About szabados

szabados · ‎01-03-2017

In my search, I'm using a transaction. After that, I create a table from the results, then I want to apply an eventstats last() function. In my table, I have two columns, let's say colA, and colB. If I'm running the transaction without any further arguments, the last() function works for both columns, like this: | transaction keyfield | table colA, colB, keyfield | eventstats last(colA) as last_colA, last(colB) as last_colB by keyfield However, for another reason, I need to run the transaction with mvlist=t. When I do this, the eventstats function fails, but only for one column. In this case, fails for colA, but works fine with colB. I don't get what is the difference, since I'm having the same type of values in both columns. If it works for one column, why does it fail for the other one?

szabados · ‎12-30-2016

I want to use a lookup table, but every time, I add the command to my search "| lookup name_of_my_lookup", I'm getting the "Error in 'lookup' command: The lookup table 'name_of_my_lookup' does not exist or is not available. " When I try to load the same lookup with "| inputlookup", it works fine, I see all the contents. I didn't find any more detailed error message. What am I doing wrong? Update: without changing anything, the issue is gone now. The lookup works now as expected, but I would be still interested in understanding what went wrong, not to make the same mistake again in the future.

szabados · ‎12-16-2016

Thanks, exactly what I needed!

szabados · ‎12-12-2016

I have a long search, where in the first part, I'm filtering down lots of data, and doing lookup, eval, etc, let's call this my base search At the end, I want to apply stats to this data set, actually three different functions, and have the results in a table. I'm able to do this, by running the base search 3 times, applying one of the stats function, and appending it to the other results, like this: | basesearch | stats 1 | append [|basesearch | stats 2] | append [|basesearch | stats 3] Obviously, this is a huge overhead of running the same search 3 times in subsearches. I can't use a datamodel, because the parameters of my subsearch are dynamically populated, and it would be almost impossible to create all the summaries for all the possible values. Is there any way, to do something like this? | basesearch | stats1 | append [| stats2 appended to the data yielded from the base search at the beginning] | append [| stats3 appended to the data yielded from the base search at the beginning] Thanks

szabados · ‎11-08-2016

As far as I've experienced, only those fields can be reused in the drill-down search, which are/can be displayed in the "Additional fields" section.

szabados · ‎10-11-2016

And is there a way, to store the output of sistats with an ad hoc search? As I did with using collect at the end of my search on the gui?

szabados · ‎10-11-2016

So let me put it this way: This time, I would like to use si-commands, I just don't get, what is the recommended way to route the output from the sistats or similar commands to an arbitrary summary index.

szabados · ‎10-11-2016

I'm trying to dig deeper into summary indexing, but at this point I feel a bit confused. What I did so far is: - created an index to use for summaries (to not to use the built in summary) - stored some of my search results with collect: | collect index=my_summary_index sourcetype=my_summary_sourcetype I was looking at the si-commands, sistats in the first place. What I don't get is, how do I store the results from sistats in a summary index? Do I have to add collect to after sistats, or I can't use it in an inline search, and I have to schedule it and enable summary indexing for the report?

szabados · ‎08-16-2016

Yes, when I clicked the value from the list, it automatically added, it didn't work either

szabados · ‎08-16-2016

I'm facing an issue which I'm simply unable to understand I ran a search, simply by specifying the index I want to search in like this: index=my_index After this, I selected one of the values which were displayed in the top 10 for the sourcetype field, and added it to my search, so I had: index=my_index sourcetype=my:sourcetype And then, I got 0 results. I haven't changed the time picker or anything else, and I'm unable to understand why I'm not getting any results. Checking with the metadata command, I have thousands of events with this sourcetype in the index, and Splunk is displaying this sourcetype in the values of the field, but for some reason I can't run a search for it. Edit: When I'm not narrowing my search with that filer, I see the events with that particular sourcetype Edit2: Searching with: index=my_index sourcetype=* is not yielding any events with this problematic sourcetype. The sourcetype itself if set by props.conf, could this cause any issues?

szabados · ‎07-28-2016

Thanks! Not exactly the same approach as I head in my head, but I like it a lot. I learned something new again.

szabados · ‎07-27-2016

szabados · ‎07-22-2016

This is the part where I got lost... I've queried the running config with btool, and there is no tcpout group configured in my search head (the one which works fine), and there is no server = option in the outputs.conf at all.

szabados · ‎07-21-2016

I have two search heads, which are not clustered, only my indexers are clustered, the search heads are separate. Both worked fine, but recently I must have misconfigured something (unintenionally obviously), because one of my search heads are not able to send any data to my indexers. The _internal index doesn't contain any data from my problematic search head, and if I try to write something to a summary index with the command "collect", it also fails. However, the search head started to create buckets locally to store the _internal index. I was trying to compare the inputs,outputs.conf files against my working search head, but I haven't found anything. I'm able to run searches from my problematic one, so it can access the cluster, but can't send any data.

