About skrajkumar_splu

skrajkumar_splu · ‎01-20-2022

Try scheduling an alert with condition "|search status !=200" with a cron schedule of "*/30 * * * *". Settings->Searches, Reports, and Alerts ->new alert

skrajkumar_splu · ‎12-20-2021

Or you can try converting the duration to string and then add sec, mins via regex like below example | eval duration=tostring(duration,"duration")| eval time_taken = replace(duration,"(\d+)\:(\d+)\:(\d+)","\1h \2min \3sec")

skrajkumar_splu · ‎11-18-2021

Yes, you can very well send data via HEC to Splunk Cloud. Pls refer the below doc for the steps. https://docs.splunk.com/Documentation/SplunkCloud/8.2.2109/Data/UsetheHTTPEventCollector

skrajkumar_splu · ‎11-18-2021

HI @jip31 , Dashboard studio also follows the same folder hierarchy. So the xml file needs to go to either local/data/ui/views or default/data/ui/views as usual.

skrajkumar_splu · ‎11-18-2021

Hi @Roy_9 , Check if Dataminr supports extracting alert information via REST API. If so then you can easily build an add-on to ingest data into Splunk via Splunk's "Add-on Builder". And you can schedule it to fetch alert info from Dataminr periodically. https://docs.splunk.com/Documentation/AddonBuilder/4.0.0/UserGuide/ConfigureDataCollection

skrajkumar_splu · ‎10-30-2021

I guess its the issue with the nested IF statement. Can you please try like below ? <drilldown> <eval token="ps2">if($click.value$="ESB - Canonical - Tibco", "6" , if($click.value$="Guiding Care - Tibco", "21" , if( $click.value$="Guiding Care - Tibco", "21" , if($click.value$="ESB - Raw data - Boomi", "1" , if($click.value$="ESB - Raw data - Boomi", "1" , if($click.value$="ESB - Raw data - Tibco", "2" , if($click.value$="ESB - Raw data - Tibco", "2" , if( $click.value$="HealthShare - Tibco","41", if( $click.value$="HealthShare - Tibco","41" , if( $click.value$="ESB - Canonical - Boomi","5", if( $click.value$="ESB - Canonical - Boomi","5" , if($click.value$="EDWADS", "10" ,if($click.value$="EDWADS", 10 , if($click.value$="EDWIDS", 15 , if($click.value$="EDWIDS", "15" , if($click.value$="Guiding Care - Boomi", "20", if($click.value$="Guiding Care - Boomi", "20" , if($click.value$="Guiding Care - PopHealthServices (PHS)","25" , if($click.value$="Guiding Care - PopHealthServices (PHS)","25" , if($click.value$="CareAnalyzer (CA)", "30" , if($click.value$="CareAnalyzer (CA)", "30" , if($click.value$="HealthShare", "40" , "false"))))))))))))))))))))))</eval> <set token="ps1">$click.value$</set> </drilldown> Here ps2 token should carry the numeric value. If nested IF statement is little confusing/ troublesome you can also use case(match(......),...)

skrajkumar_splu · ‎10-30-2021

Hi Sanjum01 Can you try using a nested IF instead of using a Boolean expression. Something like the below snippet <drilldown> <eval token="ps2">if($click.value$="ESB - Canonical - Tibco", "6" , if($click.value$="Guiding Care - Tibco", "21" , "false"))</eval> </drilldown>

skrajkumar_splu · ‎10-30-2021

Next to All add " Except Unknown" also as a static option with value as * AND data!="Unknown" here data is the field name you are going to search in the query like data = $dropdown$. This should help in filtering all values of data except "Unknown" If this answer helps. kindly accept it as a Solution and upvote it.

skrajkumar_splu · ‎10-30-2021

While this approach can save you some disk space, whereas it compromises some basic advantages for Clustering. For example if the node with the search copy goes down, the process of converting non searchable buckets to searchable and converting them to primary may/would be a time intensive process. which may delay your searches for some time. Or may produce partial results as it may search only over the available primary buckets until its recovery. So its always a best practice to go with a minimum of 2 SF.

