Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About linu1988
linu1988
Champion
Member since:
12-18-2012
06-05-2020
Community Statistics
| Posts | 979 |
| Solutions | 75 |
| Karma Given | 127 |
| Karma Received | 253 |
| Member Since | 12-18-2012 |
Activity Feed
- Got Karma for Re: Throttling-parameters in realtime search. 01-04-2023 06:13 AM
- Got Karma for Re: Convert a string into a number. 02-03-2022 07:44 AM
- Karma Re: Is there a way to change the font size or bold text in alert emails? for martin_mueller. 06-05-2020 12:48 AM
- Karma Re: Require input value in text box for dfoster_splunk. 06-05-2020 12:47 AM
- Karma Re: How to prevent | stats count in a macro from triggering a remote search? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time? for devicenul1. 06-05-2020 12:47 AM
- Karma Re: What is the easiest way to identify my universal forwarder versions for kscher. 06-05-2020 12:47 AM
- Karma Re: http://localhost/en-US/debug/refresh from terminal/console for MuS. 06-05-2020 12:47 AM
- Karma Re: Alert if source stops indexing for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: How do i ignore the new line character in the _raw field? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Python Script Not working via search command for psobisch. 06-05-2020 12:47 AM
- Karma Re: How to join value using wildcard? (Urgent) for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Are there any search and performance pitfalls with keeping data in hot buckets for 1 month and moving it from hot to cold directly? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: Is it possible to update a table with a drilldown value from another table's field in the same browser tab? for vtsguerrero. 06-05-2020 12:47 AM
- Karma Re: how to get 1st 2nd and 3rd place results? - based on value of a field - not frequency. for colineltringham. 06-05-2020 12:47 AM
- Karma Re: 6.1.3 issue with mounted Bundles for michael_herbert. 06-05-2020 12:47 AM
- Got Karma for Re: indexer configured but inactive on new Linux servers. 06-05-2020 12:47 AM
- Got Karma for Re: How to fix perfmon errors "Object specified...in conf file is not valid"?. 06-05-2020 12:47 AM
- Got Karma for Re: How to fix perfmon errors "Object specified...in conf file is not valid"?. 06-05-2020 12:47 AM
- Got Karma for Re: DBX JOIN 2 databases together. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
10-24-2014
05:44 AM
Hi Somesh,
I got some inconsistent result where i saw min(age) doesn't give proper timings. I have replaced it with latest i think that gives proper results. What do you think?
| stats latest(age) as age, max(_time) as LastTime by Host
| convert ctime(LastTime) as "Last Active On"
| eval Status= case(age < 100,"Running",age > 900,"DOWN") | rename age as Age |eval Hour=round(Age/3600,0)|eval Minute=round((Age%3600)/60,0)|eval Age="-".Hour."h"." : ".Minute."m"
... View more
10-20-2014
11:47 PM
you need to run over 2/3 days to get the missing forwarder alert again and again. The problem with daily alert is metdata doesn't show you older records.
... View more
10-15-2014
02:04 PM
use of a load balancer will be very easy solution. but i dont think any user outside the domain reach the link for which you want to re-write the rule.
... View more
10-12-2014
09:38 PM
1 Karma
Please use the below link :
http://www.splunk.com/page/previous_releases#x86_64windows
Thanks
... View more
10-10-2014
05:46 AM
1 Karma
Not sure about the java script control type. but you can use the checkbox in splunk 6 to get the earliest and latest value to change. Check out the splunk dashboard examples and custom development section.
https://apps.splunk.com/app/1603/
... View more
10-10-2014
05:42 AM
1 Karma
50000 is the subsearch limit. it will return the results but they should be partial if you are actually providing the proper joining criteria.
... View more
10-07-2014
06:38 AM
1 Karma
To give an overview you need to have a proper query which forms a table ABCD columns. That is the value which will be filtered as the hierarchy goes down. i have implemented it but not sure if i can explain all here. Check out the pulldown module documentation. If you are on splunk 6 you can also implement using the GUI. But search queries are important. Lookup are also essential for this kind of implementation.
... View more
10-06-2014
09:28 PM
1 Karma
Guess you are not putting them in lowercase as you mentioned here...
