Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About helge
helge
Builder
Member since:
11-20-2012
07-05-2023
Community Statistics
| Posts | 193 |
| Solutions | 14 |
| Karma Given | 277 |
| Karma Received | 65 |
| Member Since | 11-20-2012 |
Activity Feed
- Got Karma for Re: Why is KV Store certificate renewal not working?. 03-12-2025 02:38 PM
- Got Karma for Re: Why is KV Store certificate renewal not working?. 01-23-2025 01:16 AM
- Got Karma for Re: Why is KV Store certificate renewal not working?. 11-16-2024 04:59 PM
- Got Karma for Re: Some events missing from data model - only if accelerated. 02-15-2024 08:23 AM
- Got Karma for Some events missing from data model - only if accelerated. 02-15-2024 08:21 AM
- Got Karma for Re: Why is KV Store certificate renewal not working?. 02-02-2024 11:35 AM
- Got Karma for Re: Why is KV Store certificate renewal not working?. 07-07-2023 08:04 AM
- Got Karma for Re: Why is KV Store certificate renewal not working?. 01-06-2023 10:30 AM
- Posted Re: Why is KV Store certificate renewal not working? on Knowledge Management. 11-01-2022 01:27 PM
- Tagged Re: Why is KV Store certificate renewal not working? on Knowledge Management. 11-01-2022 01:27 PM
- Karma Re: Renewing server.pem certificate for vishaltaneja070. 11-01-2022 11:11 AM
- Got Karma for How to escape equal signs (=) in key value data?. 09-29-2022 11:35 PM
- Posted Re: Accelerated data model 100% complete even though most populating searches are skipped on Other Usage. 01-19-2022 06:10 AM
- Karma Re: SimpleXML: text size of single value element ignores height with version="1.1" for vagrawal. 09-23-2021 12:37 PM
- Posted Re: SimpleXML: text size of single value element ignores height with version="1.1" on Splunk Dev. 09-23-2021 09:12 AM
- Karma Re: SimpleXML: text size of single value element ignores height with version="1.1" for thellmann. 09-23-2021 09:02 AM
- Posted SimpleXML: text size of single value element ignores height with version="1.1" on Splunk Dev. 07-29-2021 02:52 PM
- Posted Re: SimpleXML dashboard version=1.1 backwards compatibility on Splunk Dev. 07-29-2021 02:37 PM
- Posted Re: SSL Error preventing upgrade to Splunk 8 on Security. 07-29-2021 11:53 AM
- Karma SSL Error preventing upgrade to Splunk 8 for csyvenky. 07-29-2021 11:53 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 2 | |||
| 0 |
06-13-2017
01:33 PM
1 Karma
You can disable by adding interval = -1 to the relevant stanzas. See this answer for details.
... View more
06-13-2017
01:32 PM
You can disable by adding interval = -1 to the relevant stanzas. See this answer for details.
... View more
06-13-2017
01:31 PM
See also https://answers.splunk.com/answers/444108/splunk-sub-processes-startstop-every-minute-splunk.html
... View more
06-06-2017
06:06 AM
I would be more than happy to submit log files to support if that helps.
... View more
06-06-2017
06:05 AM
ITSI is not installed on that machine, and there are no realtime searches either. Our app does have scheduled historic searches, plus the accelerated data model.
... View more
06-05-2017
06:21 PM
The correct answer depends on the exact nature of your data, but you might be able to get rid of duplicate events by defining a set of fields that combined ensure events are unique and then adding splitrow statements for each of the fields, e.g.
| pivot datamodel object
first(someField)
splitrow field1
splitrow field2
splitrow field3
... View more
06-05-2017
06:14 PM
That is not possible. Quote from the relevant documentation:
Summaries are restricted to a
particular search head (or search head
pool ID) to account for different
extractions that may produce different
results for the same search string.
Source: http://docs.splunk.com/Documentation/Splunk/6.6.1/Knowledge/Acceleratedatamodels
... View more
06-05-2017
05:17 PM
2 Karma
Our app uses an accelerated data model for all searches, which works really well.
I recently stumbled about a discrepancy which I cannot explain. The Data Models UI always shows the acceleration status as 100% completed, and the field Updated is always within a few seconds of the current time. That is good, of course, however when looking at how often populating searches are actually run, things seem to be different. In scheduler.log nearly all searches of type datamodel_acceleration have a status of skipped.
When I visualize how often populating searchs for a specific data model object are run successfully, I get only one successful search every 20 minutes:
My question is: how can the data model be 100% complete (and dashboards always show current data) when populating searches only run once every 20 minutes?
I have observed this on Splunk Enterprise 6.5.3 on Windows (simple single-instance Splunk environment).
