Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About jadengoho
jadengoho
Builder
Member since:
08-31-2017
02-28-2022
Community Statistics
| Posts | 252 |
| Solutions | 10 |
| Karma Given | 6 |
| Karma Received | 26 |
| Member Since | 08-31-2017 |
Activity Feed
- Got Karma for Re: HEC {"text":"Token is required","code":2}. 03-30-2024 02:26 AM
- Got Karma for Re: Lookup Editor limit the revert backup. 01-25-2023 04:59 AM
- Posted Re: Add-on for MS Office 365 question on Getting Data In. 02-28-2022 07:04 PM
- Posted Splunk Add-on for 0365: Why am I receiving Invalid Token? on Monitoring Splunk. 02-27-2022 11:27 PM
- Posted Re: Credentials Encryption in bash script on Security. 12-16-2021 04:39 AM
- Posted Re: Credentials Encryption in bash script on Security. 12-16-2021 12:28 AM
- Posted Credentials Encryption in bash script on Security. 12-15-2021 11:12 PM
- Tagged Credentials Encryption in bash script on Security. 12-15-2021 11:12 PM
- Posted Missing date_* fields on Splunk Enterprise. 12-03-2021 01:58 AM
- Posted Re: WARN LineBreakingProcessor on Getting Data In. 11-24-2021 06:06 PM
- Posted WARN LineBreakingProcessor on Getting Data In. 11-24-2021 12:06 AM
- Got Karma for Re: Does the Splunk Enterprise Security license expire?. 07-29-2021 09:16 PM
- Got Karma for Re: Selected Fields are missing. 05-26-2021 06:38 AM
- Got Karma for Re: Prevent users from table sorting (when clicking on its headers). 04-07-2021 11:01 PM
- Got Karma for Re: Splunk Searches delayed. 03-26-2021 09:14 AM
- Posted Re: Netskope Backend Error on Splunk Enterprise. 02-28-2021 09:28 PM
- Posted Splunk High Utilization on Splunk Enterprise. 02-24-2021 03:25 AM
- Tagged Splunk High Utilization on Splunk Enterprise. 02-24-2021 03:25 AM
- Posted Netskope Backend Error on Splunk Enterprise. 02-22-2021 12:56 AM
- Got Karma for Re: SPL on configuration files. 02-16-2021 01:24 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-15-2020
07:13 PM
@niketnilay This is helpful,
but i have a table with drill down function and need to send token from table to a multi-select in the same dashboard.
<form>
<label>Mutiselect</label>
<fieldset submitButton="false">
<input type="multiselect" token="multiselect_token">
<label>number</label>
<choice value="1">1</choice>
<choice value="2">2</choice>
<choice value="3">3</choice>
<delimiter>,</delimiter>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>|makeresults
|eval value="1,2,3"</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="count">10</option>
<option name="drilldown">cell</option>
<drilldown>
<set token="form.multiselect_token">$row.value$</set>
</drilldown>
</table>
</panel>
</row>
</form>
... View more
02-14-2020
03:21 AM
Hi All,
How could i separate the values of multiselect inputs that came from a drilldown ?
The values came from a dashboard click drilldown to the mutiselect field, unfortunately token passed are joined in one box, how could i separate them ?
Hope the picture will help
... View more
- Tags:
- dashboard
02-11-2020
04:12 AM
But this command rely on Timerange "ALL TIME".
Im finding a way to get all 25 index earliest event.
How can i do that in the most efficient way ?
... View more
02-11-2020
03:54 AM
Hi All,
Is it possible to get the Earliest available date of index and source type .
I tried "Tstats" and "Metadata" but they depend on the search timerange.
I need to get the earliest time that i can still search on Splunk by index and sourcetype that doesn't use "ALLTIME".
A good example would be, data that are 8months ago, without using too much resources. Just let me know if it's possible
... View more
01-11-2020
05:59 AM
This may not be the best way to solve this:
I encounter this issue on ingesting ApexJobs , apparently this logs changed every second and Splunk along with Salesforce Add-on doesn't re-ingest data after it updates.
For example:
1/11/2020 7:04:03.000 AM - ID:00000001 Status="Processing"
1/11/2020 7:04:05.000 AM - ID:00000001 Status="Completed"
Splunk will ingest the "Processing" but not the "Complete". In my observation it will only re-ingest the data if the update is greater than one minute.
Solution:
Lower the interval time to 20-60 seconds in Salesforce-addon.
Create a script that will ingest the APEXJOBS. If you can find a way to ingest all data along with its ID and Fields using wildcard(*).
Since "Processing" status are ingested, i need to find a way to run the script and get the latest data.
But according to this document https://developer.salesforce.com/docs/api-explorer/sobject/AsyncApexJob
I need to specify the ID to get a specific information.
In a search i get all Processing Status and run a REST API query. Curl application helps me to accomplish that, and dump the data in the same index but different sourcetype. And i save this query as a savesearch to recapture information that are not being ingested.
Again, this might not be the best solution out there, but this workaround help me.
... View more
01-10-2020
12:03 AM
Hi @esix_splunk
Just to clarify:
First proposed solution is " This would mean data is indexed in site1, and then forwarded to indexers in site2.". This happens on the Forwarders ? They are trying to avoid tons of job(Opening port, connectivity and firewalls) on all 500+ forwarders.
