Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sandeepreddy947
sandeepreddy947
Path Finder
Member since:
03-28-2019
11-21-2023
Community Statistics
| Posts | 18 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 03-28-2019 |
Activity Feed
- Posted Re: Remove specific strings from raw events based on other fields on Splunk Search. 11-21-2023 06:14 AM
- Posted Remove specific strings from raw events based on other fields on Splunk Search. 11-20-2023 01:24 PM
- Tagged Remove specific strings from raw events based on other fields on Splunk Search. 11-20-2023 01:24 PM
- Tagged Remove specific strings from raw events based on other fields on Splunk Search. 11-20-2023 01:24 PM
- Tagged Remove specific strings from raw events based on other fields on Splunk Search. 11-20-2023 01:24 PM
- Tagged Remove specific strings from raw events based on other fields on Splunk Search. 11-20-2023 01:24 PM
- Posted Re: How do I find all duplicate events? on Splunk Search. 11-14-2023 09:39 AM
- Tagged Splunk DB Connect Query using Schema on All Apps and Add-ons. 10-19-2023 01:25 PM
- Tagged Splunk DB Connect Query using Schema on All Apps and Add-ons. 10-19-2023 01:25 PM
- Posted Splunk DB Connect Query using Schema on All Apps and Add-ons. 10-19-2023 01:24 PM
- Tagged Splunk DB Connect Query using Schema on All Apps and Add-ons. 10-19-2023 01:24 PM
- Got Karma for Re: How do we extract field header to a value that changes and assigns to new value. Working in regex101 but not in Splu. 10-19-2023 07:33 AM
- Posted Re: How do we extract field header to a value that changes and assigns to new value. Working in regex101 but not in Splu on Splunk Enterprise. 10-19-2023 07:17 AM
- Posted SF & RF doesn't meet after removing indexer from cluster on Deployment Architecture. 10-18-2023 07:39 PM
- Tagged SF & RF doesn't meet after removing indexer from cluster on Deployment Architecture. 10-18-2023 07:39 PM
- Posted Re: RF AND SF NOT MET on Deployment Architecture. 10-18-2023 08:32 AM
- Posted Re: How do we extract field header to a value that changes and assigns to new value. Working in regex101 but not in Splu on Splunk Enterprise. 10-17-2023 09:14 AM
- Posted Re: How do we extract field header to a value that changes and assigns to new value. Working in regex101 but not in Splu on Splunk Enterprise. 10-16-2023 06:09 AM
- Posted Re: How do we extract field header to a value that changes and assigns to new value. Working in regex101 but not in Splu on Splunk Enterprise. 10-12-2023 11:55 AM
- Posted Re: How do we extract field header to a value that changes and assigns to new value. Working in regex101 but not in Splu on Splunk Enterprise. 10-12-2023 11:51 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-21-2023
06:14 AM
But, this regex with SED will replace in all events, i only need them replaced when action=Allowed and Service=23" in raw events. your regex will not satisfy below event. 2023-11-20K00:12:00-05:00 111.111.11.111 time=1700513221|hostname=firewallhost|product=Firewall|action=Denied|ifdir=inbound|ifname=eth3-01|logid=xxxx|loguid={xxxx,xxxx,xxxx,xxxx}|origin=111.111.11.111|originsicname=PK\=originsicname,O\=xpljdkdk..xpl78kdk|sequencenum=00|time=1700513221|version=5|dst=111.11.1.111|dst_country=PL|inspection_information=Geo-location outbound enforcement|inspection_profile=Geo_settings_upgraded_from_FWPRMLP_Internet_v4|protection_type=geo_protection|proto=99|s_port=1234|service=67|src=111.11.1.111|src_country=Other
... View more
11-20-2023
01:24 PM
Firewall logs needs some purification for threat monitoring, below are couple events, From the events below action=Accept AND Service=23 along with protection_type=geo_protection, we need "protection_type=geo_protection" to be removed from raw in indextime extraction. Current: 2023-11-20K00:12:00-05:00 111.111.11.111 time=1700513220|hostname=firewallhost|product=Firewall|action=Accept|ifdir=inbound|ifname=eth3-01|logid=xxxx|loguid={xxxx,xxxx,xxxx,xxxx}|origin=111.111.11.111|originsicname=PK\=originsicname,O\=xpljdkdk..xpl78kdk|sequencenum=000|time=1700513220|version=5|dst=111.11.1.111|dst_country=PL|inspection_information=Geo-location outbound enforcement|inspection_profile=Geo_settings_upgraded_from_FWPRMLP_Internet_v4|protection_type=geo_protection|proto=99|s_port=1234|service=23|src=111.11.1.111|src_country=Other
