Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About tarunmalhotra79
tarunmalhotra79
Engager
Member since:
10-15-2019
09-15-2022
Community Statistics
| Posts | 20 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 10-15-2019 |
Activity Feed
- Posted How to integrate Splunk DB Connect App with Azure SQL database ? on Splunk Enterprise. 09-15-2022 03:12 AM
- Posted Using transaction command to group jobs together based on different Statuses.Multiple startwith and endswith transaction on Splunk Search. 01-27-2022 10:09 AM
- Posted Re: how to identify malformed regex ? on Splunk Search. 05-31-2021 11:33 PM
- Posted Re: how to identify malformed regex ? on Splunk Search. 05-31-2021 11:26 PM
- Posted how to identify malformed regex ? on Splunk Search. 05-31-2021 02:32 AM
- Posted How to lower case the value present inside double quotes (String). on Splunk Search. 01-19-2021 09:51 AM
- Posted Re: How to copy text and tokens values getting populated inside textarea to the clipboard while clicking on copy button on Dashboards & Visualizations. 01-06-2021 07:30 AM
- Posted How to copy text and tokens values getting populated inside textarea to the clipboard while clicking on copy button ? on Dashboards & Visualizations. 01-04-2021 02:00 AM
- Posted Re: Tokens are visible on the panel label but data is not getting populated, showing error "Search is waiting for i on Dashboards & Visualizations. 12-30-2020 01:18 AM
- Posted Re: Tokens are visible on the panel label but data is not getting populated, showing error "Search is waiting for i on Dashboards & Visualizations. 12-29-2020 10:27 PM
- Posted Re: Tokens are visible on the panel label but data is not getting populated, showing error "Search is waiting for i on Dashboards & Visualizations. 12-29-2020 08:11 AM
- Posted Tokens are visible on the panel label but data is not getting populated, showing error "Search is waiting for input" on Dashboards & Visualizations. 12-29-2020 08:09 AM
- Posted How to create a secondary backup server for Splunk app for DB connect App ? on Splunk Enterprise. 08-18-2020 08:03 AM
- Tagged How to create a secondary backup server for Splunk app for DB connect App ? on Splunk Enterprise. 08-18-2020 08:03 AM
- Posted Re: How to run different alerts/report based on output of some some Alert ? on Alerting. 04-21-2020 01:59 AM
- Posted How to run different alerts/report based on output of some some Alert ? on Alerting. 04-16-2020 10:47 PM
- Tagged How to run different alerts/report based on output of some some Alert ? on Alerting. 04-16-2020 10:47 PM
- Tagged How to run different alerts/report based on output of some some Alert ? on Alerting. 04-16-2020 10:47 PM
- Tagged How to run different alerts/report based on output of some some Alert ? on Alerting. 04-16-2020 10:47 PM
- Posted Re: How to calculate max 3 cpu usage each day and when ran for last 7 days, It should show 21 max CPU usage on Splunk Search. 03-13-2020 06:34 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-15-2022
03:12 AM
How to integrate Splunk DB Connect App with Azure SQL database. I need to create inputs(Query) and ingest the results from Azure database into the Splunk. Can we use Splunk DB Connect App to do the same ? If yes, exactly what all drivers I need for that ? Again, thanks in advance Tarun
... View more
Labels
- Labels:
-
using Splunk Enterprise
01-27-2022
10:09 AM
