Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About ziegfried
ziegfried
Influencer
Member since:
11-17-2009
01-26-2022
Community Statistics
| Posts | 668 |
| Solutions | 234 |
| Karma Given | 406 |
| Karma Received | 930 |
| Member Since | 11-17-2009 |
Activity Feed
- Got Karma for Re: What's the difference between where and search in the pipeline?. 01-13-2026 11:36 PM
- Got Karma for Re: Database lookup not returning all matches. 04-21-2025 03:30 PM
- Got Karma for Re: stats by date_hour add zero count for hours with no events. 04-09-2024 12:24 PM
- Got Karma for Re: Add reports to dashboards. 12-07-2023 11:17 PM
- Got Karma for Re: stats by date_hour add zero count for hours with no events. 04-18-2023 02:05 AM
- Got Karma for Re: How do you add dummy events to a search result?. 11-06-2022 11:06 PM
- Got Karma for Re: What's the difference between where and search in the pipeline?. 09-19-2022 02:38 PM
- Got Karma for Re: What's the difference between where and search in the pipeline?. 05-12-2022 04:02 PM
- Got Karma for Re: IIS FTP LOG TIMEZONE PROBLEM. 04-28-2022 04:28 AM
- Got Karma for Re: How do I list all active input stanzas in all apps?. 03-27-2022 08:43 PM
- Got Karma for Re: How do you add dummy events to a search result?. 01-11-2022 01:42 PM
- Got Karma for Re: What's the difference between where and search in the pipeline?. 11-11-2021 02:06 AM
- Got Karma for Re: How to format _time field in results email?. 10-19-2021 11:43 AM
- Got Karma for Re: How do I determine my indexing volume by host, source, or sourcetype?. 06-07-2021 08:24 AM
- Got Karma for Re: convert bytes to megabytes in report. 05-19-2021 08:15 PM
- Got Karma for Re: What's the difference between where and search in the pipeline?. 04-30-2021 10:07 AM
- Got Karma for Re: Terminate User Session. 03-16-2021 08:22 AM
- Got Karma for Re: Splunk DB Connect - dbquery inline search and time filtering not working. 03-02-2021 02:20 PM
- Got Karma for Re: how to find the earliest and latest event in an index?. 12-09-2020 09:22 AM
- Got Karma for Re: Multiple Values per Event - transforms.conf regex. 11-24-2020 06:58 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 3 | |||
| 5 |
08-03-2011
09:23 AM
Since you seem to already have the SourceIP field extracted, you can simply use it:
host="my host" action="Deny" SourceIP=* | geoip SourceIP
... View more
08-02-2011
07:56 AM
1 Karma
Is the extraction visible in the maps app? Did you turn on global sharing for it?
... View more
07-18-2011
02:18 AM
1 Karma
Seems like your extraction does not work as you might expect. Could provide the extract extraction definition? What do you mean by "no mapping"?
The last search probably does not what you would want it to do. geoip screen_source="*" does exactly the same as simply calling geoip since screen_source is not a valid option. When you're passing an argument in the form of <key>=<value> it's interpreted as option not as a keyword/argument.
... View more
07-11-2011
04:09 PM
4 Karma
One thing that will probably make it more efficient is to reduce the number of operations:
... | rex "(?i)0x(?<d1>[0-9A-F]{2})(?<d2>[0-9A-F]{2})(?<d3>[0-9A-F]{2})(?<d4>[0-9A-F]{2})"
| eval ip=tostring(tonumber(d1,16))+"."+tostring(tonumber(d2,16))+"."+tostring(tonumber(d3,16))+"."+tostring(tonumber(d4,16)) | geoip ip
Since the geoip command is converting the IP back to an integer, it might be a good idea to extend the command to allow the processing of integer values directly. I'll probably add this in the future.
... View more
07-11-2011
03:32 PM
HTTP status 400 probably means that one or more of the post parameters are not formatted correctly or unknown. I'll try to get a version with more debug output up asap.
... View more
07-11-2011
09:40 AM
Hmm. You should be able to see the error message with Firebug. There should be several Ajax requests to .../pdfdownload/status. The last one of those shlould contain the error message.
... View more
07-11-2011
05:42 AM
What's the environment you've installed the app on? What version of the PDF Report Server are you using? Which Splunk version on which operating system? Do you use a separate reporting server? What kind of dashboard are you trying to render?
