...bsp; The issue which we are facing here is when we run the same query for that time period after a few days( say a month), we are observing the value inside the index=xyz_summary (i.e. count valu...
...egarding this like: https://community.splunk.com/t5/Getting-Data-In/Duplicate-host-field-after-indexing-JSON-event/m-p/292472 unfortunately i'm not able to change the json field name at the source. R...
.../sizes ; done
--
This query shows me the size of each folder for each input. I use this to find the three biggest folders then I changed the logging/indexing to only look at log files, h...
...opied the TA-sysmon folder to the deployment server (\Splunk\etc\deployment-apps\TA-microsoft-sysmon) and then deployed it to my UF running on my test host.
I ran my handy query
|tstats values(s...
...he API host, etc. The only advanced option I changed was the index to send events to (and I *did* change the macro to the same value), I left everything else the same.
I'm g...
...e but I have two problems: 1.) when I use the gui to get data in I can only choose a given value for hostname pre indexing or use regex only for the path in which my logfile lies. W...
...in/oracle_who, took 81.59 milliseconds to run, 1825 bytes read". But if I look for the data in splunk, it's nowhere to be found.
If I change the time separator to a space, Splunk indexes the data, b...
I try to use summary indexing to improve search efficiency, but it's resulting in an error because of the wrong _time value.
Event timestamp 6/9/15 10:59:54.960 PM is reset to 6/9/15 12:00:0...
...ourcetype = action
[source::.../action_log.txt]
TRANSFORMS-action-host=action_host_override
I don't know if that needs to be in two stanzas or one - I've tried both with no change either way. Namely, t...
...t;/table>
</panel>
</row>
</form>
So, it pulls a list of the indexes that are currently being updated (just chose a noisy search field values of for the multiselect) and t...