Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About pradeepkumarg
pradeepkumarg
Influencer
Member since:
09-22-2012
10-20-2021
Community Statistics
| Posts | 541 |
| Solutions | 84 |
| Karma Given | 140 |
| Karma Received | 223 |
| Member Since | 09-22-2012 |
Activity Feed
- Got Karma for Re: What does "show source" under "event actions" do?. 06-03-2024 04:52 PM
- Got Karma for Re: How can I bypass the License Agreement on startup after a new install?. 05-27-2024 03:01 AM
- Got Karma for Re: How to list all lookup files from an app?. 12-06-2023 01:41 PM
- Got Karma for Re: How can I bypass the License Agreement on startup after a new install?. 03-04-2023 01:16 PM
- Got Karma for Re: How can I bypass the License Agreement on startup after a new install?. 09-23-2022 04:00 AM
- Got Karma for Re: see users logging in from more than one country. 06-09-2022 12:33 PM
- Got Karma for Re: How can I verify if the boot-start is already enabled?. 03-09-2022 02:45 AM
- Got Karma for Re: Search to get the license usage per a single host?. 01-19-2022 12:09 PM
- Got Karma for Re: How can I identify which dashboards include a specific string?. 11-03-2021 07:20 AM
- Got Karma for Re: How to remove columns from search results table?. 10-27-2021 07:56 AM
- Got Karma for Re: Why is my search skipping?. 10-06-2021 11:00 AM
- Got Karma for Re: How to increment the field based on the previous value based on the condition?. 08-09-2021 06:27 AM
- Got Karma for Re: How to track the bundle size on indexers over time. 04-16-2021 06:56 AM
- Got Karma for Re: Does the splunk_archver app need to be distributed to the search peers via the knowledge bundle?. 02-09-2021 12:27 AM
- Got Karma for How to add custom message in place of "Search is waiting for input" for a dashboard panel?. 10-02-2020 08:35 AM
- Got Karma for Re: How to remove columns from search results table?. 09-17-2020 05:04 AM
- Got Karma for Re: How to count by DIFFERENT values of a field?. 08-27-2020 06:07 AM
- Posted Re: Data Onboarding Strategy on Getting Data In. 08-10-2020 09:17 AM
- Posted Data Onboarding Strategy on Getting Data In. 08-08-2020 10:41 AM
- Karma Re: rex - matching everything until a tab for Ayn. 07-25-2020 09:06 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
07-20-2018
10:39 AM
Yes, Splunk enterprise can work as a forwarder except that it becomes a heavy forwarder instead of universal forwarder.
http://docs.splunk.com/Documentation/Splunk/7.1.2/Forwarding/Typesofforwarders
... View more
07-20-2018
07:23 AM
1 Karma
| eval word=if(searchmatch("\*abend890\*"), "ABEND", "NOT_ABEND") | stats count by word
... View more
07-17-2018
08:51 PM
Ok, check the run_time of this search over the time. It could very well happen that the search is now taking a longer time to finish than before. This could happen if you have more data to search now than before or for some other reasons that is degrading the search performance.
... View more
07-17-2018
01:14 PM
Why do you want to kill the search? Isn't the purpose defeated if you are going to make a way to run a new search only to kill it later?
Your better options are spread the frequency so that they don't step over each other.
Increase the max concurrency for that particular search, so that multiple instances of the same search can run in parallel.
... View more
07-17-2018
09:43 AM
You already provided the path in your question. Does that path not exist on your mac? Depending on where you installed splunk, it may or may not be in /opt
Search for /applications/splunk/apps/search/local/props.conf ?
... View more
07-16-2018
06:22 PM
The saved search name appears to be different in both the logs.
... View more
07-16-2018
10:14 AM
This works?
|eval field_name= if(len(field_name) > 15," ", field_name)
You just retain what's there in the field if the length is not greater than 15.
... View more
07-16-2018
10:10 AM
Check if this helps
https://answers.splunk.com/answers/642834/why-are-there-multiple-host-entries-for-every-splu.html#answer-642944
... View more
07-16-2018
10:09 AM
Check the other answer.. I've copy pasted below.
I've seen this usually with syslog (/var/log/syslog)
Syslog is a pre trained sourcetype and extracts the host from within the log itself and if the log has the hostname without FQDN, you see that.
Check the sourcetypes for each of those host entry |tstats count WHERE host=test* by host,sourcetype | stats values(sourcetype) by host
You will see your problematic sourcetype that is causing the host value without FQDN.
... View more
07-15-2018
06:59 AM
A simple \n\" OR \n\W should work?
LINE_BREAKER=\n\W
... View more
07-14-2018
08:29 PM
1 Karma
Can you not use source field to differentiate the data by device?
... View more
07-13-2018
01:14 PM
Compatibility between peer nodes and search heads
Starting with 6.3, the peer nodes and search heads can run different versions from each other.
The search heads must run the same or a later version from the peer nodes.
Search head clusters participating in an indexer cluster have the same compatibility requirements as individual search heads. For information on other search head cluster version requirements, see "System requirements and other deployment considerations for search head clusters" in the Distributed Search manual.
More details here
http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Systemrequirements#Splunk_Enterprise_version_compatibility
... View more
07-13-2018
10:11 AM
3 Karma
Try this
| inputlookup my_lookup.csv | eval New_Date = strptime(Date, "%d/%m/%Y")| sort New_Date | fields - New_Date
... View more
07-13-2018
10:04 AM
Repost?
https://answers.splunk.com/answers/672472/how-to-count-by-different-values-of-a-field.html#answer-671827
... View more
07-13-2018
08:27 AM
This will give you in 60 minute spans
| bucket span=60m _time|stats dc(City) as count_status by UserId,_time | where count_status > 1
... View more
07-13-2018
08:12 AM
2 Karma
Use dc instead of count to get the distinct count of cities
| stats dc(City) as count_status by UserId | where count_status > 1
... View more
07-12-2018
01:10 PM
If there is no pre trained sourcetype, you can always create your own custom source type and define the line breaking, time stamping and fields.
... View more
07-12-2018
12:48 PM
1 Karma
https://answers.splunk.com/answers/642834/why-are-there-multiple-host-entries-for-every-splu.html#answer-642944
... View more
07-12-2018
10:00 AM
1 Karma
The message says that the index voiceapp_summary is not created on the Splunk instance where the data is being received.
... View more
07-11-2018
06:59 AM
Email and script are two different parallel actions for an alert. You can not make them interdependent. Perhaps you should use the script itself to send an email instead of splunk email.
... View more
07-11-2018
06:39 AM
This message is not related to the upgrade. The message says, a lookup was created with large size which might cause bundle replication issues. Once the bundle crosses the default max size, search heads will no longer be able to push the bundle to the indexers.
On the file system search for any .csv files that stand out with respective to size. You will have to remove that lookup in order to resolve the issue.
... View more
07-10-2018
10:35 AM
Documentation says "For the usage data logs to be created and available, your search heads, indexers, and cluster master must be running Splunk Enterprise version 6.5.0 or later."
So it might be a case that there is no collection prior to 6.5. I could be wrong.
... View more
07-10-2018
10:30 AM
3 Karma
./splunk start --accept-license --answer-yes
Your command
/trvapps/splunk/bin/splunk start --accept-license --answer-yes
... View more
07-10-2018
10:09 AM
Go to settings - > instrumentation
Click on the settings icon next to usage data to see what is turned on.
More details here
http://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Shareperformancedata
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-20-2021
03:38 PM
|
Karma given to