Ideally, JOB should start with Status as either RUNNING or STARTJOB or maybe both and it can end with either status as Termination, failure, Inactive, or success. Examples: [11/27/2021 08:00:00] TEST EVENT: STARTJOB JOB: A [11/27/2021 08:00:05] TEST EVENT: CHANGE_STATUS STATUS: RUNNING JOB: A [11/27/2021 08:06:23] TEST EVENT: CHANGE_STATUS STATUS: SUCCESS JOB: A [11/28/2021 08:00:00] TEST EVENT: STARTJOB JOB: A [11/28/2021 08:00:05] TEST EVENT: CHANGE_STATUS STATUS: RUNNING JOB: A [11/28/2021 08:00:05] TEST EVENT: CHANGE_STATUS STATUS: FAILURE JOB: A [11/28/2021 09:06:23] TEST EVENT: CHANGE_STATUS STATUS: SUCCESS JOB: A [11/26/2021 08:00:05] TEST EVENT: CHANGE_STATUS STATUS: RUNNING JOB: B [11/26/2021 20:06:23] TEST EVENT: CHANGE_STATUS STATUS: FAILURE JOB: B [11/25/2021 08:00:00] TEST EVENT: STARTJOB JOB: C [11/25/2021 20:06:23] TEST EVENT: CHANGE_STATUS STATUS: INACTIVE JOB: C I have more than 1400 jobs, some are running daily, some monthly, and some quarterly. In this scenario, Ultimately I am looking to calculate the last 90 days' average of duration (job end time - job start time) but somehow events are not getting properly grouped. Below is the query currently I am using:- Example 1 | eval end=case(_raw LIKE "%INACTIVE%","FAIL", _raw LIKE "%TERMINAT%","FAIL", _raw LIKE "%FAILURE%","FAIL" ,_raw LIKE "%SUCCESS%","FAIL",true(),"NA") | reverse | sort - _time limit=0 | transaction JOB startswith="*STARTJOB* AND *RUNNING*" endswith="end="FAIL"" keeporphans=true maxevents=9999999 keepevicted=true Example 2 | transaction JOB startswith=(STATUS="RUNNING" OR STATUS="STARTJOB") endswith=(*TERMINATED*) OR (*FAILURE*) OR (*INACTIVE*) OR (*SUCCESS*) keeporphans=true maxevents=9999999 keepevicted=true Any help would be highly appreciated. Thanks in advance.
... View more
Labels
- Labels:
-
other
-
transaction
05-31-2021
11:33 PM
Thanks richgalloway for you response. As of now, it looks like I have to go through the external option (using script) if it is not much time taking or else may be I have to do it manually then.
... View more
05-31-2021
11:26 PM
Thanks Venkatasri for you answer. I simply have a lookup which contains list of patterns some are malformed and some are good, the idea is to process then using regex and identify if some of then are malformed or not. In Order to check from the _internal I need to first run it Like - regex "My Pattern" and then i can see there is an error. But in my case I have a lookup which contains around 300 pattern or so and I need to check if any of those are malformed or not ?I am not sure how to run 300 pattern present in some lookup in one go? Again, thanks for your response and let me know if you have any queries around my question.
... View more
05-31-2021
02:32 AM
Dear Splunker, I have a lookup, which contains all the regex patterns. I would like to identify which of them are malformed. When i say malformed, I simply mean missing parenthesis or may be some mismatch in basic regular expressions. For ex- ((hostA.*,hostB.*) // This will be malformed as its missing last parenthesis. If i run this command in splunk | regex "((hostA.*,hostB.*)" It will give me the error , missing parenthesis and will immediately stop the execution , I am trying to find such kind of error proactively and correct them. Any help would be really appreciated. Thanks in advance
... View more
Labels
- Labels:
-
rex
01-19-2021
09:51 AM
Hi Splunker, I would like to lower the string/value present inside the double quotes and then use as it is. Values highlighted in red are basically string which I would like to convert it into a lower case. Actual field value : "AWSURLmonitor_" + url sourcetype + "SystemRestarted" "Batch_Comm_critical_alert"."_".to_DST_Filename."-".Time Expected field value: "awsurlmonitor" + url sourcetype + "systemrestarted" "batch_comm_critical_alert"."_".to_DST_Filename."-".Time Similarly, like above example, I have multiple data in my environment, my task is to lower case whatever the value present inside the double quotes. Any help would be really appreciated. Regards,
... View more
Labels
- Labels:
-
field extraction
-
regex
-
rex
01-06-2021
07:30 AM
Can someone please help me around here. That would be highly appreciable.
