All Posts

gcusello · ‎11-29-2023

hi @Mohamad_Alaa , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated

gcusello · ‎11-29-2023

hi @Mohamad_Alaa , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated

Jack90 · ‎11-29-2023

Hello, I am managing Splunk roles. I want to adjust capabilities to roles, but unfortunately for few of them I did not find what exactly they do. Searching did not give me results or the results we...

Hello, I am managing Splunk roles. I want to adjust capabilities to roles, but unfortunately for few of them I did not find what exactly they do. Searching did not give me results or the results were not satisfying. If you have some extract with all capabilities and their description, please advise me what exactly following capabilities do (screenshot attached)

RJ_10 · ‎11-29-2023

can anyone please tell me the scenario based interview questions for splunk admin role ?

AL3Z · ‎11-29-2023

@tscroggins @rasad4468 @richgalloway @PickleRick Can we use this method to blacklist like this blacklist3 = EventCode=%^4688$% Message=%SplunkUniversalForwarder% blacklist4 = EventCode=%^4688...

@tscroggins @rasad4468 @richgalloway @PickleRick Can we use this method to blacklist like this blacklist3 = EventCode=%^4688$% Message=%SplunkUniversalForwarder% blacklist4 = EventCode=%^4688$% Message=%Tanium%blacklist5 = EventCode=%^4688$% Message=%Rapid7% my raw events are showing like this after adding why ?

Mohamad_Alaa · ‎11-29-2023

problem solved, i appreciate all your responses once i search in SH, i should use the parameter splunk_server=* in order to see results So obviously this was my issue as i should see results with...

problem solved, i appreciate all your responses once i search in SH, i should use the parameter splunk_server=* in order to see results So obviously this was my issue as i should see results without such paramter modified the below on SH, solved it C:\Program Files\Splunk\etc\system\local\distsearch.conf [distributedSearch:dmc_group_indexer] default = false

Mohamad_Alaa · ‎11-29-2023

problem solved, i appreciate all your responses once i search in SH, i should use the parameter splunk_server=* in order to see results So obviously this was my issue as i should see results with...

problem solved, i appreciate all your responses once i search in SH, i should use the parameter splunk_server=* in order to see results So obviously this was my issue as i should see results without such paramter modified the below on SH, solved it C:\Program Files\Splunk\etc\system\local\distsearch.conf [distributedSearch:dmc_group_indexer] default = false

Splunkerninja · ‎11-29-2023

@tej57 Thanks but how can i include _time as well in the result since after mvcombine the _time data gets dropped

gcusello · ‎11-29-2023

Hi @brat_1990 , if you have a Linux server, you could configure an rsyslog server that writes syslogs in files that you cn read using the UF. Otherwise you could install the SC4S app (that's a sysl...

Hi @brat_1990 , if you have a Linux server, you could configure an rsyslog server that writes syslogs in files that you cn read using the UF. Otherwise you could install the SC4S app (that's a syslog-ng server). Last choise to use an Heavy Forwarder. My hint is to use a rsyslog server ( I usually do this). Ciao. Giuseppe

gcusello · ‎11-29-2023

Hi @mayurkale471757 , try to upload a sample of your file using the Add Data GUI feature that guides you in the sourcetype creation. Ciao. Giuseppe

richgalloway · ‎11-29-2023

I would contact Splunk Support.

gcusello · ‎11-29-2023

hi @Mohamad_Alaa , check if you have filters compatible with the values you defined for the Notable. Ciao. Giuseppe

gcusello · ‎11-29-2023

Hi @Mohamad_Alaa , as I said, you have to enable datamodels and accelerations. Ciao. Giuseppe

Glasses2 · ‎11-29-2023

The numbers are not exact, from the DS Forwarder Management > 1275, dc(h) from metrics > 1287, and the total stats count from the final query > 1166 so its not accurate. I will need to create a loo...

