Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About 493669
493669
Super Champion
Member since:
12-18-2016
10-26-2025
Community Statistics
| Posts | 1087 |
| Solutions | 179 |
| Karma Given | 14 |
| Karma Received | 247 |
| Member Since | 12-18-2016 |
Activity Feed
- Got Karma for Re: Lookup match. 11-08-2024 03:13 AM
- Got Karma for Re: eval case statement. 03-27-2024 04:06 AM
- Got Karma for Re: How do you add a field/column to an existing kvstore?. 02-08-2024 02:07 AM
- Got Karma for Re: How do you add a field/column to an existing kvstore?. 02-08-2024 02:06 AM
- Got Karma for Re: How do I search for events within _indextime?. 10-12-2023 08:38 AM
- Got Karma for Re: Find number of days between date and now(). 08-29-2023 12:38 AM
- Got Karma for Re: How do you hide panels which do not have values?. 07-03-2023 02:52 AM
- Got Karma for Re: How to extract the all the field using rex?. 04-05-2023 09:17 PM
- Got Karma for Re: How to Clone an App?. 12-14-2022 01:52 AM
- Got Karma for Re: Find number of days between date and now(). 09-08-2022 09:22 AM
- Got Karma for Re: How to extract days ,hours minutes and secs??. 09-02-2022 10:10 AM
- Got Karma for Re: How do you add a field/column to an existing kvstore?. 06-09-2022 12:33 AM
- Got Karma for Re: How to check version of all apps and add-ons installed on Splunk via CLI ?. 06-08-2022 10:23 AM
- Got Karma for Re: How to check version of all apps and add-ons installed on Splunk via CLI ?. 06-08-2022 10:22 AM
- Posted Re: Why is it when you don't put a wild card when searching after extracting the field, you can't search? on Splunk Search. 02-16-2022 08:22 PM
- Got Karma for Re: How do I search for events within _indextime?. 11-12-2021 10:52 AM
- Got Karma for Re: Why am I getting an error to start fresh splunk instance in my mac machine?. 11-08-2021 08:37 AM
- Got Karma for Re: Which inputs.conf does "splunk add monitor" modify. 11-01-2021 12:50 PM
- Posted Re: Issues With DB Connect identities.conf on Search Head Cluster on Deployment Architecture. 11-01-2021 09:11 AM
- Got Karma for Re: Which of these two options is best for distributing data across indexers when adding new indexers and retiring old o. 11-01-2021 05:37 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 |
10-11-2017
08:01 PM
You can try:
<some serch query>....|outputlookup test.csv
It will save your search query results into test.csv file and it will get replicated to all search heads (supported in distributed environment).
Then when you want use that csv file to pick up by another tool then you can try below query:
|inputlookup test.csv|table... <some search query>
... View more
10-11-2017
07:47 PM
Here on every page of table I want to display 100 records with enabled vertical scrollbar .
and when I scroll down the first row should remain fixed .
Here I am using below js:
div#tableid{
overflow-y: scroll;
}
... View more
10-11-2017
06:47 AM
Try Below query
| rest /services/authentication/httpauth-tokens splunk_server=local |stats count by userName |sort - count | head 10
It will work
... View more
10-10-2017
10:29 PM
1 Karma
Hi niketnilay,
How many Karma points do we need to be able to post images?
... View more
10-10-2017
09:19 AM
Hi @niketnilay,
I have applied below js:-
div#tableid{
overflow-y: scroll;
}
I am not able to add screenshot
... View more
10-10-2017
09:11 AM
I have applied below js on div:-
div#multiselect {
overflow-y: scroll;
}
... View more
10-09-2017
11:25 AM
can anyone suggest on this?
... View more
10-08-2017
09:02 AM
Use below rex command-
sourcetype="notrelevant" |rex field=Vegetables "(?<Vegetables>\w+)"| chart count by Vegetables
It will work.
... View more
10-08-2017
08:39 AM
Hi All,
I want to display 100 rows results in table per page with vertical scrollbar and fix the header when we move down.
I am trying to use overflow-y: scroll; on div. so it shows vertical scrollbar but it is showing 10 rows per page with header is not fixed.
can any one please help me...
Thanks.
... View more
10-08-2017
06:39 AM
Try Below
<input>
....
<fieldForLabel>All</fieldForLabel>
<fieldForValue>%</fieldForValue>
</input>
... View more
04-15-2017
03:23 AM
https://answers.splunk.com/answers/514443/after-editing-the-kv-store-for-my-custom-app-why-d.html#answer-521153
... View more
04-15-2017
03:17 AM
1 Karma
Finally issue is resolved now. It was permission issue on my windows as suggested.
