Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About jmallorquin
jmallorquin
Builder
Member since:
01-22-2013
10-09-2020
Community Statistics
| Posts | 229 |
| Solutions | 22 |
| Karma Given | 23 |
| Karma Received | 60 |
| Member Since | 01-22-2013 |
Activity Feed
- Got Karma for Re: If a peer goes down in an indexer cluster, how does new indexed data get replicated, and what happens when the peer comes back up later?. 05-28-2024 11:56 AM
- Got Karma for Issue log event alert action distributed environment. 06-24-2022 08:46 AM
- Karma Re: Why is curl search giving an error after upgrading Splunk to 7.2.4? for nickhills. 06-05-2020 12:50 AM
- Karma Re: Where can I find what has been introduced in Splunk 6.4.1 that is different from 6.4.0? for woodcock. 06-05-2020 12:48 AM
- Karma Re: Official way to clean indexed data from index cluster for gfuente. 06-05-2020 12:48 AM
- Karma Re: How do I reset the Password if I do not remember the original one? (working on a MAC) for lguinn2. 06-05-2020 12:48 AM
- Karma Re: Why is our Search Head Cluster captain generating "ERROR KVStorageProvider - Could not update replica set configuration" every 5 seconds? for splunkIT. 06-05-2020 12:48 AM
- Got Karma for Re: Is it possible to have the options for a checkbox input appear in a horizontal line instead of a vertical list?. 06-05-2020 12:48 AM
- Got Karma for Re: How can I have alerts in splunk free!. 06-05-2020 12:48 AM
- Got Karma for Re: How to set an alert to run every 5 minutes with an alert throttle set for 24 hours based on 2 fields?. 06-05-2020 12:48 AM
- Got Karma for Re: How to configure Splunk to monitor and index a file that is generated by a script daily, even if there is no change?. 06-05-2020 12:48 AM
- Got Karma for Re: How to migrate a whole indexer with almost no logs lost ?. 06-05-2020 12:48 AM
- Got Karma for Re: Saving extracted field in Props.conf Vs Using regex extraction directly in search with out saving in props.conf. 06-05-2020 12:48 AM
- Got Karma for Re: How can I have alerts in splunk free!. 06-05-2020 12:48 AM
- Got Karma for Re: Trying to performance test my Splunk searches, but why are results sometimes returned too fast?. 06-05-2020 12:48 AM
- Got Karma for Re: I have just installed Splunk (Windows - 64-bits), and when it tries to start Splunk, it returns the following error: "HTTP 404 Not Found". The web page that is trying to open is "http://localhost:8000/". Could you tell me what web page I have to open?. 06-05-2020 12:48 AM
- Got Karma for Re: Storage size thoughts and calculations. 06-05-2020 12:48 AM
- Got Karma for Re: Storage size thoughts and calculations. 06-05-2020 12:48 AM
- Got Karma for Re: TCP Routing and Anonymizing data. 06-05-2020 12:48 AM
- Got Karma for Re: Lookup table greater than 2GB - possible solutions?. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
10-31-2016
08:32 AM
Hi,
You have to configure in your local Splunk Settings > Distributed search > Search peers and add the conexion to your indexer.
Hope i help you.
... View more
09-17-2016
10:39 AM
Hi,
You should install and app to query the ldap for the members of the group that you want to filter.
https://splunkbase.splunk.com/app/1151/#/details
Hope i help you
... View more
08-29-2016
08:57 AM
Hi,
Can you post the query?
... View more
08-01-2016
01:19 PM
Hi ryanoconnor
I didn't say that you need to store the alert in the search head... Is just a problem of the functionallity.
And sure that I am sending all the internal logs to indexers.
I open the question just to advise to the rest.
regards,
... View more
07-31-2016
02:26 PM
1 Karma
Hi,
I have a SHC 6.4.2 and when I try to use the log event alert action i have notice that if the index doesn't exist in the search head, the event is not generate.