szabados · ‎07-04-2016

Hi, I've changed the configuration as displayed in the manual, but I'm still getting the same error

szabados · ‎06-30-2016

I have my proxy settings configured in my splunk-launch.conf. When I'm trying to connect to my ServiceNow account, I'm getting Could not authenticate to ServiceNow. Please check your credentials and try again. My credentials are OK, I'm able to log in via ServiceNow's web gui. In the splunkd.log I see Winsock error 10061 events, which stands for proxy error, if my understanding is correct. How to address this?

szabados · ‎06-28-2016

index=otherindex [search index= | rename relatedkeynum as keynum | return $keynum ]

szabados · ‎06-28-2016

Tried both but no luck

szabados · ‎06-28-2016

I'm running 6.4.0. The HTTP_PROXY variable was configured in my splunk-launch.conf, and later I've configured the HTTPS_PROXY as well. After restarting Splunk, I'm prompted for login, but no other page can be loaded after that. (500 - Internal Server error). How can I get the HTTPS proxy to work?

szabados · ‎06-22-2016

The issue was on my side...I forgot that in my props.conf I've explicitly defined the header to use, that's why I had field names without spaces.

szabados · ‎06-09-2016

Some users reported that the investigations functionality is not available for them in the Enterprise Security app. What role/capability should I assign to them?

szabados · ‎06-03-2016

I have an input, which is a CSV file. I want to use this as a batch input. The file is generated every day, with the same name. Most of the time, the beginning of the file is also the same. That's why I think the only method I can achieve to have this ingested every day is to use the CHECK_METHOD = modtime in props.conf After setting it, I've checked my splunkd.log, I can see that because of the new modtime, Splunk started to read the file, but now I'm getting this messages: TailReader - Will retry path="" after deferring for 10000ms, initCRC changed after being queued (before=0xd71b3bcce79fb3d8, after=0xb5a12ee23beafb6a). File growth rate must be higher than indexing or forwarding rate. I've tried restarting my forwarder, deleting the fishbucket, but I'm still getting this error. (The file wasn't modified during this time)

szabados · ‎03-24-2016

How can I provide field values to the startswith argument of the transaction command? Like I would do in a search: index=myindex fieldname=valueToSearchFor I want to do the same with a transaction

szabados · ‎03-24-2016

I want to limit the number of the digits displayed in the percentages on piechart. Is there a way to do this? I've seen only a true/false toggle for the display

szabados · ‎02-29-2016

I'm configuring what I believe is the first scenario here: http://dev.splunk.com/view/event-collector/SP-CAAAE73#scen1 I'm stuck at setting the indexes for this input. As I'm running an indexer cluster, my indexers are not visible on the forwarder, so I can't add the index I want to use to store the data coming from the HTTP Event Collector. I see only indexes which are defined on the forwarder itself, like main, summary, etc. How can I set an index for this? The other thing, the "Output Group" contains only the "None" value. However, I have outputs configured on this instance, since it is forwarding other events to my cluster. Will be these output settings applied to this by default, or do I have to configure them explicitly?

Posts	83
Solutions	2
Karma Given	0
Karma Received	11
Member Since	‎08-25-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How do you store the matching value as a field?

Why am I getting less search results when reading ...

Using _time as a discriminator without time span?

How do I deduplicate events with such conditions?

Splunk Add-on for Microsoft Cloud Services with pr...

Cropped results for inputlookup via REST ?

Confusing behaviour of fieldalias

Substituting values from MV fields?

Why are some events not summarized in a data model...

How do I properly configure proxy for Splunk?

Why does "eventstats last()" fail for one column w...

Why am I getting Invalid lookup table?

Re: Running separate searches from a base search?

Running separate searches from a base search?

Re: Drill down search is not working in Splunk Ent...

Re: Confused with the usage of si-commands

Re: Confused with the usage of si-commands

Confused with the usage of si-commands

Re: Why am I getting 0 results when trying to filt...

Why am I getting 0 results when trying to filter m...

Re: How to merge cells in a table based on value

How to merge cells in a table based on value

Re: Search head not able to send data to the clust...

Search head not able to send data to the cluster

Re: How to use Splunk App for ServiceNow with a pr...

How to use Splunk App for ServiceNow with a proxy?

Re: How to relate two different events in two diff...

Re: Why does setting HTTPS_PROXY in Splunk 6.4.0 c...

Why does setting HTTPS_PROXY in Splunk 6.4.0 cause...

Re: Datamodel with spaces in field names?

Splunk Enterprise Security: What role or capabilit...

How to monitor a file input with the same filename...

Transaction startswith argument with named fields ...

Pie chart percentage config - number of digits?

How to set the indexes for a single HTTP event col...

Join the Conversation