All Posts

ITWhisperer · ‎08-30-2023

This is a bit vague. What fields and values do you have in your lookup table? What corresponding fields do you have in your events?

ITWhisperer · ‎08-30-2023

The search command searches the events in the pipeline or finds events in indexes (for example). For saved searches, you need to use the savedsearch command https://docs.splunk.com/Documentation/Splu...

The search command searches the events in the pipeline or finds events in indexes (for example). For saved searches, you need to use the savedsearch command https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Savedsearch

Neel881 · ‎08-30-2023

Hello All, How to create dependent dropdown based on saved search I am using a saved search but when I add: |search command, then wont work. Please suggest. Thanks

waJesu · ‎08-30-2023

I created a lookup table for blacklisted DNS queries. I need a query that uses the lookup table to see if domains in the lookup table are present in events in my environment.

YourMom · ‎08-30-2023

I'm getting the exact same error message.

ITWhisperer · ‎08-30-2023

What has this to do with Splunk?

ITWhisperer · ‎08-30-2023

| addcoltotals count_carmen inserts updates errors | eval count_carmen=if(isnull(_time),count_carmen-inserts-updates-errors,count_carmen) | eval inserts=if(isnull(_time),null(),inserts) | eval update...

| addcoltotals count_carmen inserts updates errors | eval count_carmen=if(isnull(_time),count_carmen-inserts-updates-errors,count_carmen) | eval inserts=if(isnull(_time),null(),inserts) | eval updates=if(isnull(_time),null(),updates) | eval errors=if(isnull(_time),null(),errors)

Thulasinathan_M · ‎08-30-2023

Thanks, worked perfectly.

iamryan · ‎08-30-2023

Hi @Jeff.Arnold, Thanks for asking your question on Community. I did a quick search in the community and found this older post. Check it out as it provides two links for different resources. htt...

Hi @Jeff.Arnold, Thanks for asking your question on Community. I did a quick search in the community and found this older post. Check it out as it provides two links for different resources. https://community.appdynamics.com/t5/General-Discussions/Is-there-any-sample-application-and-data-I-can-use-to-learn-AppD/m-p/33936

verothor · ‎08-30-2023

Hello all, please could you help me with one question - it is possible to add an png image on a rectangle square? Just as an example the rectangle is set like this - it is possible to include there...

Hello all, please could you help me with one question - it is possible to add an png image on a rectangle square? Just as an example the rectangle is set like this - it is possible to include there an image to the corner of the rectangle? <a href=""> <g> <rect style=fill:color_grey width="150" height="90" x=1200 y=200/> </g> </a> Thank you for any help and answers.

avi7326 · ‎08-30-2023

I want to add three fields insert ,update and error then subtract it from count_carmen and add new row .

rsannala · ‎08-30-2023

Hi Experts, I would like rename sourcetype at index time with below config. props.conf [source::test/source.txt] TRANSFORMS-sourcetype = newsourcetype Transforms.conf [newsourcetype] SO...

Hi Experts, I would like rename sourcetype at index time with below config. props.conf [source::test/source.txt] TRANSFORMS-sourcetype = newsourcetype Transforms.conf [newsourcetype] SOURCE_KEY = MetaData:Sourcetype REGEX = regex to match existing sourcetype FORMAT = newsourcetype DEST_KEY = MetaData:Sourcetype Now I would like apply below settings on new sourcetype. [newsourcetype] TZ= Linebreaker= Truncate= etc.. will it work this way ? Please let me know. Thanks. Ram

anand_p · ‎08-30-2023

we have a data of 14k events under event index, which is unstructured. I'm trying to ingest this data under a metric index at search time using mcollect command and was able to convert the event logs...

we have a data of 14k events under event index, which is unstructured. I'm trying to ingest this data under a metric index at search time using mcollect command and was able to convert the event logs to metrics. As per the splunk docs, it states metric index is optimized for the storage and retrieval of metric data. While there is improvement in the search time, the storage size instead of decreasing it drastically increased. How does the storage is optimized incase of metric index? Is there any additional configuration that needs to e setup. I have updated the always_use_single_value_output for mcollect command to false under limits.conf

splunk_learn · ‎08-30-2023

Hi, I have setup an environment to learn at home. I have 2 instances, one serving as a Splunk Forwarder where I have my data and the other serving as Deployment Server + indexer + search head. I ...

Hi, I have setup an environment to learn at home. I have 2 instances, one serving as a Splunk Forwarder where I have my data and the other serving as Deployment Server + indexer + search head. I configured the serverclass and the app, however I'm not getting data into the index from the forwarder even tho I checked the logs in the latter and the connection is successful. Is it because of the trial license? Any thoughts why is it not working as expected? Any info would be appreciated. Thanks.

abi2023 · ‎08-30-2023

How do I change color single value trend by default it either red for negative, and green for positive. I want my single value color to be as I define in my range value even if trend is negative or p...