... View more
07-08-2011
10:06 AM
One option that I can think of is to append a result to the search that generates the information for outputlookup with synthetical values that are never matched by the lookup. Eg.
... | append [ | stats count | fields - count | eval field1="__INVALID__" | eval field2="__INVALID__" | eval ... ] | outputlookup mylookup
Where field1, field2, etc are the columns in your lookup file. This forces the results to be written every time. The downside is the unnecessary entry in the lookup file.
... View more
07-07-2011
03:53 PM
The best place to get started, is the distributed deployment manual in the documentation: http://www.splunk.com/base/Documentation/latest/Deploy/Distributedoverview
http://www.splunk.com/base/Splexicon:Forwarder
... View more
You never should enable the SplunkLightForwarder app on a Splunk Server. This app is enabled on a forwarder instance where you want to minimize resource consumption. To fix this, go to $SPLUNK_HOME/etc/apps/SplunkLightForwarder/local and delete the app.conf file. And then restart Splunk.
... View more
07-07-2011
02:52 AM
3 Karma
sourcetype=access_combined | eval request_type=if(match(uri, "\.(gif|jpe?g|png)"),"image", "other") | stats count(eval(request_type="image")) as image_requests count as total | eval img_pct=image_requests/total*100
or simplified:
sourcetype=access_combined | stats count(eval(match(uri, "\.(gif|jpe?g|png)"))) as image_requests count as total | eval img_pct=image_requests/total*100
... View more
07-06-2011
11:09 AM
3 Karma
All windows specific inputs (like remote eventlogs) are only available on a Splunk instance on Windows box.
... View more
07-03-2011
02:57 AM
1 Karma
to have all kinds of characters to show up in the post, you can simply select the text and click on the "code" formatting in the menubar.
... View more
07-03-2011
02:56 AM
1 Karma
Manually defining such an extraction might be a better solution here:
props.conf
EXTRACT-filename = file name:\s+(?<file_path>\\\\\S+?(?<filename>[^\\\s]+))\s+
... View more
07-01-2011
11:20 AM
2 Karma
I'm quite sure it's only resolving the top 10 results, but it's doing this in preview mode. So it's executing the lookup with the partial results multiple times until the search is finished.
... View more
06-30-2011
03:46 PM
2 Karma
You can do this by creating a default viewstates.conf. Just create a file named viewstates.conf with the following content:
[flashtimeline:_current]
FieldPicker_0_6_1.fields = host,sourcetype,source,bettername
in the default or local subdirectory of your app.
... View more
06-30-2011
10:22 AM
1 Karma
The following should work:
props.conf
[your_sourcetype]
REPORT-bean-kv = extract-bean-kv
KV_MODE = none
transforms.conf
[extract-bean-kv]
REGEX = \[([^=\]]+)=([^=\]]+)\]
FORMAT = $1::$2
CLEAN_KEYS = true
... View more
06-30-2011
07:12 AM
did you restart you deployment server after enabling deployment services?
... View more
06-26-2011
02:37 AM
1 Karma
rex field=dest_host "(?<domain>[^\.]+)\.([^\.]+)$"
... View more
06-26-2011
02:28 AM
What you're seeing is the whole search process crashing. This might not be directly caused by geoip command. There should be some crash-logs in your $SPLUNK_HOME/var/log/splunk directory. I'd suggest creating a support case with these logs.
Have you installed the Maxmind C API?
... View more
06-24-2011
08:22 AM
3 Karma
Editor's note: please see next answer down for modern, Splunk 6.x+ method of doing this
--
When drilldown is set to row , the module uses the value in the first column of each row as drilldown value. So you can put the field you want to hide in the first column and then hide it using some Javascript in application.js.
Example:
if(Splunk.util.getCurrentView() == "myview") {
Splunk.Module.SimpleResultsTable = $.klass(Splunk.Module.SimpleResultsTable, {
renderResults: function($super,data) {
$super(data);
$('td:nth-child(2),th:nth-child(2)', this.container).hide();
}
});
}
... View more
06-24-2011
04:05 AM
1 Karma
Please note: In the new version you have to use the _geo field with the combined lat/lng value:
<your search> | eval _geo=Latitude+","+Longitude
... View more
06-21-2011
12:14 PM
I've updated the answer. I hope that's understandable now.
... View more
