Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About sk314
sk314
Builder
Member since:
06-06-2013
07-15-2021
Community Statistics
| Posts | 206 |
| Solutions | 27 |
| Karma Given | 94 |
| Karma Received | 74 |
| Member Since | 06-06-2013 |
Activity Feed
- Got Karma for Re: LDAP authentication in Splunk is not working. 07-21-2021 04:56 PM
- Got Karma for Re: How to route and filter data on the Heavy Forwarder to separate indexer groups?. 11-04-2020 07:10 AM
- Karma Re: What are the best practices for defining source types? for jkat54. 06-05-2020 12:50 AM
- Karma Re: What are the best practices for defining source types? for skoelpin. 06-05-2020 12:50 AM
- Karma Re: What are the best practices for defining source types? for skoelpin. 06-05-2020 12:50 AM
- Karma Re: upgrade to 7.2 fails with "ERROR while running mongod-fix-voting-priority migration." for sylim_splunk. 06-05-2020 12:50 AM
- Got Karma for Re: Where can I download the Splunk Supporting Add-on for Active Directory 2.2.0?. 06-05-2020 12:50 AM
- Karma Re: How to differentiate between different redis hosts using Redis Add-on for Splunk? for xavierashe. 06-05-2020 12:49 AM
- Got Karma for Re: How to differentiate between different redis hosts using Redis Add-on for Splunk?. 06-05-2020 12:49 AM
- Got Karma for Re: How to differentiate between different redis hosts using Redis Add-on for Splunk?. 06-05-2020 12:49 AM
- Got Karma for Re: Can Splunk Enterprise Security use macros from another app?. 06-05-2020 12:49 AM
- Karma Re: Why am I unable to generate a diag from an indexer cluster peer after upgrading to Splunk 6.4.0? for hexx. 06-05-2020 12:48 AM
- Karma Re: How to append a single value to multiple rows in my table? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: How can we exclude weekends from the count of the number of days for the age of a ticket? for sundareshr. 06-05-2020 12:48 AM
- Karma Re: Error rendering Clustered Single Value Map Visualization visualization for shaskell_splunk. 06-05-2020 12:48 AM
- Karma Re: Cluster bucket rebalancing: How long is too long? for twinspop. 06-05-2020 12:48 AM
- Karma Re: Mysterious data spike for mattymo. 06-05-2020 12:48 AM
- Got Karma for Re: Why am I unable to see all LDAP users under Access Controls?. 06-05-2020 12:48 AM
- Got Karma for Re: How to troubleshoot Splunk 6 search performance issues?. 06-05-2020 12:48 AM
- Got Karma for Re: Can a Universal Forwarder be used to forward indexed data on a search head to an indexer?. 06-05-2020 12:48 AM
Topics I've Started
07-23-2015
01:17 PM
Could you post a sample event in its entirety?
... View more
07-23-2015
11:39 AM
Try this:
... | rex field=_raw "Code=\s*(?<code>\d+)" | table code
... View more
07-22-2015
04:59 PM
1 Karma
In addition, look under the "Storage requirement examples" section at the following link for splunk indexer clusters.: http://docs.splunk.com/Documentation/Splunk/6.2.4/Indexer/Systemrequirements
... View more
07-14-2015
12:02 PM
2 Karma
ahh, just add those cases in the case statement like so
sourcetype="socialist action" "government" OR "govern" OR "race" OR "racist" | eval word = case(word=="racist","race", word =="govern", "government", word =="government", "government", word=="race", "race") | stats count by word
... View more
07-14-2015
11:44 AM
1 Karma
Try this:
sourcetype="socialist action" "government" OR "govern" OR "race" OR "racist" | eval word = case(word=="racist","race", word =="govern", "government") | stats count by word
EDIT: assuming you have a field named "word" already extracted/populated
... View more
07-13-2015
01:08 PM
This might work:
earliest=-2w latest=-d index=int sourcetype=threat NOT [search earliest=-4w latest=-2w index=int sourcetype=threat | stats count by name | sort -count | head 10 | table name ] | stats count by name | sort -count | head 10 | table name
... View more
06-25-2015
02:22 PM
1 Karma
Not again! 😐 😛
... View more
06-25-2015
02:12 PM
1 Karma
Have you tried reading up on Field Extractions in Splunk?
Ref: http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/ExtractfieldsinteractivelywithIFX
You can also specify transforms for your data ( transforms.conf + props.conf)
Ref: http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles
... View more
06-24-2015
02:21 PM
why can't you set frozenTimePeriodInSecs in indexes.conf for each index? just curious.
... View more
06-24-2015
11:46 AM
FWIW, I use splunk 6.2.2 and had a csv file with a field named source. It got converted to extracted_source. you could simply rename the field in your logs or rename extracted_source to something else using the rename command.
... View more
06-22-2015
04:40 PM
Have you tried the delta command?
Ref: http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Delta
... View more
06-09-2015
01:19 PM
You could try using the vSphere SDK for this?
... View more
06-08-2015
02:08 PM
2 Karma
In addition to this (quite comprehensive) answer, please be aware of what gets replicated across search head cluster and what doesn't. In general knowledge-objects get replicated, for everything else use the deployer to maintain consistency across search heads. If you are not careful with this, you'll end up with search heads with inconsistent settings.
For reference: http://docs.splunk.com/Documentation/Splunk/6.2.3/DistSearch/HowconfigurationworksinSHC
... View more
05-29-2015
10:15 AM
Ahh....ui_inactivity_timout specifies interval when notification is sent. You also need to update tools.sessions.timeout in the same conf file. I misread the documentation.
... View more
05-28-2015
05:58 PM
Check the answer posted here:
http://answers.splunk.com/answers/38832/how-do-i-set-up-the-s-o-s-app-to-monitor-splunks-system-resource-consumption.html
Also, check the following answer for best practices.
http://answers.splunk.com/answers/38091/best-practices-to-deploy-the-s-o-s-app-in-a-distributed-search-environment.html
... View more
05-28-2015
05:54 PM
1 Karma
Check out web.conf, particularly the setting under ui_inactivity_timeout.
Ref: http://docs.splunk.com/Documentation/Splunk/6.2.3/admin/Webconf
... View more
05-28-2015
05:50 PM
As per the documentation, Splunk will check against all configured access strategies. By default, it searches Splunk local users first and then any other strategy configured.
(Ref: http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureSplunkToUsePAMOrRADIUSAuthentication )
... View more
05-28-2015
05:48 PM
what do you mean get rid?
... View more
05-28-2015
05:43 PM
True. It also could be related to the timing. When monitoring for each file/index started. Having said that, you don't really need a confirmation if you test it with different sources. Your real world use-case won't ever have same data! My 2 cents.
... View more
05-28-2015
05:20 PM
Splunk performs a CRC check on a small portion of the file to check if it has already been indexed. May be this is why it is not being re-indexed. Try changing the file contents or use different files.
... View more
05-20-2015
08:26 PM
Search head distributes the search to all peers and combines the results. So you'll see results from both. (if it matches the search query ofcourse!)
... View more
05-20-2015
04:28 PM
I think you should look at the other option. You could make it a non clustered search peer and then retire it once the data on it becomes too old. New data will anyway be getting indexed on the new system.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-15-2021
10:20 AM
|
Karma given to
