Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About masonmorales
masonmorales
Influencer
Member since:
10-11-2013
03-28-2026
Community Statistics
| Posts | 556 |
| Solutions | 161 |
| Karma Given | 307 |
| Karma Received | 288 |
| Member Since | 10-11-2013 |
Activity Feed
- Got Karma for Re: Can I delete all data from a KV store at once?. 10-16-2024 08:54 PM
- Got Karma for Re: What is the TZ for America Central?. 04-23-2024 01:51 PM
- Got Karma for How can I get a list of all saved searches from all apps using the REST command?. 08-16-2023 01:28 AM
- Got Karma for Re: Help understanding the commands - Search vs Where after first pipe. 01-10-2023 08:48 AM
- Got Karma for Re: How do I permanently disable the deployment server?. 07-27-2022 12:25 AM
- Got Karma for Re: How can I tell if a heavy forwarder or universal forwarder was installed on a box?. 04-25-2022 01:40 PM
- Got Karma for Re: How to generate storage and license usage reporting in a distributed Splunk deployment?. 12-08-2021 08:29 PM
- Got Karma for Re: How to generate storage and license usage reporting in a distributed Splunk deployment?. 08-20-2021 01:29 AM
- Got Karma for Re: Firewall Rules: How are connections made when using a Heavy Forwarder?. 06-22-2021 09:23 PM
- Got Karma for Re: I need to get the very oldest log event displayed on a dashboard , any tricks to speeding this up?. 06-04-2021 03:55 PM
- Got Karma for Re: Can I delete all data from a KV store at once?. 05-29-2021 06:46 AM
- Posted Re: bash script , automating splunkforwarder installation. on Splunk Enterprise. 03-08-2021 10:22 AM
- Posted Re: Searchheads can not pull apps from Deployer on ansible env, error 401 on Splunk Enterprise. 03-08-2021 10:14 AM
- Got Karma for Re: What are these Interesting Fields returned from the search "index=os sourcetype=iostats"?. 02-19-2021 01:26 PM
- Got Karma for Re: Deployment with Ansible. 02-08-2021 10:43 AM
- Posted Re: Deployment with Ansible on Deployment Architecture. 02-05-2021 04:15 PM
- Posted Re: Deployment with Ansible on Deployment Architecture. 02-05-2021 04:11 PM
- Got Karma for Re: How to add the date to a report. 01-27-2021 06:47 AM
- Got Karma for Re: How to set up a scheduled search every 5 minutes and trigger an alert if a stats average on response time is greater than 30 seconds?. 10-19-2020 12:33 AM
- Karma Re: Splunk generic warning dialog box for thambisetty. 09-10-2020 12:34 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 4 | |||
| 5 | |||
| 0 | |||
| 8 | |||
| 1 | |||
| 1 | |||
| 0 |
02-26-2020
04:34 PM
FWIW, I tested LZ4 vs GZIP on indexers that had 10 GB/s disk read and >1M IOPS. Search performance was identical between the two. I was also told by another Splunker that LZ4 was implemented as part of a hackathon and should not be used in a production environment.
... View more
01-15-2020
09:44 AM
Does splunk restartss work for you from CLI?
... View more
01-15-2020
09:40 AM
1 Karma
Patch one server at a time. Starts with the members then do the captain last.
... View more
12-02-2019
04:23 PM
@ChrisG Bump. Looks like they're gone now and the links are broken. Any idea where we can still download Conf 2014 content from?
... View more
09-12-2019
10:19 PM
No, it just adds a new field to all events that get indexed that identifies the sending forwarder.
... View more
09-12-2019
09:59 PM
OK so just add it to the default stanza.