Update 2017-06-15: I tested Splunk Enterprise 6.6.0 on Linux and Splunk Enterprise 6.6.1 on Windows. The issue occurs on those versions & platforms, too.
... View more
05-12-2017
01:15 PM
Splunk 6.6 adds support for Windows Server 2016. Both Splunk Enterprise and Universal Forwarder are now officially supported. See Splunk's system requirements page for details.
... View more
04-27-2017
07:29 AM
1 Karma
Nothing specific, I would just like to a) know if it should just work and b) see it officially supported. You answered both.
... View more
04-26-2017
04:50 PM
I wanted to add "windows-server-2016" as tag but apparently do not have sufficient permissions.
... View more
04-26-2017
04:49 PM
Server 2016 was released approximately 6 months ago, but it is still not listed as a supported OS on the system requirements page. When can we expect to see support in:
Univeral Forwarder
Splunk Enterprise
I hope I do not have to point out that people need to deploy UF to their Server 2016 machines.
... View more
03-29-2017
05:00 PM
@niketnilay Why don't you convert your comment into an answer so I can mark it as correct?
... View more
03-29-2017
04:58 PM
Thanks for the quick update to the docs! One thing I would still like to know: what is the first Splunk version to support that?
I am asking because we need to support older versions with our apps.
... View more
03-29-2017
04:57 PM
Awesome, thanks for the quick answer. It seems this really was not documented!
... View more
03-29-2017
02:31 PM
2 Karma
How can I add a summary row to a table in Simple XML? By summary row I am referring to what is described here, i.e. a special row appended to the table UI that is not affected by sorting. In the UI this is available in the Format menu of the Statistics tab.
Example from the documentation linked to above:
... View more
03-29-2017
09:19 AM
uberAgent's UI latency metric measures the responsiveness of application user interfaces, ie. how long it takes an application to internally process user keyboard/mouse input. The UI latency metric is useful to compare application UI performance between two environments, e.g. physical PCs and VDI. Absolute values are typically not as important as the differences between different types of machines. App UI latency is typically not the right metrics for troubleshooting "Citrix is slow".
Citrix (XenApp?) performance problems are as common as the potential causes are manifold. uberAgent is exactly the right tool to analyze, however it cannot determine the root cause at the click of a button. Instead it collects high-quality metrics for your troubleshooting. I would recommend you inspect network latencies to backend services (e.g. Exchange) in addition to machine resource utilization. Especially disk latency can be telling.
Another aspect often causing slowness with Citrix XenApp is folder redirection, especially if AppData is redirected. Folder redirection depends on constant high availability and low utilization of the file servers. If those are busy even for a short period Citrix users will notice sluggish application performance.
... View more
03-03-2017
04:12 PM
1 Karma
OK, now imagine you are living in a Windows world where 644 is but a number. Apparently the script was not tested on Windows?!?
... View more
02-28-2017
04:35 PM
Still documented for 6.5.2 and still broken 😞
http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML
... View more
02-27-2017
06:00 PM
1 Karma
It would be nice if it were possible to have multiple submit buttons per page in Simple XML.
Here is my scenario:
Global fieldset with filters for all charts and tables on the dashboard. Several of those charts and tables have additional filtering options, i.e. multiple input controls. Sometimes it only makes sense to rerun a panel's search when all its input controls have been configured by the user. This is especially true if the search is "expensive" and runs for a long time.
... View more
02-27-2017
05:24 PM
3 Karma
It took me a while to figure out that this does not work for multiselect inputs. Why?
... View more
02-27-2017
09:05 AM
I encountered the problem that Splunk was switching from "open in search" to "open in pivot" when modifying an existing dashboard. In my case when the number of filter statements per search went above four, Splunk would switch from "open in search" to "open in pivot".
That behavior is a bit unfortunate since "open in pivot" does not work but shows the error "Your pivot cannot complete because the search string could not be parsed into a valid pivot configuration."
I would like to be able to force Splunk to always show "open in search".
This was tested on Splunk Enterprise 6.5.2.
... View more
02-24-2017
03:07 PM
Thanks for making me aware of the makecontinuous command
... View more
02-17-2017
04:26 PM
We are populating Simple XML input elements of types dropdown and multiselect from searches. In some cases the number of elements can be very high, so I would like to limit the number added as choices to the UI.
My question is: what is a reasonable upper limit for the number of choice items per input element?
In our experiments 1,000 choice items did not pose any obvious problem. Would 10,000 or 100,000 be OK on modern browsers, too?
... View more
02-16-2017
03:39 PM
This may have changed, but the inList command does not work on 6.5.2. in needs to be used instead and it only works on string fields.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-05-2023
07:16 AM
|
