×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
thambisetty
SplunkTrust
Member since: ‎03-27-2014
‎07-14-2026
Community Statistics
Posts 1137
Solutions 129
Karma Given 55
Karma Received 364
Member Since ‎03-27-2014
Activity Feed
Topics I've Started
View All

Re: What is the permissible field value length ?

by SplunkTrust in Splunk Search
‎09-01-2020 06:45 AM
‎09-01-2020 06:45 AM
I tested below test_field, length of the field is 19202, its not truncated. | makeresults | eval test_field="dkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjdkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsjkfjdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkslfjlsfslfksafjkldsafhjlk;sdjhflkjdfkjdlkfjdklfjdklsfhksdhjfkjdjfkdjfkjhdjkfhdkjfjkldjfklsjdfsjfksfkldllsklsjlsfskldkfdldsjdfsdkdsldfhsdfsdfklsj" | eval test_field_len=len(test_field) | table test_field_len test_field ... View more

Re: Need a help in changing host name of/in Splunk

by SplunkTrust in Splunk Enterprise
‎08-31-2020 11:56 AM
‎08-31-2020 11:56 AM
Can you verify host value under system/local/inputs.conf in deployment client? you can follow below steps: splunk set servername “servername” splunk set default-host “servername” remove $SPLUNK_HOME/etc/instance.cfg splunk restart Note: dont copy paste “ quotes may not work as I am typing from my phone. ... View more

Re: Splunk Find Duplicates Within KV Store And Com...

by SplunkTrust in All Apps and Add-ons
‎08-31-2020 11:48 AM
‎08-31-2020 11:48 AM
| inputlookup vul_kvstore | stats dc(source) as distinct_source_count values(source) as source by fqdn, port, cve | where distinct_source_count > 1 | table fqdn, port, cve, source ... View more

Re: Does btool logs its usage somewhere?

by SplunkTrust in Security
‎08-31-2020 11:44 AM
‎08-31-2020 11:44 AM
Can you try running btool with —no-log option and check if that’s displaying some output?   ... View more

Re: Need a help in changing host name of/in Splunk

by SplunkTrust in Splunk Enterprise
‎08-31-2020 11:40 AM
‎08-31-2020 11:40 AM
Did you mean to say after changing hostname in system/local/inputs.conf and server.conf still seeing old name? If yes, did you restart splunk after changing host value in above two places? can you confirm where exactly are you seeing old name?   ... View more

Re: Issues with search head members pushing config...

by SplunkTrust in Deployment Architecture
‎08-31-2020 10:57 AM
‎08-31-2020 10:57 AM
That could be because member which is trying to notify changes happened to captain is out of sync from other members.  try to do rolling restart of search head cluster. ... View more

Re: Single searchhead (none of the others) constan...

by SplunkTrust in Splunk Enterprise
‎08-31-2020 10:49 AM
‎08-31-2020 10:49 AM
 Can you check if some user schedule real-time search for longer time range? real-time searches fill up dispatch directory very fast. ... View more

Re: Formatting table generated on email on email b...

by SplunkTrust in Alerting
‎08-31-2020 10:42 AM
‎08-31-2020 10:42 AM
DC2FD5F4-AF07-4D7C-B74B-D458B441996D.png   Are you looking for something like below: either you  need to modify sendemail alert action script or create custom alert action.     ... View more

Re: Hostname Override - Config on Intermediate, Ta...

by SplunkTrust in Splunk Enterprise
‎08-31-2020 10:40 AM
1 Karma
‎08-31-2020 10:40 AM
1 Karma
You are right. You will end up to have apps as many wrong hostnames you have. I have given you solution based on your existing problem. but I recommend to correct issue at the source if possible.  ... View more

Re: Hostname Override - Config on Intermediate, Ta...

by SplunkTrust in Splunk Enterprise
‎08-31-2020 09:37 AM
‎08-31-2020 09:37 AM
There is a better way  of doing this from UF itself if your UF is managed by deployment server. you need to deploy an App which will override host in inputs.conf of deployment client. you can avoid all the events coming from those UF going through the transform you created. ... View more

Re: Does Splunk look for config files recursively?...

by SplunkTrust in Installation
‎08-31-2020 09:32 AM
1 Karma
‎08-31-2020 09:32 AM
1 Karma
Splunk will ignore directory mygitrepo under local. ... View more

Re: Splunk Enterprise Login

by SplunkTrust in Installation
‎08-31-2020 09:27 AM
‎08-31-2020 09:27 AM
Did you install Splunk enterprise on your PC? If yes, if you are first time accessing Splunk,  The splunk web is available at http://localhost:8000 if service is running. if service is not running, you will not see splunk web page loading. you should start splunk service if its not running already. Find below link useful to start and stop splunk service. https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/StartSplunk ... View more

Re: DB Connect Oracle Connection Null Pointer Exce...

by SplunkTrust in Getting Data In
‎08-31-2020 05:48 AM
‎08-31-2020 05:48 AM
you are getting null pointer exception because when you are trying to save the connection db connect will validate the connection and it's getting nothing back from sql server. It could be because of authentication or some other issue.  can you confirm, if you are using local sql credentials or domain credentials? ... View more

Re: bash script , automating splunkforwarder insta...

by SplunkTrust in Splunk Enterprise
‎08-31-2020 05:43 AM
2 Karma
‎08-31-2020 05:43 AM
2 Karma
that's why I have asked you, I hope you manage this client from Deployment server. It will prompt for password if you add from CLI using splunk command. you can update inputs.conf  to avoid prompting for password. ... View more

