Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About the_wolverine
the_wolverine
Champion
Member since:
01-14-2010
11-24-2025
Community Statistics
| Posts | 994 |
| Solutions | 187 |
| Karma Given | 1004 |
| Karma Received | 956 |
| Member Since | 01-14-2010 |
Activity Feed
- Got Karma for Re: BUG: tstats not displaying latest time modifier correctly. 04-19-2025 10:52 AM
- Got Karma for Re: How do I reload authentication from CLI?. 01-17-2025 12:00 PM
- Got Karma for Re: Question about "run as" (Owner or User ) for saved searches. Missing in version 7.. 05-16-2024 05:58 AM
- Got Karma for Re: Someone else configured field extractions, but I would like to delete some of them. Where do I find them?. 01-18-2024 12:12 PM
- Got Karma for Re: What are the minimum capabilities needed to modify and push config change from Deployment Server?. 07-02-2023 01:36 AM
- Got Karma for Re: Is there a way to accurately measure data model acceleration disk usage via Splunk?. 03-07-2023 11:51 PM
- Got Karma for Re: Question about "run as" (Owner or User ) for saved searches. Missing in version 7.. 01-20-2023 07:43 AM
- Karma Re: Why would Splunk NOT obey "dispatch.ttl" and delete results/artifacts early? for matthewhasty. 12-20-2022 01:19 PM
- Got Karma for Re: Autostart Splunk on boot. 12-09-2022 05:46 AM
- Got Karma for Re: Perform two lookups with same table and two different lookup fields?. 11-21-2022 04:47 AM
- Got Karma for Re: How to determine daily license usage in GB?. 11-08-2022 02:37 PM
- Karma Re: Can i assign a color to a string in a field if it is present in the field ? for varun99. 11-03-2022 09:57 AM
- Got Karma for Re: Getting error "Streamed search execute failed because: JournalSliceDirectory: Cannot seek to 0" when running a search. 10-01-2022 04:25 AM
- Got Karma for Re: Multiple SEDCMDs. 06-29-2022 11:41 AM
- Got Karma for Re: How to efficiently calculate max events per second (eps) by hour over long timeranges, like 30 days?. 05-31-2022 02:54 PM
- Got Karma for Splunk alert reply-to field doesn't exist?. 04-28-2022 02:13 PM
- Got Karma for BEWARE: srchFilter usage may negate each other in certain situation.. 04-28-2022 02:11 PM
- Got Karma for What is the correct earliest_time format for searches when programmatically querying Splunk?. 04-28-2022 02:07 PM
- Got Karma for Re: What is the correct earliest_time format for searches when programmatically querying Splunk?. 04-28-2022 02:07 PM
- Got Karma for Re: Is there any way to get Splunk to replicate Search History in a Search Head Cluster?. 04-28-2022 02:06 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-15-2011
02:44 PM
I thought there was a way (command) that would users with the right permissions to read a file on the Splunk filesystem without indexing that file. Would someone point me to the documentation (if it exists)?
... View more
- Tags:
- search-help
07-14-2011
10:07 AM
Can someone clarify what is meant by a "period"? Context is this:
"* If the integer is followed by the letter 'p' the ttl is interpreted as a multiple of the scheduled search's period."
I would interpret this as, if my scheduled search runs once per hour and I specify a period of 10p, that would mean my search artifact would survive for 10 hours.
... View more
07-14-2011
09:59 AM
I've had issues with getting this to work. Despite setting "dispatch.ttl = 604800" for specific alerts, I still have search artifacts that report "expired" after a couple of days. I'll file a ticket.
... View more
06-29-2011
09:16 PM
2 Karma
We have a workaround in place to address the replication bug in our current version of Splunk (4.1x). Our /opt/splunk/etc/ directory is shared to the indexers via nfs export and replication is disabled.
Unfortunately, when a change is made to props.conf, Splunk changes the permissions of the directory and files (/opt/splunk/etc/apps/search/local/props.conf) to 700.
I have manually changed permissions to 744 only to have them changed back when I (or another user) make a change, such as add field extractions, from UI. This breaks all custom field extractions.
How can I force Splunk not to change the permissions on these directories and files?
... View more
06-24-2011
08:33 AM
Thank you, Dave. I asked because it is not clear whether this setting can be used on a per-search basis. I'll test it and report back for future reference.