The numbers are not exact, from the DS Forwarder Management > 1275, dc(h) from metrics > 1287, and the total stats count from the final query > 1166 so its not accurate. I will need to create a lookup of UFs. Thank you for your support.

gcusello · ‎11-29-2023

Hi @_pravin , are you sure that these reports and alerts are shared at app level and they are in Search and Reporting App? try to delesect the app in the search dropdown filter setting All. Ciao. ...

Hi @_pravin , are you sure that these reports and alerts are shared at app level and they are in Search and Reporting App? try to delesect the app in the search dropdown filter setting All. Ciao. Giuseppe

sjringo · ‎11-29-2023

I am working on adding some drop down to an existing dashboard studio. I have the queries working with no issues by referencing the drop down's but wrapping the Token Name in $$. What I am working ...

I am working on adding some drop down to an existing dashboard studio. I have the queries working with no issues by referencing the drop down's but wrapping the Token Name in $$. What I am working on now is I would like to update a Widgets Title with the Tokens Label as that is the 'human' readable data, not data to drive the queries. This works with showing the 'value' of the Tokens selection $tok_aToken$ but how do I show the tokens label? I have tried: $tok_aToken_label$, $tok_aToken.label$ and have been searching for hours and have been unable to find a solution ?

Splunkerninja · ‎11-29-2023

Hi, I have 3 values and i want to display it in a single value panel like the below image which is from Tableau,I want to replicate the same in Splunk. Can it be done? If not can we represent 2 valu...

Hi, I have 3 values and i want to display it in a single value panel like the below image which is from Tableau,I want to replicate the same in Splunk. Can it be done? If not can we represent 2 values (GPA and website) in a single value and Grade in legend? Else please suggest what other representation can i go with which displays 3 values

ITWhisperer · ‎11-29-2023

Try something like this index=_internal (host=`sim_indexer_url` OR host=`sim_si_url`) sourcetype=splunkd group=per_Index_thruput series!=_* (earliest=@d latest=now) OR (earliest=-60d@d latest=-59d@d...

Try something like this index=_internal (host=`sim_indexer_url` OR host=`sim_si_url`) sourcetype=splunkd group=per_Index_thruput series!=_* (earliest=@d latest=now) OR (earliest=-60d@d latest=-59d@d) | timechart minspan=30s per_second(kb) as kb by series

Pantman · ‎11-29-2023

I used the query index="botsv2" Amber. I found a capture_hostname: matar Which e-mail seems to be linked to "matar"? And who sends the person attach to the "feed" email to? This...

I used the query index="botsv2" Amber. I found a capture_hostname: matar Which e-mail seems to be linked to "matar"? And who sends the person attach to the "feed" email to? This is from https://github.com/splunk/botsv2

Muthu_Vinith · ‎11-29-2023

I have a single values panel with a distinct count, and I've specified a function for drill down. When clicking on a value like '25,' the table is displaying all values instead of the exact ones. Any...

I have a single values panel with a distinct count, and I've specified a function for drill down. When clicking on a value like '25,' the table is displaying all values instead of the exact ones. Any guidance on refining the drill down for precise results @gcusello

All Posts

All Posts

Re: notable exist but incident review has no values

Re: Data Model

The role capabilities' privileges

interview prep

Re: How should the process name be designated for the blacklisting of Windows events?

Re: Data Model

Re: notable exist but incident review has no values

Re: How to display result when two fields are dependent

Re: How to make universal forwarder to receive syslogs and forward to Splunk cloud?

Re: Splunkforwarder pushes multiple lines as single event from windows machine logs

Re: There was an error processing your request. It has been logged (ID xxxxxxX)

Re: notable exist but incident review has no values

Re: Data Model

Re: How can I determine the total amount of data received and indexed by UFs?

Re: Unable to see report in Searches, Reports, and Alerts UI

Dashboard Studio, how to show token 'label' instead of 'value' ?

How to display 3 values in a single value panel

Re: Query to compare total throughput for two distinct dates

Capture_hostname

Re: Splunk

All Posts

Are you a member of the Splunk Community?

All Posts