Re: DB Connect Oracle Connection Null Pointer Exce...

by SplunkTrust in Getting Data In
‎08-31-2020 05:04 AM
‎08-31-2020 05:04 AM
do you any other oracle connections working? what about authentication for the connection you are trying to create? is is oracle local authentication or domain account? ... View more

Re: Splunk DB Connect: Data not indexing

by SplunkTrust in All Apps and Add-ons
‎08-31-2020 02:32 AM
‎08-31-2020 02:32 AM
why are you looking for specific version? can't you download latest version and use ? ... View more

Re: Splunk query to identify an anomaly for increa...

by SplunkTrust in Splunk Search
‎08-31-2020 02:31 AM
1 Karma
‎08-31-2020 02:31 AM
1 Karma
check below video, it uses machine learning to detect numerical outliers and also video describes how to use standard deviation ( with out machine learning) this may help you.   https://conf.splunk.com/files/2019/recordings/FN1390.mp4 ... View more

Re: How can I search for list of UF's and to which...

by SplunkTrust in Splunk Search
‎08-31-2020 02:24 AM
‎08-31-2020 02:24 AM
| tstats count where index=_* OR index=* by host,index | stats values(index) as index dc(index) as distinct_count by host | sort - distinct_count ... View more

Re: Splunk Phantom

by SplunkTrust in Splunk SOAR
‎08-31-2020 02:18 AM
1 Karma
‎08-31-2020 02:18 AM
1 Karma
Phantom is mainly used to automate repetitive tasks. for example: if you have correlation search in Splunk that alerts when phishing email is found. in general scenarios, analyst will follow incident playbook to perform actions in response to phishing alert. The list of actions purely based on how incident can be properly handled, below are the just examples: identifying list of recipients who received phishing email identifying list of users who clicked on phishing link using proxy logs notifying users that they received phishing email with subject "what ever it is" changing password of users  sharing of new passwords to the users. and also, find more use case here  https://www.splunk.com/en_us/blog/security/playbooks-going-beyond-incident-response-use-cases.html   ... View more

Re: DB Connect Oracle Connection Null Pointer Exce...

by SplunkTrust in Getting Data In
‎08-31-2020 02:09 AM
‎08-31-2020 02:09 AM
Did you install java on windows HF? Did you install oracle-jdbc driver? ... View more

Re: REGEX help .. I am still learning ....

by SplunkTrust in Splunk Search
‎08-30-2020 10:00 PM
‎08-30-2020 10:00 PM
Can you share sample event? the example you shared is not clear. ... View more

Re: bash script , automating splunkforwarder insta...

by SplunkTrust in Splunk Enterprise
‎08-30-2020 10:54 AM
2 Karma
‎08-30-2020 10:54 AM
2 Karma
Hope you will manage deployment clients(where uf is installed) with deployment server. If yes, you don’t require to set the password at all. ... View more

Re: Track value change over time

by SplunkTrust in Splunk Search
‎08-30-2020 06:58 AM
1 Karma
‎08-30-2020 06:58 AM
1 Karma
  | stats earliest(rank) as earliest_rank latest(rank) as latest_rank by user | eval final_rank = latest_rank-earliest_rank | table user final_rank   ... View more

Re: How I can set 35 days data retention period fo...

by SplunkTrust in Getting Data In
‎08-30-2020 06:52 AM
‎08-30-2020 06:52 AM
not recommended but still to have strict retentionperiod  set below maxHotSpanSecs to 1 day.  https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Indexesconf maxHotSpanSecs = <positive integer> * Upper bound of timespan of hot/warm buckets, in seconds. * This is an advanced setting that should be set with care and understanding of the characteristics of your data. * Splunkd applies this limit per ingestion pipeline. For more information about multiple ingestion pipelines, see 'parallelIngestionPipelines' in the server.conf.spec file. * With N parallel ingestion pipelines, each ingestion pipeline writes to and manages its own set of hot buckets, without taking into account the state of hot buckets managed by other ingestion pipelines. Each ingestion pipeline independently applies this setting only to its own set of hot buckets. * If you set 'maxHotBuckets' to 1, splunkd attempts to send all events to the single hot bucket and does not enforce 'maxHotSpanSeconds'. * If you set this setting to less than 3600, it will be automatically reset to 3600. * NOTE: If you set this setting to too small a value, splunkd can generate a very large number of hot and warm buckets within a short period of time. * The highest legal value is 4294967295. * NOTE: the bucket timespan snapping behavior is removed from this setting. See the 6.5 spec file for details of this behavior. * Default: 7776000 (90 days)   ... View more

Re: How to calculate for what duration the status ...

by SplunkTrust in Splunk Enterprise Security
‎08-30-2020 06:49 AM
2 Karma
‎08-30-2020 06:49 AM
2 Karma
had to use sort many times. | stats count as count by _time, ID,STATUS | streamstats count reset_on_change=true by ID, STATUS | eventstats max(count) as max_count by ID,STATUS | where (count=max_count) OR (count=1) | sort 0 - _time | streamstats last(_time) as prev_time by ID current=false | eval duration=prev_time-_time, time=_time | sort 0 _time | streamstats sum(duration) as sum_duration reset_on_change=true by ID, STATUS | sort 0 - _time | dedup ID,STATUS consecutive=true | sort 0 _time | table ID STATUS _time sum_duration | eval sum_duration=if(STATUS=="COMPLETE","",sum_duration) ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎07-14-2026 07:48 AM
Karma from