Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About linu1988
linu1988
Champion
Member since:
12-18-2012
06-05-2020
Community Statistics
| Posts | 979 |
| Solutions | 75 |
| Karma Given | 127 |
| Karma Received | 253 |
| Member Since | 12-18-2012 |
Activity Feed
- Got Karma for Re: Throttling-parameters in realtime search. 01-04-2023 06:13 AM
- Got Karma for Re: Convert a string into a number. 02-03-2022 07:44 AM
- Karma Re: Is there a way to change the font size or bold text in alert emails? for martin_mueller. 06-05-2020 12:48 AM
- Karma Re: Require input value in text box for dfoster_splunk. 06-05-2020 12:47 AM
- Karma Re: How to prevent | stats count in a macro from triggering a remote search? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time? for devicenul1. 06-05-2020 12:47 AM
- Karma Re: What is the easiest way to identify my universal forwarder versions for kscher. 06-05-2020 12:47 AM
- Karma Re: http://localhost/en-US/debug/refresh from terminal/console for MuS. 06-05-2020 12:47 AM
- Karma Re: Alert if source stops indexing for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: How do i ignore the new line character in the _raw field? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Python Script Not working via search command for psobisch. 06-05-2020 12:47 AM
- Karma Re: How to join value using wildcard? (Urgent) for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Are there any search and performance pitfalls with keeping data in hot buckets for 1 month and moving it from hot to cold directly? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: Is it possible to update a table with a drilldown value from another table's field in the same browser tab? for vtsguerrero. 06-05-2020 12:47 AM
- Karma Re: how to get 1st 2nd and 3rd place results? - based on value of a field - not frequency. for colineltringham. 06-05-2020 12:47 AM
- Karma Re: 6.1.3 issue with mounted Bundles for michael_herbert. 06-05-2020 12:47 AM
- Got Karma for Re: indexer configured but inactive on new Linux servers. 06-05-2020 12:47 AM
- Got Karma for Re: How to fix perfmon errors "Object specified...in conf file is not valid"?. 06-05-2020 12:47 AM
- Got Karma for Re: How to fix perfmon errors "Object specified...in conf file is not valid"?. 06-05-2020 12:47 AM
- Got Karma for Re: DBX JOIN 2 databases together. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
07-24-2013
02:33 AM
I think the first block missed the for loop, so only one header is getting hidden.
... View more
07-24-2013
02:18 AM
What do you want to monitor? The change in FileSystem or any change to specific logs? As fschange is now depriciated, you need to use scripts to monitor the filesystem change/monitor stanza.
... View more
07-23-2013
04:22 AM
Please refer this documentation for the Savedsearch parameters:
_http://dev.splunk.com/view/SP-CAAAEKZ
... View more
07-23-2013
03:20 AM
I think you can go for stopping the instances one by one, And then use the rolling-restart command to start all of the peers. I also couldn't find anything about the stopping from master node.
... View more
07-22-2013
10:23 AM
bat file should contain the command then, include the bat file in the script stanza.
... View more
07-22-2013
09:26 AM
You can mention in the script stanza of inputs.conf file. But i am not sure how the script will run. For the script to execute it should have the compiler/interpreter. May be you need to set the script to run through python.
See if the script runs manually, then try setting in script stanza OR Manually set the path and run through a bat file. Thanks.
... View more
07-22-2013
09:09 AM
I tried it on sample event, i didn't get it. Let the actual person give it a go 🙂
... View more
07-22-2013
08:41 AM
Hey James,
Great analysis, but without join how the Table will show different value belonging to separate events? I faced the same in my query to get the userprocess value..
... View more
07-22-2013
07:31 AM
From this i am assuming the Total is a field from the search not evaluated. When you do the search for only for Total, why do you make the stats? Try the calculation after the SubSearch. See if the subsearch returns any matching result. Thanks.
... View more
07-22-2013
06:05 AM
sourcetype=_Name "userprocesses"|eval a=strptime(_time,"%d:%m:%y %H:%M:%S")|fields a [|search index=main sourcetype=_Name "memoryusage"|where MCount >10000000|eval a=strptime(_time,"%d:%m:%y %H:%M:%S")|fields a]
the above query will give you the event containing the Process at the same time when the memory usage is high. You can also remove the %s parameter if you are okay with comparing minute wise.
... View more
07-22-2013
04:59 AM
Extract the data into a field named Mem_count. You can use rex / UI field extraction. Thanks.
Sourcetype=_Name "memoryusage"| where Mem_count>10000000
... View more
07-22-2013
04:51 AM
Then it's the problem with the macro definition. it should give you the User_Name when you pass it in the search.
... View more
07-22-2013
03:59 AM
Does the macro give you the result when applied with some static value? And what macro does is just replace the value of the variable. When you pass like "$userid$", then in macro it becomes ""$userid$"", isn't it? and while converting the macro in XML it also makes it " , which is not supported by xml, need to replace it by " in definition.
... View more
07-22-2013
03:16 AM
web("$userid$") , why do we need double quotes? Could you post the macro definition?
... View more
07-22-2013
01:35 AM
It depends on the role of the user and maximum number of searches allowed to that use. You can see them in access control->roles->Role_Name if you are an ADMIN. There you can modify the number of searched availed to the role, which the user belong to. Thanks.
... View more
07-21-2013
12:49 AM
Nix App's scripts are basic linux commands. However there are some packages which you may need to download on the linux server. Any of the linux distribution will work..
... View more
07-20-2013
06:05 AM
replace does allow regex, please test it on the search app, i think there is a problem with xml.
... View more
07-20-2013
12:32 AM
http://docs.splunk.com/Documentation/Splunk/5.0.3/Search/Specifytimemodifiersinyoursearch
"More about snap-to-time"
i think because of this property it's rounding off to the nearest time period.
... View more
07-19-2013
02:05 PM
i think it's overcooked. Let it flow into splunk. Splunk should be able to get the events divided whereever it finds time at the start. After that, do the field extraction on the UI, which is easier, where you can actually see the matching. If the time is not correct, set the Props.conf for time recognition. Thanks
... View more
07-19-2013
10:46 AM
"AA ALL Lost Host (D)",Is that a savedsearch or macro? if you are passing parameter the you have to mention the "Savedsearch var=value".
... View more
07-19-2013
01:34 AM
Rakesh did you comment all the "intro"? This give the error when it is not able to generate a valid result set / it get s zero result from the search. Please replace the python script from the search app and see if the results are being sent. You can always debug with the help of splunkd.log to customize the file again.
... View more
07-18-2013
11:21 PM
1 Karma
You can explicitly define earlest=-1d@d latest=0d@d if only the previous day's data is to be displayed.
... View more
07-18-2013
12:25 PM
extract the IP, eval all of them into different different fields... I have not tried, thought just came to my mind..
... View more
07-18-2013
11:31 AM
you can use the cidrmatch to assign your original IPs to subgroups like you mentioned. I hope this works...
_http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/CommonEvalFunctions
... View more
