Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About tiagofbmm
tiagofbmm
Influencer
Member since:
10-24-2017
06-02-2023
Community Statistics
| Posts | 686 |
| Solutions | 106 |
| Karma Given | 15 |
| Karma Received | 141 |
| Member Since | 10-24-2017 |
Activity Feed
- Got Karma for Re: Polycom Video Infrastructure - Monitoring with Splunk. 03-05-2026 06:26 AM
- Got Karma for Re: Move partial data from index to another index.. 04-11-2024 08:55 AM
- Got Karma for Re: Move partial data from index to another index.. 04-11-2024 08:54 AM
- Got Karma for Re: Move partial data from index to another index.. 04-11-2024 08:54 AM
- Got Karma for Re: Move partial data from index to another index.. 04-11-2024 08:54 AM
- Got Karma for Re: How do you evaluate the difference between 2 multivalue fields?. 10-11-2023 10:34 AM
- Posted Re: How do I see what fields are in indexed metadata? on Splunk Search. 06-02-2023 07:38 AM
- Got Karma for Re: difference between heavy forwarder and universal forwarder. 04-27-2023 04:40 AM
- Got Karma for Re: How do I remove rows with null values on single/multivalue fields?. 03-20-2023 09:44 AM
- Got Karma for Re: Where to place common python libraries. 06-01-2022 07:14 AM
- Got Karma for Re: whether a license key is required for the ES app or not?. 02-04-2022 07:09 AM
- Got Karma for Re: Move partial data from index to another index.. 11-01-2021 04:57 AM
- Got Karma for Re: Can a report cloned as inline search(no external dependencies) in dashboard refresh from data source? Is it a static clone or it can be updated constantly?. 10-29-2021 01:06 AM
- Got Karma for Re: How to search Events on Hosts in Inputlookup File?. 10-04-2021 12:09 PM
- Got Karma for Re: Move partial data from index to another index.. 01-14-2021 05:46 PM
- Got Karma for Re: What is the difference between alert and report?. 09-08-2020 11:55 AM
- Got Karma for Re: Salesforce Add-on Status 500. 07-30-2020 12:27 PM
- Got Karma for Re: What is the best practice when creating a custom index in a indexer?. 07-19-2020 09:07 AM
- Got Karma for Re: What is the best practice when creating a custom index in a indexer?. 07-19-2020 09:07 AM
- Karma Re: moving from indexed time _json to search time for FrankVl. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-21-2018
10:00 AM
Please let me know if the answer was useful for you. If it was, accept it or upvote comments. If not, give us more input so we can help you with that
... View more
03-21-2018
09:59 AM
Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that
... View more
03-21-2018
09:59 AM
Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that
... View more
03-21-2018
09:58 AM
Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that
... View more
03-21-2018
09:58 AM
Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that
... View more
03-21-2018
09:57 AM
Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that
... View more
03-21-2018
09:56 AM
Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that
... View more
03-21-2018
09:55 AM
Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that
... View more
03-21-2018
09:55 AM
Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that
... View more
03-21-2018
09:55 AM
Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that
... View more
03-21-2018
09:52 AM
Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that
... View more
03-21-2018
09:47 AM
Hello
Yes it does exist, it is called Splunk Enterprise Security!
https://splunkbase.splunk.com/app/263/
... View more
03-21-2018
09:45 AM
@OldManEd
1 - The value 100 in the return command is to specify how many lines do you want of values of the specified field. As I have no idea how many you have, it is better to specify a high value to make sure all the values you want are included. So you're correct, default is to 1 and this needs to be adjusted to the size of everything in the column
2 - Return command returns an OR format automatically indeed. You don't need, actually you mustn't use the formata you mentioned there. The format I gave you is exactly what the syntax and logic requires. Test for yourself the subsearch I gave you and see what it is passing to the primary search.
Please @OldManEd if you think this answer is correct, upvote it and accept it
... View more
03-21-2018
09:40 AM
Try this generic example
| makeresults
| eval to="[email protected]"
| append [ | makeresults
| eval to="[email protected]" ]
| append [ | makeresults | eval to="[email protected]" ]
| rex field=to "@(.*\.)*(?<Domain>.*\..*)"
The test.co.uk is an outlier to this rule? Did you want domain to be test.co.uk? Then you have the same exact format but you want two different behaviours?
Regex doesn't work like that
... View more
03-21-2018
09:20 AM
That's the problem. Those forwarders are sending to a port that is not open in the indexer. So you need to add the stanza with th 9996 on the indexer inputs.conf too. Or repoint those forwarders outputs.conf to send to the port 9997
... View more
03-21-2018
08:51 AM
Hey
Create a rex to extract the first two words and then dedup on that new field
| rex field=_raw "(?<unique>.*\_[^\_]*)"
Then dedup unique
... View more
03-21-2018
08:47 AM
Have you set your indexer with an inputs.conf and a stanza
[splunktcp:9996]?
... View more
03-21-2018
08:32 AM
OK so now the big question is, are your indexers receiving data from the Forwarders. Are you sure the cloud forwarders have connectivity to your indexers?
Are you sure that Hostname can be resolved by the Cloud Forwarders?
... View more
03-21-2018
08:25 AM
@elliotproebstel you are correct I didn't want to pass the idea that to run hourly, it has to have a 0 in the first section. Thanks for adding useful info. Upvoted
... View more
03-21-2018
08:20 AM
1 Karma
Please re-check you dashboard script for errors. I just tried it and it works the same way. Check the example below as it is generic and you can copy it for your test environment:
<form>
<label>tokenwhere</label>
<fieldset submitButton="false">
<input type="dropdown" token="src">
<label>field1</label>
<fieldForLabel>source</fieldForLabel>
<fieldForValue>source</fieldForValue>
<search>
<query>| tstats count where index=_internal by source</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
</fieldset>
<row>
<panel>
<chart>
<search>
<query>index=_internal | where LIKE(source,"%$src$%") | timechart count</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
</form>
... View more
03-21-2018
08:01 AM
1 Karma
remember sourcetype overwrite is done in the end of the pipeline , just as cosmetic change for the latter search time field extractions and calculations.
I would still overwrite the sourcetype like you are doing but considering your use case of timestamp, I would create an EVAL in each sourcetype definition stating that _time=fieldA in one sourcetype and the respective thing on _time=fieldB on the other one.
Any time you later search for any of the sourcetype, your time will be showing modified.
... View more
03-21-2018
07:52 AM
That's what we are trying to diagnose. And the reason for my last comment
... View more
03-21-2018
07:32 AM
Then I'm afraid your internal data of the Cloud servers is being sent elsewhere to some other indexers than the ones your search head is distributing your searches to...
Can you check on your deployment server, in an app that contains an outputs.conf, where are those pointing their data to?
... View more
03-21-2018
07:27 AM
1 Karma
Sorry you don't you have the license_usage.log of your hosts?
index=_internal host=cld* source=*license_usage.log
Does this query return something or not?
... View more
03-21-2018
07:03 AM
The earliest and latest you rub the search is deeply dependant on what alarm time ranges you are aiming for.
About the cron, once every hour is:
0 * * * *
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-02-2023
01:45 PM
|
Karma given to
