Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About net1993
net1993
Path Finder
Member since:
11-07-2018
02-08-2021
Community Statistics
| Posts | 99 |
| Solutions | 0 |
| Karma Given | 10 |
| Karma Received | 10 |
| Member Since | 11-07-2018 |
Activity Feed
- Got Karma for Getting error after upgrading Splunk Add-on for AWS on v 8.0.3.. 04-28-2021 05:30 PM
- Posted Re: Splunk Add-on for AWS - Cloudwatch Metrics AmazonMQ Queue and Topic Is it possible to collect these? on All Apps and Add-ons. 02-08-2021 04:05 AM
- Posted Splunk Add-on for AWS - Cloudwatch Metrics AmazonMQ Queue and Topic Is it possible to collect these? on All Apps and Add-ons. 02-05-2021 03:34 AM
- Got Karma for Getting error after upgrading Splunk Add-on for AWS on v 8.0.3.. 11-10-2020 12:56 PM
- Got Karma for Getting error after upgrading Splunk Add-on for AWS on v 8.0.3.. 10-07-2020 03:20 PM
- Got Karma for Getting error after upgrading Splunk Add-on for AWS on v 8.0.3.. 10-04-2020 10:33 PM
- Posted Getting error after upgrading Splunk Add-on for AWS on v 8.0.3. on Installation. 09-17-2020 04:10 AM
- Posted cisco asa add-on - default regex not working in UI with regex/rex command on Splunk Search. 09-10-2020 04:09 AM
- Posted Re: regex is working in cisco asa add-on but get error if the same regex is used in UI with regex command on Splunk Search. 08-31-2020 11:44 PM
- Posted regex is working in cisco asa add-on but get error if the same regex is used in UI with regex command on Splunk Search. 08-31-2020 06:45 AM
- Tagged regex is working in cisco asa add-on but get error if the same regex is used in UI with regex command on Splunk Search. 08-31-2020 06:45 AM
- Posted metadata command returns duplicate sourcetypes - "WinEventLog" on Splunk Search. 06-24-2020 11:57 PM
- Karma Re: How to count the number of times Splunk is restarted. for kamal_jagga. 06-15-2020 02:03 AM
- Karma Re: problem with rounding bytes to gb for richgalloway. 06-05-2020 12:51 AM
- Karma Re: In the following searches, how come the days of the week are not sorting correctly? for whrg. 06-05-2020 12:50 AM
- Karma Re: alert - can I sent email from specific email address only for specific alert for VatsalJagani. 06-05-2020 12:50 AM
- Karma Re: alert - can I sent email from specific email address only for specific alert for VatsalJagani. 06-05-2020 12:50 AM
- Karma Re: After upgrade to 7.2.6 unable to send test email with sendemail.py for iserc. 06-05-2020 12:50 AM
- Got Karma for Is there Splunk documentation on the definition of the field status in the _internal log source type scheduler?. 06-05-2020 12:50 AM
- Got Karma for Re: In the following searches, how come the days of the week are not sorting correctly?. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 4 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-15-2019
01:54 AM
I am getting same issue with itsi 4.1.1 , splunk 7.4.2.4.
Someone can help?
... View more
03-14-2019
05:45 AM
Guys, some ideas ?
I tried the older build of 7.2.4. and again itsi and it was working ok.
Then I placed under /etc/deployment-server base app _all_forwarders without anything special
and sudo service Splunkd restart
and then the problem occured again
... View more
03-14-2019
01:40 AM
Hi
After fresh splunk install health check was working as I used it to check ulimit . From yesterday I cannot open the page, it says only Loading..
Tryed different browser
splunkd.log no specific errors
Someone can help?
The only things I have installed is ITSI and the releated to ITSI (java8, machine learning toolk.)
... View more
- Tags:
- splunk-enterprise
03-06-2019
04:53 AM
Hello
I have a REST call and I am on SH1, and I am trying to follow the REST, but there comes nothing from SH2. Where is the data I am interested located at?
rest :
| rest splunk_server=* count=0 /services/saved/searches
the same rest is working ok if executed locally on SH..
Anybody experience the same issue and have a clever solution?
Thanks.
... View more
- Tags:
- rest
- search-head
02-28-2019
02:15 AM
Hi
I am in a bit of urgent issue and cannot figure out solution.
I use that rest call to get list of all indexers:
|rest /servicesNS/-/-/search/distributed/peers
From admin is working ok but from User role getting error:
Failed to fetch REST endpoint uri=https://127.0.0.1:8089/servicesNS/-/-/search/distributed/peers?count=0 from server https://127.0.0.1:8089. Check that the URI path provided exists in the REST API
I have tried added all rest capabilities for my user role
... View more
- Tags:
- rest
02-19-2019
01:39 PM
Dont understand .
