Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About the_wolverine
the_wolverine
Champion
Member since:
01-14-2010
11-24-2025
Community Statistics
| Posts | 994 |
| Solutions | 187 |
| Karma Given | 1004 |
| Karma Received | 956 |
| Member Since | 01-14-2010 |
Activity Feed
- Got Karma for Re: BUG: tstats not displaying latest time modifier correctly. 04-19-2025 10:52 AM
- Got Karma for Re: How do I reload authentication from CLI?. 01-17-2025 12:00 PM
- Got Karma for Re: Question about "run as" (Owner or User ) for saved searches. Missing in version 7.. 05-16-2024 05:58 AM
- Got Karma for Re: Someone else configured field extractions, but I would like to delete some of them. Where do I find them?. 01-18-2024 12:12 PM
- Got Karma for Re: What are the minimum capabilities needed to modify and push config change from Deployment Server?. 07-02-2023 01:36 AM
- Got Karma for Re: Is there a way to accurately measure data model acceleration disk usage via Splunk?. 03-07-2023 11:51 PM
- Got Karma for Re: Question about "run as" (Owner or User ) for saved searches. Missing in version 7.. 01-20-2023 07:43 AM
- Karma Re: Why would Splunk NOT obey "dispatch.ttl" and delete results/artifacts early? for matthewhasty. 12-20-2022 01:19 PM
- Got Karma for Re: Autostart Splunk on boot. 12-09-2022 05:46 AM
- Got Karma for Re: Perform two lookups with same table and two different lookup fields?. 11-21-2022 04:47 AM
- Got Karma for Re: How to determine daily license usage in GB?. 11-08-2022 02:37 PM
- Karma Re: Can i assign a color to a string in a field if it is present in the field ? for varun99. 11-03-2022 09:57 AM
- Got Karma for Re: Getting error "Streamed search execute failed because: JournalSliceDirectory: Cannot seek to 0" when running a search. 10-01-2022 04:25 AM
- Got Karma for Re: Multiple SEDCMDs. 06-29-2022 11:41 AM
- Got Karma for Re: How to efficiently calculate max events per second (eps) by hour over long timeranges, like 30 days?. 05-31-2022 02:54 PM
- Got Karma for Splunk alert reply-to field doesn't exist?. 04-28-2022 02:13 PM
- Got Karma for BEWARE: srchFilter usage may negate each other in certain situation.. 04-28-2022 02:11 PM
- Got Karma for What is the correct earliest_time format for searches when programmatically querying Splunk?. 04-28-2022 02:07 PM
- Got Karma for Re: What is the correct earliest_time format for searches when programmatically querying Splunk?. 04-28-2022 02:07 PM
- Got Karma for Re: Is there any way to get Splunk to replicate Search History in a Search Head Cluster?. 04-28-2022 02:06 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-21-2010
03:18 AM
I thought that this was working but its not for me in 4.1.5 (setting maxinputs). My resultset is still capped at 1000 results.
Further, I don't even see that "maxinputs" exists in the alert_actions.conf.spec file.
... View more
10-20-2010
08:48 PM
How does useClientSSLCompression setting affect this behavior? I set 'useSplunkdClientSSLCompression' to false and was still getting the error (although it seems, less often.)
I've just set 'useClientSSLCompression' to false as well.
... View more
10-18-2010
04:17 PM
Would it be possible to provide information on how to identify these large assets in apps? Also, it may be a conincidence, but might this be an new issue introduced in version 4.1.5? I don't believe we encountered this issue until we upgraded our search head to 4.1.5 recently. (Indexers are still on 4.1.2).
Thanks, Stephen.
... View more
10-12-2010
04:23 PM
1 Karma
Based on the error, its possible that updating the hostname in your alert_actions.conf file will resolve this. The mail is rejected due to "Partial domain not allowed: 'Jordan-PC'". What if you update your hostname to a fully qualified domain name?
... View more
10-11-2010
04:11 PM
1 Karma
I'm trying to set up a conditional alert where if there are less than 50 results but greater than 0 results, I want to be alerted. It seems straightforward but I can't figure out the syntax of the condition to use. The following does not work, for example:
mysearch | stats count dc(memberUid)
condition: 0 < dc(memberUid) < 50
... View more
10-05-2010
06:16 PM
To add clarification, I'm not hitting any default of 10 limit. I'm already using limit=100 in my report.
