Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About gfuente
gfuente
Motivator
Member since:
06-28-2012
06-05-2020
Community Statistics
| Posts | 395 |
| Solutions | 108 |
| Karma Given | 548 |
| Karma Received | 291 |
| Member Since | 06-28-2012 |
Activity Feed
- Got Karma for Re: Extract values from all matches in regex. 09-15-2023 12:09 PM
- Got Karma for Re: How to disable KVStore on a heavy forwarder?. 08-30-2023 01:36 AM
- Got Karma for Re: How to disable KVStore on a heavy forwarder?. 08-09-2023 08:55 AM
- Got Karma for Re: Extract values from all matches in regex. 06-23-2023 07:06 AM
- Got Karma for Re: Distinct count across multiple fields. 06-15-2023 02:13 PM
- Got Karma for Re: Extract values from all matches in regex. 08-10-2022 04:10 PM
- Got Karma for Re: Distinct count across multiple fields. 02-03-2022 06:36 AM
- Karma How to change ulimit and THP in Splunk after ver 7.2.2 for yutaka1005. 06-05-2020 12:50 AM
- Karma Re: How to use separate path for Hot, Warm, Cold buckets ? for richgalloway. 06-05-2020 12:50 AM
- Karma Re: How to use separate path for Hot, Warm, Cold buckets ? for richgalloway. 06-05-2020 12:50 AM
- Karma Transformation to index events to different index not working for markconlin. 06-05-2020 12:49 AM
- Karma Re: Transformation to index events to different index not working for micahkemp. 06-05-2020 12:49 AM
- Karma Re: hideSplunkBar leaves no way to log out for niketn. 06-05-2020 12:49 AM
- Karma Re: Using an earliest_time and latest_time parameter, can the output be the amount of time between these 2 events? for DalJeanis. 06-05-2020 12:49 AM
- Karma Re: Is there a way to paginate search results or to paginate all panels at the same time? for niketn. 06-05-2020 12:49 AM
- Karma Re: List future or historical run times of scheduled searches for sideview. 06-05-2020 12:49 AM
- Karma HTTP event collector: Channel identifiers, what do they identify for mneergaa. 06-05-2020 12:49 AM
- Got Karma for Re: Transformation to index events to different index not working. 06-05-2020 12:49 AM
- Got Karma for Re: Transformation to index events to different index not working. 06-05-2020 12:49 AM
- Got Karma for Re: How do I extract the timestamp from this log?. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 6 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 1 |
10-09-2013
03:21 AM
5 Karma
Hello
try this:
sourcetype="log4j" | search "Expiry" | rex max_match=10 "(?<seqno>L[[0-9]{1,45}])"
Regards
... View more
10-09-2013
03:18 AM
1 Karma
Hello
It is related to the timestamps of the events. In a normal situation where all the events are beign received one after another in the timeline, you would have only one hot bucket, and it will be filled until it reaches the maxDataSize limit.
But, you could get events from the past that won't "fit" in the time frame of the existing hot bucket, and in that situation Splunk will create a new hot bucket for the events coming from that "past time frame", in this case you will have 2 hot buckets.
So, hot buckets groups the events by time.
Regards
... View more
10-08-2013
04:09 AM
Hello
Is it possible to configure this app http://apps.splunk.com/app/1552/ to send data to a Splunk Enterprise Software instace instead to a Splunk Storm account?
Thanks!
... View more
10-04-2013
01:29 AM
YES!
From docs:
6.0 forwarders (universal/light/heavy) are backwards compatible down to 4.2+ indexers. For example, a 6.0 forwarder can send data to a 4.2 indexer but not to a 4.1 indexer.
http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Compatibilitybetweenforwardersandindexers
... View more
10-03-2013
04:13 AM
Hello
It's saying that you need to restart splunk after the installation of the app
Try it
... View more
10-02-2013
07:47 AM
3 Karma
From docs:
6.0 indexers are backwards compatible with forwarders down to 4.x.
http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Compatibilitybetweenforwardersandindexers
... View more
09-30-2013
08:23 AM
try:
Instead of top, use: ... | stats count as myfield by Username | eval UserPlusCount = Username. "-". myfield |...
EDIT: Now I noticed, you have to do the eval after the top command, then you have the count field, and you can use it in the eval.
