About abhi04

abhi04

Hi All, We have widnows event and other application logs ngested into splunk. There is no problem with windows event logs but for our application related logs, the logs stop suddenly and starts reporting again but the log file in windows is being continuously updated with recent logs though the modified time does not get updated because of the windows feature. The modified time for the log file is not an issue because the logs starts rolling in even when the modified time is same but the log file had latest logs. we are using splunk forwarder 9.0.4 version currently. Can someone please help in triaging this issue? It is a problem with only one specific source with this windows host and other sources (windows event logs) are flowing in properly.

abhi04

@marnall Is this something that I can reach to Splunk support? Do they provide support on these type of queries?

abhi04

Hi All, I have setup the Object and event input configuration in the salesforce TA, I am able to see the object logs but unable to see the event logs in splunk cloud. Any directions of triaging the issue? Appropriate permissions are provided for the salesforce user.

abhi04

Hi team, I am following the below instructions to bring Genesys cloud logs in to splunk https://splunkbase.splunk.com/app/6552 Under the details and intsallation instruction of the app, I cant find the configuration and it also did not prompted me for the input configuration

abhi04

@kiran_panchavat Hi, so, which TA should I use for Genesys cloud because the pulse which is the TA asks for pulse info whereas the genesys cloud uses crenedtials which I dont see as an option in configuration

abhi04

Hi, I have setup the Object and event input configuration in the salesforce TA, I am able to see the object logs but unable to see the event logs in splunk cloud. Any directions of triaging the issue? Appropriate permissions are provided for the salesforce user.

abhi04

Hi Team, how can I ingest Genesys cloud logs into splunk? I see two apps 1. Genesys Pulse Add-on for Splunk https://splunkbase.splunk.com/app/5255 2. Genesys Cloud Operational Analytics App https://splunkbase.splunk.com/app/6552 For the Genesys Pulse Add-on for Splunk, I was able to see here we need to setup the configuration but for Genesys Cloud Operational Analytics App i dont follow the setup configuration. Which app should be used for Genesys Cloud log ingestion into splunk Cloud?

abhi04 · ‎03-13-2024

This is awesome, thanks @bowesmana . And, yes, it was a type for the "count" 🙂

abhi04 · ‎03-13-2024

Hi All, How can I optimize the below query? Can we convert it to tstats? index=abc host=def* stalled | rex field=_raw "symbol (?<symbol>.*) /" | eval hourofday = strftime(_time, "%H") | where NOT (hourofday>2 AND hourofday <= 4) | timechart dc(symbol) span=15m | eventstats avg("count") as avg stdev("count") as stdev | eval lowerBound=-1, upperBound=(avg+stdev*exact(4)) | eval isOutlier=if('count' < lowerBound OR 'count' > upperBound, 1, 0) | fields _time, "count", lowerBound, upperBound, isOutlier, * | sort -_time | head 1 | where isOutlier=1

abhi04 · ‎03-04-2024

Hi All, I have an alert that shows results for 7:00 Am to 7:01 AM with more than 20 results. the cron for the alert is: * 6-15 * * 1-5 condition: more than 4 results I checked and found there were more than 4 results in the timefram 7:00 AM to 7:01 AM but the alert did not trigger an email alert. Though the same alert did trigger at 8 AM. On checking the internal logs I can see that at 7 AM the alert_actions="", but at 8 AM I can see alert_actions="email" which confirms that there was no email action. What all things can I check further to check and confirm?

abhi04 · ‎02-11-2024

Hi All, I am using a mstats for a mteric and I am evaluating my hour and minute field something like below: | mstats rate_avg(abc*) prestats=false WHERE "index"="def" span=3m | rename rate_avg(* as *, *) as * | eval Date=strftime(_time,"%m/%d/%Y") | eval hour=strftime(_time,"%H") | eval minute=strftime(_time,"%M") | transpose column_name=instance | rename "row 1" as MessagesRead | eval MessagesRead=ROUND(MessagesRead,0) | where MessagesRead < 1 Now I am unable to to use the below filter condition | search NOT (instance="*xyz*" AND hour=09 AND (minute>=00 AND minute<=15)) as I dont want to alert for a particular instance only from 9 to 9:15, but it should alert for other instance for this time period. Now before the transpose the instance does not exist and I cant use the filter and after transpose I am unable to filter on hour and minute. Can u please help in filtering after transpose?

