Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About lloydknight
lloydknight
Builder
Member since:
08-11-2015
09-21-2024
Community Statistics
| Posts | 138 |
| Solutions | 8 |
| Karma Given | 16 |
| Karma Received | 15 |
| Member Since | 08-11-2015 |
Activity Feed
- Got Karma for Re: Password Universal Forwarder. 06-05-2020 12:51 AM
- Got Karma for Re: How to not sort CSV file fields. 06-05-2020 12:50 AM
- Karma Re: Starting Splunk Light for skoelpin. 06-05-2020 12:49 AM
- Got Karma for Re: How to Identify sourcetypes by logs. 06-05-2020 12:49 AM
- Got Karma for Re: How to Identify sourcetypes by logs. 06-05-2020 12:49 AM
- Got Karma for Re: How does the Splunk internal search functionality work?. 06-05-2020 12:49 AM
- Got Karma for Re: Combining unique field values. 06-05-2020 12:49 AM
- Got Karma for Re: ITSI installation. 06-05-2020 12:49 AM
- Got Karma for Re: How does reindexing data count against the license?. 06-05-2020 12:49 AM
- Got Karma for Re: Starting Splunk Light. 06-05-2020 12:49 AM
- Got Karma for Re: How do you detect WannaCry by Splunk Enterprise Security Content Updates?. 06-05-2020 12:49 AM
- Got Karma for Re: Explain Data Models (Like I'm Four). 06-05-2020 12:49 AM
- Karma Re: How to get my eval statement to output a certain value, even if there is no result for a certain field? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: Splunk IT Service Intelligence: How is the Importance Value for KPIs calculated that contribute to the Service Health Score? for appache. 06-05-2020 12:48 AM
- Karma Re: Splunk Machine Learning Toolkit: Added CorrelationMatrix algo but cannot import name BaseAlgo for aljohnson_splun. 06-05-2020 12:48 AM
- Karma Re: Splunk Machine Learning Toolkit: Added CorrelationMatrix algo but cannot import name BaseAlgo for aljohnson_splun. 06-05-2020 12:48 AM
- Karma Re: Conflicting multiple values using eval command for DalJeanis. 06-05-2020 12:48 AM
- Karma Re: Conflicting multiple values using eval command for richgalloway. 06-05-2020 12:48 AM
- Karma Re: How do I handle fields with nothing between a delimiter on a rex field extraction? for Ravan. 06-05-2020 12:48 AM
- Karma Re: Splunk ITSI 2.2.0 integration to Remedy 7.6.04 for hjauch_splunk. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-26-2018
04:40 AM
2 Karma
Also, check this link for the list of pretrained sourcetypes in case your sourcetypes are already in splunk.
... View more
03-07-2018
06:26 PM
Hello shawno,
Bunch of messages are happening from your posted splunkd.log.
You might want to address some of them if they're part of your requirement too.
Most of the messages are straightforward and can addressed individually.
For example, /tmp/hsperfdata_root/3843 is being ignored due to binary.
Check this https://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/Propsconf#Binary_file_configuration
... View more
03-07-2018
06:19 PM
Hello @shawno
Kindly check this similar question below:
https://answers.splunk.com/answers/72562/how-to-reindex-data-from-a-forwarder.html
Hope it helps!
... View more
03-07-2018
04:26 AM
does it shows Invalid username or password upon Signing in?
... View more
03-07-2018
02:59 AM
1 Karma
Hello @ramarcsight
Assuming your Indexers are clustered:
Given that data will be replicated on Index Clustering, try this link below to disable replication to specific peers (your EMMA search peer 1 and EMMA search peer 2).
https://answers.splunk.com/answers/376042/is-it-possible-to-disable-replication-to-specific.html
Assuming your Indexers are non-clustered:
Try to forward your data on the EMMA Indexer 1 and EMMA Indexer 2 only.
Check this link below:
http://docs.splunk.com/Documentation/Splunk/4.3.3/Deploy/Routeandfilterdatad#Filter_data_by_target_index
Related questions on this case:
https://answers.splunk.com/answers/55131/specific-index-forwarding-to-external-index-tier.html
https://answers.splunk.com/answers/124648/how-to-send-only-certain-indexes-from-a-search-head-to-the-indexers-but-not-all.html
Hope it helps!
... View more
03-07-2018
01:07 AM
Hello @chillsgrove
you mean in Deep Dive upon drilldown on KPIs inside the Glass Table? As Glass Tables can be just a blank canvass or just an image (usually an existing architectural diagram).
... View more
03-05-2018
11:59 PM
Hello @suresh364
So you want to know the status of the Process, which i assume is a "KPI" inside the Glass Table, that updates every 11AM daily?
Can you please explain it further?
... View more
03-05-2018
01:17 AM
Hello @pradiptam
Assuming your sample event looks like this.
