About xpac

xpac · ‎05-13-2018

The add-on is available here on Splunkbase. Please follow the provided instructions. You might also want to read this part about "How to ask good questions". Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

xpac · ‎05-13-2018

Hey, the easiest way should be a wildcard lookup, you can find a good explanation on that topic in this answer: https://answers.splunk.com/answers/52580/can-we-use-wildcard-characters-in-a-lookup-table.html You just need to switch the lookup type to wildcard, and append/prepend an * to your message text. 🙂 Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

xpac · ‎05-12-2018

This is also only a problem if it happens constantly. If you only have it happen a few times, it might just be fluctuation in data input.

xpac · ‎05-12-2018

If you're running both on the same system, you might run into trouble because, by default, both want to listen on TCP 9997. Check if both instances actually run, you might have to change the splunkd port of the UF using server.conf.

xpac · ‎05-12-2018

Depending on the compression tool you use (7-zip, WinRAR, etc) you might be able to set those permissions in the tar.gz file directly - you could check that.

xpac · ‎05-12-2018

Ah, yeah, that won't possible with that approach. You could try and put [global] acceptFrom = whatever in the restmap.conf, and just override in your own use case with a more specific stanza. You could also try putting that in a [default] stanza instead of global. Its not explicitly mentioned in the doc, but sometimes things still work. If you try this, please let us know if it worked!

xpac · ‎05-11-2018

I don't see a way besides dedup either. This should be fixed at the source/input, if possible.

xpac · ‎05-11-2018

Check this answer: https://answers.splunk.com/answers/294991/how-to-limit-which-servers-can-connect-to-splunk-f.html

xpac · ‎05-11-2018

Be aware that because the LINE_BREAKER contains \s, your data might actually get broken on every space, tab...

xpac · ‎05-11-2018

Which version did you install?

xpac · ‎05-11-2018

TCP inputs are unencrypted by default, so no, you won't 😉

xpac · ‎05-11-2018

You might get an easy success by using the sourcetype syslog. Syslog often uses the old timestamp style, without year and timezone, and that might end up in bad timestamp detection unless you use sourcetype syslog.

xpac · ‎05-11-2018

Wouldn't it actually be easier like this? index=* "searchString1" [index=* "searchString2" | stats count by key | fields key]

xpac · ‎05-11-2018

This question is pretty basic. Could you please elaborate?

xpac · ‎05-11-2018

I'm pretty sure that | behaves as a character with special meaning in regex (| = OR). Please try escaping them, as this: ||

xpac · ‎05-11-2018

Where do you see that? Forwarder Management? Internal logs?

xpac · ‎05-10-2018

It should be possible, however I'd not advise to do this, as indexers shouldn't run such inputs. I'd suggest you either get one of your existing UFs or HFs to be able to access those SNMP targets, or setup another UF/HF in the right place so it's able to do this.

xpac · ‎05-10-2018

Please add the lines of code where you actually start the search, fetch the results etc.

xpac · ‎05-10-2018

As far as I see this - because the TA ships with a eventgen.conf (which it shouldn't), and to correctly interpret such a config, Splunk would need the eventgen.conf.spec from the eventgen TA. As you don't have that it installed, it complains because it can't verify that .conf file. You can safely ignore this (and better, remove that eventgen.conf from the app at all).

xpac · ‎05-10-2018

Then please upvote/accept the answer. 🙂

xpac · ‎05-10-2018

Does the index jenkins_statistics exist on your system?

xpac · ‎05-10-2018

Check this doc, the Add controls to a dashboard part has an example on the Shared timepicker. 🙂

xpac · ‎05-10-2018

Take a look at splunkd.log in var/log/splunk/ in your Splunk folder, look for any ERROR, WARN, CRIT.

xpac · ‎05-10-2018

Good spot! You still have to either remove the ?P because that's the start of a named capture group, and add FORMAT = yourfieldname::$1, or just add the fieldname after the ?P , like (?P<yourfieldname>yourregex)

xpac · ‎05-10-2018

Would say the same. Don't see a reason against it.

Posts	468
Solutions	70
Karma Given	143
Karma Received	147
Member Since	‎04-29-2018

Online Status	Offline
Date Last Visited	‎01-23-2026 03:59 AM

Re: add on for microsoft sysmon

Re: How to search a matching string using lookup?

Re: increasing maxKBPS for only one splunk forward...

Re: How to configure Universal Forwarder on my per...

Re: App cert validation: Do I need to remove the w...

Re: How to change default "acceptFrom" for all Spl...

Re: Modify _indextime to avoid duplication at inde...

Re: How to change default "acceptFrom" for all Spl...

Re: Why are there no line breaks in the XML Micros...

Re: Login Woes

Re: Does the Greylog deployment forward events to ...

Re: Date parsing incorrect

Re: How to input the value of key from the second ...

Re: Receiving In handler 'savedsearch': Regular ex...

Re: I'm trying to create an event break for a quer...

Re: Universal Forwarder shows up as both hostname ...

Re: SNMP_TA: is it possible to install in indexer?

Re: Splunk Java SDK is not working based on splunk...

Re: Why am I getting an error about No spec file o...

Re: File will not be read, seekptr checksum did no...

Re: Why is the data not getting displayed in Splun...

Re: Dashboard query

Re: Why am I receiving a 500 internal server error...

Re: How to configure props and transforms.conf bas...

Re: Splunk Dashboard Examples on a Search Head Clu...

Join the Conversation