On Splunk Folder >Propperties>Security Tab>Advanced>In Advanced Security Settings>Given Full Control Access for particular User-Admin and tick on checkbox-"Replace all child object permission entries with inheritable permission entries from this object".
Then Apply these settings.
Thanks @MuS @woodcock and @mattymo
... View more
04-04-2017
08:21 AM
Hi MuS,
When I am trying |inputlookup command I am using transforms.conf stanza name only . As @woodcock suggested to make both header stanza same in transforms.conf and collections.conf so tried with |inputlookup sample but it not worked.
now i tried the stanza provided and tried |inputlookup sample_store but still it gives error as
The lookup table 'sample_store' is
invalid.
... View more
04-03-2017
07:49 PM
After trying ...|outputlookup sample get same error as
"Error in 'outputlookup' command: The
lookup table 'sample' is invalid."
... View more
04-03-2017
08:50 AM
After debug/refresh i get following errors:
1.
Refreshing admin/crl ResourceNotFound
In handler 'crl': Invalid action for this internal handler (handler: crl, supported: list|_reload, wanted: list).
2.
Refreshing admin/remote_indexes BadRequest
In handler 'remote_indexes': The following required arguments are missing: repositoryLocation.
... View more
04-02-2017
10:02 AM
added below stanza in default.meta :
[collections]
export = system
and
[lookups]
export = system
this stanza already present.
checked local.meta but i did not find any sample entry .below stanza are present in local.meta
[app/ui]
version = 6.4.5
modtime = 1491051965.784553700
[app/launcher]
version = 6.4.5
modtime = 1491051965.929988500
still gives same error
... View more
04-01-2017
08:05 PM
after making same header stanza for both transforms.conf and collection.conf still gives me error as "The lookup table 'sample' is invalid".
when i tried to create kv store through lookup definition it is get created but unable to set permission from private to global. it gives error as "Splunk could not update permissions for resource data/transforms/lookups [HTTP 500] Splunkd internal error; [{'type': 'ERROR', 'code': None, 'text': "\n In handler 'transforms-lookup': Data could not be written: /nobody/Test/transforms/ui/fields_list: ui, collectionName, app"}"
... View more
04-01-2017
05:20 AM
I am unable to open support case as it shows "It appears you do not have an active Support Contract or entitlement and as a result, cannot open a Support case."
... View more
03-25-2017
10:35 AM
in Local folder-
Collections.conf
[sample]
field.test = string
field.check = string
replicate = true
Transforms.conf
[sample_store]
external_type = kvstore
collection = sample
fields_list = test, check
... View more
03-25-2017
10:12 AM
1 Karma
Hi,
In Splunk 6.4.5 standalone on Windows. After creating an app, I added a stanza in transforms.conf and collections.conf in default folder. Then after adding few entries in that KV Store i am able to see through |inputlookup command
Then i added transforms.conf and collections.conf in the local folder of the app and then added stanza for KV Store, but when i tried |inputlookup command it gives me error as "The lookup table is invalid".
Please advise.
... View more
03-13-2017
05:14 AM
@jkat54,
splunk single instance is running and i have not seen mongod.exe running in task manager. also i deleted mongod.lock but still i am not able to create kv store lookup.
i am able to create csv lookup but not kv store
also in lookup editor app i tried creating kv store lookup but still it gives error as "The KV store collection could not be created"
Kindly advise
... View more
03-12-2017
04:20 AM
Hi,
I am trying to create kv store lookup by adding below stanza in transforms.conf and collections.conf.
Currently I am using Windows OS and splunk is 6.4.5 (Free version) standalone.
in transforms.conf-
[test_store]
external_type = kvstore
collection = test_collection
fields_list = Name, Country
and in collections.conf-
[test_collection]
field.Name = string
field.Country = string
after when i search |inputlookup test_store
it gives error as "The lookup table 'test_store' is invalid."
I had read few articles so did the following things.
1. Created server.conf in local
[kvstore]
disabled=false
2. Checked for mongod.log file I find the following lines-
98 Unable to create/open lock file: C:\Program Files\Splunk\var\lib\splunk\kvstore\mongo\mongod.lock errno:5 Access is denied.. Is a mongod instance already running?, terminating
2017-03-12T10:01:26.970Z I CONTROL [initandlisten] dbexit: rc: 100
Kindly advise.
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-26-2025
10:15 AM
|
