Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About svemurilv
svemurilv
Path Finder
Member since:
01-04-2017
06-05-2020
Community Statistics
| Posts | 58 |
| Solutions | 1 |
| Karma Given | 10 |
| Karma Received | 0 |
| Member Since | 01-04-2017 |
Activity Feed
- Karma Re: How to compare fieldName from different sourcetypes? for niketn. 06-05-2020 12:49 AM
- Karma Re: deduping ans eliminating the duplicate vales from 2 different sourcer for somesoni2. 06-05-2020 12:49 AM
- Karma Re: How to edit my configurations so that my Kubernetes host log will be reformatted entering Splunk? for jenthomas. 06-05-2020 12:48 AM
- Karma Re: Maximum number of historical concurrent system-wide searches has been reached for harsmarvania57. 06-05-2020 12:48 AM
- Karma Re: How to generate a search that for DalJeanis. 06-05-2020 12:48 AM
- Karma Re: Data masking for sbbadri. 06-05-2020 12:48 AM
- Karma Re: restful call search Data format for somesoni2. 06-05-2020 12:48 AM
- Karma Re: What are the best searches to monitor data flow activity from the Universal Forwarder to the Heavy Forwarder to the indexer? for adonio. 06-05-2020 12:48 AM
- Karma Re: Dashboard not working for somesoni2. 06-05-2020 12:48 AM
- Karma Re: Why are my ulimits settings not being respected on ubuntu/debian after a server reboot? for pj. 06-05-2020 12:47 AM
- Posted Re: sourcetypes comparison for the similar data with varies filed names on Splunk Search. 07-06-2018 08:27 AM
- Posted sourcetypes comparison for the similar data with varies filed names on Splunk Search. 07-05-2018 01:31 PM
- Tagged sourcetypes comparison for the similar data with varies filed names on Splunk Search. 07-05-2018 01:31 PM
- Posted Re: Inputs defined sourcetype overwrite a specific source using props and transforms on Getting Data In. 06-06-2018 10:17 AM
- Posted Inputs defined sourcetype overwrite a specific source using props and transforms on Getting Data In. 06-01-2018 01:42 PM
- Posted Re: deduping ans eliminating the duplicate vales from 2 different sourcer on Splunk Search. 11-15-2017 12:00 PM
- Posted deduping ans eliminating the duplicate vales from 2 different sourcer on Splunk Search. 11-15-2017 10:56 AM
- Tagged deduping ans eliminating the duplicate vales from 2 different sourcer on Splunk Search. 11-15-2017 10:56 AM
- Tagged deduping ans eliminating the duplicate vales from 2 different sourcer on Splunk Search. 11-15-2017 10:56 AM
- Posted Re: How can I search for two different error messages to see if they both happened in a one-minute timespan? on Deployment Architecture. 11-09-2017 07:55 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-27-2017
12:31 PM
Hi somesh,
its sorting by rank but still the default value not displaying with space.
my original lookup file and application Domain value indexed with space.
https://splunk-usergroups.slack.com/files/vemchow/F551EJ3FS/capture122.jpg
... View more
04-26-2017
02:33 PM
am using this Application Domain in my entire Dashboard searches
how can i use this i dont know how we can use this to get the app name may app are looking like BEP:Application Name and in my lookup table Application Domain was like Application Name and app dir name was ApplicationName
... View more
04-26-2017
01:55 PM
Hi
I have multiple apps in our environment each app represents ApplicationDomain, and all of them have lots of dashboards , where we are using a lookup table values to populate the ApplicationDomain values in the Drop-down. A few ApplicationDomain Names have a space in between the name. where my dashboard global token $emnv:arpp$
AppName : PGR - External Data
AppFoldername is : ExternalData
<form>
<label>RRD Restarts Clone__test</label>
<fieldset autoRun="false" submitButton="true">
<input type="dropdown" token="domain">
<label>Application Domain</label>
<search>
<query>|inputlookup ApplicationDomain.csv|stats count by ApplicationDomain |sort +ApplicationDomain</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<fieldForValue>ApplicationDomain</fieldForValue>
**<choice value="$env:anpp$">default</choice>**
</input>
How can i work this code for the ApplicationDomain name has space?
... View more
04-24-2017
04:27 PM
Hi,
I would like to monitor , how much data did UF forwarding to HF and how much data indexed by splunk from HF. Blocking information and duplicate data , forwarding stopped UF and , data indexed by each indexer
... View more
04-24-2017
01:26 PM
Hi ,
i would like to monitor the Splunk data flow activity. what are the best Splunk searches to monitor the data sending from UF (Universal Forwarder) moving to HF (Heavy Forwarder) and HF to indexer?
