Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About dantimola
dantimola
Communicator
Member since:
11-13-2016
08-17-2025
Community Statistics
| Posts | 86 |
| Solutions | 2 |
| Karma Given | 41 |
| Karma Received | 17 |
| Member Since | 11-13-2016 |
Activity Feed
- Posted Splunk Stream for M1/arm-based processor on Splunk Search. 07-17-2023 10:19 PM
- Posted Re: Internal server error 500 on system/licensing- How to resolve? on Dashboards & Visualizations. 07-17-2023 10:13 PM
- Got Karma for Re: Is it possible to rebuild multiple buckets with this command in the thawed directory?. 05-02-2023 12:39 PM
- Got Karma for Re: Is it possible to rebuild multiple buckets with this command in the thawed directory?. 09-21-2022 11:51 AM
- Karma Re: Help with script to make Splunk status up automatically if Splunk is down for gaurav_maniar. 03-18-2022 10:04 AM
- Karma Re: Indexers showing: WARN AdminHandler:AuthenticationHandler - Denied session token for user: splunk-system-user for RishiMandal. 10-11-2021 01:45 AM
- Got Karma for Re: Is it possible to rebuild multiple buckets with this command in the thawed directory?. 03-10-2021 06:54 AM
- Karma Re: Logic Behind Geographically Improbable Access Detected ? for Richfez. 02-01-2021 10:10 PM
- Got Karma for FS-ISAC Feeds Not Showing in Threat Artifacts. 11-01-2020 04:56 AM
- Posted Re: Splunk ES - Threat Intelligence TAXII feed not Working in Splunk Cloud on Splunk Enterprise Security. 10-14-2020 04:02 AM
- Posted Re: STIX TAXII Data Not Showing On Some Days on Splunk Enterprise Security. 10-14-2020 04:01 AM
- Karma Re: SEP 14.2 RU1 log format change for cascompany. 06-05-2020 12:50 AM
- Karma Re: Best practice to integrate Citrix mcs to Splunk for jconger. 06-05-2020 12:49 AM
- Karma Re: how create alert is send email in each once appear new result? for p_gurav. 06-05-2020 12:49 AM
- Karma Re: Splunk search help -- output data should match 2 or more of the keywords for DalJeanis. 06-05-2020 12:49 AM
- Karma Re: Search to display port scan attempts for DalJeanis. 06-05-2020 12:49 AM
- Karma Re: Universal Forwarder Disk Usage for koshyk. 06-05-2020 12:49 AM
- Karma Re: Is there a way set CPU and Memory consumption for splunkd process to a particular limit? for lguinn2. 06-05-2020 12:49 AM
- Karma Re: Using more than one Management Port for ddrillic. 06-05-2020 12:49 AM
- Got Karma for Re: Splunk search help -- output data should match 2 or more of the keywords. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-01-2018
11:08 PM
Hi All,
Good Day, I've indexed an event from scripted input but the events are not breaking every line, example logs are in below. How can I expand the event to every line using Splunk Search Query? Thanks.
Sample event:
02/02/2018 user, hostname
12:00:00.000 user1, hostname1
user2, hostname2
Expected Output
02/02/2018 user, hostname
12:00:00.000
02/02/2018 user1, hostname1
12:00:00.000
02/02/2018 user2, hostname2
12:00:00.000
... View more
- Tags:
- splunk-enterprise
01-15-2018
09:29 PM
Was your problem resolved already? Please give me feedback as I'm having the same problem as well. Thank you.
... View more
01-03-2018
11:36 PM
1 Karma
Try this:
index=_internal source=*license_usage.log* type=Usage | bucket _time span=1d | stats sum(b) as bytes by _time, pool | eval GB = round(bytes/1024/1024/1024,5) | eval quota=<your license quota here> | eval "% Used"=round(GB/quota*100,2) | rename GB as "License Util"| table "License Util" "% Used"
... View more
11-29-2017
06:33 PM
Thank you for the answer, however, I'm asking if its possible for splunk to use more than one management port, for example, I'm using management port 8089 and I want to add another management port 8090.
... View more
11-29-2017
03:48 AM
Hi Splunkers,
Just want to ask if is it possible to use multiple Management port? Just wondering because I've encountered a scenario that port 8089 is not available and the process that using the port is not advisable to kill.
Cheers,
Dan
... View more
11-20-2017
01:09 AM
6 Karma
If you're wondering, the right way to rebuild multiple buckets is ls | xargs -i /opt/splunk/bin/splunk rebuild {} command while you are in thawedb directory.
... View more
10-12-2017
12:19 AM
Hello,
I'm currently facing a problem on installing splunk universal forwarder on 1 of our windows server, the installer I'm using is splunkforwarder-6.2.12-277845-x86-release the OS version of the server is Windows Server 2003 32 bit. When I'm running the installer the installation wizard always ends up prematurely, I've also tried installing it via command line quietly but still has the same result, also tried installing it in low privilege mode and still has the same result. I'm pretty sure that I'm using an admin account. What could be the problem here? Thanks in advance.
