I am trying to map incoming events to CIM fields using aliases. I followed the documentation here —https://docs.splunk.com/Documentation/Splunk/7.1.3/Knowledge/Addaliasestofields— but it didn't w...
...orking properly. I've just created 7 aliases for a fieldin one sourcetype, and the search results are inconsistent:
index=foo sourcetype=bar | stats count(src),count(shost2),count(shost3),count(t...
Hi
I created a calculated field called "SUCCESS" using SplunkWeb on sourcetype. The calculated field eval condition is like if(TYPE="S", "Success", null). Now I am trying to use this calculated field...
I installed the Cisco eStreamer for Splunk on my Splunk App for Enterprise Security search head, but noticed that fieldaliasescreated by the app are viewable from Search & Reporting, but not v...
...etup might be incorrect. Though for the life of me... it's not working.
Details:
Universal Forwarder installed on the remote server. Index is main.
Website Setup:
Site = TESTSITE Host = T...
...f the fields I just defined are there. Very strange. What am I missing?
15:15:55.664 | [[ACTIVE] ExecuteThread: '2' for queue: 'weblogic.kernel.Default (self-tuning)'] | DEBUG | splunk - | {'e...
Hi,
I need to create a calculated compliance fieldinsplunkweb.
the field should have the values like full, light,expanded and none in it.
Please help me out increating this using eval f...
I've created an extracted field using the field extractor GUI inSplunk Seb. When I created it, there were two values for that field. Now that further logs have been processed, there is a new value f...
I would like to find a detaild tutorial on how to create a splunk app to parse syslogs, with pre-defined field names, not the automatic key/value that splunk is able to detect. I have syslogs with d...
Is there a way to rename the extracted fields in the Interesting Fields section? Example would be
Interesting Fields
xxxxxname1xxxx -> name1
Thanks in advance