Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About felipesewaybric
felipesewaybric
Contributor
Member since:
02-08-2013
01-12-2026
Community Statistics
| Posts | 114 |
| Solutions | 9 |
| Karma Given | 8 |
| Karma Received | 25 |
| Member Since | 02-08-2013 |
Activity Feed
- Karma Re: After upgrading to 6.5.0, KV Store will not start for sylim_splunk. 04-13-2021 12:51 PM
- Got Karma for Re: I have installed Splunk on AWS Instance, How do I restart Splunk on AWS Instance?. 06-05-2020 12:50 AM
- Karma Re: Use timepicker earliest and latest as epoch time for rjthibod. 06-05-2020 12:49 AM
- Got Karma for Re: How do I extend the number of results that an external script returns to more than 100000 lines?. 06-05-2020 12:49 AM
- Got Karma for Re: What is multithreaded ingestion?. 06-05-2020 12:49 AM
- Got Karma for Re: Why is my JSON regex expression not working properly?. 06-05-2020 12:49 AM
- Got Karma for Re: Why is my JSON regex expression not working properly?. 06-05-2020 12:49 AM
- Got Karma for Re: Why is my JSON regex expression not working properly?. 06-05-2020 12:49 AM
- Got Karma for Re: Why is my JSON regex expression not working properly?. 06-05-2020 12:49 AM
- Got Karma for Re: Why is my JSON regex expression not working properly?. 06-05-2020 12:49 AM
- Got Karma for Re: Is there a way to export all searches, alerts and reports from all users to another Splunk instance?. 06-05-2020 12:49 AM
- Got Karma for Re: Is there a way to export all searches, alerts and reports from all users to another Splunk instance?. 06-05-2020 12:49 AM
- Got Karma for Re: Is there a way to export all searches, alerts and reports from all users to another Splunk instance?. 06-05-2020 12:49 AM
- Got Karma for Re: How to make Trellis smaller in the dashboard using the Status Indicator - Custom Visualization app?. 06-05-2020 12:49 AM
- Got Karma for Re: Is there an app that easily moves splunk alerts to another server?. 06-05-2020 12:49 AM
- Got Karma for Re: Why is the date format changing in the pdf from YYYY-MM to YYYY (splunk v6.5.0) in scheduled PDF?. 06-05-2020 12:49 AM
- Got Karma for Re: Why is the date format changing in the pdf from YYYY-MM to YYYY (splunk v6.5.0) in scheduled PDF?. 06-05-2020 12:49 AM
- Got Karma for Re: How to create tabs in Splunk dashboard without admin access?. 06-05-2020 12:48 AM
- Got Karma for Re: How to index multiple CSV file from a local machine?. 06-05-2020 12:48 AM
- Got Karma for How to use Javascript to create charts from a table?. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 2 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-07-2018
05:21 PM
You will need to uninstall the Splunk Light and install the splunk enterprise as a trial/free version, then after the first start, you just point to the master with the license.
To install 2 splunks, you will need to change the management port (8089) and the web port (8000).
... View more
02-07-2018
05:16 PM
now you need to config your output.conf
first use this in your UF:
./splunk list forward-server
then
./splunk add forward-server :
and check if the port is open in your server
... View more
02-07-2018
05:11 PM
For what i use, DB Connect is to read data from Bases like Oracle, Mysql, etc. After the first config. you can use searchs like:
| dbquery "DB-NAME" "select * from dual"
And you can even summary those informations, so when you need to run a query in the DB and save that info in a csv file or a index.
Now syslog is just data being indexed to your splunk, it affects the license and you can read it from a index.
index=my_syslog | table *
... View more
02-05-2018
08:09 AM
Everything looks fine, try install the CSV lookup Editor and open your csv file.
... View more
02-05-2018
08:07 AM
Estava tendo o mesmo problema, ao atualizar no nosso master para 7.2 e os forwarders para o mais recente, nossos scans deixaram de apresentar o problema. Quais versões estão instaladas?
... View more
02-04-2018
03:59 PM
you can use the sparkline in the stats
ex: stats sparkline(avg(value)) latest(value) by monitor
and if stay like bar, just change in the xml:
<param name="type">sparkline</param>
... View more
02-04-2018
03:53 PM
https://answers.splunk.com/answers/289083/how-to-delete-event-data-from-an-indexer-using-the.html
bmacias84: The api does not provide facilities to clean the eventdata as Splunk daemon needs to be stopped. You are better off using remote ssh command or powershell command to run the shell commands. You can use the "|delete" command to mark the data as unsearchable
via the api by create a search job, but that does not remove the data.
