Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About yutaka1005
yutaka1005
Builder
Member since:
09-04-2016
06-05-2020
Community Statistics
| Posts | 269 |
| Solutions | 24 |
| Karma Given | 20 |
| Karma Received | 45 |
| Member Since | 09-04-2016 |
Activity Feed
- Got Karma for Re: I can't change "action.summary_index" to enable summary indexing in alert.. 04-15-2025 09:49 PM
- Got Karma for Re: Error message is displayed when I rebuild archive data.. 04-15-2025 07:21 PM
- Got Karma for Re: map command works but need more fields. 12-07-2022 03:59 PM
- Got Karma for Re: How can I merge events from powershell input?. 10-27-2022 01:24 PM
- Got Karma for Re: About configuration in forwarding by using SSL.. 01-30-2021 01:51 AM
- Got Karma for Re: About specification of "initCrcLength" option and "crcSalt" option.. 09-10-2020 01:29 PM
- Got Karma for About using "rising column" in DBconnect v3.. 09-04-2020 04:02 AM
- Got Karma for about splunk list monitor command. 07-19-2020 12:10 PM
- Got Karma for Re: Error message is displayed when I rebuild archive data.. 06-11-2020 11:16 AM
- Got Karma for I can't change "action.summary_index" to enable summary indexing in alert.. 06-05-2020 12:51 AM
- Karma Re: Using span option with timechart causes incorrect column names. for gcusello. 06-05-2020 12:50 AM
- Karma Re: After upgrading to Splunk8.0, when I re-change column color setting in table view, "format" tags are duplicated. for scottpestyk. 06-05-2020 12:50 AM
- Karma Can't activate summary indexing for scheduled alert Splunk 8.0.0 for falcalde. 06-05-2020 12:50 AM
- Karma Splunk Add-on for Box works on 7.3.2 but on 7.3.3 it gives [Loading] Input page for yuichirosuzuki. 06-05-2020 12:50 AM
- Karma Re: About "https://docs.splunk.com/Documentation/Splunk/7.2.3/Data/Configureindex-timefieldextraction#Add_an_entry_to_fields.conf_for_the_new_field". for woodcock. 06-05-2020 12:50 AM
- Karma Re: After log rotation, UF does not forward logs. for woodcock. 06-05-2020 12:50 AM
- Got Karma for Re: map command works but need more fields. 06-05-2020 12:50 AM
- Got Karma for After upgrading to Splunk8.0, when I re-change column color setting in table view, "format" tags are duplicated.. 06-05-2020 12:50 AM
- Got Karma for After upgrading to Splunk8.0, when I re-change column color setting in table view, "format" tags are duplicated.. 06-05-2020 12:50 AM
- Got Karma for After upgrading to Splunk8.0, when I re-change column color setting in table view, "format" tags are duplicated.. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 3 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-13-2017
05:33 PM
I don't understand when "search_optimization" will be used.
And like below situation, there is the scene that search doesn't work.
Issue number:SPL-145968
https://docs.splunk.com/Documentation/Splunk/7.0.0/ReleaseNotes/KnownIssues
So I want to know when "search_optimization" was used, and which search "search_optimization" was used to.
How can I do this?
Are kind of these informations in the internal logs?
... View more
11-13-2017
05:25 PM
1 Karma
Thanks for your comment.
As you say, if I search with "index = _ internal", the correct results are coming out.
However, at the index which originally asked a question, it still has a mysterious movement.
However, this problem was solved.
When I added " | noop search_optimization=false" to the end of the search , "correct search result" was returned to the search "index = test | search NOT ~".
Likely "search_optimization" worked, and the search "index = test | search NOT ~" was optimized for search "index = test NOT ~".
And maybe the results of the optimized search " index = test NOT ~ " and search " index = test | search NOT ~ ", were different.
So, when I looked up the search job, the cause was unknown, but the application "Configurations Analytics App for Splunk" which I did not use seemed to add extra search condition to the base search.
So when I deleted this App, I got back to what I expected.
... View more
11-13-2017
05:10 PM
Thank you for comment.
I understood it.
... View more
11-09-2017
09:43 PM
Hi skalliger,
I'm sorry I have asked you many times.
Yes, the searches you are doing in realtime are being ran on the server you are logged on to.
→ Is this "realtime" means not "real-time searches" but "all searches" that I log in and execute from the GUI search screen?
... View more
11-08-2017
09:01 PM
Thank you for comment.
As you said, I ran three searchs in same timerange.
