Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About linu1988
linu1988
Champion
Member since:
12-18-2012
06-05-2020
Community Statistics
| Posts | 979 |
| Solutions | 75 |
| Karma Given | 127 |
| Karma Received | 253 |
| Member Since | 12-18-2012 |
Activity Feed
- Got Karma for Re: Throttling-parameters in realtime search. 01-04-2023 06:13 AM
- Got Karma for Re: Convert a string into a number. 02-03-2022 07:44 AM
- Karma Re: Is there a way to change the font size or bold text in alert emails? for martin_mueller. 06-05-2020 12:48 AM
- Karma Re: Require input value in text box for dfoster_splunk. 06-05-2020 12:47 AM
- Karma Re: How to prevent | stats count in a macro from triggering a remote search? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time? for devicenul1. 06-05-2020 12:47 AM
- Karma Re: What is the easiest way to identify my universal forwarder versions for kscher. 06-05-2020 12:47 AM
- Karma Re: http://localhost/en-US/debug/refresh from terminal/console for MuS. 06-05-2020 12:47 AM
- Karma Re: Alert if source stops indexing for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: How do i ignore the new line character in the _raw field? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Python Script Not working via search command for psobisch. 06-05-2020 12:47 AM
- Karma Re: How to join value using wildcard? (Urgent) for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Are there any search and performance pitfalls with keeping data in hot buckets for 1 month and moving it from hot to cold directly? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: Is it possible to update a table with a drilldown value from another table's field in the same browser tab? for vtsguerrero. 06-05-2020 12:47 AM
- Karma Re: how to get 1st 2nd and 3rd place results? - based on value of a field - not frequency. for colineltringham. 06-05-2020 12:47 AM
- Karma Re: 6.1.3 issue with mounted Bundles for michael_herbert. 06-05-2020 12:47 AM
- Got Karma for Re: indexer configured but inactive on new Linux servers. 06-05-2020 12:47 AM
- Got Karma for Re: How to fix perfmon errors "Object specified...in conf file is not valid"?. 06-05-2020 12:47 AM
- Got Karma for Re: How to fix perfmon errors "Object specified...in conf file is not valid"?. 06-05-2020 12:47 AM
- Got Karma for Re: DBX JOIN 2 databases together. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
09-16-2013
01:59 PM
1 Karma
shouldn't the sourcetype be present in the udp://.. inputs stanza?
... View more
09-16-2013
11:21 AM
1 Karma
Make the shell script executable, chmod a+x tesh.sh then configure it in inputs.conf. It works.
... View more
09-16-2013
11:16 AM
Please check if the memory object is mentioned properly. Or it may also be possible the perfmon is corrupt and it is not present for monitoring. Refresh your performance counters.
... View more
09-12-2013
12:47 PM
Rakesh you can just create a group to add through LDAP. The search head will be administrated by some admin after you, end users will not be having access to everything if I am not wrong. Role wise/ App wise index creation will help in restricting the users and manage roles. You can't control it from indexer level without the search head. And administrator will always be able to access all the indexes if no separate role is created.
... View more
09-12-2013
12:41 PM
Why do you need a custom condition?
111011source="C:\logs\path*.log" http_status_code=400| Stats Count(Http_status_code) as Error_Count|where Error_Count > 0|Table Http_status_code,Error_Count
will give you the alert. The above is the original search. Then you can go results > 0.
And if you really want to give the custom condition you can give count >= 1
... View more
09-12-2013
10:57 AM
if the other team are having admin access with all cababilities assigned nothing will work, If they are not admins one role with a SSO group should solve the problem
... View more
09-12-2013
10:49 AM
1 Karma
Hi David,
You can use this
source="C:\logs\path\*.log" http_status_code=400| where count > 0
I presume count is a field. A real-time alert or a scheduled alert will do the job.
Or you have to do the below.
source="C:\logs\path\*.log" http_status_code=400| Stats Count(http_status_code) as Error_Count|where Error_Count > 0
... View more
09-11-2013
10:21 AM
According to the above search i have another search which will have |stats value(1st_pulldown_value).
