Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About CarsonZa
CarsonZa
Contributor
Member since:
10-03-2017
04-05-2022
Community Statistics
| Posts | 102 |
| Solutions | 16 |
| Karma Given | 13 |
| Karma Received | 30 |
| Member Since | 10-03-2017 |
Activity Feed
- Got Karma for Re: How do you rebuild multiple buckets from frozen to thawed folder in Windows?. 04-04-2025 11:17 AM
- Got Karma for Re: Knowledge Bundle. 07-26-2022 02:07 PM
- Got Karma for Re: Knowledge Bundle. 02-06-2022 02:21 PM
- Posted Re: Knowledge Bundle on Splunk Enterprise. 02-04-2022 07:40 PM
- Karma Re: Knowledge Bundle for burwell. 02-04-2022 07:40 PM
- Karma Re: Help for retrieving a lookup date and to display it in a dashboard for arjunpkishore5. 02-04-2022 01:47 PM
- Posted Re: Knowledge Bundle on Splunk Enterprise. 02-04-2022 01:29 PM
- Got Karma for Knowledge Bundle. 02-03-2022 01:35 PM
- Posted Knowledge Bundle on Splunk Enterprise. 02-03-2022 12:07 PM
- Got Karma for Re: KV Store Process Terminated. 05-11-2021 02:37 PM
- Posted Re: How to resolve high increase in forwarders reporting errors, including "Failed to checkpoint" for channel= on Splunk Search. 11-09-2020 03:59 PM
- Got Karma for Re: Is it safe to delete .bundle files from /opt/splunk/var/run/search peers ?. 10-28-2020 06:43 PM
- Got Karma for Re: How to blacklist events for a specific event code and task category?. 08-07-2020 05:40 PM
- Got Karma for Re: How to blacklist events for a specific event code and task category?. 08-07-2020 02:16 PM
- Karma Re: help for opening an apps in nav menu for whrg. 06-05-2020 12:50 AM
- Karma Lookup file 'cisco_ios_messages.csv' has 2 missing fields for _smp_. 06-05-2020 12:50 AM
- Got Karma for Re: How do you rebuild multiple buckets from frozen to thawed folder in Windows?. 06-05-2020 12:50 AM
- Got Karma for Re: Getting error when trying to setup input after installing app. 06-05-2020 12:50 AM
- Karma Re: Threatlist Error after clean install of Palo Alto App and Add-on 6.0 for panguy. 06-05-2020 12:49 AM
- Karma Re: Real time Alert for renjith_nair. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 |
08-20-2018
07:10 AM
is this a uf or a heavy forwarder
... View more
08-20-2018
07:08 AM
1 Karma
sounds like a drop down would work better in this scenario than trying to write in functionality.
... View more
08-20-2018
07:03 AM
double check your ports. Obviously you can change these but, deployment over 8089 and forwarding over 9997. these should be the same through out your environment.
... View more
08-02-2018
02:33 PM
good to hear, since you found it useful please accept my answer.
... View more
08-02-2018
07:00 AM
3 Karma
@mbharrellmtsu i came across this when i didn't read the release notes properly. Mine occurred because i upgraded exchange and my windows ta. unfortunately windows ta 5.0 is not compatible with the newest version rolling back to 4.8.4 (i believe) solved this for me
... View more
08-02-2018
06:52 AM
what version of the windows ta do you have? do you have the exchange app or the windows infrastructure app?
... View more
07-27-2018
07:43 AM
good to hear, if my answer helped you reach this conclusion please accept my answer.
... View more
07-23-2018
10:24 AM
Have you checked the DMC? There is lots of good info in there. Personally I would check search activity first.
... View more
07-23-2018
10:21 AM
try separating them with a comma */10 6-23 * * 1-5, */10 0-9 * * 2-6
Otherwise you might have to create a second input.
... View more
07-23-2018
10:12 AM
you could use |top otherwise you'll have to do some math.
|stats count(_raw) as total
|stats count(x) by x as foo
|eval perc = ((foo / total)*100) + "%"
http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Top
... View more
07-20-2018
06:32 PM
the lock file will always get remade. So the fact that it comes back is normal. But if you are still experiencing issues with the kvstore staying up then try to clean it using splunk clean kvstore --local
... View more
07-20-2018
06:07 PM
stop splunkd
delete this file
$SPLUNK_HOME\var\lib\splunk\kvstore\mongo\mongod.lock"
start splunkd
... View more
07-20-2018
01:03 PM
2 Karma
which is exactly what ive said above
... View more
07-20-2018
11:43 AM
@rmjharris i never said edit the conf in the default folder is said, check it. i have had several instances where the default has things enabled and the only way to check them to see if theyre disable is to look in the default folder to see whats enabled and whats not. Then follow my instructions which are identical to yours.
... View more
07-20-2018
09:54 AM
\etc\apps\Splunk_TA_windows\default\inputs.conf
every stanza in here should be set to disabled = 1 or true
... View more
07-20-2018
09:43 AM
1 Karma
check the inputs.conf under default. Ive also seen some perfmon inputs under system/local. Check those and create a stanza in your local directory disabling each stanza
... View more
07-20-2018
09:08 AM
ES wasn't mentioned in the original question but yes you are correct that macro does exist inside SA-Util
... View more
07-18-2018
12:38 PM
Do you have anything under license stack under the licensing page?
... View more
07-18-2018
09:40 AM
That's all there is to it, just clicking standalone instead of distributed
... View more
07-18-2018
08:28 AM
outputs.conf
[tcpout:c]
server=server1:9997
[tcpout:d]
server=server2:9997
inputs.conf
[monitor://path/file1.log]
_TCP_ROUTING = c
[monitor://path/file2.log]
_TCP_ROUTING = d
http://docs.splunk.com/Documentation/Splunk/7.1.1/Forwarding/Routeandfilterdatad
... View more
07-18-2018
08:21 AM
i would try what @poete is suggesting instead of changing it to _json leave it as default and then add your timestamp format in. I tested it with your sample event and it works great.
... View more
