Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About linu1988
linu1988
Champion
Member since:
12-18-2012
06-05-2020
Community Statistics
| Posts | 979 |
| Solutions | 75 |
| Karma Given | 127 |
| Karma Received | 253 |
| Member Since | 12-18-2012 |
Activity Feed
- Got Karma for Re: Throttling-parameters in realtime search. 01-04-2023 06:13 AM
- Got Karma for Re: Convert a string into a number. 02-03-2022 07:44 AM
- Karma Re: Is there a way to change the font size or bold text in alert emails? for martin_mueller. 06-05-2020 12:48 AM
- Karma Re: Require input value in text box for dfoster_splunk. 06-05-2020 12:47 AM
- Karma Re: How to prevent | stats count in a macro from triggering a remote search? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time? for devicenul1. 06-05-2020 12:47 AM
- Karma Re: What is the easiest way to identify my universal forwarder versions for kscher. 06-05-2020 12:47 AM
- Karma Re: http://localhost/en-US/debug/refresh from terminal/console for MuS. 06-05-2020 12:47 AM
- Karma Re: Alert if source stops indexing for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: How do i ignore the new line character in the _raw field? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Python Script Not working via search command for psobisch. 06-05-2020 12:47 AM
- Karma Re: How to join value using wildcard? (Urgent) for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Are there any search and performance pitfalls with keeping data in hot buckets for 1 month and moving it from hot to cold directly? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: Is it possible to update a table with a drilldown value from another table's field in the same browser tab? for vtsguerrero. 06-05-2020 12:47 AM
- Karma Re: how to get 1st 2nd and 3rd place results? - based on value of a field - not frequency. for colineltringham. 06-05-2020 12:47 AM
- Karma Re: 6.1.3 issue with mounted Bundles for michael_herbert. 06-05-2020 12:47 AM
- Got Karma for Re: indexer configured but inactive on new Linux servers. 06-05-2020 12:47 AM
- Got Karma for Re: How to fix perfmon errors "Object specified...in conf file is not valid"?. 06-05-2020 12:47 AM
- Got Karma for Re: How to fix perfmon errors "Object specified...in conf file is not valid"?. 06-05-2020 12:47 AM
- Got Karma for Re: DBX JOIN 2 databases together. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
08-07-2013
11:34 AM
1 Karma
Don't use the full prefix the answer posted is correct, As time prefix only needed to be unique just before the timestamp starts. And FYI if you want the configs to update without restart you can use the below link, new changes will be done.
_http://server:8000/en-US/debug/refresh
expect some of the configs minor changes can be done with it 🙂
... View more
08-07-2013
11:31 AM
From my point of view the dispatch directory contains the run stats of the saved searches. If you can configure the values low then you will get rid of the alert. They are not much of a use. The dispatch directory only eats away the memory in the hard drive nothing else... Correct me if i am wrong. Thanks.
... View more
08-07-2013
04:16 AM
Timechart gives me the result but there are too many columns to consider. Any tweak that will only join the empty times between the missing time intervals
... View more
08-07-2013
04:13 AM
You can't do a chart to show that the event came at that time. Some numerical value is needed to plot a graph , e.g. time per phase_info. Thanks
... View more
08-06-2013
10:00 AM
I had thought of using Timechart but with many fields it doesn't give me the result. I want it in a tabular format with other relevant fields along with the sum value.
BTW thank you for the guidance ,but is there any other way by which I can get the whole _time range if the events doesn't have them?
... View more
08-06-2013
06:14 AM
You can put in the local system folder of splunk.
Please follow the documentation:
http://blogs.splunk.com/2009/12/02/configure-splunk-to-pull-a-date-out-of-a-non-standard-filename/
... View more
08-06-2013
06:08 AM
Hello Everyone,
I was doing some aggregation with stats, i had to show all the events between 15 minutes interval. The events available are having time according to the file modified date. When i do
"|bucket _time span=15m|Stats sum(FILESIZE)by _time"
i get the desired result and upon the value i get to know whether the file backup was done properly or not.
