I am trying to map incoming events to CIM fields using aliases. I followed the documentation here —https://docs.splunk.com/Documentation/Splunk/7.1.3/Knowledge/Addaliasestofields— but it didn't w...
...orking properly. I've just created 7 aliases for a fieldin one sourcetype, and the search results are inconsistent:
index=foo sourcetype=bar | stats count(src),count(shost2),count(shost3),count(t...
Hi
I created a calculated field called "SUCCESS" using SplunkWeb on sourcetype. The calculated field eval condition is like if(TYPE="S", "Success", null). Now I am trying to use this calculated field...
I installed the Cisco eStreamer for Splunk on my Splunk App for Enterprise Security search head, but noticed that fieldaliasescreated by the app are viewable from Search & Reporting, but not v...
...etup might be incorrect. Though for the life of me... it's not working.
Details:
Universal Forwarder installed on the remote server. Index is main.
Website Setup:
Site = TESTSITE Host = T...
...f the fields I just defined are there. Very strange. What am I missing?
15:15:55.664 | [[ACTIVE] ExecuteThread: '2' for queue: 'weblogic.kernel.Default (self-tuning)'] | DEBUG | splunk - | {'e...
Hi,
I need to create a calculated compliance fieldinsplunkweb.
the field should have the values like full, light,expanded and none in it.
Please help me out increating this using eval f...
I've created an extracted field using the field extractor GUI inSplunk Seb. When I created it, there were two values for that field. Now that further logs have been processed, there is a new value f...
Can someone help with Splunk Placeholder?
What is Placeholder? How to create it? How does it work in lookup?
How to make changes to existing Placeholder