About hkubavat_splunk

hkubavat_splunk · ‎12-19-2019

You need to put the response in the log. It seems there is an error or something that is being return.

hkubavat_splunk · ‎12-19-2019

First of can you please help me to understand first why python 3 support in 7.2.3 Splunk. AFAIK python 3 support is in Quake(8.0.0). Also, This addon is using shell script of data collection so there is not python code except the setup page. In this particular JIRA when field value contains the space than it gets trimmed. [NIX] 'Description' field is not properly extracted from events for service.sh script in CentOS 7 configurations Event indexed into Splunk Tue Feb 5 14:52:21 IST 2019 type=systemctl UNIT=vmtoolsd.service, LOADED=loaded, ACTIVE=active, SUB=running, DESCRIPTION=Service for virtual machines hosted on VMware Extracted field from event: DESCRIPTION= Service Here DESCRIPTION field got trimmed out and not properly extracted.

hkubavat_splunk · ‎12-18-2019

You can try ingesting em_event table. It should have logging activities.

hkubavat_splunk · ‎11-06-2019

There is a limitation in API of azure where you cannot filter the logs as because of that you have to check all the files. In MSCS for one blob, there is one checkpoint file. So my question to Captcha is you are facing an issue is because of disk space or IO Read/write operation? It may be a case your CPU usage is normal though your system is slow.

hkubavat_splunk · ‎11-05-2019

I think Captcha is facing issue of Disk space because of files that is created from modular inputs and not the log files of modular input. Captcha can you please confirm?

hkubavat_splunk · ‎10-31-2019

From the Error Code: AF10001 indicates that permission did not include the expected permission. You need to enable below permissions to Delegated permission as well as Applications Permission in your azure cloud. 1. ActivityFeed.Read 2. ServiceHealth.Read 3. ActivityFeed.ReadDlp (Optional) So can you please try to provide access?

hkubavat_splunk · ‎10-31-2019

You can define the custom alert action: https://docs.splunk.com/Documentation/Splunk/7.3.2/AdvancedDev/CustomAlertScript. But you cannot to out of the box from the Splunk.

hkubavat_splunk · ‎10-31-2019

Make sure you have not configured any proxy settings. Try to ping the URL if it accessible or not from the server you are trying to configure.

hkubavat_splunk · ‎10-31-2019

You can define the record_count parameter in the splunk_ta_snow_account.conf for each account stanza. i.e. record_count = 50

hkubavat_splunk · ‎10-23-2019

I think it's not possible. You need to install the Splunk plugin to create incidents and events from Splunk because Splunk hit the rest API to some intermediate tables created through that plugin and after that plugin create actual incidents and events in the ServiceNow.

hkubavat_splunk · ‎05-30-2019

It seems to many accounts to configured. Can you try following approach? Give the collection_interval different for the accounts.(Though it may cause the issue at the time of the restart but after restart after some time it should come to the normal) You can setup the different heavy forwards with other accounts One of the performance issue was resolved recently though it's related to read/write operation related under but it will help if you have that many account(ADDON-21216)

hkubavat_splunk · ‎01-20-2019

No, There is no way to exclude a particular workload log in MSCS addon. It will fetch all the log through management activity API.

Posts	12
Solutions	3
Karma Given	3
Karma Received	1
Member Since	‎01-20-2019

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Re: REST API Modular Input is not working

Re: OS Impact of ADDON-21209 - Splunk Add-on for U...

Re: Monitoring ServiceNow logons with Splunk Add-o...

Re: Modular inputs for Microsoft cloud services Ad...

Re: Modular inputs for Microsoft cloud services Ad...

Re: Latency problems (1140mins) for sourcetype o36...

Re: How do you use Rest API Modular Input to creat...

Re: Splunk Add-on for ServiceNow configuration

Re: Splunk Add-on for ServiceNow: how to customize...

Re: How to create a servicenow Event & Incident wi...

Re: When using the Splunk Add-on for Microsoft Clo...

Re: How to exclude the MicrosoftTeams Workload log...