... View more
10-05-2010
05:58 PM
Is there a way to compress the size of the series listed on my report. I'm not seeing all series due to what appears to be a real estate issue.
... View more
10-04-2010
07:44 PM
1 Karma
Search head is version 4.1.5. I have a scheduled search that emails the report of all searches run in the past 7 days. The scheduled search runs just fine, the text of the alert indicates that several thousands results were returned by the search but the csv file only contains 1000 results.
Is this a simple configuration issue? What needs to be configured to increase this number to say, 10000 ? What are the ramifications of increasing said number?
... View more
10-03-2010
12:20 PM
1 Karma
We've disabled the UI for our indexers so don't have access to the manager UI for them. The search head UI only shows stats for it's own indexes. How do I list out the stats for my indexer's indexes. I'm interested in current size, last event indexed, and also hotdb/warmdb/colddb counts.
Sure, I could go to the filesystem to look this up but would be nice if there were a search I could run to get this or a splunk command that will list this out from one place for all indexers, if possible.
... View more
09-29-2010
11:13 PM
Here's the tcpdump command that was run at the indexer: /usr/sbin/tcpdump -A -s 1512 host and port 9997
... View more
09-29-2010
11:09 PM
1 Karma
Turns out the LWF was not a LWF. It was a heavyweight forwarder 🙂
Thanks to Raitz for figuring that out. He spotted the _linebreaker in the tcpdump output which is an indication of cooked data.
I had the system owner enable LWF from CLI and all is working as expected.
... View more
09-29-2010
11:07 PM
We have data from this host that is going to indexA. I really want to be able to keep my hands off the LWF configuration so I don't have to set those up.
... View more
09-28-2010
11:38 PM
Which version does this apply to? I ran it in 4.1.5 and Splunk returns a message that the command is deprecated:
sh-3.2# ./splunk enable module input/UDP
This command is deprecated.
... View more
09-27-2010
09:58 PM
I have syslog-ng data coming from LWFs that have been earmarked for indexA. I want to intercept these events and reroute them to another index called indexB. It doesn't seem to be working. Am I missing something basic?
The sourcetype is syslog so in props I have:
[syslog]
TRANSFORMS-route = route2indexB
transforms.conf:
[route2indexB]
REGEX=(192.168.1.12)
DEST_KEY = _MetaData:Index
FORMAT = indexB
I've tried multiple iterations of this configuration including using source and host in props.conf. I can't seem to get the data to go to indexB.
... View more
09-24-2010
09:53 PM
I'm seeing this as well after our update to 4.1.5.
... View more
09-24-2010
05:58 PM
3 Karma
I have a special user (her name is "dashboard") that needs a session timeout of 0. Is it possible to set no timeout for a specific user?
... View more
09-23-2010
11:14 PM
Audit log doesn't appear to provide the degree of information I need. For example, I can see the action=edit_role event occurred for user=tina but it doesn't tell me which roles were added or removed. Sounds like monitoring the authorize.conf file is the solution.
... View more
09-15-2010
08:54 PM
I'm trying to search for an event that tells me that a role was added or removed for some LDAP group or user. I'd like to know when capabilities have been changed due to addition or removal of a role, particularly, the can_delete role.
Does Splunk currently audit this type of event?
... View more
- Tags:
- audit
- capability
- roles
09-14-2010
05:33 PM
2 Karma
I have a Power user who is creating his own lookup files. This works great but he's unable to share the file for other users. What specific capability is required for sharing of lookup files? Or, do I need allow him to admin all objects?
... View more
- Tags:
- capability
- roles
09-13-2010
05:10 AM
1 Karma
If you don't want inline results on a system-wide basis, you can configure results to be included inline by adding the following setting to a particular saved search (in saved searches.conf):
action.email.inline = 1
Obviously this requires access to the filesystem. I've filed an ER to make this a configurable option from the UI.
... View more
09-03-2010
05:47 PM
Good enough for me. Thank you!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-24-2025
08:16 AM
|
Karma given to