... View more
06-23-2011
02:30 PM
1 Karma
Splunk, I might have missed this but it would be useful for you to provide some Windows syntax examples either in spec file or online documentation. Thx.
... View more
06-23-2011
02:29 PM
Ok, working now. In my testing I've found that both ways will work: [monitor://C:\stuff] and [monitor://C:\\stuff] work. Confirmed by trying both and seeing the source appear in metadata.
... View more
06-23-2011
02:23 PM
Thanks, Maverick. Unfortunately, it seems like a very expensive search having to search across all our data because its for anomaly detection; we'd want to be alerted close to real-time so we'd have to run this frequently.
... View more
06-23-2011
02:20 PM
I have scheduled alerts whose artifacts expire before I can get to them. Can I specify a custom ttl per alert in version 4.1.x?
... View more
06-14-2011
06:00 AM
We've been dealing with these bundle replication errors (and resulting slow search kicking off) very frequently until recently when a workaround was configured for us. The workaround involves NFS export of the bundles to the searchpeers and a few other configuration changes. Splunk support should be able to assist if you have tried the other suggestions and are still encountering this issue.
... View more
06-09-2011
10:04 PM
[monitor://C:\\program files\path\filename]
doesn't seem to be working.
... View more
06-09-2011
01:46 PM
the posted link is broken.
... View more
06-08-2011
12:40 PM
2 Karma
I'm sure this is really simple but I've been unable to figure out the syntax to combine these 2 regexes in my transforms.conf. Thus, I've split them into two separate stanzas:
[first]
REGEX=(?m)(ComputerName=HerComputer)
DEST_KEY=_MetaData:Index
FORMAT=new
[second]
REGEX=(?m)(ComputerName=HisLaptop)
DEST_KEY=_MetaData:Index
FORMAT=new
... View more
05-18-2011
01:06 PM
From the CLI:
./splunk _internal call /data/indexes/<index_name>/roll-hot-buckets –auth <admin_username>
(you will be prompted for the password)
... View more
05-18-2011
01:06 PM
1 Karma
What is the syntax, please?
... View more
05-12-2011
01:38 PM
2 Karma
Is setting auto_high_volume the same as setting bucket size to 10GB? Or, does auto_high_volume give a variable bucket size? I'm trying to size my indexes and need to know this.
Are there any pros/cons of using one vs. the other?
... View more
05-11-2011
01:53 PM
Hi, I recently started writing a few of my summary indexing searches to non-summary indexes. Will this count against our license? Just want to verify whether we need to switch back to summary index.
... View more
04-26-2011
03:22 PM
Thank you for your response, hazedev. I understand why it does not work. I'm wondering if a solution was provided recently. I recall there was a possible workaround for this.
... View more
04-26-2011
03:06 PM
Thank you Brian! Is there an easy solution to provide the user a way to submit?
I added a SubmitButton to your example, but I'm getting an intentions error using my method:
<module name="HiddenSearch" autoRun="True">
<param name="search">| inputlookup domains.csv | append [stats count | eval domain="$domain_addition$" | fields - _time | fields domain] | dedup domain | outputlookup domains.csv</param>
<module name="SubmitButton">
<param name="label">click to submit</param>
<module name="ViewRedirector" layoutPanel="viewHeader">
<param name="viewTarget">flashtimeline</param>
ERROR:
PARSER: Applying intentions failed 'unicode' object has no attribute 'get'
... View more
04-25-2011
02:34 PM
2 Karma
I want to add a form field to a dashboard that would allow a user to input some text. Somehow this text, perhaps using outputlookup, would append to a lookup table. The only issue I see is that this text doesn't yet exist in our data until the user enters it in the form. A bit backwards, yes.
The usecase is for updating a list of domains. We'd like to add a domain to a blacklist or a whitelist for searching.
... View more
04-25-2011
01:48 PM
1 Karma
If I recall correctly, there wasn't a way to set/offset the TZ for a syslog host. Has this changed?
... View more
04-07-2011
11:27 PM
Could someone look into this and let me know whether this is a bug? However, based on Vishal's response, it appears that the behavior I'm seeing is unintended (= Bug).
... View more
04-07-2011
08:30 PM
2 Karma
Does it support LEEF, Log Event Enhanced Format?
... View more
04-07-2011
07:57 PM
I have verified that the update to indexes.conf is being loaded correctly per the command you provided, Vishal.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-24-2025
08:16 AM
|
Karma given to