How do I change color single value trend by default it either red for negative, and green for positive. I want my single value color to be as I define in my range value even if trend is negative or positive. below is my source code. <earliest>-30d@d</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="colorBy">trend</option> <option name="colorMode">none</option> <option name="drilldown">none</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0xff1414","0xdc4e41","0x53a051","0xf1813f","0xdc4e41"]</option> <option name="rangeValues">[20,30,50,100]</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="trendInterval">-30d</option> <option name="unitPosition">after</option> <option name="useColors">1</option> <option name="useThousandSeparators">1</option> </single> </panel> Thank you in advance.

LearningGuy · ‎08-30-2023

Hello, How to query a field in DBXQuery that contains colon? I ran the following query and got an error. Thank you | dbxquery connection=visibility query="select abc:def from tableCompany" or...

Hello, How to query a field in DBXQuery that contains colon? I ran the following query and got an error. Thank you | dbxquery connection=visibility query="select abc:def from tableCompany" org.postgresql.util.PSQLException: ERROR: syntax error at or near ":" Position: I tried to put single quote | dbxquery connection=visibility query="select 'abc:def' from tableCompany" but it gave me the following result ?column? abc:def abc:def

mninansplunk · ‎08-30-2023

Thank you very much for the quick help, that did the trick.

nextpart · ‎08-30-2023

I'm facing a rather peculiar issue with dashboards. When non-admin users, or users without the admin_all_objects capability, access the dashboard, all panels display "Waiting for data..." indefinitel...

I'm facing a rather peculiar issue with dashboards. When non-admin users, or users without the admin_all_objects capability, access the dashboard, all panels display "Waiting for data..." indefinitely. However, the strangest part is that if the user clicks on the search of a panel and is redirected to the search view, the results appear immediately. Here's what I've tried so far: Searched through community questions and issues, but found nothing that matches this issue exactly. Experimented with different capabilities, but it seems only the admin_all_objects capability solves this issue. Attempted to adjust the job limits similar to those set for admin users. Assigning admin_all_objects capability to all users is not a viable solution for me due to security concerns. Has anyone encountered this issue before? I'm running out of ideas and would appreciate any help or insights on this. Note: Tested also on a local instance deployed via ansible-role-for-splunk to reproduce. Thank you in advance for your time and assistance.

AntoineDRN · ‎08-30-2023

Hello @splunkreal, thanks for replying to this it was really out of my mind. I reached the support about it, and the conclusion was that it is possible. The best way to increase the parameter i...

Hello @splunkreal, thanks for replying to this it was really out of my mind. I reached the support about it, and the conclusion was that it is possible. The best way to increase the parameter is to do it gradually and monitor the effects on the platform. Regards

Skye · ‎08-30-2023

Hello, We are new to the Splunk environment, and are using Enterprise v9.01. We have complete driver package from CData that allows us to use 100+ different ODBC and JDBC drivers. I tried the Splu...

Hello, We are new to the Splunk environment, and are using Enterprise v9.01. We have complete driver package from CData that allows us to use 100+ different ODBC and JDBC drivers. I tried the Splunk DB connect add-on and I can connect to a SQL DB. Can Splunk actually make connections to other JDBC/ODBC data sources, MongoDB, Teams, One-note etc from CData. Please let us know.

All Posts

All Posts

Re: How to use Lookup table to analyze events?

Re: how to create dependent dropdown based on saved search

how to create dependent dropdown based on saved search

How to use Lookup table to analyze events?

Re: TA-DMARC ERROR

Re: How to insert image on a rectangle inside the svg

Re: How to add a new row to my table that add the counts of three fields and subtract from another field?

Re: How to escape all possible special characters

Re: New to APPD - trial version, sample app

How to insert image on a rectangle inside the svg

How to add a new row to my table that add the counts of three fields and subtract from another field?

How to rename sourcetype at index time?

Metric index storage optimization

Why am I Not receiving data on indexer (Splunk Enterprise trial license)?

Re: How to color trend in single value?

How to query a field in DBXQuery that contains colon?

Re: Not seeing any results with strftime

Why are Dashboard Panels Stuck on "Waiting for data..." for Non-Admin Users?

Re: Is it possible for squash_threshold to increase value, and are there consequences?

Can Splunk actually make connections to other JDBC/ODBC data sources?

All Posts

Are you a member of the Splunk Community?

All Posts