Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About imrago
imrago
Contributor
Member since:
04-07-2010
10-31-2024
Community Statistics
| Posts | 117 |
| Solutions | 22 |
| Karma Given | 159 |
| Karma Received | 68 |
| Member Since | 04-07-2010 |
Activity Feed
- Posted Re: tstats returning zero results for a simple count query on Splunk Search. 10-31-2024 11:47 AM
- Posted tstats returning zero results for a simple count query on Splunk Search. 10-29-2024 12:11 PM
- Got Karma for udp input json to metrics - The metric event is not properly structured. 07-28-2023 05:17 AM
- Got Karma for Re: How to create a report that shows max indexed volume per day by month per index?. 04-13-2023 11:05 AM
- Karma Re: kvstore certificate renewal is not working... for vinod94. 03-02-2023 11:08 AM
- Got Karma for udp input json to metrics - The metric event is not properly structured. 10-06-2022 08:39 AM
- Got Karma for Re: Universal fowarder and WMI. 12-27-2021 05:03 PM
- Got Karma for udp input json to metrics - The metric event is not properly structured. 11-22-2021 03:16 PM
- Posted udp input json to metrics - The metric event is not properly structured on Getting Data In. 10-03-2021 01:35 PM
- Tagged udp input json to metrics - The metric event is not properly structured on Getting Data In. 10-03-2021 01:35 PM
- Posted fill_summary_index metrics index , duplicates on Knowledge Management. 03-25-2021 03:37 PM
- Karma Re: How do you fix the font size of each single value display panel? for sdchakraborty. 01-13-2021 03:13 PM
- Karma Re: Why is the dropdown input width not increasing? for vnravikumar. 01-13-2021 11:14 AM
- Karma Re: How to change the width of panels in xml? for niketn. 12-31-2020 12:22 AM
- Posted Re: AppInspect v2.2.0 wrongly reports that there is no named capturing group in Extract in props.con on All Apps and Add-ons. 07-23-2020 01:48 PM
- Posted AppInspect v2.2.0 wrongly reports that there is no named capturing group in Extract in props.conf on All Apps and Add-ons. 07-23-2020 10:22 AM
- Posted Developer Guidance - Setup View Example For Splunk - not working as expected in Firefox on Splunk Dev. 07-19-2020 07:08 AM
- Got Karma for Re: When creating an app, how to configure it that after the install, "Restart Required" dialog would be displayed?. 06-05-2020 12:49 AM
- Karma How to do DNS lookup for event-time for mirkokorn. 06-05-2020 12:48 AM
- Karma Are there any plans for data signing in splunk since this functionality was removed in 6.2? for jmallorquin. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 3 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-18-2017
05:42 AM
Was Splunk restarted after these changes?
... View more
03-23-2016
02:53 AM
Thanks, that solution will preserve the old values, but for new events it would be preferable to use the latest database. Something like we have with the time based lookups in Splunk.
... View more
03-23-2016
12:41 AM
The database used by iplocation is updated usually with each new version of Splunk. What is the best solution to preserve the changes? For example a particular IP address might have had a different geolocation last year then it has now.
... View more
08-23-2015
03:49 PM
winevent-hostoverride vs. winevent_hostoverride , just one character difference
... View more
08-23-2015
04:33 AM
Thanks for confirming that it looks good, it helped me to find the typo which caused the problem.
... View more
07-12-2015
11:55 AM
My goal is that in the newly arrived events, while indexing is happening to replace the received host value with the value of the ComputerName field.
... View more
07-12-2015
06:59 AM
My goal is to replace the host in WinEventLog events with the ComputerName field. The data is being forwarded from an UniversalForwarder and on the indexer these config files were used:
$splunkhome$/etc/system/local/props.conf
[WinEventLog:Security]
TRANSFORMS-extract = winevent_hostoverride
$splunkhome$/etc/system/local/transforms.conf
[winevent-hostoverride]
DEST_KEY = MetaData:Host
REGEX = (?m)^ComputerName=([\S]*)
FORMAT = host::$1
Tested the regex with this search:
sourcetype=Winevent* | rex field=_raw "(?m)^ComputerName=(?<hostextract>[\S]*)" | table _time host hostextract
The value of the host remains unchanged. What could be wrong with these configs?
Is this the correct approach to solve the problem?
