Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sanju2408de
sanju2408de
Explorer
Member since:
05-11-2020
3 weeks ago
Community Statistics
| Posts | 9 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 05-11-2020 |
Activity Feed
- Posted Re: Need help on creating a Single Triage dashboard wherein data should be coming from multiple regions of Splunk on Dashboards & Visualizations. 3 weeks ago
- Posted Need help on creating a Single Triage dashboard wherein data should be coming from multiple regions of Splunk on Dashboards & Visualizations. 3 weeks ago
- Posted Splunk Alert Manager - Not assigning status of the incident_id from "New" to "Auto_Assigned" on Splunk Enterprise. 09-30-2022 06:22 AM
- Tagged Splunk Alert Manager - Not assigning status of the incident_id from "New" to "Auto_Assigned" on Splunk Enterprise. 09-30-2022 06:22 AM
- Posted Unable to receive Windows Event ID 4624 and 4625 data from Splunk Forwarders on Monitoring Splunk. 05-09-2022 05:22 AM
- Posted Re: Need assistance with Regex on Splunk Search. 03-14-2022 02:23 AM
- Posted Microsoft O365 add-on: How to extract data from emails? on Splunk Search. 03-13-2022 08:03 AM
- Posted Re: Microsoft O365 Email Add-on for Splunk - No data received and getting error on All Apps and Add-ons. 02-13-2022 11:10 PM
- Got Karma for I am unable to establish DB connection to MSSQL DB with Force Encryption enabled.. 05-21-2021 06:23 AM
- Posted Need 32-bit Universal Forwarder for Debian OS on Splunk Enterprise. 12-23-2020 07:17 AM
- Posted I am unable to establish DB connection to MSSQL DB with Force Encryption enabled. on All Apps and Add-ons. 05-11-2020 03:11 AM
- Tagged I am unable to establish DB connection to MSSQL DB with Force Encryption enabled. on All Apps and Add-ons. 05-11-2020 03:11 AM
- Tagged I am unable to establish DB connection to MSSQL DB with Force Encryption enabled. on All Apps and Add-ons. 05-11-2020 03:11 AM
- Tagged I am unable to establish DB connection to MSSQL DB with Force Encryption enabled. on All Apps and Add-ons. 05-11-2020 03:11 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
3 weeks ago
Many thanks for your suggestion, we have not tried this federated search as of now, let us give it a try and see if it works.
... View more
3 weeks ago
We have Splunk Enterprise installed in almost 6 different regions(APAC/AUS/LATAM/EMEA/NA/LA) worldwide and now we are looking for feasibility check for implementing :- a. Single Triage Dashboard which can be deployed in one region and can be accessing data coming from all these 6 regions. b. I understand that looking at the current setup we can't access Splunk data from one region to other region. However, is there a possibility through API calls or any other method that we can access other region Splunk data? Kindly assist us on this topic if anybody can help.
... View more
Labels
- Labels:
-
Classic dashboard
09-30-2022
06:22 AM
Hello, We are in process of upgrading our Splunk Infrastructure from ver 7.x to 8.x. Before migration, we are stuck in the functionality testing of Alert manager ver 3.08 on Splunk Enterprise 8.1.4 (Dev env). We are seeing that the alerts which gets triggered with Alert Manager ver 3.08, are not getting converted from "New" status to "auto_assigned". We have checked the configurations and logs, we couldn't find anything which can give us the clarity on this issue. Kindly help us in this issue, if you can provide alternate way to find out the root cause of this. Note: I am attaching logs from the Dev environment where there is no log entry of "Set status of incident <id> to auto_assigned".
... View more
- Tags:
- Alert Manager
Labels
05-09-2022
05:22 AM
Hello, I am looking for a help here, this is a very weird issue that I am facing. I have a requirement to monitor Event ID 4624 and 4625 from a specific set (10) of servers. I have used following inputs.conf, but instead of receiving these specific events data, i am receiving some other event codes such 4670, 4719, 4742, 4738 etc. I have tried almost all possible ways, but unable to understand what's really happening here. [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 # only index events with these event IDs. whitelist = 4624, 4625 index = wineventlog sourcetype = xyz renderXml=false
... View more
Labels
- Labels:
-
forwarder management
03-14-2022
02:23 AM
@richgalloway Thanks so much for your help, this actually worked. We had few more fields to extract from the same email and i used the same regex patterns as you have provided. It perfectly worked. Many Thanks again for your help.
