Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About linu1988
linu1988
Champion
Member since:
12-18-2012
06-05-2020
Community Statistics
| Posts | 979 |
| Solutions | 75 |
| Karma Given | 127 |
| Karma Received | 253 |
| Member Since | 12-18-2012 |
Activity Feed
- Got Karma for Re: Throttling-parameters in realtime search. 01-04-2023 06:13 AM
- Got Karma for Re: Convert a string into a number. 02-03-2022 07:44 AM
- Karma Re: Is there a way to change the font size or bold text in alert emails? for martin_mueller. 06-05-2020 12:48 AM
- Karma Re: Require input value in text box for dfoster_splunk. 06-05-2020 12:47 AM
- Karma Re: How to prevent | stats count in a macro from triggering a remote search? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time? for devicenul1. 06-05-2020 12:47 AM
- Karma Re: What is the easiest way to identify my universal forwarder versions for kscher. 06-05-2020 12:47 AM
- Karma Re: http://localhost/en-US/debug/refresh from terminal/console for MuS. 06-05-2020 12:47 AM
- Karma Re: Alert if source stops indexing for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: How do i ignore the new line character in the _raw field? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Python Script Not working via search command for psobisch. 06-05-2020 12:47 AM
- Karma Re: How to join value using wildcard? (Urgent) for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Are there any search and performance pitfalls with keeping data in hot buckets for 1 month and moving it from hot to cold directly? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: Is it possible to update a table with a drilldown value from another table's field in the same browser tab? for vtsguerrero. 06-05-2020 12:47 AM
- Karma Re: how to get 1st 2nd and 3rd place results? - based on value of a field - not frequency. for colineltringham. 06-05-2020 12:47 AM
- Karma Re: 6.1.3 issue with mounted Bundles for michael_herbert. 06-05-2020 12:47 AM
- Got Karma for Re: indexer configured but inactive on new Linux servers. 06-05-2020 12:47 AM
- Got Karma for Re: How to fix perfmon errors "Object specified...in conf file is not valid"?. 06-05-2020 12:47 AM
- Got Karma for Re: How to fix perfmon errors "Object specified...in conf file is not valid"?. 06-05-2020 12:47 AM
- Got Karma for Re: DBX JOIN 2 databases together. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
07-21-2014
10:11 AM
they have different syntax , if not migrated properly they wont forward the data.
include perfmon in the inputs.conf file and restart
... View more
07-18-2014
06:17 AM
1 Karma
Hello,
You don't need to upgrade the forwarders. The indexers are backward compatible. But if you have cluster upgrade them to same versions.
http://docs.splunk.com/Documentation/Splunk/6.1.2/Forwarding/Compatibilitybetweenforwardersandindexers
Thanks,
L
... View more
07-18-2014
06:13 AM
do you get any error? and is this all you have in the _raw data? try with more match...
|rex field=_raw "\\d+\/(?<Error>\S+)\/"
... View more
07-18-2014
05:42 AM
Hello,
Am not sure which part exactly would you like to extract.
if it's failure: |rex field=_raw "\/(?<Error>\S+)\/"
if it's the long digit which is the error code then: |rex field=_raw "\/(?<Error>\d+)\>"
Thanks,
L
... View more
07-18-2014
05:32 AM
Hello All,
I am forwarding some csv data into splunk from a script. The problem is splunk is applying a newline character which is breaking the value in between. The data is already indexed. Is there a way that i can capture them in an extracted field and then ignore the newline character to make a new field so that i don't have use the replace function which will be used in where cause.
Currently i am using the REPORT CLASS to extract the csv values
e.g.
Field= ABCD without escape character
Field= ABC D where new line character is included
Thanks in advance
... View more
07-14-2014
04:32 AM
Hello Sunil,
You can do by renaming the fields.
index=A OR index=B|rename ipaddress as sourceip|stats avg(packets) by sourceip
OR
|multisearch [search index=A|table name,packets,sourceip][search index=B | table category,classification,ipaddress|rename ipaddress as sourceip]|stats avg(packets) by sourceip
Thanks,
L
... View more
07-05-2014
05:47 AM
Did you try
|metadata type=hosts index=*
This is the fastest way to get the host names.
OR
if you want it to be index independent, make a summary index and start collecting them. Search them over time.
Thanks,
L
... View more
06-27-2014
07:09 AM
i mentioned earlier, the script is not getting triggered at all. when it gets triggered it actually works. This is depending on the above search i mentioned. With complex searches it doesn't trigger the script at all.
