Knowledge Management

Community Activity

How do I switch smartstore to a backup object store? I'm considering using an on-premises S3 object store and keeping it in sync with an AWS S3 object storage. If my local object store fails, how to I switch to the AWS S3 object store? I'm considering using an on-premises S3 object store for warm buckets and keeping it in sync with an AWS S3 object st... by elliottj1 New Member in Knowledge Management 12-16-2019 0 1	0	1
How can we check if tag exists? We are trying the following - index=<index name> \| head 4000 \| eval containstag = if(tag="*", "true", "false") \| st... by danielbb Motivator in Knowledge Management 12-16-2019 0 3	0	3
[smartstore] How to map S2 smartstore buckets to local splunk bucket? I would like to understand the directory structure for Splunk bucket on the remote store. by rbal_splunk Splunk Employee in Knowledge Management 12-11-2019 0 11	0	11
[smartstore]Need clarification on max_cache_size ? The question is about the configuration of max_cache_size for the smart store. @srerver.conf max_cache_size = * S... by rbal_splunk Splunk Employee in Knowledge Management 12-10-2019 0 5	0	5
Does Splunk support the Japanese character encoding? I wonder whether/how Splunk supports the Japanese character encoding. Assuming we have a stream of data encoded as ut... by ddrillic Ultra Champion in Knowledge Management 12-10-2019 0 9	0	9
SmartStore Eviction Behavior I'm looking to get a better understanding of when the cache manager will evict a bucket or at least the journal and t... by jamie00171 Communicator in Knowledge Management 12-10-2019 1 0	1	0
Can you use a CLI Search with Splunk Free? Hi, I have a Splunk Free Windows box and I want to run something like this in Splunk Free CLI: splunk search 'index=... by BlueSocket Contributor in Knowledge Management 12-08-2019 0 1	0	1
How to search 5 min interval after summary index is populated Hello, I have a search that will extract a field to a summary index and I want to search that field in a specific ind... by gozdeyildiz New Member in Knowledge Management 12-06-2019 0 3	0	3
Why does kvstore lookup record insert fail with error "An error occurred during the last operation ('createCollection', domain: '5', code: '10334')"? When user try to update kvstore using command like \| inputlookup [backupdata] \| output This errors out with err... by sat94541 Communicator in Knowledge Management 12-05-2019 0 5	0	5
How to confirm if Netflow or other data is being collected under the app:"splunk_app_stream" On my Splunk Cloud instance, there is an app called: "splunk_app_stream" that is currently disabled under the 'App' s... by nathant089 New Member in Knowledge Management 12-04-2019 0 1	0	1
Querying License Master data to send to Summary Index I am trying to see how I can basically re-push historical license data from our License Master to a Summary Index. Wh... by skirven Communicator in Knowledge Management 12-04-2019 0 1	0	1
UTC Time Picker - working with UTC input time Good morning I am trying to design a dashboard always able to display data according to UTC time. So, among the other... by gavalle New Member in Knowledge Management 12-04-2019 0 1	0	1
[SmartStore] Migration to Smart Store and looking for some details around this process? We are planning to enable Smart Store (whether for all indexes or for just some indexes), our cluster will go through... by rbal_splunk Splunk Employee in Knowledge Management 12-02-2019 0 3	0	3
How to join two columns from different "Source" files? I have two join two different source file having similar column Source1 ( basically iostat data and loaded to splunk... by chvenu17 Path Finder in Knowledge Management 12-02-2019 0 2	0	2
How to change order of result in splunk query Hello, I have not found a method of bringing values backwards in a simple splunk search, always show from last to ... by leandromatperei Path Finder in Knowledge Management 11-30-2019 0 2	0	2
How to add a row into a table, the row depends on a search result, which is before the first Pipe (\|)? index="Value of index" tag="Value of Tag" DATA="code for data1" \| chart count by parameter1 \| rename count as "Count ... by ganinurceski Engager in Knowledge Management 11-28-2019 0 2	0	2
CIM data model for Azure activity logs in Splunk Hello, I have onboarded activity logs from an azure subcription to splunk using Azure monitor addon for splunk, http... by bsanjee Explorer in Knowledge Management 11-27-2019 0 2	0	2
Tyco (Software House) CCURE event collection Is anyone collecting Audit and Activity events from the CCURE 9000 application? The logs are in a SQL DB so I assume... by kwasielewski Path Finder in Knowledge Management 11-25-2019 1 6	1	6
Why is collect command not working? I have an instance of Splunk Enterprise installed where my search head and indexer are running on the same server. I... by rschmelzle_noda New Member in Knowledge Management 11-22-2019 0 12	0	12
Does summary index query runs bydefault in fast mode? I have my search in "verbose mode" and i have used \|collect command to send the data to summary index. till here ever... by vikashperiwal Path Finder in Knowledge Management 11-20-2019 0 7	0	7
Splunk on Chromebook? I'm considering grabbing a chromebook, but I'll want to install splunk enterprise on it (for testing purposes, labs a... by hagjos43 Contributor in Knowledge Management 11-20-2019 1 4	1	4
Datamodel To Accelerate Billing Data: Help With Best Practices I have been working on a Data model to use for AWS Billing information. It actually is an enhancement to the one used... by paimonsoror Builder in Knowledge Management 11-20-2019 0 0	0	0
What do the restrictions on SmartStore mean? We are considering using the SmartStore capability. The following at About SmartStore Says - -- The home path and col... by danielbb Motivator in Knowledge Management 11-19-2019 0 1	0	1
recommended way to rename a kvstore collection that is not empty ? Dear all, I am pretty new with KVstore, REST API and Python SDK, therefore my question might be trivial for an expert... by mhergh Explorer in Knowledge Management 11-19-2019 0 5	0	5
kvstore - crud and filtering Hi folks, I have a use case problem and could appreciate a peer review. My use case is to use a kvstore lookup as a j... by abeeber_merck New Member in Knowledge Management 11-18-2019 0 4	0	4