Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About ShaneNewman
ShaneNewman
Motivator
Member since:
07-25-2012
06-05-2020
Community Statistics
| Posts | 310 |
| Solutions | 35 |
| Karma Given | 339 |
| Karma Received | 86 |
| Member Since | 07-25-2012 |
Activity Feed
- Got Karma for Re: 10-26-2013 16:39:13.343 +0100 WARN TcpOutputFd - Connect to 192.168.x.x:9997 failed. No connection could be made because the target machine actively refused it.. 04-24-2024 12:23 PM
- Got Karma for Re: How do I add a dynamic _meta field pushed from deployment server to monitored files on Heavy Fowarders?. 04-01-2021 10:58 AM
- Got Karma for S3 bucket with CSV files not extracting fields at index time. 06-05-2020 12:50 AM
- Karma Re: How do I add a dynamic _meta field pushed from deployment server to monitored files on Heavy Fowarders? for acharlieh. 06-05-2020 12:49 AM
- Karma Re: Help with hot buckets rolling prematurely for sowings. 06-05-2020 12:49 AM
- Karma Re: Capabilities needed for a service account to enable Maintenance Mode and issue offline command for leonphelps_s. 06-05-2020 12:49 AM
- Karma RHEL/CentOS 7 & systemD not honoring ulimits for jethompson_splu. 06-05-2020 12:49 AM
- Got Karma for How do I add a dynamic _meta field pushed from deployment server to monitored files on Heavy Fowarders?. 06-05-2020 12:49 AM
- Got Karma for Re: Index cluster with multiple partitions. 06-05-2020 12:49 AM
- Karma Splunk Add-On for Google Cloud Platform: Splunk Add-on REST Handler ERROR[1021]: Fail to decrypt the encrypted credential information - Failed to get credentials for efferth. 06-05-2020 12:48 AM
- Karma How does DMC determine the status of its search peers? for lycollicott. 06-05-2020 12:48 AM
- Karma Re: Splunk not matching files with wildcard in monitor path in inputs.conf for ddrillic. 06-05-2020 12:48 AM
- Karma Mac OS X Sierra - How to get all logs from the Unified Log database? for managed_securit. 06-05-2020 12:48 AM
- Karma Re: Mac OS X Sierra - How to get all logs from the Unified Log database? for yannK. 06-05-2020 12:48 AM
- Karma Re: Color map not working on New Relic Splunk App for gpareesi11. 06-05-2020 12:48 AM
- Got Karma for Re: How to add a new Active Directory group to an existing LDAP strategy?. 06-05-2020 12:48 AM
- Karma Re: DB Connect: Why am I getting "Error connecting to /servicesNS/admin/dbx/dbx/dbmon: The read operation timed out" setting up Oracle DB input? for pmdba. 06-05-2020 12:47 AM
- Karma Re: How to configure inputs.conf and outputs.conf on the Heavy Forwarder to route data received from universal forwarders to the indexers? for rmorlen. 06-05-2020 12:47 AM
- Karma Re: Setting up Deployment Server to manage multiple instances on a single server for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Setting up Deployment Server to manage multiple instances on a single server for jrodman. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
11-05-2013
02:43 AM
3 Karma
If you have not given the user account access to search the firewall index by default, and the firewall index is not literally called out in the search string... you will not get any results back. You may also find that the dashboard relies on saved searches and summary indexes which may not have yet populated.
... View more
11-05-2013
02:24 AM
sourcetype="logins" | bucket span=1mon _time | timechart dc(Username)
... View more
11-04-2013
04:55 PM
1 Karma
We tried this with no luck in 5.x. What we do instead is pass that variable via outputcsv, then call that csv from within the script to pass it where it needs to go.
... View more
11-04-2013
04:52 PM
1 Karma
The answer given by somesoni2 will make it more efficient. The other option is to create a summary index, then search the summary index.
... View more
11-04-2013
04:50 PM
To me, the easiest way is to go to the xml file that creates your view and edit it directly. If you do this, it as simple as adding a new set of modules to create a table, like simpleresultstable.