So My question was to "HOW CAN I GET THE INTERMEDIATE TIMES FOR THE EMPTY EVENTS FROM STARTING TO END TIME,SO THAT I CAN GET NULL FOR THOSE VALUES?
... View more
- Tags:
- eventtime
- nullvalues
08-06-2013
12:13 AM
1 Karma
Hello Kailun,
from your case i can tell your time is appropriately recognized from the events. You just need to re-format it.
Please follow the "Reconfigure how timestamps appear in raw data" part in the below documentation:
http://docs.splunk.com/Documentation/Splunk/5.0.4/Data/Configuretimestamprecognition
... View more
08-05-2013
09:55 PM
Please provide us with sample logs. Try extracting the logs from Splunk UI, remove the matches which you don't want.
... View more
08-05-2013
12:42 PM
Sorry i should have been specific, I meant the dashboards which are having proper search queries.
... View more
08-05-2013
12:03 PM
It happens because Splunk adds an search before MACRO, Savedsearch when it's called. So if you just mention the |inputlookup macro(bar) then it will work. Thanks. There may be some other solution but i can tell this much.
... View more
08-05-2013
11:42 AM
But when i added another 20 indexes to existing 20 i felt the searches had slowed down even if the new indexes didn't contain any data. Any possible reason?
... View more
08-05-2013
10:57 AM
I wouldn't do this many index but curious to know the reason as i see something similar with me.
... View more
08-05-2013
09:32 AM
1 Karma
I would say to go with the Percentage, It's more appropriate and user friendly to understand. There are workarounds with replacing and converting them into GB and TB bytes.
... View more
08-05-2013
07:36 AM
1 Karma
Hello,
Similar questions had been answered before. This may help you:
http://splunk-base.splunk.com/answers/59361/dealing-with-keyvalue-pairs-with-inconsistent-key-case
... View more
08-05-2013
07:34 AM
Could you check which account the splunk runs under? May you can own the Splunk process, May be some access related issue rather than Network.
... View more
08-04-2013
10:57 PM
Could you add TRUNCATE=0 in props.conf?
... View more
08-03-2013
11:01 PM
But this is not a solution!! Who will change their DB just to show the content in Splunk? Date Time should be recognized automatically and shown as it is rather than epoch format. Btw Thank you for your time.
... View more
08-02-2013
07:27 AM
Hello Cris,
Please find suggested hardware requirements for Splunk:
http://docs.splunk.com/Documentation/Splunk/5.0.3/Installation/Systemrequirements
You can configure your master node as the search head and other peers as indexers. All three can be considered as your cluster with 1 Search Head and 2 indexer.
... View more
08-02-2013
07:17 AM
Could you get sample logs for us? Are the fields shown when used without transaction?
... View more
08-02-2013
07:03 AM
You can mention this on Manager » Access controls » Roles » RoleName. Assign the roles to relevant user groups and specify the index. Thanks
... View more
08-02-2013
06:52 AM
I think it's because of the assignment in count for the STATS. Filter the values before you count rather than in the count function, you should have the result. Thanks
... View more
08-01-2013
04:29 AM
After the data is indexed, it will not be indexed anymore even if there are any manipulation on the data.
... View more
07-30-2013
01:25 AM
Follow these..and Yes you can create new app in free version as well.
http://docs.splunk.com/Documentation/Splunk/5.0.3/AdvancedDev/BuildApp
http://wiki.splunk.com/Community:Creating_your_first_application
http://www.wikihow.com/Create-an-App-With-Splunk-App-Builder
... View more
07-29-2013
11:08 PM
Create a App Template from UI. Go to the relevant search/User Interface objects. Move it to the new app. Do copy the props.conf and transforms.conf to the new app. You can customize the navigation menu by modifying the default NAV file. Thanks.
... View more