... View more
01-04-2021
02:00 AM
Hi Splunkers, I am trying to copy the whole text inside textarea to the clipboard when user clicks on a button. I tried implementing suggestions from stackoverflow but nothing worked. It looks like may be i have hardcoded some text and also using run time token which might be causing issues. <panel id="Os_details">
<html>
<div>
<label>Paste the following in your alerting search</label>
<button id="clipboard">Copy to Clipboard</button>
<textarea name="generateSearchWindow" rows="25" readonly="true" style="width:98%;margin-top:12px;color:black; text-align: left;">
$MainSearch$
| eval p_os = "$os_change_tok$"
| eval p_alert_class = "$alert_class_change_tok$"
| eval p_monitoring_type = "$monitoring_type_change_tok$"
| eval p_monitoring_component = $monitoringComponent$
| eval p_hostname = "$hostnamePattern$"
| eval search_name = "$searchName$"
| eval unique_id=p_os + ":" + p_alert_class + ":" + p_monitoring_type + ":" + p_monitoring_component + ":" + p_hostname
| fields - _raw
| collect index=Test_monitoring_test addtime=false report_name="Test_EE_$searchName$_default"
</textarea>
</div>
</html>
</panel>
</row>
<row>
<panel> JS Used:- 'underscore',
'jquery',
'backbone',
'splunkjs/mvc',
'splunkjs/mvc/searchmanager',
'splunkjs/mvc/simplexml/ready!'
], function(_, $, Backbone, mvc,SearchManager) {
//Find your input control and associate tool tip attribute for it. Here data-placement represents the position of tool tip(top,bottom,right,left,auto)
$('#textbox1').find('input').attr('title', 'Hovering Example to be added').attr('data-toggle', 'tooltip').attr('data-placement', 'bottom');
$('#monitoringComponent').find('div').attr('title', 'TextArea example').attr('data-toggle', 'tooltip').attr('data-placement', 'bottom');
$('[data-toggle="tooltip"]').tooltip();
// Iitialize Default and Submitted Token Model.
var defaultTokenModel = mvc.Components.get("default");
var submittedTokenModel = mvc.Components.get("submitted");
$("#ValidateButton").click(function()
{
defaultTokenModel.set("show_details","true");
submittedTokenModel.set("show_details","true");
});
var defaultTokenSpace = mvc.Components.getInstance('default');
$('textarea').parent().parent().addClass('textarea_div');
$('textarea').each(function (ta) {
$(this).on('input', function(input) {
defaultTokenSpace.set($(this).attr('id').replace('ta_' ,'') ,$(this).val());
});
});
document.getElementById("clipboard").onclick = function() {
var copyTextarea = document.createElement("textarea");
copyTextarea.style.position = "fixed";
copyTextarea.style.opacity = "0";
copyTextarea.textContent = document.getElementById("generateSearchWindow").value;
document.body.appendChild(copyTextarea);
copyTextarea.select();
document.execCommand("copy");
document.body.removeChild(copyTextarea);
}
}); Kindly help me, what am I missing please or where should i focus more. It would be highly appreciated.
... View more
Labels
- Labels:
-
javascript
-
simple XML
12-30-2020
01:18 AM
I completely agree with you, I am thinking there must be something which I am missing, because it looks like everyone must be facing the same problem then.
... View more
12-29-2020
10:27 PM
Can someone please help me around here..
... View more
12-29-2020
08:11 AM
JS Used:- require([
'underscore',
'jquery',
'backbone',
'splunkjs/mvc',
'splunkjs/mvc/searchmanager',
'splunkjs/mvc/simplexml/ready!'