Search 1 using "NOT" in the base search
Search 2 using "search" and "NOT" after connecting with pipe
Search 3 using "! ="
timerange
2017/11/09 13:35:00.000
2017/11/09 13:50:00.000
search 1
index=_internal | search NOT (sourcetype="security_nexus" OR sourcetype="mongod" OR sourcetype="splunkd" OR sourcetype="splunkd_access")
result:11065
search 2
index=_internal NOT (sourcetype="security_nexus" OR sourcetype="mongod" OR sourcetype="splunkd" OR sourcetype="splunkd_access")
result:11065
search 3
index=_internal (sourcetype!="security_nexus" AND sourcetype!="mongod" AND sourcetype!="splunkd" AND sourcetype="splunkd_access")
result:9172
This result was in the internal log.
... View more
11-08-2017
07:39 PM
I have two questions about search job execution when search head cluster is used.
In a search head cluster, when I access a specific search head from a browser and search there, is the job execute with the search head that I access?
Or, if there are members that have fewer load, will the member responsible for processing?
Is there a way to check which members performed the schedule search?
... View more
11-08-2017
05:53 PM
Yes! The exam you have done is quite close to my situation!
So the searches ② and ③ presented by me are the expected movements.
However, it is mysterious that the results do not come out at my search ①.
Again, this is not a search problem, is it a fault?
... View more
11-08-2017
01:06 AM
Sorry guys.
I can't understand it.
why "NOT" excludes more and the overall result?
I think that "! =" excludes events for which the specified field does not exist, but "NOT" does not exclude events which doesn't have the specified field.
But is it different?
... View more
11-07-2017
05:20 PM
Hi niketnilay,
Thank you for answer.
If "NOT" is used, the event that the specified field does not exist is also returned as the result.
When "! =" Is used, only events containing specific values are returned in the specified field, and events for which the specified field does not exist are not returned as a result.
yes I understand these things.
But what I would like to know is below.
1.Why there are more results by using "! =", in spite of "NOT" should return more results?
2.Why when using "NOT" is the result is 0, but when I specified a different field using "where", is the result come out?
... View more
11-07-2017
05:05 PM
Hi koshyk.
Thank you for comment.
What you are saying was right.
Of the three search heads, only one was not license slave.
So I will review the license slave settings and watch more whether this event happens again.
... View more
11-07-2017
12:18 AM
In my environment, there are search head clustering consisting of three search heads and one deployer, and indexer clustering consisting of one cluster master and three indexers.
All of these are unified to ver6.5.5.
Up to now it was working normally, Starting around 11/5, sometimes the following error occurred and search failed.
Streamed search execute failed because: Error in 'litsearch' command: Your Splunk license expired or You have exceeded your license limit too many times. Renew your Splunk license by visiting www.splunk.com/store or calling
866. GET.SPLUNK
However, when I checked with the license master, the license has not expired, each indexer being license slave, and the number of excess license was also 0.
Is this a known problem? And is there a workaround?
... View more
Labels
- Labels:
-
indexer
-
search head
11-06-2017
11:39 PM
The result of the schedule search that is working in my environment is different depending on how to search.
As a premise, the log has two fields, field and field2.
When searching with the following search ①, no results are displayed.
search1
------------------------------
index = test
| search NOT (field = A OR field = B OR field = C)
------------------------------
Search period: 10/16 14: 50 ~ 14: 55
Result:
None
However, when searching with the following search ②, one result will be displayed.
search2
------------------------------
index = test
| search NOT (field = A OR field = B OR field = C)
where field 2 = "111"
------------------------------
Search period: 10/16 14: 50 ~ 14: 55
Result:
field = D, field 2 = 111
In addition, one search result will be displayed in Search ③ below.
search3
------------------------------
index = test
| search field! = A AND field! = B AND field! = C
------------------------------
Search period: 10/16 14: 50 ~ 14: 55
Result:
field = D, field 2 = 111
I do not know the reason why the search results differ with these searches ....
Why are these search results different?
... View more
11-06-2017
06:35 PM
Thank you for your prompt reply.
I understood about it.
It was very helpful.
Thank you!
... View more
11-06-2017
06:22 PM
Hi MuS,
Thank you for answer.
Yes I'm referring to the no-enforcement license.
Regarding the no-enforcement license, it is described in the manual as follows.
The Enterprise license enables all Enterprise features, such as authentication and distributed search. As of Splunk Enterprise 6.5.0, new Enterprise licenses are no-enforcement licenses.
I think that Trial license corresponds to "Enterprise licenses", so I think that it corresponds to no-enforcement licenses.
However, I did not know if the free license since the trial period expired corresponds to "Enterprise licenses" or no-enforcement licenses.
So I asked this question.
Do you agree that you are saying that if it is ver of 6.5 or later, can the free license also correspond to no-enforcement licenses?
cheers, Yutaka1005
... View more
11-06-2017
05:30 PM
In Splunk after 6.5, even if it is a trial license,
I think that there are no restrictions on functions when there are five license violations.
Now I want to know whether is there no function restriction due to license violation,
even if it move to a free license.