... View more
03-13-2022
08:03 AM
I am facing challenges while extracting the data from emails, using the Microsoft O365 email add on.
I want to extract the "Requested for" and "Finished" for which respective values are "ABC.ITGLOBAL@XYZ.com" and "Fri, Mar 11 2022 15:09:29 GMT+00:00".
I have tried Regex101 site and could successfully test a Regex pattern as below for matching the value for "Requested for" but the same pattern doesn't work in Splunk.
(?i) for\S+\s+\S+\s+\S+\s+\S+\s+\S+\s+\S+\s+\S+\s+\S+\s+\S+\s+\S+\s+\S+\s+\w+\-\w+:\w+\-\w+\"\>(?P<Requested_For>\S+)(?=\<\/td)
I need help here to sort this out, please if anyone can share their thoughts here.
Finished</td><td class="" style="vertical-align:top; padding:10px 4px; border-bottom:solid #eaeaea 1px; text-align:left; white-space:normal; width:99%; word-break:break-word">Fri, Mar 11 2022 15:09:29 GMT+00:00</td></tr><tr><td class="" style="vertical-align:top; padding:10px 4px; border-bottom:solid #eaeaea 1px; text-align:left; white-space:nowrap; font-weight:600; min-width:130px">Requested for</td><td class="" style="vertical-align:top; padding:10px 4px; border-bottom:solid #eaeaea 1px; text-align:left; white-space:normal; width:99%; word-break:break-word">ABC.ITGLOBAL@XYZ.com</td></tr><tr><td class=""
... View more
Labels
- Labels:
-
regex
02-13-2022
11:10 PM
Did you get solution for this issue? I am also facing similar issue wherein it gives below error and no emails are getting ingested into Splunk. 2022-02-14 06:28:02,998 ERROR pid=21464 tid=MainThread file=base_modinput.py:log_error:309 | Get error when collecting events. Traceback (most recent call last): File "/splunk/etc/apps/TA_microsoft_o365_email_add_on_for_splunk/bin/ta_microsoft_o365_email_add_on_for_splunk/aob_py3/modinput_wrapper/base_modinput.py", line 128, in stream_events self.collect_events(ew) File "/splunk/etc/apps/TA_microsoft_o365_email_add_on_for_splunk/bin/o365_email.py", line 136, in collect_events input_module.collect_events(self, ew) File "/splunk/etc/apps/TA_microsoft_o365_email_add_on_for_splunk/bin/input_module_o365_email.py", line 182, in collect_events messages.append(messages_response['value']) KeyError: 'value'
... View more
12-23-2020
07:17 AM
We are looking for 32-bit version of Splunk UF agent for Debian OS, which we did not find in the Splunk portal. Is there any binary for the same or if there is any way we can monitor 32-bit Debian OS performance counters? Please suggest or provide the link to download binaries.
... View more
Labels
- Labels:
-
installation
05-11-2020
03:11 AM
1 Karma
I am trying to connect to few of the MSSQL DB instances wherein the Force Encryption is enabled (set to true) and if I try to create DB connection through Splunk DB Connect Version: 20.02.3.0 Build 1, it gives me error as *"I/O Error: DB server closed connection."*
While checking this issue on Splunk Answers portal, I have gone through similar question with title *"Splunk DB Connect 2: Why am I unable to connect to MSSQL with encryption?"*.
But even though I set the connection parameters same as mentioned in that link, it doesn't work. After following this, I am getting error as *"This driver is not configured for integrated authentication. ClientConnectionId:bc701e78-0062-4bb6-af77-7b6d4238a340"*
Here is the DB Connection input which I am using:-
[DB_Connection]
connection_type = generic_mssql_with_windows_auth
jdbcURLFormat= jdbc:sqlserver://:/;useCursors=true;domain=;integratedSecurity=true;encrypt=true;trustServerCertificate=true
disabled = 0
identity =
localTimezoneConversionEnabled = false
port = 1600
readonly = true
database = master
host = abc.com
Please can someone assist me on this, as I am not able to find any other option to establish connection to the encrypted DB instances.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
3 weeks ago
|