Cheers,
Dan
... View more
10-06-2017
01:24 AM
Is there any deployment application out there for Citrix MCS?
... View more
10-04-2017
11:02 PM
Hi, Splunkers,
Can someone suggest what is the best practice to integrate Citrix mcs to Splunk? Our case is, we can't install splunk universal forwarder on the citrix servers because the server is frequently rebooting, once rebooted, the server will start to its original state meaning all installed app, configuration changes will be removed (just like deep freeze). Thanks.
Cheers,
Dan
... View more
10-04-2017
03:08 AM
Have you tried checking via Deployment Server? You can check the status of your universal forwarder in Deployment Server's Forwarder Management, have you also tried the query below?
| metadata type=hosts index=<index name> | convert ctime(*Time)
Cheers,
Dan
... View more
10-04-2017
03:03 AM
Can you provide details of inputs.conf and server.conf of your indexers and heavy forwarders if you have any.
You might have a problem with your disk, perhaps the IOPS of your disk is not enough to handle your current splunk workload.
Cheers,
Dan
... View more
09-26-2017
12:13 AM
Hi,
Seeking for an assistance on how can I automate splunk forwarder installation using windows script? Can I add this command on a windows script?
msiexec.exe /i splunkforwarder-6.6.1-aeae3fe0c5af-x64-release.msi INSTALLDIR="C:\Directory" AGREETOLICENSE=Yes DEPLOYMENT_SERVER="ip:8089" /quiet
Cheers,
Dan
... View more
09-21-2017
09:33 PM
Hi, Fellow Splunkers,
Had post a question this past few days about matching 2 words or more ( https://answers.splunk.com/answers/577564/splunk-search-help-output-data-should-match-2-or-m.html), however, this case is working if you have to match 1 word only, my problem is that I have to match 3 sets of words for my output. For example:
case 1: Apple Banana Cupcake
case 2: foo1 foo2 foo3
case 3: food drinks people
Field = The Apple and Banana are fruit (matched word are in case 1: Apple and Banana)
Can I possibly do this in Splunk search? Thanks in advance.
... View more
09-21-2017
08:04 PM
Hi I would like to seek for help once again, what about this case, the keyword needs to find is "Apple"
the regex couldn't find the word Apple if it has a comma on its side unless I'll also add the comma in the keyword like Apple, | Banana :
rex "(?i)(?<keyword_found>Apple| Banana......
Apple,
... View more
09-20-2017
07:58 PM
1 Karma
Thank you very much!
... View more
09-20-2017
04:41 AM
Hi, Fellow Splunkers,
Noob question. I would like to seek for help in my search, this is the case: The client gave csv for keywords, the search should be filtered based on the keyword matched, for example, the keywords are "Apple, Banana, Car" the output data should contain 2 or more of the keyword match. What will be my search? Is there an if match.count > 1 condition in splunk?
Thanks,
... View more
08-22-2017
11:39 PM
1 Karma
Hi arechenberg,
I've resolved this kind of problem by just converting .evtx file to .txt file, you can do it by opening the .evtx file on the Windows Event Viewer on your local machine and save it as Text file or CSV, after converting .evtx file to text file or csv you may now ingest in to your splunk. I've provided link on how to save windows event as text file or csv below.
https://technet.microsoft.com/en-us/library/cc749339(v=ws.11).aspx
... View more
08-16-2017
01:09 AM
1 Karma
What if i exported .evtx file from other machine and i want to ingest it to our splunk?
... View more
08-09-2017
10:31 PM
FATAL HTTPServer - Could not bind to port 8089 here's the log
... View more
08-09-2017
10:24 PM
yes, the install almost complete, but eventually roll back from the end. Then splunk installation wizard will show a message stating that "UniversalForwarder setup wizard ended prematurely"
... View more
07-25-2017
09:33 PM
This answer is late, but for this problem you can just add the stanza below for your inputs.conf
[blacklist://<path>]
Cheers,
Dan
... View more
07-25-2017
09:32 PM
This answer is late, but for this problem you can just add the stanza below for your inputs.conf
[blacklist://<path>]
Cheers,
Dan
... View more
07-24-2017
08:46 PM
Good Day fellow splunkers,
I just like to ask if is it still possible to re-index lost Windows Active Directory logs? Let's say, AD logs from a month a go. The reason why the logs lost is probably because of network issue. Please check my inputs.conf below.
[admon://default]
disabled = 0
monitorSubtree = 1
index = ad
Cheers,
Dan
... View more
07-24-2017
08:41 PM
I saw migration.conf in the uf. Is it possible that it was the culprit why the issue is occuring?
... View more
07-17-2017
10:24 AM
Hi Splunkers,
I have AD server integrated to our splunk that is indexing Active Directory logs and we've lost data from specific date range, however, logs is active on that date. Is there any way to index that lost AD logs? The dates are July 13-15, 2017 to be specific.
Thanks,
Dan
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-17-2025
08:35 PM
|
Karma from
Karma given to