... View more
10-24-2017
01:19 AM
1 Karma
To DalJeanis
Thank you for answer.
I was able to understand dynamic eval in more detail.
It seems certainly difficult to calculate the number of fields with certain values for each field without using dynamic eval, unless I know in advance about the field that I have a particular value for.
... View more
10-19-2017
06:38 PM
2 Karma
I recently saw the manual of eval, and I found the following description.
To specify a field name with multiple words, you can either concatenate the words, or use single quotation marks when you specify the name. For example, to specify the field name Account ID you can specify AccountID or 'Account ID'.
To specify a field name with special characters, such as a period, use single quotation marks. For example, to specify the field name Last.Name use 'Last.Name'.
You can use the value of another field as the name of the destination field by using curly brackets, { }. For example, if you have an event with the following fields, aName=counter and aValue=1234. Use | eval {aName}=aValue to return counter=1234.
It means that "{ }" is able to define the value of the field as a new field as it is,
but I can not think of a good way to use it.
Is there any use example using this eval?
... View more
10-18-2017
08:50 PM
ご回答いただきありがとうございます。
ご指摘のとおりアラートが二重で動いていたことが原因でした。
... View more
10-18-2017
08:49 PM
ご回答いただきありがとうございます。
アラートが二重で動作していたことが原因でした…
jobを確認したらすぐにわかりました。
... View more
10-17-2017
10:09 PM
In my environment, I am building search head clustering consisting of three search heads and one deployer.
In addition, I am using an alert that sends mail individually with the "map" command and "sendmail" command for logs that meet certain conditions.
However, as a result of checking this morning, only one alert was caught, and even though the result was one line, two mails were sent.
When I checking the internal logs, the logs below were issued in the internal logs of the two search heads at approximately the same timing (deviation of about 0.4 seconds).
"INFO sendemail:128 - Sending email..."
From this I thought that the same search ran for the two search heads.
Is there a workaround for this phenomenon?
Also, are "sendmail" and "map" commands not recommended in clustering?
And Is there a possibility that it is the cause?
... View more
10-11-2017
09:43 PM
To rjthibod
Thank you for answer!
I will check your app!
... View more
10-11-2017
09:42 PM
1 Karma
It was able to be realized with the following code.
require(['jquery', 'splunkjs/mvc/simplexml/ready!'], function($) {
//
$('#<id of panel1>').closest(".dashboard-cell").css('width', '97%');
$('#<id of panel2>').closest(".dashboard-cell").css('width', '3%');
document.getElementById("<id of contents of panel2(table,chart...)>").style.display="none";
var cnt = 0;
$('#<id of button>').click(function onoff() {
if(cnt == 0){
cnt = 1;
$('#<id of panel1>').closest(".dashboard-cell").css('width', '70%');
$('#<id of panel2>').closest(".dashboard-cell").css('width', '30%');
document.getElementById("<id of contents of panel2(table,chart...)>").style.display="block";
} else {
cnt = 0;
$('#<id of panel1>').closest(".dashboard-cell").css('width', '97%');
$('#<id of panel2>').closest(".dashboard-cell").css('width', '3%');
document.getElementById("<id of contents of panel2(table,chart...)>").style.display="none";
}
});
$(window).trigger('resize');
});
By clicking the button,
Since it is possible to change the width of panel1 and panel2 and display/non-display of contents of panel2, so, panel2 looks like a panel that can switch between folding/unfolding.
Details of processing are as follows.
In the case of cnt = 0, clicking, the width of the panel 1 is narrowed, the width of the panel 2 is widened, and the content in the panel 2 is displayed.
In the case of cnt = 1, when clicking, widens the width of the panel 1, narrows the width of the panel 2, and hides the contents in the panel 2.
... View more
10-11-2017
07:01 PM
To niketnilay
Thank you for reply.
It would be nice if I could display or hide the panel, but I would like a mechanism that can change the display/folding of the panel by pressing the button, not by using variables and "depends".
So if it can realize that mechanism, I do not care about the method (fade in, accordion menu ... etc).
There is a part called "Focus" which can change display/folding by click, in "deep dive" which is one of the contents in ITSI which is a chargeable App of Splunk.
I would like to do something similar to this.
See below ↓
http://docs.splunk.com/images/e/e3/Deep_dive.png
... View more
10-10-2017
07:41 PM
To niketnilay
Thank you for answer.
Second URL that you pasted is very similar to what I want to do.
But I want to make a panel that fades in from the side when I press the button.
Have you any ideas?
... View more
10-06-2017
01:42 AM
I'd like to make the div that can be fold/unfold on dashboard.
So I tried to implement an easy thing using html, but it does not work.
How can I make this possible on Splunk's dashboard?
Please tell me that if someone know about it.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
