Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About ShaneNewman
ShaneNewman
Motivator
Member since:
07-25-2012
06-05-2020
Community Statistics
| Posts | 310 |
| Solutions | 35 |
| Karma Given | 339 |
| Karma Received | 86 |
| Member Since | 07-25-2012 |
Activity Feed
- Got Karma for Re: 10-26-2013 16:39:13.343 +0100 WARN TcpOutputFd - Connect to 192.168.x.x:9997 failed. No connection could be made because the target machine actively refused it.. 04-24-2024 12:23 PM
- Got Karma for Re: How do I add a dynamic _meta field pushed from deployment server to monitored files on Heavy Fowarders?. 04-01-2021 10:58 AM
- Got Karma for S3 bucket with CSV files not extracting fields at index time. 06-05-2020 12:50 AM
- Karma Re: How do I add a dynamic _meta field pushed from deployment server to monitored files on Heavy Fowarders? for acharlieh. 06-05-2020 12:49 AM
- Karma Re: Help with hot buckets rolling prematurely for sowings. 06-05-2020 12:49 AM
- Karma Re: Capabilities needed for a service account to enable Maintenance Mode and issue offline command for leonphelps_s. 06-05-2020 12:49 AM
- Karma RHEL/CentOS 7 & systemD not honoring ulimits for jethompson_splu. 06-05-2020 12:49 AM
- Got Karma for How do I add a dynamic _meta field pushed from deployment server to monitored files on Heavy Fowarders?. 06-05-2020 12:49 AM
- Got Karma for Re: Index cluster with multiple partitions. 06-05-2020 12:49 AM
- Karma Splunk Add-On for Google Cloud Platform: Splunk Add-on REST Handler ERROR[1021]: Fail to decrypt the encrypted credential information - Failed to get credentials for efferth. 06-05-2020 12:48 AM
- Karma How does DMC determine the status of its search peers? for lycollicott. 06-05-2020 12:48 AM
- Karma Re: Splunk not matching files with wildcard in monitor path in inputs.conf for ddrillic. 06-05-2020 12:48 AM
- Karma Mac OS X Sierra - How to get all logs from the Unified Log database? for managed_securit. 06-05-2020 12:48 AM
- Karma Re: Mac OS X Sierra - How to get all logs from the Unified Log database? for yannK. 06-05-2020 12:48 AM
- Karma Re: Color map not working on New Relic Splunk App for gpareesi11. 06-05-2020 12:48 AM
- Got Karma for Re: How to add a new Active Directory group to an existing LDAP strategy?. 06-05-2020 12:48 AM
- Karma Re: DB Connect: Why am I getting "Error connecting to /servicesNS/admin/dbx/dbx/dbmon: The read operation timed out" setting up Oracle DB input? for pmdba. 06-05-2020 12:47 AM
- Karma Re: How to configure inputs.conf and outputs.conf on the Heavy Forwarder to route data received from universal forwarders to the indexers? for rmorlen. 06-05-2020 12:47 AM
- Karma Re: Setting up Deployment Server to manage multiple instances on a single server for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Setting up Deployment Server to manage multiple instances on a single server for jrodman. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
10-28-2013
05:49 PM
1 Karma
props.conf
[sourcetype_name_here]
TIME_PREFIX = \s
TIME_FORMAT = %m/%d/%Y %H:%M
SHOULD_LINEMERGE = false
TRANSFORMS-0_null_queue = nullq_header, nullq_dash
REPORT-0_field_kv = field_kv
transforms.conf
[nullq_header]
REGEX = statusdesclong
DEST_KEY = queue
FORMAT = nullQueue
[nullq_dash]
REGEX = ^\-\-\-\-
DEST_KEY = queue
FORMAT = nullQueue
[field_kv]
DELIMS = "\t"
FIELDS = statusdesclong, time, probeid, responsetime, status, statusdesc
... View more
10-28-2013
04:57 PM
Did this help or is that not the problem?
... View more
10-27-2013
09:45 AM
go to the search bar and pipe your main search to | extract getcsvfields
Does that extract the fields correctly?
