About matt

matt · ‎01-19-2011

I have a search which runs an eval statement. The problem is every couple of times a day the numbers its pulling (they are incremental numbers) are reset. This of course means the last number received is higher then the first number received in the search and results in a negative value. I want to throw this number out entirely. How do I go about this? Example Problem: eval FOO = firstFOO-lastFOO Where firstFOO=10 and lastFOO is 1024 Foo will now equal -1014 which completely messes up the graphs. Usually this is an incrementing number, but this counter gets reset when the application does.

matt · ‎01-12-2011

Is splunk FIPS 140-2 compliant?

matt · ‎10-15-2010

Only data that is populated through a summary search command is exempt from the daily licensing volume.

matt · ‎10-07-2010

I've got a distributed search setup (standalone search head and an indexer) that has been working like a champ for awhile . Recently I started to see this message when I run a search: Failed to create result provider for remote peer 'splunk.example.com' at uri 'https://splunk.example.com:8089' with the stream... To my knowledge nothing has changed in my enviornment. What does this message mean and how can I prevent it?

matt · ‎09-29-2010

The message appears to be benign and should not be impacting your use of LDAP. I have confirmed that all of my users are still able to authenticate and I can modify role assignements without issue. This issue will be resolved in a future maintenance release

matt · ‎09-21-2010

What is the expected outcome of the "Yesterday" time function when applied to data from multiple timezones. I have a report that brings data back from Berlin, Sydney and Cleveland. I would like to run the report once per day for "Yesterday's" data, but each region will have a slightly different definition of "Yesterday" based on the local timezone.

matt · ‎09-15-2010

The copyright notice for all third-party packages can be found in $SPLUNK_HOME/share/splunk/3rdparty These copyright notices contain the version strings for each 3rd party package Splunk ships.

matt · ‎08-16-2010

Is there a way to specify an alternate location for a Splunk forwarder to do its Splunk crash dumps?

matt · ‎08-12-2010

What are the steps to setup a new CA and generate new certs for SSL forwarding with no auth:

matt · ‎08-11-2010

I have an SSL cert signed by a third-party CA. I point to it in the in the web.conf file (caCertPath=/certs/cert.pem), restart splunkweb and connect via https://server:8000. I can see my cert file is being read, but the connection is untrusted because I haven't installed the intermediate cert file anywhere. HOW/WHERE do I install the intermediate cert?

matt · ‎07-22-2010

Wondering if we can take advantage of this: http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_hardware_acceleration_04.html

matt · ‎07-21-2010

Can I set up a role to access the jobs, but not give them the ability to administer all objects on the system? It seems that the capability "admin_all_objects" is the only one that allows users to view any job they send to background which is a pretty broad capability

matt · ‎07-09-2010

I'd like to see a search that will show me who is logged in currently. Anyone know how to do this?

matt · ‎07-07-2010

The two functions (BINDIP and Real-time search) do not play well with each other. This is being tracked as SPL-32549 and we hope to have it addressed in an upcoming maintenance release

matt · ‎06-01-2010

What's the best way to create a search to identify which hosts have not sent a syslog message to Splunk in the last 2 days?

matt · ‎05-27-2010

Rayfoo sent you in the right direction, but instead of disabling the search you should remove the dashboard modules that are built on those searches from the view in question. When you load the view you are calling that search which is triggering the nag message

matt · ‎05-24-2010

Was wondering if there was a quick way to reload an app in splunk without having to restart the splunk server

matt · ‎05-07-2010

Splunk forwarders can encrypt their communication with the indexer using SSL, this can also be used to authenticate the forwarders which will prevent unauthorized forwarders from polluting your index. Documentation on how to configure encryption and authentication of forwarders using SSL can be found here

matt · ‎04-23-2010

The sendemail.py script seems to want to support the sending of pdfs, but I can't trick it into actually delivering one from the command line. I have tried: sourcetype=syslog startminutesago=5 | sendemail to="foo@example.com" sendpdf=1 sendresults=1 pdfview=1 and various other incantations of the same with no luck. The PDF server works fine with dashboards and saved searches. Inside of the email that sendemail.py sends is this statement: An error occurred while generating a PDF of this report: Can't attach PDF - either ssLink or sessionKey unavailable

matt · ‎04-16-2010

Note on the Note: This still applies to 4.0 since workflow actions did not exist until 4.1

matt · ‎04-08-2010

another question, there is nothing (iptables, ipchains, etc.) that is blocking access to the management port (8089) right?

matt · ‎04-08-2010

Is this is all being done on a single instance? Are other emails being sent successfully by Splunk? This is a simple single admin test, there is nothing special with apps and permissions right?

matt · ‎04-08-2010

If you are doing anything that is non-trivial you are going to need this file, since it is what the UI needs for showing labels and configs. Without it I believe it would just be a container of confs. Depending on what you define in your metadata/default.meta it is likely that the confs will not be accessible by other apps so you'll have a hard time taking advantage of anything you put in it.

matt · ‎04-07-2010

This is a bug and there is no way to workaround it. A programmatic fix will be delivered in a 4.1.x maintenance release. Look for SPL-30779 in the Change Log section of the Release Notes

matt · ‎04-05-2010

In 4.1 this value is hardcoded to 2GB and it cannot be changed. The 4.1.1 release will honor the same minFreeSpace value

Posts	119
Solutions	52
Karma Given	203
Karma Received	426
Member Since	‎01-15-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

How can I assign the day of the week to my events?

how can i see all of the searches that are looking...

Why is the Splunk Web service not running after an...

If I upgrade my forwarder will it reindex the file...

QualysGuard says splunk is vulnerable to cross-sit...

How do I get Splunk to serve other content

can a universal forwarder serve as a relay between...

Can I switch my install method on Linux?

What's the best way to upgrade my environment to 4...

How do I determine the appropriate timeout value f...

How do I remove negative numbers from an eval?

Does Splunk support FIPS 140-2

Re: How does Splunk determine data is being summar...

What does "Failed to create result provider for re...

Re: LDAP Authentication error: Splunk failed to fe...

What does "yesterday" mean when data is spanning m...

Re: How can I determine what version of a thrid pa...

Can I force Splunk to drp core in a specific locat...

What is the recipe for creating new SSL certs for ...

how do I define an intermediate certificate author...

Does Splunk support Flash 10.1 GPU

How can a simple user have job control within the ...

Is there a way to find the number of UI users logg...

Re: BIND IP Causing issues with RTSearch...

How do I alert when a host stops sending data?

Re: Can you stop the feature-disabled-in-free-vers...

Is there a simple way to reload an app?

Re: Secure transport of log files to our Splunk Se...

Can I email a pdf on demand?

Re: How to setup "show source" at the drop-down bo...

Re: Scheduled PDF Report Generation Error -- urlop...

Re: Scheduled PDF Report Generation Error -- urlop...

Re: What is the default behavior for an app that d...

Re: How do I get the update checker to work behind...

Re: What is the minimum free space value for a sea...

Join the Conversation