About niddhi

niddhi · ‎01-08-2021

Saved my day. This works perfectly. Thank you so much!!

niddhi · ‎01-07-2021

Hi, Can someone please help me create a Splunk Table from the below data: { "cd":[ { "cn":"cust-1", "s":"api", "ps":61, "fs":94, "es":142, "ud":[ { "un":"user-0", "ps":61, "fs":94, "es":142, "ad":[ { "at":"asset2", "ps":61, "fs":94, "es":142, "ttd":[ { "tt":null, "ps":61, "fs":94, "es":142 } ] } ] } ] }, { "cn":"cust-2", "s":"api", "ps":727, "fs":152, "es":26, "ud":[ { "un":"user-6", "ps":725, "fs":149, "es":21, "ad":[ { "at":"asset1", "ps":722, "fs":149, "es":20, "ttd":[ { "tt":null, "ps":722, "fs":149, "es":20 } ] }, { "at":"asset2", "ps":3, "fs":0, "es":1, "ttd":[ { "tt":null, "ps":3, "fs":0, "es":1 } ] } ] }, { "un":"user1", "ps":1, "fs":0, "es":0, "ad":[ { "at":"asset1", "ps":1, "fs":0, "es":0, "ttd":[ { "tt":null, "ps":1, "fs":0, "es":0 } ] } ] }, { "un":"user2", "ps":1, "fs":3, "es":5, "ad":[ { "at":"asset2", "ps":1, "fs":3, "es":5, "ttd":[ { "tt":null, "ps":1, "fs":3, "es":5 } ] } ] } ] }, { "cn":"cust-3", "s":"api", "ps":0, "fs":1, "es":0, "ud":[ { "un":"user-3", "ps":0, "fs":1, "es":0, "ad":[ { "at":"asset2", "ps":0, "fs":1, "es":0, "ttd":[ { "tt":null, "ps":0, "fs":1, "es":0 } ] } ] } ] }, { "cn":"cust-4", "s":"api", "ps":1, "fs":4, "es":22, "ud":[ { "un":"user-4", "ps":1, "fs":4, "es":22, "ad":[ { "at":"asset1", "ps":1, "fs":4, "es":22, "ttd":[ { "tt":null, "ps":1, "fs":4, "es":22 } ] } ] } ] } ] } I want the output to be like: cn un at tt ps fs es cust-1 user-0 asset2 null 61 94 142 cust-2 user-6 user1 user2 asset1 asset2 asset1 asset2 null null null null 722 3 1 1 149 0 0 3 20 1 0 5 cust-3 user-3 asset2 null 0 1 0 cust4 user-4 asset1 null 1 4 22 Thanks in advance.

niddhi · ‎09-17-2019

Thanks, replace worked. The mentioned syntax didn't work exactly, but it worked in this format: eval category = replace(category, "A_1", "A-1") .Thanks so much, you saved the day!!

niddhi · ‎09-17-2019

Hi, In the logs i am analyzing, one of the field's value has changed (change is from '-' to '_'). For example if it was A-1 before, now its A_1. The rest of the entries are as is. So my table looks something like this: category error exception A-1 5 0 A_1 2 1 B-1 3 0 I want to combine A-1 and A_1 as single row and the output should be something like: category error exception A-1 7 1 B-1 3 0 Any pointers are appreciated. Thanks!

niddhi · ‎06-03-2019

Hi, I have Splunk instance running on a docker and the docker is running on an EC2-instance. I am trying to configure email settings for sending the dashboard reports but it doesn't seem to work. I don't have an explicit smtp server, therefore I was trying to use smtp.gmail.com:587, but its also not working. Any pointers on how can I get the email alerts working. I am very new to all this. Please let me know if I am missing anything obvious here. Thanks

niddhi · ‎05-30-2019

HI, I did exactly the same steps, but i am only getting NONE (default) for all the entries. I have checked and matches do exists on the csv file. Any pointers on why ip is not getting matched to CIDR and how can it be resolved?

niddhi · ‎05-30-2019

I also have the same settings in transform.conf, but its not matching the results. What am i missing here? Any pointers are appreciated. Thanks,

niddhi · ‎05-30-2019

I have exactly the same scenario and its not working. I don't want to add the ip's manually as src, that will defeat the purpose of having a dynamic lookup. Any pointers are appreciated.

niddhi · ‎05-16-2019

this is the link for configuring the cloudwatch logs: https://docs.splunk.com/Documentation/AddOns/released/AWS/CloudWatchLogs

niddhi · ‎05-16-2019

I have done it by installing and configuring splunk add On for AWS. I already had the log groups defined. So just pointing to the log groups in the cloudwatch log config did the trick to get the data. There are props.conf and transform.conf specific to this AddOn for AWS(different location on the splunk under apps. I am very nee to Splunk and have tried configuring props.conf and transform.conf without any luck. Can you give me an example, as in what to give for source, sourcetype and where to define filter/pattern for cloudwatch logs. Thanks

niddhi · ‎05-16-2019

Hi, I am getting cloudwatch logs data into Splunk. Right now, i am getting all the log data but i want only specific data(for eg, only the json stream being populated in logs once in a while). How can i filter the data before Splunk ingest all of it from Cloudwatch Logs. Thanks, Niddhi

niddhi · ‎05-16-2019

I have a similar case, where i want to filer the incoming data from cloudwatch logs. I am trying to configure props.conf and transform.conf. What should be the value of source in this case?

Posts	12
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎05-15-2019

Online Status	Offline
Date Last Visited	‎01-11-2021 04:58 PM

Create Splunk Table from nested json output

How to sum 2 rows in a table?

How to set up email alerts for Splunk running on a...

To filter data from cloudwatch logs to splunk

Re: Create Splunk Table from nested json output

Create Splunk Table from nested json output

Re: How to sum 2 rows in a table?

How to sum 2 rows in a table?

How to set up email alerts for Splunk running on a...

Re: How to match an IP address from a lookup table...

Re: How to Join IP with CIDR?

Re: Lookup with IP range

Re: To filter data from cloudwatch logs to splunk

Re: To filter data from cloudwatch logs to splunk

To filter data from cloudwatch logs to splunk

Re: Splunk Add-on for Amazon Web Services: How to ...