Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About the_wolverine
the_wolverine
Champion
Member since:
01-14-2010
11-24-2025
Community Statistics
| Posts | 994 |
| Solutions | 187 |
| Karma Given | 1004 |
| Karma Received | 956 |
| Member Since | 01-14-2010 |
Activity Feed
- Got Karma for Re: BUG: tstats not displaying latest time modifier correctly. 04-19-2025 10:52 AM
- Got Karma for Re: How do I reload authentication from CLI?. 01-17-2025 12:00 PM
- Got Karma for Re: Question about "run as" (Owner or User ) for saved searches. Missing in version 7.. 05-16-2024 05:58 AM
- Got Karma for Re: Someone else configured field extractions, but I would like to delete some of them. Where do I find them?. 01-18-2024 12:12 PM
- Got Karma for Re: What are the minimum capabilities needed to modify and push config change from Deployment Server?. 07-02-2023 01:36 AM
- Got Karma for Re: Is there a way to accurately measure data model acceleration disk usage via Splunk?. 03-07-2023 11:51 PM
- Got Karma for Re: Question about "run as" (Owner or User ) for saved searches. Missing in version 7.. 01-20-2023 07:43 AM
- Karma Re: Why would Splunk NOT obey "dispatch.ttl" and delete results/artifacts early? for matthewhasty. 12-20-2022 01:19 PM
- Got Karma for Re: Autostart Splunk on boot. 12-09-2022 05:46 AM
- Got Karma for Re: Perform two lookups with same table and two different lookup fields?. 11-21-2022 04:47 AM
- Got Karma for Re: How to determine daily license usage in GB?. 11-08-2022 02:37 PM
- Karma Re: Can i assign a color to a string in a field if it is present in the field ? for varun99. 11-03-2022 09:57 AM
- Got Karma for Re: Getting error "Streamed search execute failed because: JournalSliceDirectory: Cannot seek to 0" when running a search. 10-01-2022 04:25 AM
- Got Karma for Re: Multiple SEDCMDs. 06-29-2022 11:41 AM
- Got Karma for Re: How to efficiently calculate max events per second (eps) by hour over long timeranges, like 30 days?. 05-31-2022 02:54 PM
- Got Karma for Splunk alert reply-to field doesn't exist?. 04-28-2022 02:13 PM
- Got Karma for BEWARE: srchFilter usage may negate each other in certain situation.. 04-28-2022 02:11 PM
- Got Karma for What is the correct earliest_time format for searches when programmatically querying Splunk?. 04-28-2022 02:07 PM
- Got Karma for Re: What is the correct earliest_time format for searches when programmatically querying Splunk?. 04-28-2022 02:07 PM
- Got Karma for Re: Is there any way to get Splunk to replicate Search History in a Search Head Cluster?. 04-28-2022 02:06 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-07-2011
05:46 PM
Pardon my nomenclature! I've updated my post to reflect this. What do I do once I confirm that this is a conf loading issue? Note that the INFO message went away after I changed my maxHotBuckets count to 10.
... View more
04-07-2011
04:41 PM
2 Karma
We have an index that receives a lot of events resulting in buckets with 2 hour spans. I initially figured I would give this index 20 hot buckets by setting maxHotBuckets = 20 in indexes.conf.
After seeing the following message in splunkd.log, I think this actually caused issues on my indexer:
04-06-2011 21:13:13.505 INFO HotDBManager - flushing db: $SPLUNK_DB/defaultdb/db/hot_v1_XXXX (max=10, count=11 )
When I set the value back to 10 hot buckets, the INFO message went away. Is this intentional to not allow > 10 hot buckets? And what is the reasoning?
... View more
04-04-2011
07:00 PM
2 Karma
I have a bunch of events that, for some reason, are coming up with NULL values for date_* fields. Why would this happen? The events all contain the correct date/time -- just missing the date_* fields that I wanted to use for reporting.
... View more
03-30-2011
07:47 PM
Currently when I click on links in my dashboard, Splunk launch the link in the existing browser window and I lose my dashboard view. What syntax is needed to get Splunk to launch a new window when I click on a link in my dashboard?
... View more
03-26-2011
08:38 PM
http://answers.splunk.com/questions/3239/try-to-route-certain-wmi-events-to-nullqueue
... View more
03-24-2011
05:14 PM
Currently I don't see a lot of documentation on how to manually configure this. I was able to figure out by running ./splunk list apps which apps are enabled. Then I deduced that I could enable the universal forwarder by running ./splunk enable apps UniversalForwarder.