... View more
10-27-2013
08:10 AM
PROPS.CONF
[ComputeUtilization2]
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TIME_FORMAT = %M-%D-%Y %H:%M:%S
TIME_PREFIX = ^([\w\-\.]+\s+){21}
pulldown_type = 1
REPORT = getcsvfields
TRANSFORMS.CONF
[getcsvfields]
DELIMS = "\t"
FIELDS = tenant, MGId, HostGroup, TotalVMsPerHG, TotalpCoreForHG, UsedpCoreForHG, FreepCoreForHG, CoreAvailabilityPercentForHG, AvgTotalCoresPerHost, vCoresPerVMForHG, vCoreTopCoreRatio, FreevCoresForHG, TotalpMemInGBForHG, UsedpMemInGBForHG, FreepMemInGBForHG, MemAvailabilityPercentForHG, AvgTotalMemoryPerHost, vMemPerVMForHG, vMemTopMemRatio, FreevMemForHG, BucketStartTime, BucketEndTime
... View more
10-26-2013
10:39 AM
4 Karma
Log into your indexer. If you are using 6.0 then click settings in the upper right hand corner, then forwarding and receiving. Under receive data click on configure receiving. Then add new, type 9997 - save.
... View more
10-25-2013
04:30 PM
I am running Mavericks right now, have been since it came out. The only thing I noticed is that the name of my os changed and some of the searches I had needed to be updated to accommodate that, everything else is working fine.
... View more
10-25-2013
04:20 PM
Not a problem!
... View more
10-25-2013
04:18 PM
I would create a ticket with Splunk on this one, be sure to include a diag. To get a diag - use command line to get out to the $SPLUNK_HOME\bin directory, then type "spunk diag". The diag should be exported in the var directory.
In the meantime, install the export to excel app and see if that will allow you to export your data correctly. You will have to copy and paste the module from the app into the search app's view.
... View more
10-25-2013
04:13 PM
12 Karma
Pretty easy 🙂
At the very end:
| fields <list of fields you want to be displayed (no commas)>
... View more
10-25-2013
04:09 PM
Remember that searches run on the Indexers, the compiling of data and post processing of the data happens on the search heads.
... View more
10-24-2013
07:30 PM
What version of Splunk are you using?
... View more
10-24-2013
10:52 AM
command line out to the splunk bin directory. Stop splunk, run "splunk clean eventdata -index _thefishbucket"
That will tell splunk to start over from an indexing perspective, meaning it will see the file as new.
Let me know if that works.
... View more
10-24-2013
10:49 AM
Did you make sure to reference the file name in the application.css in the appserver\static directory?
.appLogo {
height: 42px;
width: 104px;
background: url(yourlogo.png) no-repeat 0 0;
}
... View more
10-23-2013
08:34 PM
1 Karma
That should be fine, we have 4.x forwarders sending to 6.0 indexers. I couldn't find any good documentation on compatibility between 3.x and 6.
... View more
10-23-2013
08:23 PM
Did that work for you?
... View more
10-23-2013
08:17 PM
You may want to add crcSalt = to your inputs.conf file for that particular input.
... View more
10-23-2013
08:13 PM
Actually, just a small modification to aholzer's comment: strptime(Date, "%d/%b/%Y")
... View more
10-23-2013
08:07 PM
I just put "| transaction name= " in my searches that require events to be grouped. Is there a source type you have that always requires the transaction command?
... View more
10-23-2013
08:00 PM
1 Karma
I had the same issue, go to the main URL and type/info after 8000. At the bottom there is a cache control to force your browser to update. Doing this should make the changes appear.
... View more
10-23-2013
07:23 AM
Well, I don't really see how that is going to be possible... The first one, highest priority, will have to encompass the time range of the downstream. If the one downstream is more broad than the upstream selection, you will still only get data for the range upstream.
... View more
10-22-2013
10:10 AM
In the props.conf, create an entry with the name of your sourcetype in brackets
[sourcetype]
EXTRACT-windows_firewall = Transform_Windows_FW
Once you do this, go to the main URL add "/info"
The second selection from the bottom is Reload EAI Objects, selecting that will reload all the configs without restarting the instance.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
