Is there a quick way on getting a list of all events coming in and all feeds coming in?
Would it also be possible to see which feeds are being used for the data models?
And also getting a list of...
...or your help I am now helpning ut a company that has splunk for the iot stuff and they are a welding company and want me to use SPL to count the number ofevents (alerts) between sequeantial stages of...
...ourcetype specific processing/rewriting (fx using SEDCMD) on heavy forwarder B before sending the events to a syslog server.
I am having difficulties in getting the forwarded events to go through local processing...
I am getting this error frequently and I can see the index queue is 99% for many indexers in the cluster. I am not able to figure out what is causing this issue. During this period indexing is consid...
...nly 1 event in each bucket but that seems hacky at best and probably won't scale to long time ranges?
I'm guessing i need to process the arrays into a single set of values per event, ideally at s...
Hey All,
I am looking to add a blacklist entry to our inputs for our Windows UF's that would blacklist based on the event code, a process name (with wildcard path), and a specific account name....
...100 WARN AggregatorMiningProcessor - Breaking event because limit of 256 has been exceeded
But when I look at this specific sourcetype and data source, there are no events with more than one l...
...": { "hello": "world" }
}
But what if I want to process the timestamp directly from the event, like this:
{
"host": "localhost",
"source": "datasource",
"s...
Hi,
Is it possible to create a search, that finds all "ERROR" messages in search.log for all search jobs?
I tried to search it in _internal - but not found.