Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About sk314
sk314
Builder
Member since:
06-06-2013
07-15-2021
Community Statistics
| Posts | 206 |
| Solutions | 27 |
| Karma Given | 94 |
| Karma Received | 74 |
| Member Since | 06-06-2013 |
Activity Feed
- Got Karma for Re: LDAP authentication in Splunk is not working. 07-21-2021 04:56 PM
- Got Karma for Re: How to route and filter data on the Heavy Forwarder to separate indexer groups?. 11-04-2020 07:10 AM
- Karma Re: What are the best practices for defining source types? for jkat54. 06-05-2020 12:50 AM
- Karma Re: What are the best practices for defining source types? for skoelpin. 06-05-2020 12:50 AM
- Karma Re: What are the best practices for defining source types? for skoelpin. 06-05-2020 12:50 AM
- Karma Re: upgrade to 7.2 fails with "ERROR while running mongod-fix-voting-priority migration." for sylim_splunk. 06-05-2020 12:50 AM
- Got Karma for Re: Where can I download the Splunk Supporting Add-on for Active Directory 2.2.0?. 06-05-2020 12:50 AM
- Karma Re: How to differentiate between different redis hosts using Redis Add-on for Splunk? for xavierashe. 06-05-2020 12:49 AM
- Got Karma for Re: How to differentiate between different redis hosts using Redis Add-on for Splunk?. 06-05-2020 12:49 AM
- Got Karma for Re: How to differentiate between different redis hosts using Redis Add-on for Splunk?. 06-05-2020 12:49 AM
- Got Karma for Re: Can Splunk Enterprise Security use macros from another app?. 06-05-2020 12:49 AM
- Karma Re: Why am I unable to generate a diag from an indexer cluster peer after upgrading to Splunk 6.4.0? for hexx. 06-05-2020 12:48 AM
- Karma Re: How to append a single value to multiple rows in my table? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: How can we exclude weekends from the count of the number of days for the age of a ticket? for sundareshr. 06-05-2020 12:48 AM
- Karma Re: Error rendering Clustered Single Value Map Visualization visualization for shaskell_splunk. 06-05-2020 12:48 AM
- Karma Re: Cluster bucket rebalancing: How long is too long? for twinspop. 06-05-2020 12:48 AM
- Karma Re: Mysterious data spike for mattymo. 06-05-2020 12:48 AM
- Got Karma for Re: Why am I unable to see all LDAP users under Access Controls?. 06-05-2020 12:48 AM
- Got Karma for Re: How to troubleshoot Splunk 6 search performance issues?. 06-05-2020 12:48 AM
- Got Karma for Re: Can a Universal Forwarder be used to forward indexed data on a search head to an indexer?. 06-05-2020 12:48 AM
Topics I've Started
05-24-2016
05:35 PM
Have you tried naming the second field in your header? Just a guess.
... View more
05-24-2016
05:27 PM
Did you check if splunk is automatically assigning the first field as the timestamp? try extending your search to "All Time" and see if you get more results.
... View more
05-16-2016
10:57 AM
Have you tried using the transaction command on "field" and "user"? Ref: http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Transaction
The transaction command adds a duration field that you could use.
... View more
05-13-2016
11:47 AM
Does the outputs.conf have this line
[indexAndForward]
index = false
Ref: http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Forwardsearchheaddata
... View more
04-26-2016
01:29 PM
1 Karma
You are welcome. To be fair, It's a couple of links down the chain...
... View more
04-26-2016
01:16 PM
2 Karma
From the docs at http://docs.splunk.com/Documentation/Splunk/6.4.0/Knowledge/Configurebatchmodesearch#Configure_batch_mode_search_parallelization
You can enable and configure batch mode search parallelization with an additional set of limits.conf parameters. This is an indexer-side setting. It needs to be configured on all of your indexers, not your search head(s).
... View more
03-21-2016
09:13 PM
I am not sure why you are deduping. Assuming that's what you want...try this:
index=someindex queryType="ts" filename=RECON OR filename=PNASC.HRBDT status=1| dedup filename | stats count by filename
... View more
02-12-2016
03:52 PM
Have you checked which roles are being applied to the user. If any one of the roles has those capabilities, they would automatically be inherited.
... View more
02-12-2016
03:00 PM
@somesoni2 provides a much better regex (unsurprisingly) and also that would work for any file extension. I will now go ahead and drown in my sorrow.
... View more
02-12-2016
02:52 PM
You should try Field Extractionsin Splunk : http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/ExtractfieldsinteractivelywithIFX
For the example, you could try something like this:
| rex field=source "(?<=\\\)(?[^\\\]+(?=.log).log)"
... View more
what sorcery is this? 🙂
... View more
02-09-2016
04:18 PM
From the documentation at http://docs.splunk.com/Documentation/Splunk/6.3.3/Viz/DashboardPDFs
PDFs for dashboards with multiple panels in a row might generate with only a single panel per row.
Look under the "Limitations to PDF generation" heading.
... View more
02-09-2016
04:12 PM
Have you followed the procedure listed here?
http://docs.splunk.com/Documentation/Splunk/6.2.7/DistSearch/Connectclustersearchheadstosearchpeers
... View more
02-09-2016
04:09 PM
Are your indexers also in a cluster?
... View more
02-09-2016
03:57 PM
Assuming the file is already indexed in Splunk, try this:
| rex field=_raw "Elapsed Time:\s(?<elapsed_time>[^ \n\r]+)"
(Note: there's a space before \n\r )
... View more
07-30-2015
06:31 PM
1 Karma
I recently installed S.o.S on our clustered Splunk(6.2) instance. As per @bmacias84, I went ahead and configured DMC. It's really cool! Thanks for the tip.
... View more
07-30-2015
02:43 PM
I have a similar setup (2 search heads in a cluster, 3 clustered indexers).It's the same process. Install the S.o.S app on the search heads using the deployer.
... View more
07-30-2015
12:41 PM
1 Karma
check out this post: http://answers.splunk.com/answers/81351/what-are-the-best-practices-for-installing-sos-on-cluster.html
... View more
07-29-2015
05:23 PM
post some sample logs or sample extracted user agent strings and I'm sure one of us could help you with the regex.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-15-2021
10:20 AM
|
Karma given to