], function(_, $, Backbone, mvc,SearchManager) {
//Find your input control and associate tool tip attribute for it. Here data-placement represents the position of tool tip(top,bottom,right,left,auto)
$('#textbox1').find('input').attr('title', 'Hovering Example to be added').attr('data-toggle', 'tooltip').attr('data-placement', 'bottom');
$('#monitoringComponent').find('div').attr('title', 'TextArea example').attr('data-toggle', 'tooltip').attr('data-placement', 'bottom');
$('[data-toggle="tooltip"]').tooltip();
// Iitialize Default and Submitted Token Model.
var defaultTokenModel = mvc.Components.get("default");
var submittedTokenModel = mvc.Components.get("submitted");
$("#ValidateButton").click(function()
{
defaultTokenModel.set("show_details","true");
submittedTokenModel.set("show_details","true");
});
var defaultTokenSpace = mvc.Components.getInstance('default');
$('textarea').parent().parent().addClass('textarea_div');
$('textarea').each(function (ta) {
$(this).on('input', function(input) {
defaultTokenSpace.set($(this).attr('id').replace('ta_' ,'') ,$(this).val());
});
});
}); Sourcecode Used :- <form script="Test_SG.js">
<label>Test_Search_Generation</label>
<fieldset submitButton="false"></fieldset>
<row>
<panel id="formPanel">
<html>
<div id="ta_task_Input">
<label for="MainSearch">MainSearch</label>
<textarea id="MainSearch" placeholder="Please enter your main search !" name="MainSearch" style="width:75%; background-color: #f7f8fa;"/>
</div>
</html>
</panel>
<panel id="Dropdown_Panel">
<input type="dropdown" token="os_change_tok">
<label>Operating System</label>
<fieldForLabel>os_display</fieldForLabel>
<fieldForValue>os</fieldForValue>
<search>
<query>| inputlookup Test_Lookup1.csv | dedup os | fields os, os_display</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
<input id="Alert_class" type="dropdown" token="alert_class_change_tok">
<label>Alert class</label>
<fieldForLabel>alert_class_display</fieldForLabel>
<fieldForValue>alert_class</fieldForValue>
<search>
<query>| inputlookup Test_Lookup1.csv | where os="$os_change_tok$" | fields alert_class, alert_class_display | dedup alert_class</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
<input id="Monitoring_Type" type="dropdown" token="monitoring_type_change_tok" searchWhenChanged="true">
<label>Monitoring Type</label>
<fieldForLabel>monitoring_type</fieldForLabel>
<fieldForValue>monitoring_type_display</fieldForValue>
<search>
<query>| inputlookup Test_Lookup1.csv | where os="$os_change_tok$" AND alert_class="$alert_class_change_tok$" | fields monitoring_type,monitoring_type_display | dedup monitoring_type</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
<html>
<div id="monitoringComponent"/>
<label for="monitoringComponent">Monitoring Component</label>
<textarea id="monitoringComponent" name="monitoringComponent" token="monitoringComponent" placeholder="Pattern Defination !" style="clear:left;width:90%; background-color: #f7f8fa;"/>
<div id="hostnamePattern"/>
<label for="hostnamePattern">Hostname Pattern</label>
<textarea id="hostnamePattern" token="hostnamePattern" placeholder="Pattern Defination !" style="clear:left;width:90%; background-color: #f7f8fa;"/>
<div id="searchName"/>
<label for="searchName">Search Name</label>
<textarea id="searchName" name="searchName" token="searchName" placeholder="Pattern Defination !" style="clear:left;width:90%; background-color: #f7f8fa;"/>
<div id="extendedAttributes">
<p>Extended Attributes
<img src="/static/app/tc_monitoring_sh/green_plus.png" id="green_plus" style="margin-left:10px;width:20px;height:20px;"/>
</p>
</div>
</html>
</panel>
<panel id="Os_details">
<html>
<div>
<label>Paste the following in your alerting search</label>
<button id="clipboard">Copy to Clipboard</button>
<textarea name="generateSearchWindow" rows="25" readonly="true" style="width:98%;margin-top:12px;color:black; text-align: left;">
$MainSearch$
| eval t_os = "$os_change_tok$"
| eval t_alert_class = "$alert_class_change_tok$"
| eval t_monitoring_type = "$monitoring_type_change_tok$"
| eval t_monitoring_component = $monitoringComponent$
| eval s_hostname = "$hostnamePattern$"
| eval search_name = "$searchName$"
| fields - _raw
| collect index=Test_monitoring_test addtime=false report_name="Test_EE_$searchName$_default"
</textarea>
