Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About arrowecssupport
arrowecssupport
Communicator
Member since:
12-29-2015
06-05-2020
Community Statistics
| Posts | 74 |
| Solutions | 5 |
| Karma Given | 11 |
| Karma Received | 1 |
| Member Since | 12-29-2015 |
Activity Feed
- Got Karma for DB Connect Lookup failing, sending NULL to SQL server. 07-13-2021 03:14 AM
- Karma Re: Users subsearch in event type not working for woodcock. 06-05-2020 12:50 AM
- Karma Re: Help with Rex or RegEx: How do I extract all lines after a string? for javiergn. 06-05-2020 12:48 AM
- Karma Re: Action log of emails sent as trigger from alert for inventsekar. 06-05-2020 12:48 AM
- Karma Re: Combine fields into new field without NULL for somesoni2. 06-05-2020 12:48 AM
- Karma Re: How to monitor and report the amount of data indexed per host? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Is it possible to get field values from metadata results? for javiergn. 06-05-2020 12:47 AM
- Karma Re: Merge two fields into one field for lguinn2. 06-05-2020 12:46 AM
- Karma Re: Restarting Splunk for DaveSavage. 06-05-2020 12:46 AM
- Karma Syncing dashboards and alerts on multi search head architecture for grahamrb. 06-05-2020 12:46 AM
- Karma Re: Move indexed file! for erick_costa. 06-05-2020 12:46 AM
- Karma Re: How do I alert when a host stops sending data? for Lowell. 06-05-2020 12:45 AM
- Posted Re: Join only returns 1 value on Splunk Search. 02-28-2020 06:36 AM
- Posted Join only returns 1 value on Splunk Search. 02-28-2020 06:25 AM
- Posted Re: Use another index as lookup on Splunk Search. 02-26-2020 06:19 AM
- Posted Re: Use another index as lookup on Splunk Search. 02-26-2020 06:06 AM
- Posted Re: Use another index as lookup on Splunk Search. 02-26-2020 05:51 AM
- Posted Re: Use another index as lookup on Splunk Search. 02-26-2020 03:46 AM
- Posted Use another index as lookup on Splunk Search. 02-26-2020 03:32 AM
- Posted DB Connect Lookup failing, sending NULL to SQL server on All Apps and Add-ons. 02-24-2020 09:25 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-28-2016
03:24 AM
Hi thanks for the response. I fixed it an posted my own answer below.
... View more
11-28-2016
03:23 AM
It appeared that in my dedup i was using a "tag" that the user group didn't have permissions to view.
... View more
11-24-2016
09:34 AM
Why when i used dedup, in a search for a user account does it return no results. Where the exactly same search for an admin account works.
It works for the users until i add the dedup into it. Very odd.
... View more
- Tags:
- splunk-enterprise
11-24-2016
07:00 AM
Thanks that appears to work and might work in some situations.
Problem is want to be able to create a search into an Event type and this isn't possible when you use a pipe.
... View more
11-23-2016
08:37 AM
We have data which can display a computer's serial number. The data is a little odd and we have to extract the serial number using 1 rex and 1 is done automatically. This creates 2 fields serialnumber1 & serialnumber2 .
I've tried to create an alias called serialnumber, but I've run into problems.
Applies to sourcetype = imap
Field aliases > serialnumber1 =serialnumber
Field aliases > serialnumber2 =serialnumber
The problem is that when both fields are populated, serialnumber is populated
1. When serialnumber1 is NULL and serialnumber2 is populated, "serialnumber" is populated
2. When serialnumber1 is populated and serialnumber2 is NULL,"serialnumber" IS NOT POPULATED
3. When Both serialnumber1 & serialnumber2 are populated, "serialnumber" is populated
Why is this case that when search result 2. above is true the aliases fail.
... View more
10-18-2016
08:35 AM
What is the best training material you've seen to help you move towards a clustered environment?
... View more
10-18-2016
08:34 AM
In the end it appeared that the splunk server was skipping triggering as apparently there is a limit to 1 real time alert per CPU core.