MY_TEST;0;12/12/2014 23:32:14:9000;1;MK69KSS97;TRKCHOP;;4480;EXPORT THE TALISMAN;9;0;0;;Q:\TRKCHOP\POMS\KSKAGNE\IN\STAKK.TXT
MY_TEST;0;12/12/2014 23:31:14:9000;1;MK69KSS97;TRKCHOP;;4480;EXPORT THE TALISMAN;9;0;0;;Q:\TRKCHOP\POMS\KSKAGNE\IN\STAKK.TXT
MY_TEST;0;12/12/2014 23:30:14:9000;1;MK69KSS97;TRKCHOP;;4480;EXPORT THE TALISMAN;9;0;0;;Q:\TRKCHOP\POMS\KSKAGNE\IN\STAKK.TXT
try this search:
your base search | rex field=_raw ".*\\w+\\w+\\w+\\w+(?<your_field_name>\w+\.\w+)"
Hope it helps!
... View more
03-05-2018
12:43 AM
Will you kindly provide some sample events for us to better understand and answer your question?
Much appreciated!
... View more
03-04-2018
07:21 PM
Hello,
what are the possible impacts in doubling the max_content_length ?
... View more
01-04-2018
08:19 PM
Hello @auaave
will you kindly share a sample log for us to better address your question? Thank you.
... View more
11-02-2017
09:10 PM
can anyone confirm if TA for Trendmicro is exclusive to Splunk ES only? Thanks.
... View more
10-26-2017
09:09 AM
Hello rjbonilla
Have tried checking the splunkd.log for errors on the ldap authentication?
... View more
10-25-2017
07:52 AM
Hello @kannu
Please see links below:
Launch new window
https://answers.splunk.com/answers/13306/simple-syntax-to-launch-new-window-when-clicking-on-link-in-dashboard.html
Using iframe
https://answers.splunk.com/answers/432153/how-to-embed-an-external-page-in-a-dashboard-panel.html
Hope it helps!
Thanks!
... View more
10-25-2017
07:11 AM
Hello ikulcsar
I would highly suggest to download the currently installed 4.3.x as a backup installer in case you would want to revert when an issue arises and backup your current configurations before upgrading.
For some reason (by my experience on installing UFs on different types of OS), I have encountered some version incompatibility issues esp. on AIX and solved some of those by downgrading or upgrading the UF. Also check the release notes of the UF that you will install. After the installation/upgrade, always check splunkd.log for errors.
Hope it helps!
Thanks!
... View more
10-23-2017
11:51 PM
Hello @inventsekar
I believe he/she is referring to the previous .conf presentation decks.
... View more
10-23-2017
10:19 PM
Hello @k_harini
May I ask if what are you trying achieve?
try changing the sourcetype name per index.
... View more
10-23-2017
06:58 PM
Hello @danielwan
try this app instead
https://splunkbase.splunk.com/app/3760/
This will monitor your Splunk Searches and Schedules and Splunk Infrastructure // knowledge Objects.
Or you can install the Splunk Add-on for Unix and Linux to capture the processes running in the background.
Hope it helps!
Thanks
... View more
10-21-2017
10:12 PM
Hello @romux
If you mean you want to Monitor Splunk ITSI itself, you can just go to Settings > Monitoring Console since ITSI is just on top of Splunk Enterprise.
Hope it helps!
Thanks!
... View more
10-21-2017
10:00 PM
Hello @sbowser_splunk
I believe it would appear static if the health scores and kpis' values were not changing values
In addition, as per Splunk Doc,
The minimum time range that can be selected in the time picker is 45 minutes. This is the minimum length of time needed to ensure all KPI data is available. If you select Last 15 minutes, or any time range that is less than 45 minutes, the time picker is automatically set to 45 minutes.
Hope it helps!
Thanks!
... View more
10-21-2017
09:29 PM
1 Karma
Hello @test_qweqwe
It's like a whole set of logs automatically arranged with their rightful fields.
I'll give an example:
Splunk field:
chocolate
Field values of chocolate:
- dark
- milk
drilldown on field values:
dark
- 40%
- 50%
- 80%
milk
- goat's milk
- soy milk
- cow's milk
As per Splunk docs,
Data models are composed of datasets, which can be arranged in hierarchical structures of parent and child datasets. Each child dataset represents a subset of the dataset covered by its parent dataset.
Hope it helps!
Thanks!
... View more
10-21-2017
08:38 PM
Hello @romelrkhan
assuming 389=default, try this
index=indexname |eval input2=if(input2=389,default,input2) | table input1 input2 output
or give a more detailed background on the other fields.
Hope it helps!
Thanks!
... View more
10-20-2017
10:58 PM
Have you checked the permission of the cpu.sh script? The script should be in executable permission. Also check the splunkd.log for errors.
Hope it helps!
Thanks!
... View more
10-19-2017
11:58 PM
you can view most of the details concerning your Splunk Instance in the Settings > Monitoring Console Just drilldown on the CPU Usage and Memory Usage and from there, you can see the historical Resource Usage of your Splunk Instance.
... View more
10-19-2017
10:16 PM
what servers are you monitoring? what do you mean by all-in-one Splunk? is that a single instance Splunk? if you're using an add-on to monitor some servers, index=os is for unix systems and index=perfmon is for windows systems
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-21-2024
02:09 PM
|
Karma from
Karma given to