</div>
</html>
</panel>
</row>
<row>
<panel>
<html>
<button id="ValidateButton" class="btn btn-primary button1">Validation !</button>
</html>
</panel>
</row>
<row>
<panel id="validator" depends="$show_details$">
<title>Checking tokens for $show_details$ and $monitoringComponent$ and "$hostnamePattern$" and "$os_change_tok$" and $alert_class_change_tok$ and $monitoring_type_change_tok$ and $searchName$</title>
<input type="checkbox" token="tokReset" searchWhenChanged="true">
<label></label>
<change>
<unset token="show_details"></unset>
<unset token="form.tokReset"></unset>
</change>
<choice value="hide">Hide Details</choice>
<delimiter/>
</input>
<table>
<search>
<query>
index=something_prod
| eval t_os = "$os_change_tok$"
| eval t_alert_class = "$alert_class_change_tok$"
| eval t_monitoring_type = "$monitoring_type_change_tok$"
| eval t_monitoring_component = "$monitoringComponent$"
| table index t_os t_alert_class t_monitoring_type t_monitoring_component s_hostname search_name
</query>
<earliest>-30d@d</earliest>
<latest>now</latest>
</search>
<option name="drilldown">cell</option>
<drilldown>
<unset token="show_details"></unset>
</drilldown>
</table>
</panel>
</row>
<row>
<panel>
<html>
<style>
.input-dropdown {width: 400px !important;height:85px !important;}
#text41 .splunk-textinput input{clear:left;width:100% !important;height:80px !important;position:relative;}
#textbox1 .splunk-textinput input{clear:left; width: 165% !important ;height:80px !important;padding : 8px 0 70px 0; margin:0 auto;position:relative; }
#Os_details {width: 39.3333% !important ;height:80px !important;}
#formPanel {clear:left; width: 30% !important ;}
#MainSearch {clear:left; width: 98% !important ;height:550px !important;}
#Dropdown_Panel{ width:30% !important;}
</style>
</html>
</panel>
</row>
</form>
... View more
12-29-2020
08:09 AM
Hello Splunkers, Problem Statement :- When i click on html validate button in my dashboard i can see a hidden panel getting populated as expected .But that panel does not show any values and on the contrary it shows "Search is waiting for input...".I have also added a checkbox to again hide the panel and when i tried to do the same and then again click on validate button (2nd time click) strangely i can see all the values getting populated in that panel. First time no values, and when I unhide and again click on my button then I can see all the values in my panel. Resolution steps taken :- 1) I tried to print all the tokens on that panel which I am trying to use and can be seen getting populated and despite that panel is waiting for some kind of input/token. 2) Also, i tried to find if I am using any values starting with $ (dollar) sign, which I am not. The highlighted ones are the token which I am using in my dashboard and can be seen visible but still panel is waiting for some inputs. Once I click the check box and then again click the validate button and then i can see all the values getting populated in the panel. Also adding source code in comments for further details. Any suggestion would be very much appreciated and thanks a lot in advance.
... View more
Labels
- Labels:
-
simple XML
-
token
08-18-2020
08:03 AM
Hi Team, There was a recent failure on one of our host where we have hosted Splunk App for DB Connect.Resultant we have lost data for almost 5,6 hours. I wanted to create a secondary backup server, if something goes wrong with our present server, Ideally it should start working on the secondary server. Also, i have realized that decrypting the passwords and entering it with script are not working, last time i tried I had to put it manually all the passwords. Could anyone please guide me or gives me the direction how can i achieve that ? Regards,
... View more
Labels
- Labels:
-
development
04-21-2020
01:59 AM
Did anyone get a chance to look into my request, any idea would be highly appreciated?
... View more
04-16-2020
10:47 PM
Dear Splunker,
I am trying to implement end to end monitoring where searches have dependecy on multiple lookups and those lookups are dervied from different searches running internally.The idea is to diagnose the situation thouroughly and as early as possible without running all the searches/alerts all the time because there are atleast 60/70 Odd searches in production.