2023-11-20K00:12:00-05:00 111.111.11.111 time=1700513221|hostname=firewallhost|product=Firewall|action=Accept|ifdir=inbound|ifname=eth3-01|logid=xxxx|loguid={xxxx,xxxx,xxxx,xxxx}|origin=111.111.11.111|originsicname=PK\=originsicname,O\=xpljdkdk..xpl78kdk|sequencenum=00|time=1700513221|version=5|dst=111.11.1.111|dst_country=PL|inspection_information=Geo-location outbound enforcement|inspection_profile=Geo_settings_upgraded_from_FWPRMLP_Internet_v4|protection_type=geo_protection|proto=99|s_port=1234|service=23|src=111.11.1.111|src_country=Other
2023-11-20K00:12:00-05:00 111.111.11.111 time=1700513221|hostname=firewallhost|product=Firewall|action=Accept|ifdir=inbound|ifname=eth3-01|logid=xxxx|loguid={xxxx,xxxx,xxxx,xxxx}|origin=111.111.11.111|originsicname=PK\=originsicname,O\=xpljdkdk..xpl78kdk|sequencenum=00|time=1700513221|version=5|dst=111.11.1.111|dst_country=PL|inspection_information=Geo-location outbound enforcement|inspection_profile=Geo_settings_upgraded_from_FWPRMLP_Internet_v4|protection_type=geo_protection|proto=99|s_port=1234|service=23|src=111.11.1.111|src_country=Other
2023-11-20K00:12:00-05:00 111.111.11.111 time=1700513221|hostname=firewallhost|product=Firewall|action=Denied|ifdir=inbound|ifname=eth3-01|logid=xxxx|loguid={xxxx,xxxx,xxxx,xxxx}|origin=111.111.11.111|originsicname=PK\=originsicname,O\=xpljdkdk..xpl78kdk|sequencenum=00|time=1700513221|version=5|dst=111.11.1.111|dst_country=PL|inspection_information=Geo-location outbound enforcement|inspection_profile=Geo_settings_upgraded_from_FWPRMLP_Internet_v4|protection_type=geo_protection|proto=99|s_port=1234|service=67|src=111.11.1.111|src_country=Other Expected: 2023-11-20K00:12:00-05:00 111.111.11.111 time=1700513220|hostname=firewallhost|product=Firewall|action=Accept|ifdir=inbound|ifname=eth3-01|logid=xxxx|loguid={xxxx,xxxx,xxxx,xxxx}|origin=111.111.11.111|originsicname=PK\=originsicname,O\=xpljdkdk..xpl78kdk|sequencenum=000|time=1700513220|version=5|dst=111.11.1.111|dst_country=PL|inspection_information=Geo-location outbound enforcement|inspection_profile=Geo_settings_upgraded_from_FWPRMLP_Internet_v4|---|proto=99|s_port=1234|service=23|src=111.11.1.111|src_country=Other
2023-11-20K00:12:00-05:00 111.111.11.111 time=1700513221|hostname=firewallhost|product=Firewall|action=Accept|ifdir=inbound|ifname=eth3-01|logid=xxxx|loguid={xxxx,xxxx,xxxx,xxxx}|origin=111.111.11.111|originsicname=PK\=originsicname,O\=xpljdkdk..xpl78kdk|sequencenum=00|time=1700513221|version=5|dst=111.11.1.111|dst_country=PL|inspection_information=Geo-location outbound enforcement|inspection_profile=Geo_settings_upgraded_from_FWPRMLP_Internet_v4|---|proto=99|s_port=1234|service=23|src=111.11.1.111|src_country=Other
2023-11-20K00:12:00-05:00 111.111.11.111 time=1700513221|hostname=firewallhost|product=Firewall|action=Accept|ifdir=inbound|ifname=eth3-01|logid=xxxx|loguid={xxxx,xxxx,xxxx,xxxx}|origin=111.111.11.111|originsicname=PK\=originsicname,O\=xpljdkdk..xpl78kdk|sequencenum=00|time=1700513221|version=5|dst=111.11.1.111|dst_country=PL|inspection_information=Geo-location outbound enforcement|inspection_profile=Geo_settings_upgraded_from_FWPRMLP_Internet_v4|---|proto=99|s_port=1234|service=23|src=111.11.1.111|src_country=Other
2023-11-20K00:12:00-05:00 111.111.11.111 time=1700513221|hostname=firewallhost|product=Firewall|action=Denied|ifdir=inbound|ifname=eth3-01|logid=xxxx|loguid={xxxx,xxxx,xxxx,xxxx}|origin=111.111.11.111|originsicname=PK\=originsicname,O\=xpljdkdk..xpl78kdk|sequencenum=00|time=1700513221|version=5|dst=111.11.1.111|dst_country=PL|inspection_information=Geo-location outbound enforcement|inspection_profile=Geo_settings_upgraded_from_FWPRMLP_Internet_v4|protection_type=geo_protection|proto=99|s_port=1234|service=67|src=111.11.1.111|src_country=Other Thanks in Advance!