... View more
02-04-2018
03:33 PM
you can create a html block just after your panel, then you can set your js with some tokens from the search.
... View more
02-04-2018
03:30 PM
while you can find the solution, you can use "| dedup _raw" to remove duplicates,
... View more
02-04-2018
03:15 PM
you can try ('Domain Admins' OR 'Domain Users')?
... View more
02-04-2018
03:13 PM
you can change the legend to the bottom of the chart in a dashboard, just click on edit, then in the chart you want, just click on the Y or X (i dont remember now), and then you can change to left, right, bottom or none.
... View more
02-04-2018
02:50 PM
nice, i'm glad it works.
The _time real value is aways something like 1526324562.234, so somethime you will need to create a new variable.
In my country the date default is dd/mm/YYYY, so i aways need to re-adjust the _time.
... View more
02-01-2018
07:35 PM
wow, nice to meet you, very good presentation, we took lots of useful information and I learned a lot from her.
... View more
02-01-2018
06:59 PM
you will need to use some regex in the raw to get the v1.0 from the device, then, you can correlate with some stats by v* and device*, in the end you can set a | add totals to get te total line
... View more
02-01-2018
06:55 PM
I would start with this one:
https://conf.splunk.com/files/2016/slides/how-to-run-splunk-as-a-docker-image.pdf
then customize and even try it on kubernets
... View more
02-01-2018
06:15 PM
1 Karma
sry, the command was not completed, you will need:
| convert timeformat="%m/%d/%Y" ctime(_time) as _time
but i think will not gonna work.
sometimes you will need to create a new variable to use instead of _time
try
| eval date = strftime(_time,"%Y-%m")
to show correctly, you can use:
| sort _time
| table date Count
... View more
02-01-2018
12:36 PM
1 Karma
I have the same problem, I resolve by forcing my timestamp in the query with:
| convert timeformat="%m/%d/%Y"
or
strptime/strftime with eval.
... View more
02-01-2018
09:55 AM
you can change the timestamp format, one way is:
| timechart span=1d count by source | convert timeformat=""%H:%M"" ctime(_time) AS _time
... View more
02-01-2018
09:50 AM
try this one, if istill return zero, try the first line only, then 1,2 and 3 together, then 1 to 7
index=ABC ("TokenStatus=Success" OR TokenSubStatus=error) ServiceName=ABC
| eval TotalSuccess = if(TokenStatus=Success,1,0)
| eval TotalFailure = if(TokenSubStatus=error,1,0)
| stats
count as TotalA
sum(TotalSuccess) as TotalSuccess
sum(TotalFailure) as TotalFailure
| eval Total=(TotalSuccess*100)/TotalA | table Total
... View more
02-01-2018
09:41 AM
How about this way:
index=ABC ("TokenStatus=Success" OR TokenSubStatus=error) ServiceName=ABC
| eval TotalSuccess = if(TokenStatus=Success,1,0)
| eval TotalFailure = if(TokenSubStatus=error,1,0)
| stats
count as TotalA
sum(TotalSuccess) as TotalSuccess
sum(TotalFailure) as TotalFailure
| eval Total=(TotalSuccess*100)/TotalA | table Total
... View more
01-31-2018
11:10 AM
You can create a new command in splunk, is really easy, http://docs.splunk.com/Documentation/Splunk/7.0.2/Search/Writeasearchcommand
... View more
07-11-2017
09:56 AM
1 Karma
What i use is: https://www.splunk.com/blog/2015/03/30/making-a-dashboard-with-tabs-and-searches-that-run-when-clicked.html
but you will need to add to app/resource/appserver/static, if you create your app, you can deploy in manager apps.
... View more
02-09-2017
06:15 AM
Nice, you can monitor the folder, send to the same index and perform the searches as follows: index = nnn source = file.csv
... View more
02-08-2017
09:40 AM
1 Karma
Maybe monitoring the folder? Are the files dynamic or static?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-12-2026
11:35 AM
|
Karma from
Karma given to