Please look at the below example for more clarity.
search 1
|inputlookup Lookup1
|rename sys_id AS app_sys_id
|lookup Lookup2 parent AS app_sys_id OUTPUTNEW child AS server_sys_id
|mvexpand server_sys_id
|join server_sys_id [inputlookup Lookup3 | rename sys_id AS server_sys_id]
|fields host, server_fqdn, server_status, server_support_group, server_type, server_sox, server_sas, server_admin, server_location, server_environment
|outputlookup Lookup1
Also, as we can see here Lookup1 is dependent on 2 lookups internally (Lookup2,Lookup3)
Search 2
sourcetype=someother_source2|outputlookup Lookup2
here, this sourcetype will eventually create lookup2
Search 3
sourcetype=someother_source3|outputlookup Lookup3
here, this sourcetype will eventually create lookup3
Basically, It's just an example in production I have more than 30 searches in such a manner,I do not want to create 30 alert and running all unnecessary at 30 Odd timings.
I was thinking if i can create something where I will create an alert which will check inside search 1, if the result count is zero or not,if it is zero I should be alerted and then only it should also internally run a report (search 2) to check there if a data is missing or not. If not then move to search 3 to check further, if something is missing then we need to be alerted that data is missing with search 2 or search 3 .It will help me in diagnosing the situation early and also not all the time unnecessary alerts are running on my search head.
Any ideas would be appreciated, I am okay using alerts,report,dashboards,scripts etc.
Again, thanks in advance.
... View more
Labels
- Labels:
-
alert condition
03-13-2020
06:34 AM
Thanks, It worked
... View more
03-13-2020
01:13 AM
The idea is to show up top 3 CPU Averages in a day for last 7 days.
Query Using:-
index=os sourcetype=ps host="Host1"
| timechart span=1h avg(pctCPU) as Avg_pctCPU
Here, I want to first sort the result and then using the limit command filter only top 3 results with maximum value for each day and then if i run the search for last 7 days then it should do the same thing and should give me the 21 results,
Top 3 results each day * 7 days. == Total 21 results
Thanks in advance
... View more
01-27-2020
08:48 AM
Hi Team,
I am in a process of updating Splunk to version 8.0 and to Python 3.X.Also, for that I have remove all the usage of Advanced XML and convert it into the simple XML views.
But there are few dashboards/XML which seems to be impossible to convert them back to simple XML.
Could you please guide me the way how can i actually remove advance XML ? Or any kind of leads would be highly appreciated because manually changing them back to simple XML seems like a very tedious task.
For ex:-
APP Name:- Splunk Add for *Nix
Location:- tc_matrix_nix/default/data/ui/views/Setup.xml
Setup.XML
<view autoCancelInterval="100" template="search.html">
<label>Splunk for Unix Add-on: Setup</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="Message" layoutPanel="messaging">
<param name="filter">splunk.search.job</param>
<param name="clearOnJobDispatch">True</param>
<param name="maxSize">1</param>
</module>
<module name="TitleBar" layoutPanel="viewHeader">
<param name="showActionsMenu">False</param>
</module>
<module name="TA_Unix_FTR" layoutPanel="viewHeader">
</module>
<module name="TA_Unix_IFrame" layoutPanel="viewHeader">
<param name="height">auto</param>
</module>
</view>
Thanks in advance
... View more
11-05-2019
01:49 AM
Thanks for the information.
Could you please guide me through that process, How can i search results from Summary Index using my python script.
Ultimately, I have use that host name collected from that SI and then using that host name info. my python script will connect with SSH and perform some action.
... View more
10-16-2019
08:37 AM
I am looking forward to create a Python script which should run whenever there we get Alerted.
Also, My alert would be showing a Hostname and I would like to use that Hostname information inside my Python script.
Apologies in advance, I am doing it for the first time so it would be really helpful if you can help me like how can this be possible ?
Thanks in advance
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-15-2022
08:24 AM
|
