Hello Splunk community, We had the splunk heavy forwarder set up on one machine, and SQL server database on the other machine. On "Splunk DB Connect" app, when we try the "New Input" on "Data Lab" t...
I have upgraded splunk to splunk version 4.3 but I am not seeing Datapreview option as in this
http://docs.splunk.com/Documentation/Splunk/4.3/Data/Overviewofdatapreview
I have recently upgraded my version up to 6.1.3 and noticed such thing in Splunk UI, when doing a standard search.
Event raw data is no longer displayed in search results as the default field, s...
Hello,
I have configured a SEDCMD in props.conf to remove a few unwanted lines of logs. During datapreview, the SEDCMD seems to be working fine and the unwanted lines disappear, but once I a...
...oom | 10. 73.214. 82| |
Where the number at the beginning is the date in the format YYMMDDHHMMSS. I've tested it in datapreview and the above props.conf settings worked perfectly - h...
For some reason, when I attempt to previewdata in the Aggregate Threshold View window fordata that DEFINITELY exists and I can see it in the preview above the Aggregate Threshold View window, it d...
When I upload any new data to Splunk to review before the index, the preview page is blank and no sample of data is generated
Splunk Version: 7.1.2
Lab environment
Hi,
I was just asked if there was an option to disable the results previewfor a chart for which I replied "Yes, there is". We just want to see the final chart with the full results instead of w...
Hello,
I forgot to have an index ready when I started to ingest data (log file with data from last week to present) from a Universal Forwarder to my indexer. I saw the message warning me of t...