... View more
11-14-2023
09:39 AM
For a better and easy, you can use below SPL and replace your index name for any duplicates in Splunk. index=* | stats count by _raw, index, sourcetype, source, host | where count>1
... View more
10-19-2023
01:24 PM
I have a very long SQL query executing for every 900 seconds and amount of events are in millions. There're ~ 10 "left joins" in SQL query, which seems like filtering events with fields to get output creating load on server and on db connect server. I wanted to use "Catalog", "Schema" and "Table" options in db input where i want to choose or add multiple left joins. Do we have any documentation, i didn't find any documentation in Splunk Docs and same in community. Much appreciated for any explanation or documentation "How to use left join using schema in db connect input". Thanks in advance!!
... View more
Labels
- Labels:
-
troubleshooting
10-19-2023
07:17 AM
1 Karma
I've tried identifying all individual fields in events and extracted using rex. | rex "\s\<externalFactor\>(?<externalFactor>.*)\<\/externalFactor\>"
| rex "\s\<externalFactorReturn\>(?<externalFactorReturn>.*)\<\/externalFactorReturn\>"
| rex "\<current\>(?<current>.*)\<\/current\>"
| rex "\<encrypted\>(?<encrypted>.*)\<\/encrypted\>"
| rex "\<keywordp\>(?<keywordp>.*)\<\/keywordp\>"
| rex "\<pepres\>(?<pepres>.*)\<\/pepres\>"
| rex "\<roleName\>(?<roleName>.*)\<\/roleName\>"
| rex "\<boriskhan\>(?<boriskhan>.*)\<\/boriskhan\>"
| rex "\<sload\>(?<sload>.*)\<\/sload\>"
| rex "\<externalFactor\>(?<externalFactor>.*)\<\/externalFactor\>"
| rex "\<parkeristrator\>(?<parkeristrator>.*)\<\/parkeristrator\>"
... View more
10-18-2023
07:39 PM
I have a bucket in fixup tasks in indexer cluster-> bucket status, its been struck. Both SF & RF. So, both SF and RF are not met in indexer cluster. I tried to roll and resync bucket manually, that didn't work. There're no buckets in excess buckets, i've cleared them like more than 3hrs. Is there any way to meet SF & RF without loosing data or bucket ? I even tried to restart Splunk process on that Indexer Forgot to mention, i had a /opt/cold drive that has I/O error on an indexer. To get it fix i had stop Splunk and remove an indexer from indexer cluster, All other indexers are up and running since last night. All 45 indexers in cluster-master are up and running and left it to bucket fixup tasks to fix and it also to rebalance overnight. When i check morning there're only 2 fixup tasks left one is in SF & one in RF. Does it also need manual data rebalance to perform from indexer-cluster as well ?
... View more
- Tags:
- buckets
Labels
10-18-2023
08:32 AM
I have a bucket in fixup tasks in indexer cluster-> bucket status, its been struck. Both SF & RF. So, both SF and RF are not met in indexer cluster. I tried to roll and resync bucket manually, that didn't work. There're no buckets in excess buckets, i've cleared them like more than 3hrs. Is there any way to meet SF & RF without loosing data or bucket ? Forgot to mention, i had a /opt/cold drive that has I/O error on an indexer. To get it fix i had stop Splunk and remove an indexer from indexer cluster, All other indexers are up and running since last night. All 45 indexers in cluster-master are up and running and left it to bucket fixup tasks to fix and it also to rebalance overnight. When i check morning there're only 2 fixup tasks left one is in SF & one in RF.
