About RicoSuave

RicoSuave · ‎07-18-2011

I have run into the same issue. I just end up deleting that particular event. Click on the event to isolate it in the results, then just pipe it to delete: | delete Make sure you have the can delete role or else it wont work.

RicoSuave · ‎07-18-2011

just add ?showsource=true to the end of the URL in you browser, then scroll down and you will find the advanced XML for that view. I would copy and paste it into a good text editing program like notepad++ and set the language to XML. Enjoy.

RicoSuave · ‎07-08-2011

yes, run a search that will return only those events and just pipe it to delete. Assuming you have the can_delete permissions, this should work example: mysearch | delete

RicoSuave · ‎07-08-2011

Any chance you can post your code?

RicoSuave · ‎07-08-2011

I can't figure out how to get the code to post correctly, but just copy and paste it into notepad++ and hopefully it should format correctly

RicoSuave · ‎07-08-2011

Try this code instead. uri_setting True

RicoSuave · ‎07-08-2011

It looks like you have your stringreplace and replacementmap parameters flipped. Stringreplace should come first then replacementmap. I believe this is a bug when using the showsource=true to convert from simple xml formsearch to advanced.

RicoSuave · ‎07-06-2011

click on manager>apps>click on permissions for whatever the app is>select which roles/users have read and/or write access.

RicoSuave · ‎07-05-2011

Try using the eval command with the strftime argument. Try this search mysearch | eval Time = strftime(_time, "%H:%M") | chart span=1d host over Time

RicoSuave · ‎07-05-2011

I believe you have to give your users write permissions to whatever app they are making the field extractions in.

RicoSuave · ‎06-21-2011

Can you please post the xml for your dashboard? i ran into similar issues with 4.2 and found a bug where single value modules won't render when combined in the same panel as another chart.

RicoSuave · ‎06-16-2011

I understand the search and it does work, i also understand how to create alerts, since i have created them before. However, when i choose to create the alert, i only get three conditions: if number of events, hosts, source, and a custom condition. For now i'm just going to send an alert if that search returns any results, but ideally i would like an alert to fire as soon as a user is trying to connect from more than one unique src ip within a specified timeframe. I know this will require the search to run in real time and probably the use of a custom condition.

RicoSuave · ‎06-16-2011

Both appear to work, i still need to figure out how to setup an alert to fire when the source ip count for any user is greater than 1.

RicoSuave · ‎06-15-2011

Hello, I'm trying to setup an alert that fires when a user tries to log in from more than one src ip address within the last 24 hours. My base search looks like index=myindex product=myvpnappliance Src ip's and user fields are extracted automatically. I've tried different searches to no effect. Can anybody please help?

RicoSuave · ‎05-11-2011

This worked like a charm. Thanks.

RicoSuave · ‎05-11-2011

This is what i'm looking to do and i can't figure it out. I want a single value module to green up once a certain event shows up and go red when a different event shows up and instead of the module displaying the number of events, i want it to show the src address that is in the event. Any suggestions?

RicoSuave · ‎04-27-2011

I ran into a similar issue and i found a bug where if you use a single value module in the same panel as a charting module, the chart or module won't display. Behavior was different in every browser, so i just fixed my dashboards by moving single value modules into their own panels.

RicoSuave · ‎04-27-2011

I think the only way you are going to be able to group results in that way is by using the rangemap command. index=myindex | somefilter | stats count(field) by field | rangemap field=yourfield Great=1-200 Good=201-400 Acceptable=401-600 default=Slow or maybe this index=myindex | somefilter | rangemap field=yourfield Great=1-200 Good=201-400 Acceptable=401-600 default=Slow | stats count(field) by field You can adjust the ranges to your liking. Let me know if this works.

RicoSuave · ‎04-27-2011

How are you uploading the file? I remember having the same issue and it was solved when i told splunk that the sourcetype was a csv. When in the process to upload the file, make sure you check the "More settings" box then go to sourcetype and select "From List" then select csv. This should fix the problem that you are having. Let me know if this works.

RicoSuave · ‎04-20-2011

I believe you can use the | delete command. This is assuming you have the can delete role. For example, when i want to delete all events from one source within an index i do source= | delete you should be able to also do index= sourcetype= | delete

RicoSuave · ‎04-19-2011

No problem. Another thing to note is that i find the exact opposite behavior in IE8. In IE, the single value module populates but not the charting module if they are placed within the same panel. Hope this helps.

RicoSuave · ‎04-19-2011

So i figured out what the issue was and it looks like it might be a bug. Essentially, in 4.2, if you place both a single value module and a charting module in the same panel, the single value module will not show up. This is in firefox. Can anyone else test for this issue and report back? Please keep in mind that pre4.2 i didn't have this issue.

RicoSuave · ‎04-18-2011

Hello, I have a dashboard with several singlevalue modules within different panels. We recently upgraded to 4.2 and the single value module doesn't populate at all within firefox 3.5 When referencing the error console, i see a lot of warnings for skipped to next declaration, declaration dropped, error in parsing value etc. All of these errors are from view.css and default.css However, the singlevalue module still works in IE8, but the graph that is also supposed to populate underneath it doesn't. Any ideas?

RicoSuave · ‎04-13-2011

So i have a csv with hundreds of lines in the same format i specified above, but the lines have different dates. When i index that csv, splunk doesn't extract the timestamp individually from the date column in the csv, instead it assigns all the events the same time. That time being when the file was indexed.

RicoSuave · ‎04-06-2011

I tried this and it did not work. Is there anything else you recommend?

Posts	204
Solutions	33
Karma Given	3
Karma Received	288
Member Since	‎10-02-2015

Online Status	Offline
Date Last Visited	‎10-27-2020 12:43 AM

Notable Event Suppression Keys: Why are there peri...

is there a limit on the number of files splunk can...

How to use srchFilter to anonymize data based on r...

SPLUNKD_CONNECTION_TIMEOUT 6.x

DB Connect encryption

Reduce fishbucket size

"Ended without a done-key" messages

Documentation formatting with Chrome

Reached end-of-stream error troubleshooting

Permissions on monitored files

Re: Removing CSV Header from Indexing

Re: What are the precise Search strings used in th...

Re: How to remove some indexed data

Re: Form search drill down action to set field val...

Re: ExtendedFieldSearch

Re: ExtendedFieldSearch

Re: ExtendedFieldSearch

Re: Allow users to add public field extractions

Re: How to modify the timechart x-axis label

Re: Allow users to add public field extractions

Re: Chart not plotting in dashboard

Re: Alert on user with different src address

Re: Alert on user with different src address

Alert on user with different src address

Re: Single value module question

Single value module question

Re: Splunk 4.2 charts not displayed in Internet Ex...

Re: search help - stats of a count by that field.....

Re: CSV file not uploaded to splunk

Re: How do I delete a specific data input & its re...

Re: Single Value Not working Since 4.2

Re: Single Value Not working Since 4.2

Single Value Not working Since 4.2

Re: Extracting Timestamp From csv

Re: Extracting Timestamp From csv

Are you a member of the Splunk Community?