... View more
06-27-2014
06:02 AM
I mentioned earlier, i get all the events for all the searches and get the detailed mail as well. I have been struggling to understand why it is not triggering that .bat file. Any idea on the logic how the script is triggered? may be some bug with wildcard searches or longer search queries. Where else should i check for the reason?
... View more
06-27-2014
03:24 AM
no it is script which is triggered with a savedsearch. That is not working what ever i do. Manually the bat file runs and it works with some specific search with wildcards. As i mentioned once i include more filtered criteria that doesn't trigger the script. As usual the email alert i get.
... View more
06-27-2014
12:42 AM
Hey Mus,after this long i have set up each and every tracing mechanism to validate where the issue lies. But it doesn't trigger the script at all. It sends me the result mail but it simply doesn't trigger until i give some specific filters. if time is the problem i want the ugly result but there is no trigger from the script. Hope you can give some other idea.
e.g bat file contains mkdir folder. it's not even creating that.
... View more
06-26-2014
08:23 PM
def htmlTableTemplate
`<th style="text-align: left;
add color: blue/red.. for splunk 6`
... View more
06-26-2014
10:26 AM
Hello All,
i have been struggling to find the reason why sometimes the scripts are not triggered when i put some wildcards for filtering search. My search contains many sub searches to be able to get all the information with append statements.
sample:
Working scenario:
index=dummy "x\.y\.z" OR "x\.y" OR "v.x.y.z.*IO*"
Non-Working
index=dummy "x\.y\.z" OR "x\.y" OR "v.x.y.z*.*.IO*"
it doesn't trigger the script in the second. Any setting which could help me in this? I have inspected the job not able to get any error or hint. No errors in python.log or splunkd.log. Am using splunk v5.0.1
Thanks
... View more
06-24-2014
02:29 AM
use
BREAK_ONLY_BEFORE=\d{2}-\d{2}-\d{4}\s\d{2}:\d{2}:\d{2}\.\d{3}
... View more
06-20-2014
07:42 PM
Go to Perfmon if you have logon access to the machine.
Check all the instances for the databases object which you want to monitor rather that using *. If you don't see the database in the list splunk will not as well
Moreover you can also monitor the size using sql script as well. Search for how to check database size using sql and trigger the same using sqlcmd in the bat file.
Thanks,
L
... View more
06-20-2014
07:35 PM
1 Karma
you can do it. Using the pulldown module user have to choose one value or a default value will be chosen.
... View more
06-19-2014
08:51 PM
put a java script in your input and validate it. If no input is given re-focus on that again. Could you give it a try?
... View more
06-19-2014
08:48 PM
could you be a little more clear? you are plotting them for every 15 minutes already. What do we required here? Is rate is another param?
|bucket _time span=15m |chart max(rate) by out_msgs
|timechart span=15m max(rate) by out_msgs
Thanks,
L
... View more
06-19-2014
07:51 PM
the database engine is more powerful than Splunk's query engine as database knows how the data is stored and retrieved. Selecting them both then do a join in splunk is not proper use of network.The desired data can be taken from the DB directly and then with Splunk's command you can manipulate
For e.g. if you have 10 Million records in both the tables and the desired result is only 30000 records then in DB you only see 20 Million.But when you do it in splunk you are taking 20+20 Million to the join,which takes more time and resource. But joining DB data with splunk's raw data will be useful
... View more
06-19-2014
10:16 AM
Hello,
you need the where clause.
...|where "Account Name" like "%-%-%"
Thanks,
L
... View more
06-19-2014
10:03 AM
1 Karma
we should not do any join and let the data come to splunk. It is wastage of resource and not proper usage of the database engine itself
No need to include any other db in the query. Just put one single query and then write down the query using conventional join. Just include the full name, DB.schema.table name. it will work
... View more
06-18-2014
10:54 AM
1 Karma
Splunk 6 forwarders are not compatible to 4.x indexers..
http://docs.splunk.com/Documentation/Splunk/6.1.1/Forwarding/Compatibilitybetweenforwardersandindexers
... View more
06-16-2014
12:31 PM
i guess if you change the version you will be able to upgrade if not re-install. And i guess you will be deploying using deployment server? Waiting for the answer too.
... View more
06-16-2014
12:26 PM
Luke i was checking the same.
i found out that in the slideshow_setup.js file the path was static and was checking /app/slideshow/js/views/SlideshowSetupView
once i changed that to the respective view directory i could add them all and they worked as expected. Is that the bug?
... View more
