Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About sidekix24
sidekix24
Path Finder
Member since:
09-09-2015
06-05-2020
Community Statistics
| Posts | 117 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 6 |
| Member Since | 09-09-2015 |
Activity Feed
- Got Karma for How to set a different drilldown for each cell in a table in my Simple XML dashboard?. 06-05-2020 12:48 AM
- Got Karma for How to set a different drilldown for each cell in a table in my Simple XML dashboard?. 06-05-2020 12:48 AM
- Got Karma for How to set 1 Search Head cluster member to send all alerts?. 06-05-2020 12:48 AM
- Got Karma for How to set 1 Search Head cluster member to send all alerts?. 06-05-2020 12:48 AM
- Got Karma for Re: How to set 1 Search Head cluster member to send all alerts?. 06-05-2020 12:48 AM
- Got Karma for Splunk App and Add-on for Unix and Linux: How to change the default index name and set retention policy?. 06-05-2020 12:48 AM
- Karma Re: How do I show more than 10 field values in a timechart? for Drainy. 06-05-2020 12:46 AM
- Posted DB Connect stop sending new data on All Apps and Add-ons. 01-26-2018 12:03 PM
- Posted Daily license usage by index on Splunk Cloud on Monitoring Splunk. 12-05-2017 12:18 PM
- Posted Login with local account with SSO Okta enabled on Security. 09-14-2017 10:53 AM
- Tagged Login with local account with SSO Okta enabled on Security. 09-14-2017 10:53 AM
- Posted Splunk/Pager Duty integration no results work around on All Apps and Add-ons. 07-20-2017 04:00 PM
- Posted Indexes appear in usage report but not in indexes.conf or on indexer on Getting Data In. 05-04-2017 03:37 PM
- Tagged Indexes appear in usage report but not in indexes.conf or on indexer on Getting Data In. 05-04-2017 03:37 PM
- Posted Disable index on Getting Data In. 04-05-2017 02:25 PM
- Tagged Disable index on Getting Data In. 04-05-2017 02:25 PM
- Posted Re: Splunk App and Add-on for Unix and Linux: How to change the default index name and set retention policy? on All Apps and Add-ons. 03-23-2017 01:47 PM
- Posted Splunk App and Add-on for Unix and Linux: How to change the default index name and set retention policy? on All Apps and Add-ons. 03-23-2017 10:25 AM
- Tagged Splunk App and Add-on for Unix and Linux: How to change the default index name and set retention policy? on All Apps and Add-ons. 03-23-2017 10:25 AM
- Posted Re: Hide Radio Input in Dashboard on Getting Data In. 03-22-2017 03:21 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 2 | |||
| 0 |
10-03-2016
11:04 AM
Does anyone know if this change has been made already? And what version has this new feature?
Thanks
... View more
10-03-2016
11:04 AM
Does anyone know if this change has been made already? And what version has this new feature?
Thanks
... View more
09-09-2016
02:30 PM
I think that might have done the trick!!!
Thanks
... View more
09-09-2016
01:38 PM
Hello,
How do I get a single value display to show a value of zero instead of no results? I've tried fillnull in various spots in my search but I can't seem to get it to work.
Thanks
... View more
06-17-2016
02:15 PM
I can see if that's the case...I will let you know. Thanks
... View more
06-17-2016
12:58 PM
The events themselves look good. The only issue is that each event is duplicating every time the file updates. The log has about 200,000 lines but the events are up to a couple of million due to the re-indexing.
... View more
06-17-2016
12:43 PM
no...we don't have control of that
... View more
06-17-2016
12:18 PM
Hi,
We are currently monitoring a log file that tracks available time and unavailable time using the universal forwarder. The issue that we are running into is that we are getting duplicate events every time because Splunk seems to re-index the whole log every minute.