Make everything in Caps , as per the documentations provided.
If you ever have any doubt always append all the configurations in etc\system\local\props.conf
... View more
10-06-2014
09:51 AM
There are some bugs in 6.1 which prevents installation in 2003 server. Go for 5.0.8 or similar.
Check out the 6.1.3 documentation.
... View more
10-06-2014
04:57 AM
not needed once the timestamp rule matched once. It's helpful when you only want to take a specific portion of the time data.
... View more
10-06-2014
02:12 AM
Hello Ant1D,
Rather than going for splunkd.log you can search in splunk metadata command. You wont be finding any indication in the splunkd.log if is has been stopped for monitoring because splunk will keep on monitoring but doesn't actually read anything unless it has changed state.
|metadata type=sources index=Index_Name|where source like '%part_of_Source%'
Of course you wont be able to find if there are many hosts having the same source names.
Thanks,
L
... View more
10-05-2014
11:20 PM
4 Karma
Hello,
you have to mention the timeformat which splunk needs to take.
Mention in Props.conf in indexer end.
[Sourcetype]
TIME_FORMAT=%Y-%m-%d %H:%M:%S.%6q
That should be enough. You need to restart the indexer after making this entry.
Thanks,
L
... View more
10-04-2014
11:51 PM
do i start a new thread?
... View more
10-04-2014
07:31 PM
I have just upgraded to 6.1.4 where i use splunk stop before doing a restart or for any kind of configuration change. I get a message in v6 onwards that service didn't respond in a timely manner hence will be stopping forcibly. Is this a known issue or going to be addressed? Because once a user doesn't have access to the servers and the splunk restart doesn't occur gracefully the services are stopped forever without a manual intervention. Any comment.
... View more
10-02-2014
09:32 PM
which log management software? if we are talking about event logs it will start from where it left off.
... View more
10-02-2014
09:26 PM
2 Karma
where do you expect the file to be created? give the absolute file path rather than the one you have mentioned. I have not tries to give a ps1 file in the script trigger path ever. So could you try with a bat file? just mention complete path to script and output file everywhere. Make the cron schedule to */1 * * * * . It's quite easy to test with the below in a .bat file
%SPLUNK_ARG_5% > e:\output.txt
... View more
10-01-2014
04:08 AM
3 Karma
Hello Guys,
This issue has been fixed now in 6.1.4 release. I have tested it and it works perfectly on Windows machine.
Thank you team Splunk 🙂
... View more
10-01-2014
02:30 AM
i doubt suck things happen. When you add the AD group the users can be seen in the users list. Where do you see unknown? if there are frequent change in the AD group refresh it periodically.
... View more
09-30-2014
01:42 PM
they won't support 2012 as per the versions. Newer version should work. Fire a support case. I will try on one of my VM tomorrow to see if it works
... View more
09-30-2014
09:07 AM
Do you see any error? Is all the permissions given for reading the logs? Could you check if system/security logs work?
... View more
09-30-2014
08:49 AM
Hello,
Please go through the documentation below
http://docs.splunk.com/Documentation/Splunk/6.1.3/Alert/Setupalertactions
I have not tried it but, you will find the $trigger_date$ & $trigger_time$ which you can use in the email to send it to recipients.
Thanks,
L
... View more
09-30-2014
08:43 AM
Hello,
I think it is because of your syntax. Could you try the below?
[WinEventLog://Application]
disabled = 0
checkpointInterval = 5
current_only = 0
index = app
Thanks,
L
... View more
09-30-2014
07:50 AM
Add the indexer as search peer, Run search which you feel as slow. It should also have the data which is required. See inspect and check the run duration. This is quite abstract way to check if it has any performance improvement.
... View more
09-30-2014
07:35 AM
Have a faster disk rather than Memory and big CPU. 64 GB memory is mostly unnecessary. If required have 16 Core CPU. Until and unless your disk is capable of handling the indexing and give output to your searches faster you won't see the performance increase..
... View more
09-30-2014
04:24 AM
Hello,
Rather than appending the result
just do the below
index=idx1 sourcetype=src1 OR sourcetype=src2|timechart count by sourcetype
Thanks,
L
... View more