... View more
10-17-2023
09:14 AM
But, i'm still not able to view extracted field_header properly in interesting fields. i can only view "key" and "value" in interesting fields. I'm searching in verbose mode.
... View more
10-16-2023
06:09 AM
Its great, i have all key as in field_header and all valuesas in field_value assigned to a field called paris. So, here all key and value extracted in one field called paris. But, i'm trying to extract field headers and field values from raw data. As to search for SPL query "index=index_name sourcetype=sourcetype |table current, encrypted, keywordp,boriskhan, rolename, prepres, externalFactor, parkeristrator". so, what i got is field_header as paris and field_values as current=parker, encrypted=true, . . . . paris current=parker encrypted=true keywordp=****** boriskhan=1-CMX_PRTY roleName=ROLE.CustomerManager pepres=false externalFactor=false parkeristrator=true current=parker What goal is, field_header_1 is current, field_header_2 is encrypted, field_header_3 is keyword as below and to get field_headers showup in Splunk interesting fields with its values. current encrypted keywordp boriskhan roleName pepres externalFactor parker true ****** 1-CMX_PRTY ROLE.CustomerManager false false
... View more
10-12-2023
11:55 AM
Result i need from raw data is, current=parker encrypted=true keywordp=****** boriskhan=boriskhan1-cmx_prty rolename=role.customermanager . . . .
... View more
10-12-2023
11:51 AM
I have regex in description and also url from regex101.com. its not working in Splunk when i used rex with SPL query. index=universe sourcetype=planet
| rex field=_raw "<(?<key>[^>]+)> (?<value>[^<]+)<\/\1>" Results i got, key current encrypted keywordp boriskhan rolename . . value parker true ****** role.customermanager false . . .
... View more
10-12-2023
11:44 AM
i'm trying to find right regex for Splunk search time extraction first, via Splunk GUI.
... View more
10-12-2023
11:18 AM
I need help in regex for key and value to be extracted from raw data, below regex working with xml_kv_extraction. While its working in regex101 but not in splunk with rex, any suggesstions. <(?<field_header>[^>]+)>(?<field_value>[^<]+)<\/\1>https://regex101.com/r/IBsMhK/1 eg: events with <field_title><field_header1>field_value1</field_header1><field_header2>field_value2</field_header2></field_title> Should appear fields as below. field title = <field_header1>field_value1</field_header1><field_header2>field_value2</field_header2> field_header1=field_value1 field_header2=field_value2 1997-10-10 15:35:13.046, CREATE_DATE="1997-10-10 13:36:22.742479", LAST_UPDATE_DATE="1997-10-10 13:36:22.74", ACTION="externalFactor", STATUS="info", DATA_STRING="<?xml version="1.0" encoding="UTF-8"?>
<externalFactor><current>parker</current><keywordp><encrypted>true</encrypted><keywordp>******</keywordp></keywordp><boriskhan>boriskhan1-CMX_PRTY</boriskhan></externalFactor>"
1997-10-10 15:35:13.046, CREATE_DATE="1997-10-10 13:03:58.388887", LAST_UPDATE_DATE="1997-10-10 13:03:58.388", ACTION="externalFactor.RESPONSE", STATUS="info", DATA_STRING="<?xml version="1.0" encoding="UTF-8"?>
<externalFactorReturn><roleName>ROLE.CustomerManager</roleName><roleName>ROLE.DataSteward</roleName><pepres>false</pepres><externalFactor>false</externalFactor><parkeristrator>true</parkeristrator><current>parker</current></externalFactorReturn>"
1997-10-10 15:35:13.046, CREATE_DATE="1997-10-10 13:03:58.384984", LAST_UPDATE_DATE="1997-10-10 13:03:58.384", ACTION="externalFactor.RESPONSE", STATUS="info", DATA_STRING="<?xml version="1.0" encoding="UTF-8"?>
<externalFactorReturn><roleName>ROLE.CustomerManager</roleName><roleName>ROLE.DataSteward</roleName><pepres>false</pepres><externalFactor>false</externalFactor><parkeristrator>true</parkeristrator><current>parker</current></externalFactorReturn>"
