Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About cphair
cphair
Builder
Member since:
03-07-2012
06-05-2020
Community Statistics
| Posts | 220 |
| Solutions | 28 |
| Karma Given | 115 |
| Karma Received | 106 |
| Member Since | 03-07-2012 |
Activity Feed
- Got Karma for Re: Search a field for multiple values. 03-22-2024 10:26 AM
- Got Karma for Re: How to find earliest event based on Event code for once server?. 02-10-2021 12:38 PM
- Got Karma for Re: How do you set an input's conditional change to match a literal * with Simple XML?. 11-15-2020 03:03 PM
- Got Karma for identifying sourcetypes by index. 10-29-2020 07:40 AM
- Karma How to set the default value of a multiselect input box to the results of a search? for coleman07. 06-05-2020 12:48 AM
- Karma Re: How can I return specific results using head and tail commands? for maciep. 06-05-2020 12:48 AM
- Karma How to search a lookup table and return the matching term? for clv1clv1. 06-05-2020 12:48 AM
- Karma Re: How to search a lookup table and return the matching term? for gokadroid. 06-05-2020 12:48 AM
- Karma Re: How to replicate a Search Head Cluster's KV Store lookup data to an Indexer? for dwaddle. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk Enterprise Security: How to troubleshoot why the threat_activity index is no longer populating with data?. 06-05-2020 12:48 AM
- Karma Re: Method to rename field to value of another field for acharlieh. 06-05-2020 12:47 AM
- Karma Re: Distributed Search Environment: Do accelerated data models reside on the indexer or search head? for helge. 06-05-2020 12:47 AM
- Karma How extract data model fields using REST search? for Runals. 06-05-2020 12:47 AM
- Karma Re: Extract Data Model fields using REST search for reed_kelly. 06-05-2020 12:47 AM
- Karma How to re-run a relative time search on click of the submit button? for helenashton. 06-05-2020 12:47 AM
- Karma Re: How to re-run a relative time search on click of the submit button? for masonmorales. 06-05-2020 12:47 AM
- Karma Re: can I extract a field with a regexed dynamic fieldname? for MuS. 06-05-2020 12:47 AM
- Karma Re: Removing null columns from a table for pj. 06-05-2020 12:47 AM
- Karma Re: Getting error "Error in 'chart' command: The argument ' ' is invalid." when using "chart-count-over-by" clause in chart with post-process search for ishangajera. 06-05-2020 12:47 AM
- Karma Why are values for a dynamic checkbox not being populated by variables passed from 2 drop-downs? for vdevarayan. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-20-2015
05:49 AM
You're probably only looking at the current app context. You need to wildcard your query to force it to look at all apps:
| rest /servicesNS/-/-/saved/searches
Add a filter for is_scheduled=1 to see only the scheduled jobs. See https://answers.splunk.com/answers/221242/is-there-a-way-to-identify-all-scheduled-searches.html for details.
... View more
10-01-2015
05:12 AM
Yep, understood that Win10 wasn't supported when you first answered this. Was just posting to clarify for people who came across this question now.
... View more
09-29-2015
05:18 AM
Windows 10 is listed as a supported OS for 6.3: http://docs.splunk.com/Documentation/Splunk/6.3.0/Installation/SystemRequirements
... View more
09-26-2015
05:08 PM
Technically I could edit the created file, but there are a bunch like this. I don't have the ability to change the source. There's no other date information in the events.
... View more
09-26-2015
04:52 AM
I have a CSV dataset with (only) a year field. I'd like to use the year as a partial timestamp on the events and then use either January 1 12:00 or the current datetime for the rest of the timestamp. Is that possible? I've been playing around with TIME_FORMAT trying things like
%Y/1/1:12:00, but I haven't gotten anything to work yet.
... View more
09-16-2015
06:58 AM
Some code editors automatically indent with tabs, and it is not unusual to add whitespace within a search tag for readability on a long search. It is silly that Splunk can handle spaces but not tabs within tags. I have already reported this as a bug and I hope it is fixed in 6.3.
... View more
08-27-2015
10:22 AM
Ugh, it ended up being an error earlier in the search--nothing to do with the brackets. Printing out the field values like you suggested below showed it up. Thanks for your help.
