Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About linu1988
linu1988
Champion
Member since:
12-18-2012
06-05-2020
Community Statistics
| Posts | 979 |
| Solutions | 75 |
| Karma Given | 127 |
| Karma Received | 253 |
| Member Since | 12-18-2012 |
Activity Feed
- Got Karma for Re: Throttling-parameters in realtime search. 01-04-2023 06:13 AM
- Got Karma for Re: Convert a string into a number. 02-03-2022 07:44 AM
- Karma Re: Is there a way to change the font size or bold text in alert emails? for martin_mueller. 06-05-2020 12:48 AM
- Karma Re: Require input value in text box for dfoster_splunk. 06-05-2020 12:47 AM
- Karma Re: How to prevent | stats count in a macro from triggering a remote search? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time? for devicenul1. 06-05-2020 12:47 AM
- Karma Re: What is the easiest way to identify my universal forwarder versions for kscher. 06-05-2020 12:47 AM
- Karma Re: http://localhost/en-US/debug/refresh from terminal/console for MuS. 06-05-2020 12:47 AM
- Karma Re: Alert if source stops indexing for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: How do i ignore the new line character in the _raw field? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Python Script Not working via search command for psobisch. 06-05-2020 12:47 AM
- Karma Re: How to join value using wildcard? (Urgent) for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Are there any search and performance pitfalls with keeping data in hot buckets for 1 month and moving it from hot to cold directly? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: Is it possible to update a table with a drilldown value from another table's field in the same browser tab? for vtsguerrero. 06-05-2020 12:47 AM
- Karma Re: how to get 1st 2nd and 3rd place results? - based on value of a field - not frequency. for colineltringham. 06-05-2020 12:47 AM
- Karma Re: 6.1.3 issue with mounted Bundles for michael_herbert. 06-05-2020 12:47 AM
- Got Karma for Re: indexer configured but inactive on new Linux servers. 06-05-2020 12:47 AM
- Got Karma for Re: How to fix perfmon errors "Object specified...in conf file is not valid"?. 06-05-2020 12:47 AM
- Got Karma for Re: How to fix perfmon errors "Object specified...in conf file is not valid"?. 06-05-2020 12:47 AM
- Got Karma for Re: DBX JOIN 2 databases together. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
07-18-2013
11:28 AM
i don't think splunk needs root access to read logs. If you are using monitor stanza it should read it..
... View more
07-17-2013
08:30 AM
It's the architecture to disable the splunk indexer's splunkweb if it's the search peer. You can't start it...
Please refer the documentation for clustered peer/Splunk indexers. It's not explicitly mentioned but it's no where mentioned that you can access indexer from UI.
Moreover you can actually search everything from your search head why do you need the indexer splunkweb. Finally don't worry that is the expected behavior when it's only a search peer and it's pooled. Thanks 🙂
... View more
07-17-2013
06:08 AM
Could you please post the search query used? I have checked multikv was working ...
... View more
07-17-2013
05:53 AM
As per the splunk documentation We should use the below approach:
splunk rolling-restart cluster-peers
_http://docs.splunk.com/Documentation/Splunk/5.0.3/Indexer/Restartthecluster
... View more
07-17-2013
05:48 AM
Hello MarMoh,
Is the indexer is added as a search peer? I think it will not allow you to start the Splunk Web on the indexer.
... View more
07-17-2013
05:22 AM
Use " instead of the quote in your search expression in xml
... View more
07-17-2013
04:24 AM
Could you please give the below query a try:
|bucket _time span=5m| eval percent_difference=((BandwidthIn/BandwidthOut)*100) | table percent_difference ,_time
Thanks
... View more
07-16-2013
06:40 AM
Hello,
You can't delete the host names until and unless you clean the index/re-create them.
I suppose the logs were collected for some web event which gave you all the other host names. If you can define the default HOST stanza in inputs.conf then it will give you the single host name.
Even you can define them separately per source basis.
Kindly refer the below path:
_http://docs.splunk.com/Documentation/Splunk/5.0/Data/overridedefaulthostassignments
... View more
07-12-2013
01:09 PM
So are you suggesting they are not indexed?
Other scenario is like , you could see the events in realtime, but the indexed event may have a different timestamp than the actual event time. Search for for the whole data, check if the data which you saw in the rt search are present or not...
... View more
07-12-2013
12:13 PM
lookup AllClients.csv is that the name of your lookup?? Did you define the lookup for the search in props and transform.conf?
... View more
07-12-2013
11:08 AM
Is the field has the value "Nom du compte :"? If not you have to manually extract and make a field, then u can use it for tables/graphs.
... View more
07-12-2013
09:24 AM
Hey Rakesh could you check Splunkd.log and see if the 8089 port is blocked by any chance.
... View more
07-12-2013
05:59 AM
use join to see the difference
Index=blah earliest=-1w@W|stats count as LastCount|join host[Index=blah earliest=-0w@W|stats count as Latest]|table host,LastCount,Latest|eval Difference=Latest-LastCount
... View more
07-11-2013
01:54 PM
The mentioned error i dont think is the cause. Please give the splunkforwarder folder full access. Run the forwarder under root. use splunk btool to check whether all the settings are correct or not. The receving port needs to be configured on indexers
... View more
07-11-2013
11:45 AM
The cron schedule should be like this:
* * * * /1 * * *
Please refer this: docs.splunk.com/Documentation/Splunk/5.0.3/Alert/Scheduledsearch
... View more
07-11-2013
11:34 AM
TIME_FORMAT=%s
TIME_PREFIX= \d{7}\|\d{6}\|\d\|
MAX_TIMESTAMP_LOOKAHEAD = 10
could you try setting props.conf and index new data?
... View more
07-11-2013
11:04 AM
is the receiving port configured?
... View more
07-11-2013
10:22 AM
Please use
TIME_FORMAT=%s
TIME_PREFIX= (regex)
MAX_TIMESTAMP_LOOKAHEAD = 32
... View more
07-11-2013
08:28 AM
evenif it's multi valued the field contains the keyword. I haven't tested as i don't have relevant data. Try it out, see if it's not working, use the multikv command to separate the mv fields, make it single valued field.
... View more
07-11-2013
05:29 AM
And for Heavy/Light you will have a full splunk instance i.e. splunkd, splunkweb will be available but not in universal forwarder..
... View more
07-11-2013
05:12 AM
check the inputs.conf/outputs.conf files. They will give you a hint
... View more
07-11-2013
05:10 AM
Ahh i get it, So lookup is the best option/ a csv containing the commands. Just use a subsearch and get the result.
e.g.
Index=blah sourcetype=blah [|inputcsv command.csv]| table _raw
note:make sure any single column should be present to match
... View more
07-10-2013
10:35 PM
How do you plan to execute unix command? Are the data indexed? If yes then the source=* will give you all the commands' result. then see how it can be done. Correct me if i am wrong.
... View more
07-10-2013
01:02 PM
Please mark answer if it gave you the solution, may help others as well
... View more