1997-10-10 15:35:13.046, CREATE_DATE="1997-10-10 13:03:58.384947", LAST_UPDATE_DATE="1997-10-10 13:03:58.384", ACTION="externalFactor.RESPONSE", STATUS="info", DATA_STRING="<?xml version="1.0" encoding="UTF-8"?>
<externalFactorReturn><roleName>ROLE.CustomerManager</roleName><roleName>ROLE.DataSteward</roleName><pepres>false</pepres><externalFactor>false</externalFactor><parkeristrator>true</parkeristrator><current>parker</current></externalFactorReturn>"
1997-10-10 15:35:13.046, CREATE_DATE="1997-10-10 13:03:58.378965", LAST_UPDATE_DATE="1997-10-10 13:03:58.378", ACTION="externalFactor", STATUS="info", DATA_STRING="<?xml version="1.0" encoding="UTF-8"?>
<externalFactor><current>parker</current><keywordp><encrypted>true</encrypted><keywordp>******</keywordp></keywordp><boriskhan>boriskhan1-CMX_PRTY</boriskhan></externalFactor>"
1997-10-10 15:35:13.046, CREATE_DATE="1997-10-10 13:03:58.374242", LAST_UPDATE_DATE="1997-10-10 13:03:58.373", ACTION="externalFactor", STATUS="info", DATA_STRING="<?xml version="1.0" encoding="UTF-8"?>
<externalFactor><current>parker</current><keywordp><encrypted>true</encrypted><keywordp>******</keywordp></keywordp><boriskhan>boriskhan1-CMX_PRTY</boriskhan></externalFactor>"
1997-10-10 15:35:13.046, CREATE_DATE="1997-10-10 13:03:58.374235", LAST_UPDATE_DATE="1997-10-10 13:03:58.373", ACTION="externalFactor", STATUS="info", DATA_STRING="<?xml version="1.0" encoding="UTF-8"?>
<externalFactor><current>parker</current><keywordp><encrypted>true</encrypted><keywordp>******</keywordp></keywordp><boriskhan>boriskhan1-CMX_PRTY</boriskhan></externalFactor>"
1997-10-10 15:35:13.046, CREATE_DATE="1997-10-10 13:03:58.325953", LAST_UPDATE_DATE="1997-10-10 13:03:58.325", ACTION="externalFactor.RESPONSE", STATUS="info", DATA_STRING="<?xml version="1.0" encoding="UTF-8"?>
<externalFactorReturn><roleName>ROLE.CustomerManager</roleName><roleName>ROLE.DataSteward</roleName><pepres>false</pepres><externalFactor>false</externalFactor><parkeristrator>true</parkeristrator><current>parker</current></externalFactorReturn>" @priit @PriA @yonmost @jameshgibson @bnikhil0584
... View more
Labels
04-01-2019
09:56 AM
i know actual size/length of a line which is 1194646(single line with multiple characters). that is there anything that i can set it to truncate value to unlimited, where i can't use TRUNCATE=0 anyways is there any other way.
... View more
03-29-2019
12:03 PM
Okay, Do we have any other than TRUNCATE=0 in my case then? Or i must set TRUNCATE=0 is the only way to get complete event in splunk
... View more
03-28-2019
08:38 PM
I had about 2 million characters in a single line, As I can't use TRUNCATE=0. What should I do in this case?
Is there any way I can get all those 2million characters into Splunk.
Currently my props are:
[source::truncate_value/source/with_large_character_in_single_line]
TRUNCATE=100000
... View more
03-28-2019
08:10 PM
It's just a single event with 1194646 characters which needs to get into Splunk. I'm missing data in Splunk.
earlier i have 67k characters in a single line and i set TRUNCATE=100000 where I'm able to get all events but now i had ~2 million characters per line. As per one Splunk answers, i noticed that i can't use TRUNCATE=0 link for that below.
"https://answers.splunk.com/answers/90586/can-i-change-truncate-and-max-events-to-unlimited.html"
So, how i need to get all my 1194646 characters in a single line to get into Splunk.
... View more
03-28-2019
03:41 PM
What is the best way to get my all the data of a single lined of length 1194646 into splunk ?
My data starts with :
0328-15:34:30.007 [ jnsdnvsvn] ...RECEIVE_NEW_AUTHS ..tradeOrderId=xxx.. NewAuthsReceived .. TradeOrderUpdate ....tradeOrderId=xxx
0328-15:34:31.470 [ lkjnksdjnc] ...RECEIVE_NEW_AUTHS ..tradeOrderId=xxx.. NewAuthsReceived .. TradeOrderUpdate ....tradeOrderId=xxx
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-21-2023
10:23 AM
|