... View more
08-27-2015
10:10 AM
Your if-statement isn't searching over anything or assigning anything anywhere; it's just making a calculation in thin air. If you really only have two input choices and four servers for each, you could hardcode them into the search:
... | where ($token$="1" AND (host=a OR host=b OR host=c OR host=d)) OR ($token$="2" AND (host=e OR host=f OR host=g OR host=h))
Another alternative is to code the server list into your token value, if you don't actually need that value for anything else and it's just there as a placeholder:
<choice value="host=a OR host=b OR host=c OR host=d">1</choice>
<choice value="host=e OR host=f OR host=g OR host=h">2</choice>
Then you could use the token directly in your base search, which is more efficient:
index=foo $token$ ...
... View more
08-27-2015
06:13 AM
Yes--no luck.
... View more
08-27-2015
05:22 AM
Yes, it is already enclosed in quotes. I've had to do that for tokens with special characters before, but the brackets seem to be really confusing something.
... View more
08-26-2015
08:16 AM
I have a field that contains square brackets, and I can't get my dashboard to search on it properly when it's used in an input token. It keeps telling me no results are found. The search works fine from the search bar, and the token value is being populated as I would expect in the URL (with the brackets encoded of course), so I'm guessing something is funny with the token interpolation. Is there some special way I need to handle brackets? I've tried escaping them with the backslash (multiple times), using their HTML encoding value, trying to escape with quotes...no luck.
Example:
<pre><choice value="foo[bar]">Foo Bar</choice></pre>
... View more
08-11-2015
08:57 AM
Thanks for the tip that sparklines are multivalued fields. It helped me figure out that to preserve an already-created sparkline in a table in further statistical searches, you need to use stats list(YourSparklineField).
... View more
07-15-2015
06:46 AM
@black123, did you get an answer from Splunk about this?
... View more
07-07-2015
05:21 AM
@SloshBurch, did you get an answer from Splunk on this? I'm seeing a similar behavior.
... View more
06-25-2015
05:36 AM
@ziegfried, in 6.2 there's no separate splunkweb service anymore. Does that mean I need to do a full Splunk restart to pick up new JS files?
... View more
05-14-2015
11:40 AM
1 Karma
It's not once per event, it's once per SID. One event with a lot of SIDs causes multiple lookups against the DC. Also note that the current forwarder behavior is to contact the PDC first and then revert to a local DC, so all the load will be initially directed against your PDC. This is supposed to be fixed in an upcoming version. If you don't have a compelling reason to enable SID resolution, I would turn it off.
... View more
05-07-2015
06:41 AM
2 Karma
See http://wiki.splunk.com/Community:HowIndexingWorks for a summary of which settings take effect at which locations.
... View more
02-25-2015
05:34 AM
It seems to undo the multivaluing if I run a stats first(*) by _time host RecordNumber, but this seems a little silly.
... View more
02-25-2015
05:29 AM
Splunk automatically extracts certain fields in my Windows event logs, the ones that are specified key=value. Sometimes the Message field has its own set of key-value pairs separated by a colon, one per line, and I want to treat those as named fields too. If I run extract pairdelim="[\r\n]+" kvdelim=":" , it extracts the key-value pairs in the Message field as new fields, but it also makes multivalue every field that had been extracted before. Is there a way to tell it not to do that?
... View more
02-12-2015
11:54 AM
1) I was trying to indicate that the name of the capturing group should match the string directly in front of it. I already knew the regex I mentioned didn't work. Your proposed format doesn't work for me either, though.
2) Events are strictly single-line.
... View more
02-12-2015
07:17 AM
Yes, I did. It doesn't work.
... View more
02-12-2015
07:00 AM
You'll need to fix the formatting on your regex so it displays properly in the browser; we can't read it as is. Edit your question and substitute & # 92; (with no spaces) for all the backslashes.
... View more
02-05-2015
10:25 AM
Right, I forgot TRANSFORMS was search-time. But neither of the syntaxes specified in transforms.conf spec are working. I tried FORMAT=$1::2 $3::$4 $5::$6, and I tried the _KEY_X/_VALUE_X approach. Do I need to run three separate stanzas? That seems inefficient too.
... View more
02-05-2015
07:01 AM
Wouldn't that make it an index-time extraction and hurt performance? All I need is the search-time extraction.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma from
| User | Karma Count |
|---|---|
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