Has anyone noticed that?
So if I am correct, is mandatory to define the same index in the shc to enable the functionality.
Regards,
... View more
07-12-2016
06:21 AM
Hi,
After configure site=site0 in server.conf all the search head says error invalid site.
Is needed other configuration to disable search affinity?
Thanks,
... View more
06-21-2016
06:17 AM
Hi,
Yes, just put this at the end:
| eval Jenis = case (Jenis="CPU001","CPU1",Jenis="CPU_ALL","CPUALL")
Hope i help you
... View more
06-20-2016
07:27 AM
Hi,
props.conf
[<<sourcetype>>>]
.
.
.
EXTRACT-user = \\(?<user_wo_domain>[^\)]+)\)$
Hope i help you
... View more
06-20-2016
07:20 AM
Hi,
The way to configure the SSL configuration is using the indexer certs. So you only need to deploy the certs of all of your indexer to all of your forwarder.
You have to configure inputs.conf in the indexer and outputs.conf in the forwarders.
Check out this link
https://wiki.splunk.com/Community:Splunk2Splunk_SSL_3rdPartyCA
Hope i help you
... View more
06-20-2016
07:05 AM
Hi,
You could make buckets smallers but is not recommended.
Hope i help you
... View more
06-20-2016
06:58 AM
Hi,
Which period are you using in the search? alltime?, try other if you use alltime.
Hope i help you
... View more
06-20-2016
02:04 AM
Ok regards 🙂
... View more
06-20-2016
12:34 AM
No for this time sorry.
... View more
06-17-2016
06:16 AM
Hi,
Have you try to extract the fields of the email like @
Then if you make a search using these fields it should be faster like
index=aaaa field1=test field2=google.com
Hope i help you
... View more
06-17-2016
06:13 AM
Hi,
Have you try use this?
https://splunkbase.splunk.com/app/3186/#/overview
Hope i help you
... View more
06-17-2016
06:12 AM
Hi,
Have you try use this?
https://splunkbase.splunk.com/app/3186/#/overview
Hope i help you
... View more
06-17-2016
05:56 AM
1 Karma
Hi,
One trick that you can do is make a script to print the ouput of the file and index the output, with current time
Hope i help you
... View more
06-14-2016
07:38 AM
Hi,
The problem is that you configured the F:\Splunk\etc\system\default\props.conf SHOULD_LINEMERGE in the default directory.
You should never change the configuration in this directory becouse when you upgrade splunk overwrite default files.
Hope i help you
... View more
06-14-2016
06:14 AM
Hi,
For cluster you need 5 instances
2 - indexer
1 - master
1 - license master
1 - search head
You can put license master and cluster master in the same instance and is ok. But no a search head.
2 - indexer
1 - master / license master / deployment server
1- search head
Other interesting thing is to have in each DC a HF .
And replication factor 2 is correct.
Hope i help you.
... View more
06-10-2016
04:53 AM
Hi,
I mean the configuration in indexes.conf.
Are you sure that you are indexing the data in the index that you have configured?
... View more
06-08-2016
03:49 AM
Hi,
Use <html> </html> in the xml to put a text.
Hope i help you
... View more
06-08-2016
03:36 AM
1 Karma
Hi,
If you add all the checkbox just for one value, you can put in line in the dashboard
Hope i help you
... View more
06-08-2016
03:31 AM
Hi,
Are you forwarding the internal events of the master to indexers? (recommended). When you did that, only have to have care about the location in the indexers.
You have to configure in the indexes.conf a new location for _audit _internal _introspection and the best way is using volume definition.
And correct, is in the master-apps/_cluster/local/indexes.conf
Hope i help you
... View more
06-07-2016
12:53 AM
Hi,
I think the problem is with the firewall, have you try open the outgoing in the new server. Maybe the incoming port 8089 is open but the firewall is cutting all outgoing
Hope i help you
... View more