The log looks like this:
Unavailable 09.09.2015 18:31:11 - 09.09.2015 18:33:11
Available 09.09.2015 18:34:11 - 10.09.2015 10:49:14
Unavailable 10.09.2015 10:50:14 - 10.09.2015 11:11:14
Available 10.09.2015 11:12:14 - 17.09.2015 16:47:50
Unavailable 17.09.2015 16:48:50 - 17.09.2015 16:48:50
Available 17.09.2015 16:49:50 - 21.01.2016 12:48:27
Unavailable 21.01.2016 12:49:27 - 22.01.2016 17:28:33
Available 22.01.2016 17:29:30 - 22.01.2016 17:29:30
Unavailable 22.01.2016 17:29:33 - 22.01.2016 17:29:33
Available 22.01.2016 17:30:30 - 22.01.2016 17:30:30
Unavailable 22.01.2016 17:30:33 - 22.01.2016 17:30:33
Available 22.01.2016 17:31:30 - 22.01.2016 17:31:30
The way the file is updated is: it will update the the end time on the last line every min until the status goes to unavailable, then a new line can be created. Also, we used indexed time because there were no timestamps for each entry.
Does anyone have any ideas on how we can stop the re-indexing/duplicate events?
Thanks
... View more
04-06-2016
09:21 AM
frobinson,
I got it working. My endpoints were incorrect for the saved searches. Once I fixed those, the whole process came together and worked. I was able to successfully build a script to trigger a second search then another script to disable that search once it sends out the "all clear" message.
Thanks for the help
... View more
Thanks Kamal,
Do you have a sample script for triggering that 2nd search?
Thanks again
... View more
03-30-2016
01:41 PM
Even a command to enable/disable the saved search would solve my issue 🙂
Thanks again
... View more
03-30-2016
12:10 PM
ok...I'm getting a little further but need some assistance if someone can help.
I'm running the command below:
-k -u admin:pass -XPOST https://splunk.server/en-US/account/login?return_to=%2Fen-US%2Fmanager%2Flauncher%2Fsaved%2Fsearches%2FEnable%2520Test%2520status
And I'm getting this in return:
{"status":1}
I've tried enabling and disabling the status of the saved search in "Searches, reports, and alerts" but that status doesn't change every time I run that command, it stays at {"status":1}.
... View more
03-30-2016
11:27 AM
Thank you,
Is there something that needs to be enabled to run these commands?
In the output, I get the message below. The output doesn't match what I expect to see compared to the output in documents.
Splunk relies on JavaScript to function properly. Please enable JavaScript and then refresh the page to login.
... View more
03-28-2016
02:26 PM
Hello,
I'm trying to set up a curl script to enable/disable a search under "Searches, reports, and alerts" when an alert is triggered. I've done some searching on the boards and found the example below, but it's not working for me.
curl -ku admin:changeme https://localhost:8089/servicesNS///saved/searches/ -d "is_scheduled=0"
Basically, a curl or CLI command that will drop a check mark in the box in the screen shot for me so I can script that out would solve my issue.
Anyone have any suggestions?
... View more
jitsinha,
Did you ever figure out a solution for this? I'm looking to do something similar. If an alert gets triggered from one report, we need another search to run as part of that alert.
Thanks
Chris
... View more
03-15-2016
02:35 PM
Did anyone ever get an answer to issue?
Thanks
... View more
02-24-2016
03:02 PM
Thanks somesoni2!!!! I think that work around might have done the trick
... View more
02-24-2016
02:44 PM
I'm using a simple XML dashboard
... View more
02-24-2016
01:06 PM
One the screen shot attached, I'm able to use drilldown to click on the value in Red and it takes me to another dashboard I created. Is it possible to make the title of the panel a hyperlink to that dashboard instead?
... View more
02-24-2016
08:51 AM
Thanks for the help cramasta!
I tried adding minspan and it still doesn't give us what we were looking for. I think our only option would be to run the script more frequently.
Thanks again
... View more
02-23-2016
09:01 AM
I'm thinking that timechart just isn't able to give us what I'm looking for because we need to run it without specifying a span and in order to do that we need to script to run more frequently (1 min intervals).
Am I on the right track?
... View more
02-23-2016
07:53 AM
I get what you are saying but my question is...why is only using the values from the last run/runs and not all the values in the range in the timepicker?
Using my screen shot as the example:
I'm choosing the last "4 hours" and it gave me the average of the values at 2030 (which is the response times from 2015 and 2030). I was hoping it would give me the average of the whole 4 hours.
Same thing goes for the previous screenshots, it's grabbing the values from the 1930 line because that was the lastest one. So the timepicker doesn't matter cause it's going to always use values from the latest runs.
... View more
02-22-2016
08:58 PM
here you go...it grabbed the last one (the one that ran at 20:30)
... View more
