Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About aelliott
aelliott
Motivator
Member since:
10-03-2013
06-05-2020
Community Statistics
| Posts | 451 |
| Solutions | 66 |
| Karma Given | 96 |
| Karma Received | 202 |
| Member Since | 10-03-2013 |
Activity Feed
- Got Karma for Re: Display percentage on pie charts in Splunk 6?. 12-26-2024 07:49 AM
- Got Karma for Re: How to use a $ in a form search?. 12-17-2023 12:27 AM
- Got Karma for Re: How to use a $ in a form search?. 05-16-2022 09:15 AM
- Got Karma for Re: How to use a $ in a form search?. 10-06-2021 06:14 PM
- Got Karma for Re: Display percentage on pie charts in Splunk 6?. 03-10-2021 10:12 AM
- Got Karma for Re: How to use a $ in a form search?. 09-10-2020 10:58 PM
- Got Karma for Anonymous access to dashboards. 09-03-2020 06:31 AM
- Karma So many Spams in Splunk answers for guilmxm. 06-05-2020 12:47 AM
- Karma Re: How to tell if accelerated data model is still rebuilding? for jamesvz84. 06-05-2020 12:47 AM
- Karma Re: How to fill a field with an ip address extracted from another field? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Will changing a lookup file persist on app update? for strive. 06-05-2020 12:47 AM
- Karma Re: Split ip and port into two fields using delims for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Splunk app for windows infrastructure, CIM Compliance and Role with Enterprise Security for jcoates_splunk. 06-05-2020 12:47 AM
- Karma Re: Quick Question - CPU Search Limit on Search Head or Indexer? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Splunk plz help for alacercogitatus. 06-05-2020 12:47 AM
- Got Karma for Splunk_TA_nix 5.0.2 Eventtype does not exist or is disabled. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk_TA_nix 5.0.2 Eventtype does not exist or is disabled. 06-05-2020 12:47 AM
- Got Karma for Will changing a lookup file persist on app update?. 06-05-2020 12:47 AM
- Got Karma for Splunk app for windows infrastructure, CIM Compliance and Role with Enterprise Security. 06-05-2020 12:47 AM
- Got Karma for Re: Documentation on implementing a function triggered by change of a token's value?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 |
03-13-2014
07:09 AM
1 Karma
Try using $$vikas$$
http://answers.splunk.com/answers/114841/search-query-is-not-fully-resolved-when-using-a-in-a
... View more
03-13-2014
06:37 AM
I'm leaning towards yes on this question.
ES is good at telling you that there are anomalies in flows of data.
You've still got to apply the subject matter expertise to know if that's malware behavior or something else (through the use of a security analyst).
Malware is more likely to occur on a user's machine, which could lead to an outbreak.
Catching anomalies early can prevent an outbreak.
... View more
03-12-2014
02:05 PM
Correct, and those anomalies is what our security analyst would look at to determine the root cause and determine whether or not it is possibly intrusive activity. You'd be able to correlate with several other users' machines to determine what is an anomaly and what is normal activity.
... View more
03-12-2014
01:49 PM
What about malware events that do not get detected by anti-malware software. I think that is the benefit of Enterprise security, the ability to track down these threats before they become "known" malware
... View more
03-12-2014
01:34 PM
Should I install a universal forwarder on everyone's workstation in order to track possible malware attacks through correlation searches? Is this best practice?
... View more
03-12-2014
06:56 AM
Correct, you cannot have input type=time..
... View more
03-12-2014
06:40 AM
Check this out:
http://answers.splunk.com/answers/5434/timerangepicker-custom-values
... View more
03-10-2014
11:05 AM
1 Karma
how about this: http://answers.splunk.com/answers/756/how-can-i-include-greaterless-than-signs-in-a-search-in-my-apps-simple-xml-view
... View more
03-10-2014
10:11 AM
The DELIMS = "\s" does not work.
Changed it to DELIMS = " " and it worked for me.
... View more
03-10-2014
09:04 AM
I think your whole issue is that you are attempting to point to a file that is on the filesystem. it must be able to be retrieved via web for this to work.. such as a URL to the text file.
... View more
03-10-2014
08:08 AM
you could just add it within your script after it is defined. Just add loadXMLDoc() after the code
... View more
03-10-2014
06:52 AM
Try this:
http://stackoverflow.com/questions/15547407/javascript-read-text-file-using-ajax
... View more
03-07-2014
06:52 AM
1 Karma
Try this:
http://answers.splunk.com/answers/116336/upgraded-to-splunk-6-now-the-settings-menu-shows-duplicate-entries
... View more
03-06-2014
02:15 PM
2 Karma
Is this along the lines of what you are looking for?
http://answers.splunk.com/answers/110886/hide-interesting-fields
... View more
03-06-2014
07:32 AM
Ok so to do this you must also set enable_insecure_login = True within the web.conf file in the system/local directory and it works. Thanks for your help!
... View more
03-05-2014
01:40 PM
1 Karma
You could order by State Ascending before deduping, then if there are any "down" it will show up top.. That seems like a much easier solution
That will require you to move your "if" statement though before the sort,dedup
| sort State | dedup etc.
... View more
03-05-2014
01:36 PM
2 Karma
Is it possible to give anonymous access to users to a single dashboard?
I found this post on the subject, however, the link within does not work.
http://answers.splunk.com/answers/5182/anonymous-access-of-dashboards
... View more
03-05-2014
12:51 PM
1 Karma
perhaps quotation marks around "Running"?
It may be looking for the field named Running.
... View more
03-05-2014
07:04 AM
What index did you store the data in? if you did not store it in the "main" index, you may have to go and change all the saved searches etc to use the specified index as it will default to main i believe in the searches.
... View more
03-05-2014
06:42 AM
2 Karma
There are many examples here:
http://www.splunk.com/web_assets/pdfs/secure/Splunk_Quick_Reference_Guide.pdf
I believe what you are looking for is "substr"
... View more
03-04-2014
01:58 PM
I have modified my post, does that look much better?
... View more
03-04-2014
11:55 AM
Does this seem like a good setup for a dedicated Search head, indexer for a virtualized Splunk?
Search Head
- 8 core 16 GB Ram
Indexer
- 8 core 8 GB Ram 1 TB Hard Drive
We will have approximately 3 concurrent users at a given time, and a throughput of 10 GB/day
... View more
- Tags:
- virtual
- virtualized
03-04-2014
10:47 AM
I normally use http://www.w3schools.com/tags/tag_textarea.asp for multiple line text boxes
... View more