... View more
09-08-2014
01:16 PM
1 Karma
index=_internal source=license_usage.log type=Usage | eval yearmonthday=strftime(_time, "%Y%m%d") | eval yearmonth=strftime(_time, "%Y%m") | stats sum(eval(b/1024/1024/1024)) AS volume_b by idx yearmonthday yearmonth | chart max(volume_b) over yearmonth by idx
... View more
09-08-2014
07:43 AM
4 Karma
index=_internal source=license_usage.log type=Usage | stats sum(eval(b/1024/1024/1024)) AS volume_b by idx date_mday date_month date_year | stats max(volume_b) by idx date_month date_year
... View more
12-06-2013
02:19 AM
I solved the problem based on an answer from Ayn in this question and presented it with a SingleValue component:
... | addinfo | eval selection_duration=strftime(info_min_time,"%+") . " - " . strftime(info_max_time,"%+") | table selection_duration
http://answers.splunk.com/answers/49539/variables-indicating-the-time-range-of-the-interactive-search-selection/49544
... View more
12-04-2013
01:27 PM
In advanced xml I was using a lot the ResultsHeader module, amongst others it is showing nicely the "earliest" and "latest" in human readable format. How could I reproduce something like that in simple xml?
... View more
07-18-2013
07:39 AM
I would like to compare events from two different custom time ranges. If I put two timerange modules in a panel, how could I get the values of those, to populate the earliest and latest variables in the outer and inner searches?
... View more
- Tags:
- timerangepicker
07-04-2013
03:45 AM
The line breaking is working fine and Splunk is finding the timestamps.
The problem is that only the date part is used.
... View more
07-04-2013
03:09 AM
I would like to extract this timestamp:
2013-07-03,8
with
%Y-%m-%d,%H
but I am unable to that because:
If <strptime-style format> contains an hour component, but no minute component, TIME_FORMAT ignores the hour component. It treats the format as an anomaly and considers the precision to be date-only. Splunk Docs
How could I disable that feature?
... View more
- Tags:
- time_format
- timestamp
09-17-2012
01:23 PM
2 Karma
You could use the distinct count function of stats command, something similar to this:
splunk_server="server" index="index" | stats dc(source IP), dc(dest ip), dc(source port), dc(dest port) by tag
http://docs.splunk.com/Documentation/Splunk/4.3.4/SearchReference/CommonStatsFunctions
... View more
09-07-2012
02:45 PM
My previous suggestion did not work, because JSChart was used by simplified xml.
Please try the following where you will get flash based chart :
Splunk Licence Use Over 30 Days
Splunk Licence Use Over 30 Days
line
1
90
... View more
09-07-2012
12:53 PM
in case that you are using simplified xml that line would be
90
so try this:
Splunk Licence Use Over 30 Days
Splunk Licence Use Over 30 Days
line
90
... View more
09-07-2012
12:10 PM
To rotate the labels, in the advanced xml you could add the following parameter to HiddenChartFormatter module
<param name="charting.axisLabelsX.majorLabelStyle.rotation">90</param>
This might not be supported in JSChart.
... View more
08-30-2012
12:08 PM
1 Karma
A method to download the graph as an image :
http://splunk-base.splunk.com/answers/31530/how-to-get-png-of-graph
... View more
05-02-2012
10:48 AM
In my system I have a searchhead and an indexer, both on a same switch. From time to time I am experiencing this error when running searches on the searchhead:
Failed to create result provider for remote peer 'indexer' at uri...
some error messages from the splunkd.log which might be related :
05-02-2012 13:22:10.508 -0400 WARN NetUtils - select_for timeout hit waiting for read
05-02-2012 13:22:10.508 -0400 WARN NetUtils - Bad select for loop rv = -2
05-02-2012 13:22:20.745 -0400 ERROR HTTPClient - Should have gotten at least 3 tokens in status line, while getting response code. Only got 0.
05-02-2012 13:26:46.572 -0400 WARN NetUtils - select_for timeout hit waiting for read
05-02-2012 13:26:46.572 -0400 WARN NetUtils - Bad select for loop rv = -2
05-02-2012 13:26:46.572 -0400 ERROR LMTracker - failed to send rows, reason='problem with message to master=https://192.168.16.100:8089, reason='Unable to connect to remo
te peer: https://192.168.16.100:8089 rc=2''
05-02-2012 13:28:47.500 -0400 WARN NetUtils
This system was working perfectly for more than a year and few days ago I started to experience this problem without any changes to the configs.
What could be the cause?
... View more
03-16-2012
03:03 AM
there is an error in search C, try this:
index=webserver1 type=error | APPEND [search index=webserver2 type=error] | table serverName message method
... View more
02-29-2012
01:59 PM
index=_audit action="alert_fired" ss_name=Alert1 OR ss_name=Alert2 OR ss_name=Alert3 | stats dc(ss_name) as alerts
and you should fire the alert if alerts = 3
... View more
02-29-2012
12:55 PM
1 Karma
Perhaps you could create an alert which would search for those three alerts in
index="_audit" action="alert_fired"
... View more
02-29-2012
11:01 AM
Thank you for that, but found another problem. Time field is needed to be present in the events based on the documentation:
If no events in a source have a date, Splunk tries to find one in the source name or file name. (This requires that the events have a time, even though they don't have a date.)
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-31-2024
03:07 PM
|
Karma given to