Since they do have different environment they also have different license.
Second proposed solution is "Single Multisite Cluster ( site1 and site2,) ". Site1 and Site2 has there own cluster master, means they are not connected. As far as i understand replication factor can only be applied for those site(s) under ONE cluster master.
... View more
01-09-2020
10:34 PM
Hi Everyone.
I do have experience on setting up a clustered environment but this request is new to me.
Situation: There are 2 different clustered environment "Site1" and "Site2", they do have their own Independent Environment.
Site1 data are shared to Site2 ,but Site 2 will not share data to Site1 (One way replication).
They also want it to be in the Indexer level since there are 500+ universal forwarders sending data to Site1 , and that's a tedious work for them setting up the firewall, connection and etc.
Here are the listed requirements:
2 different Clustered environment, they have their own ClusterMaster, DeploymentServer, LicenseMaster, SearchHead etc.
Replicate/Forward data from Site 1 to Site 2 [ONE WAY].
Replication or Forwarding are setup on Indexer Level.
Hope this image below will help you understand.
... View more
01-03-2020
12:27 AM
1 Karma
Hi Thanks for this, I manage to identify the issue.
Resolution:
Increase the Limits.conf base on server information and Splunk transactions.
... View more
12-17-2019
04:58 AM
Hi All,
I would like to ask why do we encounter this notification:
Root Cause(s):
The percentage of high priority searches delayed (16%) over the last 24 hours is very high and exceeded the red thresholds (10%) on this Splunk instance. Total Searches that were part of this percentage=12. Total delayed Searches=2
The percentage of non high priority searches delayed (47%) over the last 24 hours is very high and exceeded the red thresholds (20%) on this Splunk instance. Total Searches that were part of this percentage=21. Total delayed Searches=10
May i know what are the possible issue and resolution regarding this?
... View more
12-17-2019
04:55 AM
Yes this might be due to SSO. Is there any other way to ingest this kind of data to our environment.
... View more
12-07-2019
02:31 AM
Hi All Splunk ,
We are using Website Input for a while now, and it works fine until now.
Why i can't monitor this site : Salesforce Site.. it shows "Cannot GET /".
It doesn't even need credential to view this.
... View more
11-28-2019
11:18 PM
Nov 29 2019 - Still on update ?
Hope Splunk Add it on Major Update (8.0.0)
... View more
11-23-2019
06:57 AM
Do you use other application ?
... View more
11-23-2019
04:00 AM
Hi All,
Yes, there is a lot of similar question to this one.
But I want to ask in the current time, is there any tool that can help to customize email reporting, either PDF or Alert?
Like to add color, HTML tags or any customizations.
... View more
11-05-2019
10:03 PM
Yes i've tried it , but it will close all the Splunk dashboard. I just want to close a specific dashboard after minutes of no action.
... View more
11-05-2019
07:08 AM
Hi All,
A random question here,
Is there an application or a setting in Splunk that will close the dashboard after minutes of no usage/action.
Cause there is some user that doesn't close the dashboard after using it. It consumes storage and process due to autorefresh.
... View more
11-05-2019
03:17 AM
We've figured this out,
It seems the term license was not renewed by our client, that why it shows the error.
It's a good thing to ask the client and the sales support team for this.
... View more
10-29-2019
07:38 AM
Could you tell me what causes the issue?
Have you experienced it before?
Is it on our part of a Splunk issue itself ?
... View more
10-29-2019
07:18 AM
Hi Splunkers,
I would like to know if you have this issue on adding a Splunk license :
"Bad Request — Splunk.License: failed to parse license because: The license file with signature ********* has been revoked. Please file a case online at http://www.splunk.com/page/submit_issue.";
What might cause the issue and what the probable solution.
... View more
09-09-2019
03:21 PM
Yes it works, thank you very much
Props.conf
DATETIME_CONFIG = CURRENT
EVENT_BREAKER_ENABLE = true
EVENT_BREAKER = ([\r\n]+)
Inputs.conf
useACK = false
time_before_close = 300
Still i want to know why does behavior happens ?
... View more
09-06-2019
09:45 PM
Thank you very much this really help me a lot.
@DalJeanis can you tell me why does this happens?
... View more
09-05-2019
06:34 PM
I am having problem with UF data ingestion.
There are 36 servers (18 server are prod and 18 are test-prod)
I have deployment server who deploy configuration files to the 36 servers. But the logs i get are incomplete from different server.
"incomplete" means most server send complete logs but other servers logs are being cut.
Example logs:
(Complete)
+ server-service applicationservice-engine1:status
server-service: applicationservice-engine1: OK
+ server-service applicationservice-engine2:status
server-service: applicationservice-engine2: OK
(incomplete sample 1)
+ server-service applicationservice-engine2:status
server-service: applicationservice-engine2: OK
(incomplete sample 2)
server-service: applicationservice-engine1: OK
+ server-service applicationservice-engine2:status
server-service: applicationservice-engine2: OK
my inputs.conf :
[monitor:///var/log/scripts/service-status.log]
disabled = 0
index = operations
sourcetype = service:status
and there are NO Props or Transforms applied.
What may be the reason of this occurrence?
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-28-2022
11:18 PM
|
