I just noticed, that I have to add the 'typer' command to a search in a dashboard so my cusotm event renderer is active for non admin Users. Is there some documentation that explains when and how e...
I have created a field using the rex command. I have partioned the field into two parts: admin and spss_user. However when I try to search for non admins (tag!=admin), I still get both admin and non_...
I would like a list of all eventtypes associated to an IP on a single table. Is there a way to perform this?
I would like to have a list like.
ip=1.1.1.1 eventtype=google,maps,yahoo,amazon
I have a correlation search that includes the field host and is enriched with all the usual fields such as host_nt_host, host_ip, etc from using the get_asset macro.
I know that the host field in ...
I need to create a field aliase by event type. I saw that it is possible to reference an eventtype from the props.conf:
http://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/Propsconf
I am runn...
...xtracted, and disable the typer and lookups components by using dispatch.* settings in savedsearches.conf , but I'm trying to keep this question about understanding the execution cost info, and less a...
We have following log file which we need to import in Splunk:
"cdrRecordType","globalCallID_callManagerId","globalCallID_callId","nodeId","directoryNum","callIdentifier","dateTimeStamp","numberPa...
Hi everyone,
I am running Splunk 6.2.2 on a distributed setup with 3 search heads in a search head cluster and 4 non-clustered indexers. Splunk seems sluggish and I am trying to figure out why st...