Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About aelliott
aelliott
Motivator
Member since:
10-03-2013
06-05-2020
Community Statistics
| Posts | 451 |
| Solutions | 66 |
| Karma Given | 96 |
| Karma Received | 202 |
| Member Since | 10-03-2013 |
Activity Feed
- Got Karma for Re: Display percentage on pie charts in Splunk 6?. 12-26-2024 07:49 AM
- Got Karma for Re: How to use a $ in a form search?. 12-17-2023 12:27 AM
- Got Karma for Re: How to use a $ in a form search?. 05-16-2022 09:15 AM
- Got Karma for Re: How to use a $ in a form search?. 10-06-2021 06:14 PM
- Got Karma for Re: Display percentage on pie charts in Splunk 6?. 03-10-2021 10:12 AM
- Got Karma for Re: How to use a $ in a form search?. 09-10-2020 10:58 PM
- Got Karma for Anonymous access to dashboards. 09-03-2020 06:31 AM
- Karma So many Spams in Splunk answers for guilmxm. 06-05-2020 12:47 AM
- Karma Re: How to tell if accelerated data model is still rebuilding? for jamesvz84. 06-05-2020 12:47 AM
- Karma Re: How to fill a field with an ip address extracted from another field? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Will changing a lookup file persist on app update? for strive. 06-05-2020 12:47 AM
- Karma Re: Split ip and port into two fields using delims for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Splunk app for windows infrastructure, CIM Compliance and Role with Enterprise Security for jcoates_splunk. 06-05-2020 12:47 AM
- Karma Re: Quick Question - CPU Search Limit on Search Head or Indexer? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Splunk plz help for alacercogitatus. 06-05-2020 12:47 AM
- Got Karma for Splunk_TA_nix 5.0.2 Eventtype does not exist or is disabled. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk_TA_nix 5.0.2 Eventtype does not exist or is disabled. 06-05-2020 12:47 AM
- Got Karma for Will changing a lookup file persist on app update?. 06-05-2020 12:47 AM
- Got Karma for Splunk app for windows infrastructure, CIM Compliance and Role with Enterprise Security. 06-05-2020 12:47 AM
- Got Karma for Re: Documentation on implementing a function triggered by change of a token's value?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 |
03-04-2014
09:16 AM
1 Karma
Check out this post.
Basically you need to replace '\r' with
http://forums.asp.net/t/1711955.aspx?How+do+you+save+carriage+returns+from+a+multi+line+textbox+
... View more
03-03-2014
12:39 PM
2 Karma
Check out this tutorial, It has some examples of using $tokens$
http://dev.splunk.com/view/webframework-htmldashboards/SP-CAAAETQ
... View more
03-03-2014
09:23 AM
If you have 3 violations of the license, then yes
http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Aboutlicenseviolations
... View more
03-03-2014
09:17 AM
The warnings will clear themselves in 30 days.
The only other way(besides waiting) to get rid of them would be to re-install Splunk.
... View more
02-27-2014
02:40 PM
1 Karma
I'm new to the Universal Forwarders and wanted to make sure I had this process correct. Some of the apps require specific TA's to be used.
Step 1: Open Port on receiving machine.
Step 2: Install Universal Forwarder on forwarding machine.
Step 3: Install TA on universal Forwarder
What index does this data go into on the receiving machine and is there a way to control this?
If it is in a specific piece of documentation please let me know.
I am using this as a reference but did not see this information in there:
http://docs.splunk.com/Documentation/WindowsApp/latest/User/InstalltheSplunkAppforWindows
... View more
02-27-2014
09:28 AM
1 Karma
Here's how I do this.. I just put at the end of the query Where myColumn > 234234
you will need to put And inside the brackets as below.
Do not put the "Where myColumn > 234234" inside the {{ and rising_column...}} .. leave outside.. and if it's your rising column, then it will always be bigger than the myColumn value so it doesn't hurt to leave it in there.
So it would be Where myColumn > 234234 {{ and rising_column > ?}}
Also you can always put "select TOP 10000" on your query and order by your ID column ascending
make sense?
... View more
02-25-2014
08:33 AM
See this post: http://answers.splunk.com/answers/66786/free-license-reset
... View more
02-25-2014
06:16 AM
on that post at the end, @MasterOogway posted:
"Usually this shows up when your trying to compare results from a current search to a previous one and the results from the earlier search cannot be found. Appears to be harmless knowing this will go away once the search condition is met."
... View more
02-24-2014
10:13 AM
1 Karma
check out this post:
http://answers.splunk.com/answers/51106/splunk-ports
and here's a diagram:
http://answers.splunk.com/answers/118859/diagram-of-splunk-common-network-ports
... View more
02-24-2014
08:14 AM
Here is someone that had a similar issue.
http://answers.splunk.com/answers/2380/cannot-find-artifacts-for-savedsearch_ident
... View more
02-24-2014
07:59 AM
Since I have seen some posts that say that SQL Logs are the way to go, and TCP inputs have the possibility of losing data if the splunk server were to go down. I am going to say that the better way is through MSSQL as it will pick up where it left off.
... View more
02-24-2014
07:29 AM
To feed logs from Websense to Splunk, which would be ideal and why?
As a TCP Input
From MSSQL
If Splunk server goes down, will logs be lost using the TCP input?
... View more
02-21-2014
11:19 AM
we have it in the format etc and it works great
In addition, you probably just want to start with the tag right? so you could do break only before ^<ResultSetData etc?
... View more
02-21-2014
08:00 AM
4 Karma
you could do index=my_index sourcetype=/var/log/mysource host=abc-host101 | bucket _time span=5m | stats count by sourcetype,_time
and
index=my_index sourcetype=/var/log/mysource host=abc-host101 | bucket _time span=30m | stats count by sourcetype,_time
... View more
02-20-2014
02:46 PM
if you are loading a one time huge load.. it is ok to do a few times a month, as long as you don't get too many that would cause your search to stop working in splunk. After 30 days, those warnings will be gone and you can do it again. This helps you be able to load Historical data when needed without scaling up your splunk instance.
... View more
02-20-2014
08:59 AM
1 Karma
Actually you could say and '$multiTokenQuery$' != ''
... View more
02-20-2014
08:08 AM
ah it would be Instr('$multiTokenQuery$',perioperiod_name)
... View more
02-20-2014
07:48 AM
1 Karma
I've modified my answer, while that way will probably work as well, you could use the CharIndex in the SQL query so then no javascript changes
... View more
02-20-2014
07:39 AM
1 Karma
It looks like the issue is that it returns 'Dec-13,Jan-14' instead of 'Dec-13','Jan-14' , which is correct sql syntax for the IN operator.
... View more
02-20-2014
07:29 AM
1 Karma
Apparently I thought for some reason you were using web framework but that is not the case. You would need to find out what token value that splunk was sending your query via SQL Profiler or a like function.
... View more
02-20-2014
06:55 AM
1 Karma
Can you debug your javascript? if so after everything is rendered, you could inspect the search object and find the query that is being run. Alternatively you could use SQL profiler to find out what query is being run to see exactly what is getting added into the token
... View more
02-20-2014
06:42 AM
You set it in indexes.conf on an index per index basis.
And yes you can do it exactly as you state.
http://docs.splunk.com/Documentation/Splunk/5.0.3/Indexer/Setaretirementandarchivingpolicy
... View more
