Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About p_gurav
p_gurav
Champion
Member since:
09-17-2014
07-27-2020
Community Statistics
| Posts | 970 |
| Solutions | 63 |
| Karma Given | 12 |
| Karma Received | 148 |
| Member Since | 09-17-2014 |
Activity Feed
- Got Karma for Re: AutoLB Volume. 04-07-2025 10:51 AM
- Got Karma for Re: After downloading the free trial, why do I get the error "cannot accept license agreement"?. 02-25-2024 04:25 AM
- Got Karma for Re: After downloading the free trial, why do I get the error "cannot accept license agreement"?. 01-05-2024 12:57 PM
- Got Karma for Re: Search peer indexer1 has the following message: License Manager: Failed to contact license master: reason='Unable to connect to license master:. 07-31-2023 06:22 AM
- Got Karma for Re: How to forcefully change the current search head captain to actual captain in the search head cluster Environment ?. 07-12-2023 02:24 PM
- Got Karma for Re: round in addcoltotals. 02-10-2023 12:04 PM
- Got Karma for Re: How to forcefully change the current search head captain to actual captain in the search head cluster Environment ?. 10-10-2022 01:46 AM
- Got Karma for How to split a json array into multiple events with separate timestamps?. 09-21-2022 02:16 AM
- Got Karma for Re: splunk dbconnect how to obtain a list of all database connections. 09-02-2022 09:56 AM
- Got Karma for Re: splunk dbconnect how to obtain a list of all database connections. 06-08-2022 08:39 AM
- Got Karma for Re: How do I disable the auto refresh delay on all dashboards?. 02-01-2022 01:51 AM
- Got Karma for Splunk false alerts. 10-25-2021 08:26 AM
- Got Karma for Re: Splunk upgrade from 7.x to 8.x. 09-13-2021 03:15 AM
- Got Karma for Re: After downloading the free trial, why do I get the error "cannot accept license agreement"?. 09-10-2021 03:03 AM
- Got Karma for Re: After downloading the free trial, why do I get the error "cannot accept license agreement"?. 08-19-2021 01:44 PM
- Got Karma for Re: datamodel command for multilevel data model child datasets. 12-04-2020 11:57 PM
- Got Karma for Re: datamodel command for multilevel data model child datasets. 12-04-2020 11:56 PM
- Got Karma for Re: Splunk Enterprise not working. 11-02-2020 05:47 AM
- Got Karma for Re: After downloading the free trial, why do I get the error "cannot accept license agreement"?. 11-02-2020 04:08 AM
- Got Karma for Re: Summary Indexing give duplicated records. 08-05-2020 01:48 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 4 | |||
| 5 | |||
| 0 | |||
| 2 |
03-12-2018
11:22 PM
Happy to help!!!
... View more
03-12-2018
11:21 PM
1 Karma
According to document it cant:
Operating systems and browsers
Splunk DB Connect runs on the following operating systems. For details, see supported operating systems of Splunk Enterprise.
Linux, kernel version 2.6 and later
Linux, kernel version 3.x and later
Windows Server 2008R2, 2012R2
You can use the following browsers to use Splunk DB Connect on your Splunk platform:
Apple Safari (latest)
Google Chrome (latest)
Microsoft Edge (latest)
Microsoft Internet Explorer 11
Mozilla Firefox (latest)
... View more
03-12-2018
10:47 PM
Did you stop splunk and then delete it?
... View more
03-12-2018
09:45 PM
Also look through this answer:
https://answers.splunk.com/answers/25431/inconsistency-between-splunk-api-vs-gui-search-results.html
... View more
03-12-2018
09:20 PM
1 Karma
You have to add this line in props.conf not in inputs.conf.
<sourcetype>
TRANSFORMS-index_cloudwatch=index_env1,index_env2
Transforms.conf seems ok.
... View more
03-12-2018
09:01 PM
Hi,
This may help you:
https://answers.splunk.com/answers/586680/report-creates-multiple-emails-looking-for-single.html
Also try using sendemail command in search, then schedule report. Refer below command doc:
https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Sendemail
... View more
03-12-2018
08:58 PM
Hi,
Can you try this:
By going to etc/apps/the app that contains the lookup/metadata/local.meta
search for the csv file entry. should look something like this.
[lookups/lookup_table.csv]
version = ###
owner = nobody
modtime = 1464798467.783966000
access = read : [ * ], write : [ admin ]
export = system
and set the owner to nobody. You can restart the splunk process or issue the refresh command by going to http://splunk_server:8000/en-US/debug/refresh
... View more
03-12-2018
06:57 AM
Hi,
Can you try below changes:
open/create $SPLUNK_HOME/etc/system/local/web.conf and increase the value.
splunkdConnectionTimeout = (default 30 secs)
... View more
03-12-2018
06:29 AM
1 Karma
Hi,
Assuming that timeseries of events is maintain, you can try this command:
index=<your_data_index_> | stats latest(_raw) AS "last line" by source
... View more
03-12-2018
06:21 AM
2 Karma
Hi,
Yes, you can configured forwarder. You can take help of this document:
http://docs.splunk.com/Documentation/Forwarder/7.0.2/Forwarder/HowtoforwarddatatoSplunkEnterprise
... View more
03-12-2018
06:09 AM
Hi,
As this app used rangemap command, you can refer this documents:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rangemap#Using_rangemap_with_single_value_panels
Also this app is supported till splunk 6.2 version.
... View more
03-12-2018
06:01 AM
Hi,
You can do that with transaction command. Also refer documents for it:
https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Transaction
... View more
03-12-2018
06:00 AM
Hi,
You can try increasing the admin user's srchDiskQuota from 10000 to 100000. To do this, I created the file /etc/system/local/authorize.conf, and added the stanza:
[role_admin]
srchDiskQuota = <integer>
Be careful about increasing this quota for non-admin users, as this can severely hamper performance.Also refer documents:
http://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/authorizeconf
... View more
03-12-2018
05:48 AM
Hi,
Can you try something like this:
| rest servicesNS/-/-/saved/searches splunk_server=local
Also refer this docs:
http://dev.splunk.com/view/python-sdk/SP-CAAAEK2
... View more
03-12-2018
05:41 AM
Hi,
This may helpful to you :
https://answers.splunk.com/answers/538382/splunk-add-on-for-tenable-why-has-splunk-stopped-i.html
... View more
03-10-2018
04:19 AM
Can you try something:
[]
dispatch.earliest_time = @w1
dispatch.latest_time = now
... View more
03-10-2018
03:47 AM
Try changing summary searches with your default index.
... View more
03-10-2018
02:48 AM
Yes, Its possible. If all clients are sending data to your Splunk instance. If that's the case, can you share sample data?
... View more
03-10-2018
02:37 AM
This troubleshooting steps might help you:
http://docs.splunk.com/Documentation/Mint/1.0/ProductOverview/Troubleshooting
... View more
03-10-2018
02:34 AM
are you running script same user as Splunk is running?
Refer this document:
https://developer.akamai.com/tools/siem-integration/docs/Content/SetupSplunkconnector.html
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-27-2020
02:54 AM
|
Karma given to
