Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About CarsonZa
CarsonZa
Contributor
Member since:
10-03-2017
04-05-2022
Community Statistics
| Posts | 102 |
| Solutions | 16 |
| Karma Given | 13 |
| Karma Received | 30 |
| Member Since | 10-03-2017 |
Activity Feed
- Got Karma for Re: How do you rebuild multiple buckets from frozen to thawed folder in Windows?. 04-04-2025 11:17 AM
- Got Karma for Re: Knowledge Bundle. 07-26-2022 02:07 PM
- Got Karma for Re: Knowledge Bundle. 02-06-2022 02:21 PM
- Posted Re: Knowledge Bundle on Splunk Enterprise. 02-04-2022 07:40 PM
- Karma Re: Knowledge Bundle for burwell. 02-04-2022 07:40 PM
- Karma Re: Help for retrieving a lookup date and to display it in a dashboard for arjunpkishore5. 02-04-2022 01:47 PM
- Posted Re: Knowledge Bundle on Splunk Enterprise. 02-04-2022 01:29 PM
- Got Karma for Knowledge Bundle. 02-03-2022 01:35 PM
- Posted Knowledge Bundle on Splunk Enterprise. 02-03-2022 12:07 PM
- Got Karma for Re: KV Store Process Terminated. 05-11-2021 02:37 PM
- Posted Re: How to resolve high increase in forwarders reporting errors, including "Failed to checkpoint" for channel= on Splunk Search. 11-09-2020 03:59 PM
- Got Karma for Re: Is it safe to delete .bundle files from /opt/splunk/var/run/search peers ?. 10-28-2020 06:43 PM
- Got Karma for Re: How to blacklist events for a specific event code and task category?. 08-07-2020 05:40 PM
- Got Karma for Re: How to blacklist events for a specific event code and task category?. 08-07-2020 02:16 PM
- Karma Re: help for opening an apps in nav menu for whrg. 06-05-2020 12:50 AM
- Karma Lookup file 'cisco_ios_messages.csv' has 2 missing fields for _smp_. 06-05-2020 12:50 AM
- Got Karma for Re: How do you rebuild multiple buckets from frozen to thawed folder in Windows?. 06-05-2020 12:50 AM
- Got Karma for Re: Getting error when trying to setup input after installing app. 06-05-2020 12:50 AM
- Karma Re: Threatlist Error after clean install of Palo Alto App and Add-on 6.0 for panguy. 06-05-2020 12:49 AM
- Karma Re: Real time Alert for renjith_nair. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 |
07-18-2018
08:03 AM
each append needs to be closed by "]". that closes the statement but you have a random OR in there
... View more
07-18-2018
08:01 AM
not that im aware of, you'll have to create a domain account. change the splunkd user to the domain account and then give the domain account access to that share.
... View more
07-17-2018
01:41 PM
does the user splunkd is running as have read access to that location?
... View more
07-17-2018
11:52 AM
yes you could technically put them in search it would be better if you created a separate app for them if not just for organization. What i meant by indexer though is a splunk instance whose role is an indexer. If you are running a standalone my point is mute. Can you tell me what your environment looks like and i can tailor my answer a little better?
... View more
07-17-2018
11:25 AM
a uf will ignore props and transforms, you will need a heavy forwarder on your syslog server.
... View more
07-17-2018
11:04 AM
run a subsearch using |join .
"search"
| join type=inner
[ |search "search" earliest=x latest=x]
Set the time picker as two weeks prior, the sub search would be the current time range. This should only show you events that were persistent between the two weeks
http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Join
... View more
07-17-2018
10:54 AM
its best practice to not put anything in system/local you could even put it etc/apps/search if you so desired but more importantly just to make sure you put these on the indexer correct?
... View more
07-17-2018
10:44 AM
try this and see if its what you're looking for
index=_internal source=*splunkd.log Reason="' frozen_buckets'"
... View more
07-17-2018
10:34 AM
The default power role already inherits user. If you are looking to make a custom role based off power, inheriting from power should suffice.
... View more
07-17-2018
10:31 AM
use |append and run the search again as a subsearch with a hard coded time range using earliest=-15m latest=now and your time picker could be 24hrs or you can leave it in your search as well. whatever field you are using to calculate on will need to be different than your main search for instance |"search" |stats count(a) as ex1 |append[|search "search' earliest=-15m latest=now |stats count(a) as ex2] Keep in mind there is a default subsearch timeout of 60s.
... View more
07-17-2018
10:20 AM
on what instance did you put the props and transforms in
props and transforms should really be in ....etc/apps/yourapp/local/
... View more
07-17-2018
10:15 AM
never used it but it seems pretty straight forward. You just define what customers/groups use what indexes. Personally id just install it in my dev enviroment and just look at all the searches to get a better understanding, this is your best bet.
... View more
07-17-2018
10:05 AM
yes, i would check to make sure you are not unnecessarily replicating apps you don't use and lookups that aren't useful.
... View more
07-17-2018
09:56 AM
3 Karma
yes it is safe to delete the bundles. How big are the bundles a piece?
... View more
07-17-2018
09:41 AM
silly questions first
is the indexer up?
Can you reach reach the gui of that indexer?
... View more
07-17-2018
09:37 AM
you can still use the monitor type input, it just wont show you a preview of the data before ingesting for remote hosts. This is working as intended.
... View more
07-17-2018
06:48 AM
try using join
then forcing the time range just like you have done above in your sub search. Be aware of subsearch timeouts though, I believe default is 60 seconds.
... View more
07-17-2018
06:42 AM
@skoelpin is referring to something like this
| appendpipe
[ |stats count(a) as a
| eval empty=if(isnum(a),"0", "a")]
you would have to add the append to for each category a, b, c... etc
... View more
07-17-2018
06:29 AM
1 Karma
I dont believe you can, i was in a similar situation and just had change permissions one by one. which realistically does take to long just tedious. Keep in mind not all apps in the drop down are visible in the first place by default so that should shrink your list a bit.
you could change
[ui]
is_visible = 0
in app.conf but this will hide the app from all users but still allow access to all the KO and app if you know the path.
... View more
07-16-2018
01:15 PM
we need more information.
whats the alert condition?
how are you saving that file?
... View more
07-16-2018
12:46 PM
do you have this stanza in your inputs.conf
[WinEventLog://Secuirty]
... View more
07-16-2018
12:42 PM
either way the same applies you need to turn on audit logging for your file share
... View more
07-16-2018
12:29 PM
by downloaded do you mean copied....locally?
... View more
07-16-2018
11:02 AM
Reports can either be exported locally to the users machine
or
emailed out on a schedule.
... View more
07-16-2018
10:56 AM
2 Karma
according to the documentation yes, upgrade your forwarders to 6.5 first.
From version 6.5 or later to 7.1 on Splunk universal forwarders.
http://docs.splunk.com/Documentation/Splunk/7.1.1/Installation/AboutupgradingREADTHISFIRST
... View more