"Note also that If the Sonicwall sourcetype you use has search time extractions then you need to put it in the search heads ".
Why need to put on the indexers?
Just can you explain the whole sentence..?
... View more
02-19-2019
12:41 PM
hi
Why it is reqired the last thing with search time field extraction. Can you please explain more ?
... View more
02-11-2019
01:41 AM
I am looking at same attribute and in 15 minutes cannot get it whether it is me or Splunk's missing sense as it is not the first time.
When I see NO_ I expect behaviour as Do Not and if =true then Do Not !!!
but Specs file at /README/ says "* When set to true, Splunk software processes binary files."
so I am confused as it is two contrary statements .
... View more
01-23-2019
11:29 PM
earliest=-10m latest=now index=_internal source=metrics.log fwdType!="uf" |head 2
|append [|search earliest=-10m latest=now index=_internal source=metrics.log fwdType="uf" |head 1 ]
|table hostname ,version
not possible to be issue as only 1 row.
Plus the missing data is most of time from the first search ,though sometime from both are missing.
... View more
01-23-2019
02:28 PM
1 Karma
Hi
using append to add result to search , values dissapears from my main search and drives me crazy.
The result is per search basis, meaning 1 time execute -> Null values, 2nd run -> ok - 3rd Null...
100% problem is from append.
Total non-sense and more than 7 hours analyzing.
... View more
- Tags:
- splunk-enterprise
01-21-2019
03:01 PM
Hi
Thanks a lot for the fast responses and help:)
I needed 1,5 hour to check this but seems to work quite ok.
Still it is not the perfect solution as this retain the value of only 1 field. lWhat do we do if we need whole row. Write 50 lines more?
Anyway, this is working solution.
... View more
01-21-2019
07:08 AM
dedup will remove data which I need , this is incorect.
... View more
01-21-2019
06:58 AM
its epoch but I write it like that for simplicity..
... View more
01-21-2019
06:57 AM
I marked \n for new line as the reply web form is not recognizing new lines
... View more
01-21-2019
06:52 AM
A|C|_time
text1|23|20180101\n
text2|33|20180102\n
text1|24|20180103\n
text2|54|20180104\n
|stats latest(_time) by A
A|C|_time
text1|20180103\n
text2|20180104\n
A|C|_time
text1|24|20180103\n
text2|54|20180104\n
then I want to do sum on C
and get:
78
... View more
01-21-2019
06:33 AM
Yes I hope this is enought.?
Before using stats function I have the following fields:
A, B, C, _time
then I do this:
|stats latest(_time) by B I want to see the resulting values for field C for every value of field B
then If I want to do that :
|stats sum(C) I get error as field C doesnt exist anymore as its not mentioned in stats command.
let me know if not clear
... View more
01-21-2019
06:31 AM
thank you but this still is not right solution but I think you got the point. The problems with mvexpand:
- work with only up to 100 values.
- it is sorting the values as they re strings where isntead I need to get only these values which care corresponding on the rows for result from latest function.
- as far as I see from your command, the final sum will do sum on all values from list command fx 100x values but this ebcomes incorect as I want sum only on the values resulting from latest functions row
... View more
01-21-2019
05:28 AM
I will try to illustrate the required outcome:
Before using stats function I have the following fields:
A, B, C, _time
then I do this:
|stats latest(_time) by B * I want to see the values for field C for every value of field B
then If I want to do that :
|stats sum(C) * I get error as field C doesnt exist anymore as its not mentioned in stats command.
... View more
01-21-2019
05:20 AM
no. this is not the problem. I want to have stat table but what I want is after using the stats function to keep all of the fields which are before using stats. Currently, after stats is used, the only available fields after that are the one mentioned in stats function. The rest are unavailable.
... View more
01-21-2019
05:14 AM
hmm, no this is not doing what I need. I tried but instead of doing grouping , it does something else.
... View more
01-21-2019
05:00 AM
Hi,
I've read a while ago how easier Splunk is vs SQL, but I do not agree within the context of my issue:(
I want to get the latest values based on a field, and then use a different field, but according to SPL, this is not so common, and I need to use hours to hit my head in table
So, basically, here's what I want:
|stats latest(_time) by A
-> I want now to see/use values for field C, but I cannot as after stats, the only fields that are left are the ones mentioned in stats.
... View more
01-15-2019
01:54 AM
That could be woraround but 1 question:
Isnt that file only allowing you to change from shared in app to shared globally KO?
... View more
01-15-2019
01:15 AM
Hi
Today I needed to edit perm. for 16 reports from private to app but I didnt had time to check how to do it on os level so I done it manually but this is absolutely stupid.
Isn't there other way , fx change perm. on App level or something else ?
... View more
- Tags:
- splunk-enterprise
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-08-2021
08:05 AM
|