abhi04 · ‎02-06-2024

Hi @scelikok I missed mentioning that Private key can be one of the below format: format 1: PrivateKey : abc.def.ghi.jkl format 2: PrivateKey : Meaning it can be empty as well as in format 1

abhi04 · ‎02-05-2024

These logs are collected using scripted input using .bat file it has several lines in one events , I only showed 6 lines per event but the repetion is same with more lines in between privatekey and issuer

abhi04 · ‎02-05-2024

Hi I am trying to divide the the logs into different evwnt based on below scenario: I have one single event currently: Issuer : hjlhjk a: xyz PrivateKey : abc Issuer : dfjh a: fhfh PrivateKey : dsgd Now I want it as two events: event1: Issuer : hjlhjk a: xyz PrivateKey : abc event2: Issuer : dfjh a: fhfh PrivateKey : dsgd how can i get this? I tried below line breaking which is not working [sourcetype] LINE_BREAKER = ([\r\n]+)(PrivateKey) [sourcetype] BREAK_ONLY_BEFORE = Issuer SHOULD_LINEMERGE = false

abhi04 · ‎12-12-2023

Thanks @richgalloway

abhi04 · ‎12-12-2023

Sample example logs: {"timestamp":"2023-12-12T15:27:22.890Z","shortmessage":"(abc): def ghi","level":"info","source":"xyz,"file":"/home/abc/def.txt","line":144}

abhi04 · ‎12-12-2023

Hi, I am trying to ignore the logs that have level info and want to send them to null queue: example logs (not including the befor eand after pattern of the logs but its a json format and this is one of the fields): "level":"info", I have tried below and it does not work, can someone help if this is correct or is there another way, the below is in heavy forwarder props: [abc] TRANSFORMS-null = infonull transforms [infonull] SOURCE_KEY = level REGEX = info DEST_KEY = queue FORMAT = nullQueue

abhi04 · ‎12-12-2023

Thanks @richgalloway and @gcusello

abhi04 · ‎12-11-2023

How can I mask the verfiication code using props/transforms? {"body": " Verification Code: 123456", I want to mask the code using props and transforms using below format, not sure how the search spl regex is different than regex in transforms props.conf [source::abc] TRANSFORMS-anonymize = abc-anonymizer transforms.conf [abc-anonymizer] DEST_KEY = _raw REGEX = FORMAT = $1######$2

abhi04 · ‎11-27-2023

So, top does not take NULL into account for total and percentage? IS there a way top can take NULL into consideration? @ITWhisperer

abhi04 · ‎11-26-2023

Hi, Why the below two queries giving me different percentage values? I checked the total count and count for Action=Sell is same. Am I missing something here? index=abc source=def | top Action This gives me 49.7 % for Action=Buy ================================================ index=abc source=def | stats count as Total | appendcols [ search index=abc source=def | search Action=Buy | stats count as Buy] | eval Percent_Buy=round((Buy/Total)*100,2) This gives me 27.7 % for Action=Buy

abhi04 · ‎10-17-2023

I want to enable/disable splunk alerts in splunk cloud, How to disable/enable alerts using rest api spl commands in splunk cloud?

abhi04 · ‎10-05-2023

@yuanliu Thanks for the query, just wanted to update that I was able to get the results that are not in the holiday date but got stuck on how to also put a filter on the hour (9 Am - 5:30 PM on holiday) The query I used to exclude events on holiday | search NOT [| inputlookup holidays.csv | rename HolidayDate as Date | fields Date ]

abhi04 · ‎10-05-2023

Hi, I have a alert query that uses mstats, I want this query to not throw alert during public holidays (from 9 AM to 5 PM). I have created a lookup holidays.csv with columns "Date","Description". How can i use this lookup with the already mstats command to check for the date and time in the lookup file and if its in the timerange in the file then not trigger the alert or probably not search. Thanks in advance. Lookup file:

abhi04 · ‎07-01-2021

Ye s, I restarted splunk after making changes. Below is the settings [main] frozenTimePeriodInSecs = 1209600 maxTotalDataSizeMB = 20000 As per this screenshot we can see the sum of data seen is more than 20 GB

Posts	203
Solutions	1
Karma Given	8
Karma Received	6
Member Since	‎02-12-2018

Online Status	Offline
Date Last Visited	Monday

Logs from windows host stops all of a sudden

Salesforce event logs not ingested into splunk clo...

Genesys cloud logs into SPlunk

Issue with salesforce event logs ingestion

How to get Genesys cloud logs into splunk?

Optimizing the search

Splunk alert did not trigger

how to filter based on hour and minute after using...

props

Send the logs level info to null queue

Logs from windows host stops all of a sudden

Re: Genesys cloud logs into SPlunk

Salesforce event logs not ingested into splunk clo...

Genesys cloud logs into SPlunk

Re: How to get Genesys cloud logs into splunk?

Issue with salesforce event logs ingestion

How to get Genesys cloud logs into splunk?

Re: Optimizing the search

Optimizing the search

Splunk alert did not trigger

how to filter based on hour and minute after using...

Re: props

Re: props

props

Re: Send the logs level info to null queue

Re: Send the logs level info to null queue

Send the logs level info to null queue

Re: How to mask the verificaition code using props...

How to mask the verificaition code using props and...

Re: Why the top and appendcols giving different pe...

Why the top and appendcols giving different percen...

How to disable/enable alerts using rest api comman...

Re: How to use mstats and inputlookup command

How to use mstats and inputlookup command

Re: Why does my search on specific indexer shows m...