Hi All I did a look around for a syntax definition for SPL in Notepad++ and didn't find one. Attached is my attempt. Feel free to use. if you have any suggestions, changes etc then post a reply. Th...
...t doesn't work for me. The closest I have come is this: | localop | rest .... ```first search key field``` |eval soar_uuid= id+"_RecordedFuture" |append [search index=rf-alerts soar_uuid|rename s...
I maintain an app on Splunk, the AbuseIPDB App. This app uses a collection that holds a set of key-value pairs for things like user state and settings, and it's looked up on every command (i.e. abuse...
So I am attempting to perform two lookups in a single query, and i'm receiving an error. if I remove the second lookup (doesn't matter which one) then my search returns results normally.
Q: is t...
In the fundamentals 1 course lab 8 tells us to:
"As a best practice and for best performance, place dedup as early in the search as possible." (page 4)
But the quick refence guide tells us that:...
Has anybody experienced installing xmlutils app in Splunk clustered environment? I receive below error with 'xmlprettyprint' command only shcluster installation:
[myindexer1insite1] Search Factory:...
...he script. This fails, however, due to the firewall not being open for the script to run.
I have local=true set on the lookup command, and also used localop
Search:
| head 1 | localop | l...
Hi,
There are 2 splunk servers( A and B) that have differente data and indexes. I have setup distributed search from A to B and B to A.
searches done from A to B: everything is working as expec...