... View more
02-08-2017
10:47 AM
i had resolved it, in 3 steps.
1.updated restart_timeout stanza, increased time out to 15 min in master server server.conf file( master will wait for the peer node to come up till 15 min )
2 set the peer node offline using 'splunk offline'
3 power off the peer node
4 Change the HW settings
5 power on the system
6 wait for replication and search factors met on the master server dashboard
... View more
02-07-2017
07:34 AM
Hi,
My Splunk environment contains 1 master 6 pears of indexer hosts. I just want to perform the CUP upgrade on my indexer hosts which all are in virtual environment. i Need to reboot the virtual system after CUP upgrade.
whats the best practices to do this on all 6 indexer pears by minimizing the downtime.
-Rag
... View more
01-30-2017
02:05 PM
yeah for both 6.2 and 6.5.1
... View more
01-30-2017
01:30 PM
This code is working
<table>
<search>
<query>index=* source="/home/XXXXXXX/XXXXXX/logs/$date_log$/$processname$" $loglevel$ "$search$" | table _time _raw |sort +_time</query>
<earliest>$time_sel.earliest$</earliest>
<latest>$time_sel.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
... View more
01-30-2017
12:05 PM
Hi,
Am seeing same issues with staging which is running on latest 6.5.1 version.
-thanks
... View more
01-30-2017
10:22 AM
its bit old version 6.2
... View more
01-30-2017
10:13 AM
Same out pot no change its displaying only 1020 raw events , that's it
... View more
01-30-2017
09:58 AM
<panel>
<event>
<search>
<query> index=main source="/home/gdloader/gdloader/logs/$date_log$/$processname$" $loglevel$ "$search$" | table _time _raw </query>
<earliest>$time_sel.earliest$</earliest>
<latest>$time_sel.latest$</latest>
</search>
</event>
</panel>
... View more
01-30-2017
09:44 AM
Hi rjthibod
this doesn't help full to pull all my 6K events, again its showing 1020 events only instead of all events.
... View more
01-30-2017
07:34 AM
Hi Team,
I have a Dashboard displaying the log events List of the specific date. When I am trying to displays all _raw events list, my dashboard shows only 1020 events count, is there any way to display complete raw log events in dashboard, without updating my Limits.conf file or some other .conf changes
using the search index=main source="/home/apps/loader/logs/$date_log$/$processname$" $loglevel$ "$search$"
-Thanks.
... View more
01-16-2017
01:53 PM
got it thanks
... View more
01-16-2017
01:38 PM
Hi ,
Where can i download an older version of Splunk DB Connect app, such as i want Splunk DB Connect 2.2.0?
please advice
Thanks
... View more
- Tags:
- Splunk DB Connect
01-12-2017
07:38 PM
Thanks @soni its working
... View more
01-12-2017
01:10 PM
Hi ,
I am using Splunk DB Connect to take the database data in to Splunk.
In that data, i have a data field name as update_date
In my dashboard, i would like to search the data based on the update_date and should take the input date_time from the time_picker drop-down.
i want search all updated data between x-date to y-date. Or updated date =x-date should display all the data on that updated data.
My updated_date and _time (indexing times) are different. My updated_date is in _raw.
In search, I am taking different sources data using "left join"
thanks
... View more
01-10-2017
09:35 AM
HI soni,
First thanks for reply.
what am exactly expecting is. first search giving process,START_TIME ,END_TIME . and i want to pass those process ,START_TIME and END_TIME to the Contextual drilldown pannels search inputs queary like
source =source Process=$process START_TIME=$START_TIME$ END_TIME=$END_TIME$
... View more
01-10-2017
09:06 AM
Hi
I have a two panel dashboard. If I select the process from the first panel, then I want the process related logs to be displayed in between the time range will display in the second panel
i have used dynamic drilldown to display the _raw data in the second panel
process START_TIME END_TIME Duration PID
PR_FileWorker_AA 01/10/17 01:00:01 01/10/17 01:03:49 227 30387
PR_FileWorker_AA 01/09/17 13:15:01 01/09/17 13:15:43 42 11077
in my drilldown panel search would be like , search based on the process related all the logs should display between START_TIME, END_TIME time frame i need to pass Process, START_TIME, END_TIME are the variables for the drilldown panel
... View more
01-09-2017
01:34 PM
Thanks @ DalJeanis Its working.
... View more
01-09-2017
12:33 PM
Sorry to say its not displaying the source1 values in this case, its displaying only source2 values
... View more
- « Previous
-
- 1
- 2
- Next »