... View more
09-10-2019
10:56 AM
Try this:
| rex field=host (?<cde_model>vlt0*([1-9]|1[0-6])-she1)
| search cde_model=*
See also:
https://answers.splunk.com/answers/322170/how-to-use-regex-on-a-fields-value-in-a-search.html
https://answers.splunk.com/answers/327465/how-can-i-use-regex-with-wildcard-patterns-in-a-se.html
... View more
09-09-2019
03:21 PM
Assuming that you have removed frozenTimePeriodInSecs at the index-level config of all indexes in your indexes.conf file(s) (use splunk cmd btool indexes list --debug to check), you can do:
indexes.conf
[default]
frozenTimePeriodInSecs = 31536000
... View more
09-04-2019
01:49 PM
Response time would have to be measured from the client side. The metrics that Splunk has available for HEC performance can be found at: https://docs.splunk.com/Documentation/Splunk/latest/Data/TroubleshootHTTPEventCollector
... View more
09-04-2019
01:41 PM
@vinaykataaig The first screenshot is so small it's not really readable. Can you post a larger version? Also, some sample events from each index/sourcetype would be helpful.
... View more
09-04-2019
01:35 PM
If you want to blacklist multiple final_actions, you could do:
index=proofpoint sourcetype=mail "@somedomain.com" "connection.helo"=".somename.com"|stats latest(final_action) as final_action by msg.header.subject{} msg.header.to{} msg.header.from{} | search NOT final_action IN (continue, discard, reject)
... View more
09-04-2019
01:31 PM
This is the best way.
... View more
09-04-2019
01:29 PM
Splunk does not have a native feature for performing automatic/distributed upgrades of the software. We use Ansible internally to upgrade Splunk, but some customers use Chef, Salt, or Puppet to do it. For Windows, some customers use SCCM.
... View more
08-29-2019
12:28 PM
1 Karma
index=myindex src_ip NOT [inputlookup all_ip.csv]
Assuming the field is named src_ip in the CSV as well. If it's not, you can rename the field by using a | rename after the inputlookup
... View more
08-28-2019
12:52 PM
Go to Settings -> Event types -> then search for it across all apps to see what search criteria matches the event type.
... View more
08-26-2019
02:58 PM
2 Karma
Try this:
| stats values(user) as user, values(result) as result by traceid
| stats count(result="200") as "success", count(result!="200") as "failure" by user
... View more
08-26-2019
02:49 PM
Here's an example: https://github.com/masonsmorales/python-checkpointer/blob/master/checkpoint.py
Instead of a timestamp, you'll need to parse out the UUID from the response and store it to disk, then reference it on the next run (similar logic).
... View more
08-26-2019
02:43 PM
Would this work?
| transaction source mvlist=status startswith="(Logon:)" endswith="status=*"
| where isnotnull(status)
... View more
07-14-2019
11:41 AM
Can you post some sample data? This is difficult to answer without knowing which fields are in what events. Also, how do you want to use the combined field?
... View more
07-14-2019
11:39 AM
Quoting another answer:
.conf files have a special support for consuming environment variables that depends on the variable expansion ability of the code that reads them. That is, some .conf files will honor an environment variable (such as deploymentclient.conf) while others won't (such as inputs.conf).
... View more
07-14-2019
11:36 AM
Did you restart Splunk after configuring the environment variables in splunk-launch.conf?
... View more
10-12-2018
08:32 PM
1 Karma
Large lookups like this should ideally be converted to a KV store. That way, MongoDB can do the replication independently of the search bundle.
... View more
07-26-2018
02:56 PM
1 Karma
Here are a few good resources:
https://conf.splunk.com/files/2016/slides/architecting-splunk-for-epic-performance-at-blizzard-entertainment.pdf
https://conf.splunk.com/files/2017/slides/splunk-enterprise-security-health-check.pdf
https://www.rfaircloth.com/2017/12/12/tuning-splunk-when-max-concurrent-searches-are-reached/
... View more
06-25-2018
02:34 PM
Same issue here on v6.6.5. Did you ever find anything out?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-28-2026
04:25 PM
|
Karma given to
