Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About aelliott
aelliott
Motivator
Member since:
10-03-2013
06-05-2020
Community Statistics
| Posts | 451 |
| Solutions | 66 |
| Karma Given | 96 |
| Karma Received | 202 |
| Member Since | 10-03-2013 |
Activity Feed
- Got Karma for Re: Display percentage on pie charts in Splunk 6?. 12-26-2024 07:49 AM
- Got Karma for Re: How to use a $ in a form search?. 12-17-2023 12:27 AM
- Got Karma for Re: How to use a $ in a form search?. 05-16-2022 09:15 AM
- Got Karma for Re: How to use a $ in a form search?. 10-06-2021 06:14 PM
- Got Karma for Re: Display percentage on pie charts in Splunk 6?. 03-10-2021 10:12 AM
- Got Karma for Re: How to use a $ in a form search?. 09-10-2020 10:58 PM
- Got Karma for Anonymous access to dashboards. 09-03-2020 06:31 AM
- Karma So many Spams in Splunk answers for guilmxm. 06-05-2020 12:47 AM
- Karma Re: How to tell if accelerated data model is still rebuilding? for jamesvz84. 06-05-2020 12:47 AM
- Karma Re: How to fill a field with an ip address extracted from another field? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Will changing a lookup file persist on app update? for strive. 06-05-2020 12:47 AM
- Karma Re: Split ip and port into two fields using delims for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Splunk app for windows infrastructure, CIM Compliance and Role with Enterprise Security for jcoates_splunk. 06-05-2020 12:47 AM
- Karma Re: Quick Question - CPU Search Limit on Search Head or Indexer? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Splunk plz help for alacercogitatus. 06-05-2020 12:47 AM
- Got Karma for Splunk_TA_nix 5.0.2 Eventtype does not exist or is disabled. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk_TA_nix 5.0.2 Eventtype does not exist or is disabled. 06-05-2020 12:47 AM
- Got Karma for Will changing a lookup file persist on app update?. 06-05-2020 12:47 AM
- Got Karma for Splunk app for windows infrastructure, CIM Compliance and Role with Enterprise Security. 06-05-2020 12:47 AM
- Got Karma for Re: Documentation on implementing a function triggered by change of a token's value?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 |
04-08-2014
08:35 AM
can you see what events have gone into your new index? You mentioned there were 2?
... View more
04-08-2014
08:31 AM
You may want to make sure your database connection is good then 🙂
... View more
04-08-2014
08:28 AM
how many results does your query return when you run it?
... View more
04-08-2014
08:24 AM
is it giving you any errors in splunkd.log?
... View more
04-08-2014
08:18 AM
if you go into the indexes, does it show anything in there as far as # of events?
... View more
04-08-2014
07:56 AM
You need to create a new index.
You will have to re-create your input so that it re-indexes. Disable the input, hit the clone button, Change to dbmon:mkv (if you haven't already) and make sure it says " Multiline Key-Value based" instead of "Key-Value based"
... View more
04-08-2014
07:43 AM
you deleted the old index, created the new index, then cloned the input?
... View more
04-08-2014
06:17 AM
3 Karma
Try
require(["splunkjs/ready!","underscore","jquery","myAddon"], function(mvc,_, jQuery,myAddOn) {
Also, I would add this code before including your javascript file in the page
(This assumes your javascript file is in your appname/django/appname/static/appname
<br>
require.config({<br>
paths: {<br>
"myAddon": "{{STATIC_URL}}{{app_name}}/myJqueryAddon.js"<br>
},<br>
shim: {<br>
"myAddOn": {<br>
deps: ["jquery"],<br>
exports: "jQuery.fn.myJQueryAddon"<br>
}<br>
}<br>
});<br>
What error are you getting?
... View more
04-07-2014
01:02 PM
1 Karma
Yes, it appears that you need Python 2.7
Requirements
Here are the Web Framework requirements for this release:
https://github.com/splunk/splunk-webframework
Operating system: Windows, Linux or Mac OS X.
Web browser: Latest versions of Chrome, Safari, or Firefox; Internet Explorer 9 or later.
The Splunk Web Framework: The Web Framework is available as a ZIP file from GitHub and as a Git repository.
Splunk: Splunk 5.0 or later.
Note The Web Framework is already included with Splunk 6.0 and later.
Programming language: Python 2.7.
... View more
04-07-2014
12:49 PM
Did this fix your issue? If so please mark this as answer
... View more
04-04-2014
10:58 AM
1 Karma
how about something like this:
... | eval num=if(like(index,"summary_%"),23,10) | eval totalVolumeGB=num*(homePath_maxDataSizeMB+coldPath_maxDataSizeMB)/1024
... View more
04-04-2014
10:10 AM
and why 2 300 gb as opposed to 1 600 gb
... View more
04-04-2014
09:20 AM
i'd also like to know the "disk" space of a Deployment Server. I know it doesn't need "much" but that is not very specific. We plan on having thousands of devices connected to it.
... View more
04-04-2014
09:18 AM
We will have 2 search heads, one for ES 3.0 and one for Regular splunk.
According to the documentation for 3.0, tsidx files are stored on the Indexer and not the search head.
We are planning on having all summary indexes stored on the indexer.
What is the Disk space required for these search head instances and will they grow based on data throughput into the indexer?
I read that 2 300 GB drives were best, however that seems a bit excessive to me. Disk space is not cheap.
Our search heads will be virtualized in a data center.
... View more
04-04-2014
07:02 AM
ah yes, then definitely dbmon:mkv, Is it working?
... View more
04-04-2014
06:33 AM
1 Karma
delete index, re-create, disable db input, clone db input, change to dbmon:mkv
... View more
04-04-2014
06:32 AM
multiple lines in a field.
... View more
04-04-2014
06:28 AM
do you have fields in your database with multiple lines? If so you will need to use dbmon:mkv
... View more
04-03-2014
01:00 PM
Did you get this working?
... View more
04-03-2014
08:03 AM
http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Configuredatabasemonitoring
7. Specify a data Sourcetype.
The following formats are associated with the sourcetypes:
Key-Value format with dbmon:kv sourcetype
Multi-line Key-Value format with dbmon:mkv sourcetype
Template with dbmon:tpl sourcetype
CSV format with CSV sourcetype
Note: If you leave the Sourcetype field blank, the pre-defined sourcetype associated with the format is used.
... View more
04-03-2014
07:59 AM
what is your sourcetype? dbmon:kv?
... View more
04-03-2014
07:37 AM
to copy your current input, it will run the query initially once again without the {{ AND $rising_column$ > ?}}
... View more
04-03-2014
07:34 AM
That's the issue, you literally need to put {{ AND $rising_column$ > ?}} instead of {{AND CREATED_DT > ?}}
... View more
04-03-2014
07:31 AM
and you have {{ AND $rising_column$ > ?}} in your input query?
... View more