... View more
09-30-2013
08:15 AM
1 Karma
Hello
try this:
...| eval UserPlusCount = Username. "-". count |...
If it doesnt works, rename the count as other field
Regards
... View more
09-30-2013
06:35 AM
If the restart tooks more than 1 minute, then that execution will be skkiped, and you would need to run a command to backfill that missing execution
If the restart take place between executions, then the summary index won't be affected.
Regards
... View more
09-30-2013
06:21 AM
1 Karma
Hello
It depends on the search schedule, but if the restart or down time took place during the schedule of the search, then that execution will be skkiped and then you will need to backfill those results.
Regards
... View more
09-30-2013
02:56 AM
Hello
Maybe it's a permissions issue or they all have the same header and Splunk, by defaults, think that already has indexed that file. You could try to add this to your inputs.conf file:
crcSALT = < SOURCE >
**Remove the blanks before and after SOURCE, and you dont need to put here your real source file, just the string SOURCE
Regards
... View more
09-27-2013
03:57 AM
Just for reference:
At search time Splunk can automatically extract additional fields, depending on its Search Mode setting and whether or not that setting enables field discovery given the type of search being run.
http://docs.splunk.com/Documentation/Splunk/5.0.4/Knowledge/Aboutfields
... View more
09-27-2013
03:46 AM
Splunk, by default extracts fields when it found a repeating pattern like parameter=value or parameter:value
Maybe those fields are being extracted automatically
regards
... View more
09-27-2013
03:20 AM
Hello there is a command to get all configuration (including fields extractions):
./splunk cmd btool props list --debug
Regards
... View more
09-26-2013
08:50 AM
Hello
In the default search app, you have a few reports with search user activity, you can found them in:
Status\Search Activity\
In particular: Search Activity per user.
In addition to those reports, you have even more in the SOS app that you can download from apps.splunk.com
Regards
... View more
09-23-2013
07:28 AM
Hello
There is an existing command to do what you need: CORRELATE
http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Correlate
Regards
... View more
09-23-2013
02:18 AM
I'm sorry, but i can help you more than pointing you in the right direction.
... View more
09-23-2013
12:17 AM
Hello
As far as i know, you could use the new App Framework:
http://dev.splunk.com/view/app-framework/SP-CAAADVF
And then use this open library:
http://bl.ocks.org/dk8996/5538271
To integrate gantt charts into splunk.
Regards
... View more
09-21-2013
01:15 AM
Hello
What you have to do is change the way of doing the transaction.
Use this: transaction startswith="Session Open" endswith="Session disconnected"
... View more
09-20-2013
08:16 AM
Hello
It seems that you are not indexing logs properly, as it should break events by timestamp, and then you already will get the events splited by time.
So, post your props.conf configuration for this sourcetype, so we can propose you the best way to index those events
Regards
... View more
09-20-2013
04:18 AM
1 Karma
Hello
We have a Splunk cluster deployment with this settings:
1 Node: Master and Deployment Server
2 Nodes: Indexers
1 Node: Search Head
Using default ports 8089 for management and 9997 for data forwarding.
As our enviroment is getting larger and in the future we are going to hit the 500 UF managed by the Deployment Server, we are thinking in moving the Deployment Server to a separate instance in the same server.
The only issue I see here is the need of use a different port for the new instance (8090 for example) and configure all the existing UF to talk to the new Deployment Server by the new port.
Is there any other possible issues I'm missing?
Thanks
... View more
09-20-2013
03:32 AM
2 Karma
Hello
Here you go:
index="_internal" "ack=false" | dedup hostname | table hostname, sourceIp
regards
... View more
09-20-2013
02:33 AM
2 Karma
Hello
I guess you should create a new dashboard with two panels inside, one for the table and other one for the chart, then you will get all the info in the same screen
Regards
... View more
09-19-2013
06:45 AM
3 Karma
Hello
Have you tried to eval the percentage after the timechart, like:
index=tt OrderIntegration.asmx "PlaceOrderResponse" ("RealTime" OR "AdvancedSale") | timechart span=1d count(eval(searchmatch("RealTime"))) as NumberofRealTimeListings, count(eval(searchmatch("AdvancedSale"))) as NumberofNonRealTimeListings | eval Percent = (NumberofNonRealTimeListings/NumberofRealTimeListings)*100
Regards
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
