I just noticed, that I have to add the 'typer' command to a search in a dashboard so my cusotm event renderer is active for non admin Users. Is there some documentation that explains when and how e...
I have created a field using the rex command. I have partioned the field into two parts: admin and spss_user. However when I try to search for non admins (tag!=admin), I still get both admin and non_...
I would like a list of all eventtypes associated to an IP on a single table. Is there a way to perform this?
I would like to have a list like.
ip=1.1.1.1 eventtype=google,maps,yahoo,amazon
I've got a long-running search that's spending more time than necessary in command.search.typer. I say more time than necessary because I'm not referencing the eventtypes at all, whether as a field n...
I have a correlation search that includes the field host and is enriched with all the usual fields such as host_nt_host, host_ip, etc from using the get_asset macro.
I know that the host field in ...
I need to create a field aliase by event type. I saw that it is possible to reference an eventtype from the props.conf:
http://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/Propsconf
I am runn...
We have following log file which we need to import in Splunk:
"cdrRecordType","globalCallID_callManagerId","globalCallID_callId","nodeId","directoryNum","callIdentifier","dateTimeStamp","numberPa...
...nd of the search.log: 07-13-2023 11:37:03.695 INFO SearchParser [29042 localCollectorThread] - PARSING: typer | tags
07-13-2023 11:37:03.900 INFO FastTyper [29042 localCollectorThread] - found n...