Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About klim
klim
Path Finder
Member since:
10-29-2020
01-26-2024
Community Statistics
| Posts | 93 |
| Solutions | 1 |
| Karma Given | 5 |
| Karma Received | 3 |
| Member Since | 10-29-2020 |
Activity Feed
- Posted Re: migrate to auth0 for SAML friendly username instead of user_id on Security. 01-29-2024 12:31 PM
- Karma Re: migrate to auth0 for SAML friendly username instead of user_id for datadevops. 01-29-2024 12:31 PM
- Posted How to change the username when migrating to saml authentication on Security. 01-25-2024 04:52 PM
- Posted migrate to auth0 for SAML friendly username instead of user_id on Security. 01-24-2024 10:24 AM
- Karma Re: Using a lookup table to store regex patterns to be used in a search for dtburrows3. 01-02-2024 03:43 PM
- Posted Re: Using a lookup table to store regex patterns to be used in a search on Splunk Search. 01-02-2024 03:42 PM
- Posted Using a lookup table to store regex patterns to be used in a search on Splunk Search. 01-02-2024 02:37 PM
- Posted Reports are not indexed correctly on Getting Data In. 11-29-2023 04:24 PM
- Karma Re: Does using a kvstore lookup in a SH cluster decrease performance? for richgalloway. 10-27-2023 09:38 AM
- Posted Does using a kvstore lookup in a SH cluster decrease performance? on Knowledge Management. 10-27-2023 09:27 AM
- Posted Re: Using a token to dynamically set the window parameter in streamstats on Dashboards & Visualizations. 10-06-2023 11:33 AM
- Posted Using a token to dynamically set the window parameter in streamstats on Dashboards & Visualizations. 10-06-2023 11:12 AM
- Posted Re: How to optimize my dashboard panel on Splunk Search. 06-09-2023 03:02 PM
- Posted Am I only allowed to yield results in the generate function? on Splunk Dev. 06-09-2023 02:43 PM
- Posted How to optimize my dashboard panel on Splunk Search. 06-09-2023 11:29 AM
- Posted How to prevent users from sharing adhoc searches? on Security. 04-19-2023 10:02 AM
- Posted Why is bubble chart display is inconsistent when changing time period? on Dashboards & Visualizations. 04-13-2023 11:15 AM
- Posted API request to change permissions on dashboards and reports returns 404 and 409s on Dashboards & Visualizations. 04-12-2023 03:02 PM
- Posted Can you restrict what API calls a role can run? on Security. 04-07-2023 10:19 AM
- Posted Re: How to allow users to change roles without seeing all other roles? on Security. 04-07-2023 10:05 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-06-2023
01:06 PM
I would like to know if it is possible to be able to inject an event to a heavy forwarder via the hec and then have it be split into two events and sent to different indexes.
For example I have the original log line of:
ID=1 time=”2022-12-29 16:57:41 UTC” name=”person” address=”abc” message=”some note”.
I want the event to be split but the two new events can share similar fields.
So index1 would be:
ID=1 time=”2022-12-29 16:57:41 UTC” name=”person” address=”abc”
And index2 would be:
ID=1 time=”2022-12-29 16:57:41 UTC” message=”some note”
... View more
- Tags:
- index
- splunk-search
Labels
- Labels:
-
heavy forwarder
-
props.conf
-
transforms.conf
11-07-2022
04:02 PM
I have a search head cluster and I will have scheduled reports that send data to a summary index. I don't want other users searches to queue or not run this scheduled report. Is it possible to create a dedicated search head to run this scheduled report but the search head cluster still has access to the summary index?
... View more
Labels
- Labels:
-
other
11-03-2022
01:49 PM
Is it possible to give a user two options when drilling down on a panel? For example the dashboard has a table with one column A. If a user clicks that it updates the token in the dashboard. But now when a user clicks the value in column A a pop up occurs that gives the user the option of updating the current dashboard or going to another dashboard.
... View more
Labels
- Labels:
-
dashboard
-
drilldown
-
javascript
11-03-2022
11:49 AM
I figured it out. I was initially using set instead of eval. I need to use something like this: <drilldown>
<condition field="x">
<eval token="form.Token1">$click.value2$</eval>
</condition>
<condition field="y">
<eval token="form.Token2">$click.value2$</eval>
</condition>
<condition field="z">
<eval token="form.Token3">$click.value2$</eval>
</condition>
</drilldown>
... View more
11-03-2022
11:45 AM
@rwardwell were you able to figure this out?
... View more
11-03-2022
11:43 AM
I have a dashboard with tokens on it: Token1, Token2, and Token3.
I have a table that contains multiple columns: x, y, z.
When I click the value of column x, I want to update Token1 on the same page.
When I click the value of column y, I want to update Token2 and so on.
When I click a column I only want to update the corresponding token and not the rest of the tokens.
... View more
Labels
- Labels:
-
drilldown
10-21-2022
02:50 PM
Yes I know I can delete using the rest api. I want to know if it can be done from the splunk search line either using the rest command or with an app that enables you to send api requests.
... View more
10-20-2022
03:56 PM
I know you can delete KVStore via the command line : https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/usetherestapitomanagekv/
Is it possible to delete from the splunk search line? I tried using the following but it doesn't work.
| rest /servicesNS/nobody/search/storage/collections/data/my_collection
I also tried installing the Webtools TA app to get access to being able to send external api requests but it says I'm unauthorized:
| curl method=get user="" password="" uri=https://host:8089/servicesNS/nobody/search/storage/collections/data/my_collection
The Webtools TA app uses python requests and I'm able to get a 200 when I make the request from a python script.