... View more
10-29-2013
07:39 PM
2 Karma
Ok, I see the image now.
First, to remove the Splunk logo in application.css
.navbar .brand {
font-family: "Splunk Icons";
font-weight: normal;
color: #ffffff;
padding: 0 0px 0 20px;
height: 0px;
line-height: 0px;
font-size: 17px;
text-shadow: none;
border-right: 1px solid transparent;
margin: 0;
}
To get your text to show up in the navbar area, you will have to add the text to the HTML file in the correct div for the base dashboard.
... View more
10-29-2013
06:47 PM
User powershell for this...
Get-WmiObject win32_groupuser | Where-Object { $_.GroupComponent -match 'administrators' } | ForEach-Object {[wmi]$_.PartComponent }
... View more
10-29-2013
06:13 PM
You need to get the data from the dns lookup into Splunk, either as a lookup file (csv) or by having the data indexed with a timestamp. If you create a lookup or csv file, make sure that file is inside a lookups folder inside a Splunk app. The it is as simple as:
some_search | lookup lookupfilename.csv hostname OUTPUT <field-list>
... View more
10-29-2013
05:38 PM
I do not see a screen capture.
... View more
10-29-2013
04:10 PM
My apologies.
In $SPLUNK_HOME\etc\apps\your_app\appserver\static
You will create your "custom" application.css and application.js/html.
Then bump the version by going to http://splunk_url:8000/info and click "Static resource cache control"
application.css example:
.appLogo {
height: 42px;
width: 104px;
background: url(your_logo.png) no-repeat 0 0;
}
.AccountBar .popupAppLogoContainer {
height: 46px;
}
... View more
10-29-2013
03:27 PM
The module should look something like this:
<module name="HiddenSavedSearch" layoutPanel="panel_row5_col1">
<param name="savedSearch">_capsule_details_search</param>
<param name="useHistory">True</param>
You will just need your savedsearch to be scheduled on a regular basis to ensure it doesn't keep grabbing the old search data.
... View more
10-29-2013
03:21 PM
Advanced XML is depreciated in Splunk 6.0... We have not converted our deployment yet because of this. That being said, using Sideview Utils, you should be able to do this. Ping him, user sideview, and he should be able to point you in the right direction.
... View more
10-29-2013
03:16 PM
You can give someone else point by up voting their question or answer. Additionally, you can also award points to folks by "giving" them some of yours...
... View more
10-29-2013
03:14 PM
This will work on version 5...
... View more
10-29-2013
03:13 PM
1 Karma
inside the .xml file for the view:
<label>Your Label Name</label>
<module name="AccountBar" layoutPanel="appHeader">
<param name="popupTitle">Your title/param>
<param name="mode">popup</param>
</module>
<module layoutPanel="navigationHeader" name="AppBar"/>
<module name="SideviewUtils" layoutPanel="appHeader"/>
<module name="TitleBar" layoutPanel="viewHeader">
<param name="showActionsMenu">False</param>
</module>
... View more
10-29-2013
03:07 PM
We had the same problem with Splunk itself filling up the TCP buffer. To fix, this we had to go into the process local to the machine Splunk was on and increase the memory allocation. Sadly, it didn't help a whole lot because the process is 32-bit and we could only allocate 1.5GB...
... View more
10-29-2013
08:32 AM
Ah, TIME_PREFIX = \t
... View more
10-29-2013
07:44 AM
That is correct.
... View more
10-29-2013
07:09 AM
& l t ; < less than
& g t ; > greater than
& a m p ; & ampersand
& a po s ; ' apostrophe
& q u o t ; " quotation mark
... View more
10-29-2013
05:47 AM
The saved searches that power the dashboards should update on a regular basis. If you want to refresh them more often, go into the savedsearches.conf of that app and update the frequency of when the searches run to update the dashboards.
... View more
10-29-2013
05:37 AM
Did that help?
... View more
10-29-2013
05:31 AM
The way to reference the less than sign inside of XML is & l t ; without the spaces between.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