skrajkumar_splu · ‎10-30-2021

I believe you are trying to add threshold values to your Column chart. If so please try in adding the threshold limits via eval . And add them as chart overlays as shown below index=_internal sourcetype=splunk* | stats count by sourcetype | eval lower_threshold = 400 | eval higher_threshold = 6000

skrajkumar_splu · ‎06-11-2020

Try using Bin span to group all dates to corresponding months and chart command instead of time chart like in below snippet

skrajkumar_splu · ‎06-11-2020

Try using join command like below Query 1 | join Microservice type=left[search Query2]

skrajkumar_splu · ‎03-13-2020

It should go as a drilldown token like the below snippet <dashboard> <label>Sarath</label> <row> <panel> <table> <search> <query>| makeresults | eval name= "My Name is Sarath" | table name</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <eval token="name">replace($click.value2$, "Sarath","Sarath kumar")</eval> </drilldown> </table> </panel> </row> <row> <panel> <table> <search> <query>|makeresults| eval name="$name$" | table name</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </dashboard>

skrajkumar_splu · ‎03-13-2020

Hi rkrish71 Try using replace command in drilldown like below <drilldown> <eval token="name">replace($click.value2$, "Sarath","Sarath kumar")</eval> </drilldown> Guess this could help you solve your issue.

skrajkumar_splu · ‎03-13-2020

Hi Troyfred One suggestion is instead of forwarding the logs from one indexer to another. You can configure the UF to send only specific monitors to the second indexer( Or even both indexers) via _TCP_ROUTING. Define two different routing groups for both scenarios in outputs.conf and declare the group in inputs.conf. Refer inputs.conf.specs for more info https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

skrajkumar_splu · ‎10-16-2019

In order to make the forwarder re-index the entire data. you need to clear the fishbucket. You can do this by deleting $SPLUNK_HOME/var/lib/splunk/fishbucket and restart the forwarder instance. By doing this it will make the forwarder to re-index everything. If you are looking to do this for a single file try adding CrcSalt to your inputs.conf, like crcSalt = readItAgain. https://docs.splunk.com/Documentation/Splunk/7.3.2/Data/Monitorfilesanddirectorieswithinputs.conf

skrajkumar_splu · ‎10-15-2019

Try using chart instead of stats. like host=localTest sourcetype="perf" Path "/api/*/" cache="MISS" OR cache="HIT" | chart count over cache by Path

skrajkumar_splu · ‎10-10-2019

You can use licenseusage.log file to get your ingestion amount. Kindly try the below query that could give you the date in which maximum data was ingested in specified timeframe. index=_internal source="license_usage.log" type=Usage | bin span=1d _time | stats sum(eval(b/1024/1024/1024)) AS volume by _time| sort- volume| head 1 Hope this helps

skrajkumar_splu · ‎10-10-2019

Hi Kundanbbisht I believe easy install script doesn't enable service monitoring by default. If you want to monitor windows service kindly include below winhostmon stanza in your inputs.conf file [WinHostMon://Service] type = service interval = 300 index = default If you wish to further narrow down or filter your data on services you can even opt a wql query to ingest filtered data. For that you have to go with wmi.conf like below. [WMI:Services] interval = 60 disabled = 0 index = default wql = select Name, ProcessId, Caption, DisplayName, State, Status, StartName, SystemName from Win32_Service You can alter this WQL query as per your necessity. Hope this helps.

skrajkumar_splu · ‎10-10-2019

Hi arun_kant_sharma Technically speaking your query should work, please check below snippet for sample. May be the the scale difference in Y-axis is too large that may cause the spike in linecharts to be very small to be visible. Try using Log scale in y-axis or try defining the interval/min & max value manually, it may help. If you still face any issues kindly post a snippet with your query and output.

skrajkumar_splu · ‎09-29-2019

Hey Santosh, The best recommended solution is to connect the DB via HF. By this way you can eradicate below challenges It helps in security. You need not risk in exposing your DB to internet, also you need not trouble yourself with port openings. At time SQL queries may yield huge datasets, depending on your bandwidth it may slowdown your network. So its better to install DB Connect in your Local HF( As you usually configure in Splunk enterprise) and forward its data to the cloud. Hope this helps. ,

Posts	21
Solutions	5
Karma Given	0
Karma Received	4
Member Since	‎09-29-2019

Online Status	Offline
Date Last Visited	‎01-20-2022 07:25 AM

Re: Trigger an email alert when status code is oth...

Re: Need Minutes and hours conversion

Re: Consume alerts from a tool into splunk

Re: help on json file from dashboard studio

Re: Consume alerts from a tool into splunk

Re: how should I assign a value on base of conditi...

Re: how should I assign a value on base of conditi...

Re: How to show all values except for one in a dro...

Re: Why would I want a replication factor of 2 and...

Re: Mark values in Diagram

Re: Chart count with timespan

Re: Not Getting result while trying to pass result...

Re: How to Use Replace Command in Drilldown with U...

Re: How to Use Replace Command in Drilldown with U...

Re: How to send a specific index from one indexer ...

Re: Forwarder Resend Data After Connect To Indexer

Re: How to change the row value to column value ?

Re: largest single day result in a 90 day period

Re: How to fetch Windows Services details using Sp...

Re: line chart continues

Re: splunk DB connect with splunk cloud