We increased this and it mostly fixed the issues.
... View more
09-15-2016
02:45 PM
I've added the earliest and latest settings under "edit trigger conditions" which i think does the same as putting it in the search page, yes/no?
Regarding the need to throttling of the alerts, we've not had issues with real time alerts, we know the data/events that come in quite well and it shouldn't be a problem in this situation.
... View more
09-15-2016
01:53 PM
We've been using real time alerts to send us an email whenever a specific log/event is hit. However we only have 4 CPU cores and can only run 4 real time alerts.
What is the best configuration to set up a scheduled alert to run every minutes so we get 1 email every time a new log is triggered?
I'm getting stuck because it's sending lots of emails each time an alert is triggered.
My criteria is 1 new log 1 email sent out.
... View more
09-13-2016
08:43 AM
Sorry it didn't resolve my issue. Thank you for you time on this.
... View more
09-13-2016
08:42 AM
(?-s)(?^.(Failed).$)
This was the final REX that gave me exactly what i wanted.
... View more
09-12-2016
12:02 PM
Thanks for this, yes it shows that it ran 1441 times on that day. Meaning it ran every minuet in the day so all working well..
Also if i run the search that the alert is built on the event shows up so i know the criteria was met.
This morning i sent a test alert no email
restarted services
sent another test alert and it worked.
... View more
09-12-2016
10:20 AM
I should say i tested it and it was working 11.55pm on friday. Then nothing for the rest of the weekend
... View more
09-12-2016
10:20 AM
I create a new lookup table, added the new fields to search and also to the email alert that went out.
... View more
09-12-2016
08:56 AM
We have had a problem over the weekend when one of our alerts did not trigger. I had to restart the services to get it all working again.
Does anyone had any idea why this might have happened?
It's possible it was related to changes we had made. It's the second time in a week we've needed to restart the services to have changes start working.
... View more
09-02-2016
09:09 AM
Getting the issue where we get all lines up to the match.
So not just getting the 1 line i want but loads more.
... View more
09-02-2016
04:18 AM
If i run it under field extractor it doesn't show anything up.
... View more
09-02-2016
02:05 AM
My splunk system is reading in logs as mutli lined events which is by design. So 1 event could have 300 lines or so.
Here is an extract from that long log file of 3 HDDs 1 of which is faulty.
15.5 : DRACKA z159_BHIFIJFOKFO xx01 5538.5GB 512B/sect (P78J4Dk)
15.6 : DRACKA z159_BHIFIJFOKFO xx01 6538.5GB 512B/sect (Failed)
15.7 : DRACKA z159_BHIFIJFOKFO xx01 6538.5GB 512B/sect (PJ5F4Dk)
I need a REX that will extract to a field ONLY the middle line. The REX will be used in field extractor.
Extracted field could be called "failed_disk_error" and the result would be
15.6 : DRACKA z159_BHIFIJFOKFO xx01 6538.5GB 512B/sect (Failed)
... View more
- Tags:
- splunk-enterprise
09-01-2016
05:05 AM
Sorry not it doesn't return the right data.
I simply need it so when Splunk reads a multi line event and it find (Failed), it to extract that single line as an extracted value.
... View more
09-01-2016
05:02 AM
Use i'm trying to use the rex in the field extraction. I just -need to get the rex to work, I've done quite a few other extractions using this method but this wont i can't get my head around.
... View more
09-01-2016
05:01 AM
Thank you for the recommendation but this doesn't return anything on my search
... View more
09-01-2016
04:18 AM
Ah i see what you've got that but that's not what i'm after.
So where the "event" has 3 lines i ONLY want line 2.
... View more
08-26-2016
07:03 AM
Sorry for the delay been away. It still returns the the full event not just the line from the multi line event.
... View more
08-11-2016
08:11 AM
Error in 'rex' command: Encountered the following error while compiling the regex '([\r\n])(?[\S\s](?=(Failed))': Regex: missing )
... View more
- « Previous
-
- 1
- 2
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