... View more
03-24-2011
05:00 PM
1 Karma
I just got off the phone with Support and was told that I needed to use Universal Forwarder (mode) in order to forward data from 4.2 forwarders to 4.1 legacy indexers. It sounds like the Universal Forwarder is the "new" even lighter than LightWeight forwarder?
If a full version of Splunk was installed, what are the steps to reconfigure it as a Universal Forwarder?
... View more
03-23-2011
12:46 AM
props.conf
[dns]
SEDCMD-dns = s/\(\d\)/\./g s/\(\d\d\)/\./g
* Splunk didn't seem to like \d? so I used \d\d for the cases where we have 2 digits: (12)
... View more
03-22-2011
10:46 PM
Thank you! It seems you don't need the escape for '.' for some reason -- Ultimately, I will use sedcmd to do this.
... View more
03-22-2011
10:19 PM
Thank you Gerald - even though you make me click on 2 links for the answer.
... View more
03-22-2011
10:17 PM
I have DNS log lines that look like the following:
(4)mail(6)google(3)com(0)
(7)twitter(3)com(0)
(12)spreadsheets(1)l(6)google(3)com(0)
How would I configure rewriting so that Splunk will display them in a more appealing format?
mail.google.com
twitter.com
spreadsheets.l.google.com
... View more
- Tags:
- configuration
03-10-2011
12:49 AM
I've verified that setting action.email.format PER SEARCH works in 4.1.5. Still wondering why this useful feature is not documented.
... View more
03-09-2011
07:41 PM
Is this a legitimate action in version 4.1.5? I ask because I don't see this action in the spec file.
... View more
03-09-2011
06:12 PM
You should try contacting sales to see if they can offer you a larger license for your evaluation. The licenses have a time out so if you are legitimately evaluating, I don't see why they wouldn't offer you the bigger license.
... View more
03-03-2011
12:48 AM
If I have an internal IP address in my data, is there some way I can run a lookup to determine the hostname via Splunk?
... View more
- Tags:
- lookups
- search-help
02-18-2011
08:53 PM
1 Karma
I have a ton of useragent type fields, like MacOutlook/some_version_x_os_version_etc and Entourage/other_version_x_os_version_etc. How can I group these for reporting so they all show up as MacOutlook and Entourage?
... View more
02-11-2011
12:20 AM
Ziegfried, just wanted to post that I tried out your app and have to say, AWESOME! Thanks for sharing.
... View more
02-10-2011
11:54 PM
Comments doesn't allow me to format so here's my comment as a response:
How do I configure props so that it can be referenced in transforms? The following doesn't appear to work at all:
props.conf:
[ldif]
EXTRACT-memberOf = multivalue_ldif
transforms:
[multivalue_ldif]
REGEX = (?i)memberOf: CN=(?P<memberOf>[^\,]+)
MV_ADD = true
... View more
02-10-2011
07:31 PM
I'm not sure how to workaround an issue where my field extraction is working on multiple values of the same field. For example, I have the following event that contains lines from ldap:
(this is in one event)
memberOf: CN=tina
memberOf: CN=toby
memberOf: CN=ben
My field extraction looks like this:
(?i)memberOf: (?P<memberOf>[^\n]+)
Splunk only pulls out the first instance of memberOf (CN=tina) and ignores the others. Is there a simple solution for this?
... View more
- Tags:
- field-extraction
01-27-2011
05:27 PM
Thanks for your response, Gerard. Your search appears to run faster.
My search, otherwise, works fine for me giving me the data in the format I want and on a sliding window basis. I use this to alert on potential brute force attack on a system and can't limit it to a fixed time window. Is there some way to bypass any timeout I might be hitting in the UI?
... View more
01-26-2011
09:52 PM
I have noticed that when I use a transaction-based search in my dashboard panels, the performance is not so great and my panels do not always load (perhaps the search times out)? Other than summarizing these searches, is there anything I can do to improve the performance of my transactional searches?
For example:
index="main" sshd "failed password" root OR "invalid user" NOT "user monitoring" | transaction host maxspan=10m | where linecount>9 | stats count host (over past 24 hours)
Perhaps there is a way to lengthen the timeout (if that's the problem that I'm encountering.)
... View more
01-12-2011
07:48 PM
That was easy! Just literally copied .splLastRefreshed { display:none; } to my application.css file for my app and it worked.
... View more
12-29-2010
07:39 PM
GERALD,
Can you post a sample sendemail.py script that has been modified to do SMTP AUTH?
Thank you.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-24-2025
08:16 AM
|
Karma given to
