc\system on Getting Data In. 04-27-2018 12:12 AM
- Tagged Monitoring deploymentclient.conf in etc\system on Getting Data In. 04-27-2018 12:12 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-18-2019
06:07 AM
Also if that is the case,i shouldnt be able to login to search heads and my master node GUI ryt?
... View more
04-18-2019
06:06 AM
Ok..so how do i correct it so that in future it does not happen again
... View more
04-13-2019
02:57 AM
Hi,
I created 2 indexers connected to masternode on a AWS ec2 instance.
Initially when setting up the configuration i was able to login to my peers GUI,but once i stop and start my instance on which peers are running.Im no longer able to access the peers GUI via 8000(which is open to all).
I checked my web.conf it is set to 1.
Splunk service is running.
Splunk Web is also running.
Im able to login to my master node but not my peers..
I dont know what to do now,kindly help me in logging to the GUI.
The OS of instance(Peer) is RH Linux 7
... View more
05-11-2018
12:18 AM
Never knew there was range(_time) option..Thanks..
... View more
05-10-2018
06:38 AM
Hi,this is the statistics i have
dv_cmdb_ci number _time state
1 A B 2018-04-03 15:00:51 Assigned
2 A B 2018-04-03 15:03:28 Work in Progress
3 A B 2018-04-03 18:09:46 Work in Progress
4 A B 2018-04-03 18:11:36 Assigned
5 A B 2018-04-03 18:14:53 Assigned
6 A B 2018-04-03 18:22:14 Work in Progress
7 A B 2018-04-03 18:51:07 Work in Progress
8 A B 2018-04-03 18:57:26 Work in Progress
9 A B 2018-04-03 19:18:41 Work in Progress
10 A B 2018-04-04 17:25:59 Work in Progress
11 A B 2018-04-04 17:26:25 Pending
12 A B 2018-04-19 16:18:43 Resolved
13 A B 2018-04-22 17:00:07 Closed
This is for single host and single ticket data.
How can i get the time difference when ticket was in pending to Resolve.
From above based on state my time difference should be (2018-04-19 16:18:43)-(2018-04-04 17:26:25)=difference in second.
So how to calculate it????
... View more
04-27-2018
12:12 AM
Is it possible to monitor the folder in etc/system which consists the deployment client ip thru windows app/add-on.
I tried this but not working.
[monitor://C:\Program Files\SplunkUniversalForwarder\etc\system\local\deploymentclient.conf]
disabled = 0
interval = 60
sourcetype = DSIP
index = perfmon
... View more
04-10-2018
12:15 AM
One question,
How are you segregating the high cpu usage??
is it by warning(80&-90%) and critical(>90%).
For creating a new ticket in SNOW,a parameter called sys_id is very important,If correlationid is unique,then sys_id will be unique,then it will create new ticket,else it should just update the existing one,without any notification.
Now assume you have an instance,for warning,when alert is raised and ticket is created in SNOW with sys_id.
Assume sys_id is "A" .
Once you resolve the ticket,then again an alert should be raised with warning state,but it will not raise a new ticket,it just updates the short_description.
So ideally for an instance only 2 ticket will logged for warning and critical state.
Aren't you facing this problem??this is what i'm facing...
... View more
04-07-2018
04:42 AM
Hi Kiran,
Not Possible.
The reason is: Your Uf will collect data in the Server timezone(windows),but when the data is forwarded to indexers,the timestamp of the data will be changed to that of indexers time.Later when you search that event from SH,it will change to your profile's Timezone.
so there is lot of changes to your event time,Now if you have the one instance,then you can convert the time to epoch and add/substract from the epoch time to get the instance time.But what if you have instances in multiple timeZone??
So it is better to have a common timezone(GMT) rather than the instance time.
... View more
04-07-2018
03:44 AM
Hi,I assume you want to send an event to SNOW to create an incident.
The best thing is to save your query as an alert.
Once done that in the trigger action column in alerts,you'll find an action as "SNOW incident managment".
through this you can send your events from an alert to SNOW.
Assume,you have many rows of data like hostname,usage,which can be sent by mentioning it as $result.ur fieldname$
... View more
04-07-2018
03:36 AM
Also you can get by segregating the data only from those two sources
index=* source=a OR source=b
|stats count by source
... View more
04-07-2018
03:24 AM
try this
|table sourcename|eval sourcename=replace(sourcename,":","")
... View more
04-07-2018
03:09 AM
Hi it is simple try this,
your search
| eval count=if(isnull(count),"0",count)
| table count
... View more
04-05-2018
11:39 PM
Hi,
Thank you for your answer.
But my requirement is i should join based on some other value,but in the subsearch it should take host values from previous search(main search)
... View more
04-05-2018
04:14 AM
Hi ,
I have a macro which gets values including host,now i do a left join .Once i do a left join in the subsearch only those host which was in previous search result should be searched.
Ex:
my search which results host
| join type=left xxx
[search index=a source=b host="host from previous search"]
Assume my first search returned many host,so in my second search after join,it should take individual host and check for any data in index=a
... View more
- Tags:
- splunk-cloud
