Other Using Splunk

Category Activity

How to prevent duplicate alerts with multiple search heads Hi Experts, In my Splunk distributed environment, I have one load balancer and two search heads, and one deployment ... by arun_kant_sharm Path Finder in Alerting 10-17-2019 0 2	0	2
Report Schedule via SH Hello there, I got some scheduled reports that write on summary indexes, I scheduled it via a sh script with curl. T... by marziaolla Path Finder in Reporting 10-17-2019 0 0	0	0
Splunk Alert I want to create an alert that will email us if we see any traffic that is not from a.b.c.d network communicating wit... by jdrogers83 New Member in Alerting 10-16-2019 0 2	0	2
splunk time problem Hello , We have a problem between the time of the splunk and the time of the events cisco probably : We create a r... by aalaa Path Finder in Alerting 10-16-2019 0 1	0	1
Is it possible to display the search condition that was met? If I have a single alert search with multiple conditions that looks something like this: index=X condition1 OR condi... by tjmurphyjr Explorer in Alerting 10-16-2019 0 3	0	3
How to send search reports to a network share A previous splunk admin had some daily search reports in PDF format coming from the splunk server (version 6.6.4 runn... by PaulJGreene Explorer in Reporting 10-15-2019 0 3	0	3
Dynamic alert creation for TSM backup failures We are monitoring a folder which has multiple ~100 files. Each file is with single line of backup status. I have inde... by rchittip Path Finder in Alerting 10-15-2019 0 1	0	1
Need a Help with Query for Report Hello, I have user data which is ingesting every week on Saturday in to Splunk. I have 3000 Events on 5th Oct and... by satyaallaparthi Communicator in Reporting 10-14-2019 0 3	0	3
Schedule Search Hi Splunk Team When I enter a dasborad, the search will start running. So why is there a schedule search. What is the... by vumanhtai Path Finder in Reporting 10-13-2019 0 2	0	2
Trigger and send mail after 15th occurrence based on threshold breach Hi, My requirement is : I have create real time schedule which will run for every 2 mins (cron schedule) based on the... by prsubramanian New Member in Reporting 10-13-2019 0 1	0	1
Updated: Scheduled report runs slower each time (time creep) despite acceleration - command.stats.execute_output.merge_stats duration steadily increasing I have a scheduled report that runs at minute 05 for events seen in the last hour on the hour (one full hour of data)... by orion44 Communicator in Reporting 10-11-2019 0 8	0	8
Can anyone help me with my sizing and performance considerations? Hello! I have a small distributed deployment consisting of 2 search heads (16 cores each) and 2 indexers (24 cores e... by andrewtrobec Motivator in Reporting 10-11-2019 0 2	0	2
Datamodels getting rebuild after after attaching it to new Search Head. Hello, We are trying to move from Single node installation to multinode/Distributed Search Installation(1SH and 2 In... by AKG1_old1 Builder in Reporting 10-10-2019 0 2	0	2
How to stop datamodels from rebuilding on a new Distributed search Hi We broken up a single install [SH + Indexer]. We have created a new SH and added the original Indexer(Full of dat... by robertlynch2020 Influencer in Reporting 10-09-2019 1 2	1	2
sendemail via SMTP relay server Hi, I'm trying to send emails via a SMTP relay server (alias "smart host" or "smarthost" [2]). No authentication is ... by frank_buettner Explorer in Reporting 10-08-2019 0 6	0	6
Is it possible to pass a parameter to a report via the URL? I'd like to have users be able to run a report from a URL but be able to pass a parameter to that report via the URL... by nick405060 Motivator in Reporting 10-08-2019 0 1	0	1
How to setup alert for x% decrease in count by market? Hi all, We are receiving web traffic to one index from multiple markets like the below search. Now we have been aske... by datamine Loves-to-Learn Lots in Alerting 10-08-2019 0 8	0	8
How to schedule a summary index where the base search look back time is greater than the scheduled report time and not create duplicates? Hi I have a data source that does not roll in on a consistent near-real-time schedule. I need to send the events to ... by Glasses Builder in Reporting 10-07-2019 0 1	0	1
How do I Delete, Edit, or Rename a search True newbie question: After creating my first search string and saving the search, I wanted to edit it. Finding no ... by jakesalomon Engager in Reporting 10-06-2019 1 5	1	5
Create Alert for Failed Scheduled Saved Search I need to create an alert for failed scheduled saved searches. If any scheduled saved searches fails to run due to sc... by rajim Path Finder in Reporting 10-04-2019 0 11	0	11
Schedule report with variable field First and foremost: maybe what I'm looking for isn't possible or I'm going down the wrong road, in which case, please... by splunkuzleuven Loves-to-Learn Lots in Reporting 10-04-2019 0 1	0	1
How can we move alerts from one app to another? Hi, We need to move few alerts from one app to another, is there a way we can do this? Thanks by splunker9999 Path Finder in Alerting 10-04-2019 1 7	1	7
How can I use the rest api to add a webhook action,How can I add a webhook action via REST API,Can I configure webhook with api I want to use API to configure the webhook action for an alert. It looks like the API docs only cover email configura... by rigddevops New Member in Alerting 10-02-2019 0 0	0	0
help for catching a field in order to use it in an loadjob command Hi In the saved search below, I retrieve the field "SITE" because I use a dropdown list in my dashboard in order to ... by jip31 Motivator in Reporting 10-01-2019 0 7	0	7
How to create a report for VPN user sessions including username, source ip, date and time for sonic wall firewall We have a customer who had CISCO firewall but got it replaced by Sonicwall, now the VPN user session reports are not ... by RK_sp1unk New Member in Reporting 10-01-2019 0 8	0	8