That's the case on the dashboard, it's not worthless as all the possible selection should be available and easy to filter the options. The end user won't have Splunk knowledge to use the search view.
"trying to provide all the information" means it should be exactly like eventvwr. if i give a smaller time period in earliest i will miss some relevant info in the pulldown which i don't want to.
... View more
09-11-2013
07:54 AM
I am trying to provide all the information. At the starting we have the index name and particular server index=xx host=xx. But It takes long. Even if i will filter out the things it will scan all the events for the stats command. I was looking for something like |metadata which will help in getting results faster. I have not tried but will a summary index work?
... View more
09-11-2013
03:09 AM
Thank you for your reply, but i would like to have a complete list with updated fields till the point when i search. I would give it a try with the summary index.
... View more
09-11-2013
02:14 AM
Hello,
I have a dashboard for windows event viewer. There are two pulldowns which populates the relevant fields. But to populate them the search query which i use takes a long time. Is there any other alternative to them quickly rather than using the below?
| stats dc(*) as * |transpose| where column != "host" AND column != "Type" AND column != "source" AND column !="sourcetype" and column != "index"
... View more
09-10-2013
10:48 PM
Did you restart the splunk service? you should be able to use the customized version of Sendmail file.
... View more
08-30-2013
11:02 PM
Did you check the permission on the folder?
"%SPLUNK_HOME%\bin\scripts\echo_output.txt"
Replace with some other location and file outside Splunk directory. I have seen this happens due to lack of permission on the directory.
... View more
08-30-2013
03:03 AM
you need to run this
sourcetype="squid" | lookup lan_lookup homeip as clientip
This will give you the result no need to mention the OUTPUT anymore. Valid point from AYN also don't see much of a mistake there..
... View more
08-29-2013
07:25 AM
yes you should be, Could please do a ping / telnet to the ip port..
... View more
08-29-2013
06:39 AM
Does your event have all 3 fields? I meant every event has all 3 values? If not it's kinda obvious you will get inconsistent or odd values where event may be missing one single field.
If you want to see the consistent value you have to use :
field1=* AND field2=* AND field3=*.
But that may not give you the desired value.
... View more
08-26-2013
07:57 AM
If the eventtime is matching with the log time, if not _time needs to assigned from logs then chart...
... View more
08-26-2013
07:56 AM
because it's still a string not a date.
Convert into time using strftime()/ convert then do a sort then chart...
... View more
08-26-2013
07:50 AM
Are you seeing splunk daemon not responding? This may happen with a busy/locked port [8089]
... View more
08-26-2013
07:49 AM
It's the same i guess,
change my lookup definition
Lookup-s=Source_Lkp srcIP as source
You can't replace the ip by source in the original event, but you can format and show it in a table
...|Table srcIP dstIP srcPORT dstPORT source|...
... View more
08-23-2013
02:24 PM
index="my_summary" source[| inputlookup lookup.csv | fields source ]
or you should give it a go with proper lookup definition
props.conf
[src]
Lookup-s=Source_Lkp source as srcIP dstIP srcPORT dstPORT
transforms.conf
[Source_Lkp]
filename= lookup.csv
assuming you have source in your eventdata
... View more
08-23-2013
10:08 AM
It doesn't really depend on the indexer restart or you don't have to.It's some other reason, works well if the search query with a valid condition. Could you post your query?
... View more
08-23-2013
02:24 AM
The below also gives us a good info :
| rest /services/licenser/pools| where title = "Indexers"|eval Total=(used_bytes/1024/1024/1024)
... View more
08-22-2013
03:17 AM
Hello,
No we can't as there are not valid attributes like source/sourcetype available for wineventlog in inputs.conf
We can however use
[Source::WinEventLog:Application] as source
Thanks
... View more
08-22-2013
01:57 AM
Okay rather than this you can use
|bucket _time span=1d|timechart count. This will always show 1 day interval not two days
... View more