... View more
Labels
- Labels:
-
kvstore
10-20-2022
02:00 PM
Is it possible to restrict a role to run a certain search or only be able to run saved searches? Ie a user can only run index=index | stats count by field? OR
| savedsearch search1
... View more
Labels
- Labels:
-
other
10-18-2022
01:27 PM
1 Karma
@jkat54 I ran into an error with a long data parameter: command="curl", field larger than field limit (10485760) I see this value in a bunch of internals.py under csv.field_size_limit and changed every possible one to a smaller value to see if the error message changes but it is still the same. Do you know which config controls this issue?
... View more
Labels
- Labels:
-
troubleshooting
10-18-2022
11:52 AM
I figured out a different method to get the data into one row using mvcombine.
... View more
10-18-2022
10:53 AM
@gcusello I want to use the events in the lookup table to be used in an api request. Using format allowed me to get all the events into one row and then I can format it however I want. I was trying to use foreach to loop through the values and concatenate them but I have not been able to figure that out as well.
... View more
10-18-2022
10:28 AM
I have a lookup table that I want to use in a search. So I load the lookup table and use format. However I noticed there is a limit to 50,000 events in the format's result. What config allows me to increase that or convert a column of values into a single string? | inputlookup test.csv
| table count
| format The lookup has 50,001 values in it but format only goes up to 50,000.
... View more
Labels
- Labels:
-
lookup
08-09-2022
05:11 PM
I have ack enabled for a HEC input. I can successfully send data into splunk with guid #1. With the same curl but a different guid #2 the data is not in splunk but the response is Success and the ack Id request also returns true.
I looked in splunkd.log and I see this:
08-09-2022 17:10:04.755 -0700 ERROR JsonLineBreaker [49865490 parsing] - JSON StreamId:0 had parsing error:Unexpected character while looking for value: 'c' - data_source="http:dev", data_host="host:8088", data_sourcetype="sourcetype_name"
... View more
Labels
- Labels:
-
HTTP Event Collector
06-28-2022
09:38 AM
Actually that example worked for me.
... View more
06-28-2022
09:36 AM
<form>
<label>test</label>
<fieldset submitButton="false">
<input type="text" token="field2">
<label>field2</label>
</input>
<input type="multiselect" token="field1">
<label>field1</label>
<valuePrefix>index=</valuePrefix>
<delimiter> OR </delimiter>
<fieldForLabel>index</fieldForLabel>
<fieldForValue>index</fieldForValue>
<search>
<query>index=* blah=$field2$ | stats count by index</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
</fieldset>
<row>
<panel>
<title>test panel</title>
<table>
<title></title>
<search>
<query>index=$field1$ | stats count by host</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</form> I have two user input fields. Field2 is populated by text and I want to use the input in that field in the user input field1's dynamic search option.
... View more
06-27-2022
03:21 PM
No that isn't what I'm trying doing. What you provided has a user input that creates a token which is then used in a search to populate a dashboard panel. What I want to do is use a token inside a dynamic input that is generated by a search. The token is generated by another user input field. <input type="multiselect" token="brand" searchWhenChanged="true">
<label>brand</label>
<fieldForLabel>field</fieldForLabel>
<fieldForValue>field</fieldForValue>
<search>
<query>index=* field2=$token$ | table field</query>
<earliest>-1d</earliest>
<latest>now</latest>
</search>
</input>
... View more
06-27-2022
02:12 PM
Sure. I tried a simple search like: index=* field=$token$ | table field2 That doesn't produce a result. When I click the search button in the input config, the search page that opens contains the same query as above and the token isn't replaced with a value. However if I put a value in the $token$ spot it returns a value for the input.
... View more
06-27-2022
01:44 PM
I am trying to create a dynamic input using the dynamic search option. Can this search use a token in it? So far I've tried and haven't had any success.
... View more
Labels
- Labels:
-
token
05-31-2022
05:06 PM
Is it possible to only allow REST API access with token authentication and not username:password?
Is there a config to allow certain roles to be able to access the REST API?
... View more
Labels
- Labels:
-
other
03-28-2022
09:19 AM
I actually want to use it in the search pipeline for a lookup like your example a whois call. The go.path is in the bin directory of my app.
... View more
03-25-2022
02:28 PM
Are the non custom search commands able to get the results from splunk, manipulate them and create new fields and then send them back to splunk or can I only do logging or send an alert that the search is done? I was trying to create a script with golang but it keeps saying my command can't find the go.path file which I was copying from the java example that you linked.
... View more
03-25-2022
12:37 PM
That is running everything from the custom script. I need to be able to call the script from the search in splunk instead. Edit: But I could just wrap the other script inside a python/bash file.
... View more
03-25-2022
12:09 PM
Is it possible to create a custom script that is a search command that can take in the search's results, do something, and then return the new results to splunk in a different language than python?
... View more
Labels
- Labels:
-
other
03-17-2022
02:22 PM
I'm using the Webtools Add-on to do a get request for each row on a keyword field but combine the curl results with the initial data. Ie the initial data returns _time, keyword, hostname, etc and the curl request returns curl_message, curl_status,etc and I want my final table to be _time,keyword,hostname,curl_message,curl_status .
Right now I'm able to get the curl response using the map search="uri=.../$keyword$ " but that only returns the curl output.
I do see that you can use datafield without a map command to do multiple curl requests (|curl uri=... datafield=keyword) and it would have the my desired output but that made the uri look like this uri=.../?keyword. I need the uri to look like uri=.../keyword instead.
Any help/tips would be appreciated.
... View more
Labels
- Labels:
-
search
-
troubleshooting
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-26-2024
01:23 AM
|
