Splunk Enterprise

Community Activity

	Missing date_* fields Hi,I have this log format on our environment : 2021-12-03 03:28:04.296, EVENT_TIMESTAMP="2021-12-03 03:26:38.039962 A... by jadengoho Builder in Splunk Enterprise 12-03-2021 0 0	0	0
	Splunk regex ignore fields before match I need to extract the contents of the message field, but the first strings must be ignored, I need to get from the st... by leandromatperei Path Finder in Splunk Enterprise 12-02-2021 0 1	0	1
	rex field Need help on trimming the month from the field EX: Input November 29, 2021 2:02:33 PM output Nov 29, ... by shreyasamin64 Explorer in Splunk Enterprise 12-02-2021 0 1	0	1
	help on a dropdown list from an lookup HiI retrieve the fields of a dropdown list from an CSV fileIt works but the probleme I have is that randomnly I have ... by jip31 Motivator in Splunk Enterprise 12-02-2021 0 3	0	3
	Splunk License: warnings and violation // What will be sendt to Splunk? Hello Everyone,This is a general question that I haven't found an answer to yet. I am aware of how a license violatio... by klischatb Path Finder in Splunk Enterprise 12-01-2021 0 1	0	1
	How do I run Bench marking for optimum performance on upgraded to 8.2.3 UFs / HFs ? Any SPLs? Thx a million Have upgraded a few 100 FWs (UF & HF) to Splunk 8.2.3. Looking for a bench marking checks to make sure they are fully... by SamHTexas Builder in Splunk Enterprise 12-01-2021 0 1	0	1
	Filtering the events using transforms Hi,I am trying to filter the events using LOGIN keyword and drop remaining events. I am trying with the below configu... by vihar254 Loves-to-Learn Lots in Splunk Enterprise 12-01-2021 0 0	0	0
	Indexing I have indexed a file on Splunk but when I start searching, the file cannot be found. Do you know why it happened? Fo... by Azwaliyana Path Finder in Splunk Enterprise 12-01-2021 0 1	0	1
	eval function need help on eval function of trimming the month EX : April = APR all months first 3 letters thanks by shreyasamin64 Explorer in Splunk Enterprise 12-01-2021 0 2	0	2
	Need help with regex Can some one help me to extract correlation _id from the below sample data.requirement is to extract the correlation_... by sbhatnagar88 Path Finder in Splunk Enterprise 11-29-2021 0 3	0	3
	Single Value Display text with colour How to make the words colourful? What needs to be added at the source? <option name="drilldown">none</option> by Azwaliyana Path Finder in Splunk Enterprise 11-28-2021 0 3	0	3
	Visualization for single value I want to make the panel and the font smaller in size. So that I can put more panel in one line with the font visibl... by Azwaliyana Path Finder in Splunk Enterprise 11-28-2021 0 4	0	4
	forgot my password and username i forgot my username and passwords and now iam unable login. i dint even find the filepath $SPLUNK_HOME/etc/passwd) s... by ganga2694 Observer in Splunk Enterprise 11-28-2021 0 1	0	1
	How do I rebuilt a Cluster Master without a backup? Due to a disaster the Cluster Master of my indexer cluster is gone. There is no way to recover its data and we do not... by garias_splunk Splunk Employee in Splunk Enterprise 11-28-2021 0 1	0	1
	How do I take a Splunk Index (IndxA.aws.gov) out of a cluster during a maintenance to avoid data loss? Thx a million There is a maintenance being performed & we are told that an Index (part of a cluster) is going to be moved to a new ... by SamHTexas Builder in Splunk Enterprise 11-27-2021 0 4	0	4
	How do I check to see if my Splunk Technology add-ons (TAs) are working properly on Splunk Ent or ES? Thanks a mil. Since TAs run in the background & usually not viewed, how do I check on their health? Any useful SPLs are appreciated... by SamHTexas Builder in Splunk Enterprise 11-26-2021 0 3	0	3
	help with EVAL command \| eval new_name=mvindex(split(name, ","),0), first name 0 and last name 1split first and last namewhy split a... by shreyasamin64 Explorer in Splunk Enterprise 11-26-2021 0 4	0	4
	assign values to multiple variables with the case command hi,I have a question to ask: can you assign values to multiple variables in Splunk with the case command?I need that ... by antonio147 Communicator in Splunk Enterprise 11-26-2021 0 4	0	4
	Left outer join in splunk using \|mstats HI Is it possible to do left outer join after using two \|mstats commands like below?I have Process_Name common to bot... by robertlynch2020 Influencer in Splunk Enterprise 11-25-2021 0 0	0	0
	How to create an app on SHC Hello,I am new to Splunk and I would like to create an app for my dashboards that would be visible on all Search Head... by tbenpr New Member in Splunk Enterprise 11-25-2021 0 3	0	3
	License requirement What is the license required to be acquired for a single instance splunk enterprise deployment which involves zero da... by sh254087 Communicator in Splunk Enterprise 11-25-2021 0 2	0	2
	How to take an Indexer (indexA.aws.gov) out of a Cluster during a maintenance to avoid data loss. Thanks a million I work in a large environment clustered mostly, have Splunk Ent., ES. SHs & Indexers clustered) There is a maintenanc... by SamHTexas Builder in Splunk Enterprise 11-24-2021 0 3	0	3
	Not working SEDCMD. Props.conf. help Not working SEDCMD in my props.conf /opt/splunk/etc/system/local/props.conf [ActiveDirectory]SEDCMD-mask_ms_pwd = s/(... by gitingua Communicator in Splunk Enterprise 11-23-2021 0 12	0	12
	Active directory splunk I am looking to see if anyone knows how to do this or if it is possible. I am trying to have splunk read to the Activ... by Rcope96 New Member in Splunk Enterprise 11-23-2021 0 0	0	0
	SSL certificate error: Couldn't find "distributed_tracer" in server.conf. Hi Splunkers,I am getting below error while configuring the SSL certificate among the splunk hosts.ERROR DistributedT... by anil15694 Explorer in Splunk Enterprise 11-23-2021 0 1	0	1