Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About highsplunker
highsplunker
Contributor
Member since:
01-09-2018
10-18-2025
Community Statistics
| Posts | 131 |
| Solutions | 4 |
| Karma Given | 305 |
| Karma Received | 10 |
| Member Since | 01-09-2018 |
Activity Feed
- Karma Splunk Dashboard Studio Button to launch searches for Mux_Pl0uc. 10-16-2025 02:32 PM
- Karma replace one backslash by double backslash for ryastrebov. 10-17-2024 05:50 AM
- Karma Re: replace one backslash by double backslash for manan_amin. 10-17-2024 05:50 AM
- Posted Re: How to replace backslash by double backslash using eval in search and props.conf on Splunk Enterprise. 10-17-2024 05:47 AM
- Karma Re: How to replace backslash by double backslash using eval in search and props.conf for manan_amin. 10-17-2024 05:47 AM
- Karma How to replace backslash by double backslash using eval in search and props.conf for jay. 10-17-2024 05:46 AM
- Posted Re: How can I get list of users from rest api ? on Getting Data In. 10-14-2024 11:35 AM
- Karma Re: How can I get list of users from rest api ? for egid_la. 10-14-2024 11:33 AM
- Karma How can I get list of users from rest api ? for egid_la. 10-14-2024 11:18 AM
- Posted Re: How to filter on KV Store lookup time-based fields using a time picker? on Splunk Search. 10-04-2024 07:06 AM
- Karma Re: How to filter on KV Store lookup time-based fields using a time picker? for woodcock. 10-04-2024 07:06 AM
- Karma How to filter on KV Store lookup time-based fields using a time picker? for nawneel. 10-04-2024 07:05 AM
- Posted Re: Following the "Create a custom Splunk view" tutorial, but I receive "Failed to load resource: the ser on Dashboards & Visualizations. 10-03-2024 04:31 AM
- Karma Why the error "Failed to load resource: the server responded with a status of 404" when following the tutorial? for faustf. 10-03-2024 04:31 AM
- Karma Re: Following the "Create a custom Splunk view" tutorial, but I receive "Failed to load resource: the server responded with a status of 404" error. How to fix? for keweizhang123. 10-03-2024 04:31 AM
- Karma Re: Following the "Create a custom Splunk view" tutorial, but I receive "Failed to load resource: the ser for jramos123. 10-03-2024 04:31 AM
- Posted Re: Splunk button javascript unset token on Dashboards & Visualizations. 09-19-2024 03:11 PM
- Karma Splunk button javascript unset token- Is there a method to unset the splunk's token after the page refresh? for maurobissante. 09-19-2024 03:09 PM
- Karma Re: How to reference the search time range for somesoni2. 09-13-2024 08:14 AM
- Posted Re: How to set the timestamp when using the collect command? on Knowledge Management. 09-03-2024 08:08 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 |
05-28-2019
01:27 AM
Again. So poor support here...
... View more
05-28-2019
01:26 AM
Again. So poor support here...
... View more
05-23-2019
07:30 AM
I saw this issue https://answers.splunk.com/answers/521046/can-rest-api-be-used-to-execute-a-python-script-on.html?childToView=747914#answer-747914
But it does not help.
And the problem remains if myServer1 == myServer2.
... View more
05-23-2019
07:27 AM
Error when I run custom Python script from one server to another sever using cURL.
Error message in the CLI is this:
"Search Factory: Unknown search command"
Why this does not work from a Linux myServer2?
curl -k -u 'myUser:myPwd' https://myServer1:8089/services/search/jobs/export -d search=" | makeresults | myScript " -d output_mode=csv
But OK for search = " | makeresults | eval myVal=777 "
And OK for search = " | makeresults | sendemail to=\"myMail@myCompany.com\" subject=\"test_from_cli\" "
And OK for myScript if I run it from Splunk search box from myServer1 itself.
Splunk Enterprise version 6.5.2
The commands.conf:
[myScript]
filename = myScript.py
... View more
05-23-2019
06:49 AM
Guys,
why this does not work from a Linux myServer2?
curl -k -u 'myUser:myPwd' https://myServer1:8089/services/search/jobs/export -d search=" | makeresults | myScript " -d output_mode=csv
But OK for search = " | makeresults | eval myVal=777 "
... View more
05-08-2019
09:24 AM
I had problems at first.
But it's OK now for:
... | table file_name
| map file_name search="
| inputlookup $$file_name$$
"
... View more
04-04-2019
01:46 AM
Ok. Nice. This worked for me. But I simply removed this lock-file and restarted Splunk application (if I remember correctly).
... View more
01-10-2019
06:13 AM
Hey guys. Why don't anybody comment on this? Especially from Splunk Inc.
... View more
10-15-2018
01:06 PM
Why it's not by default? Very strange.
Trying to implement your advice anyway.
Thanks a lot!
I'll come back with the results!
... View more
09-23-2018
03:10 PM
Hey guys,
It seems that if a field in Splunk index contains Non English characters - the search is very slow.
I would say it's not indexed.
How so?
Thanks in advance.
... View more
- Tags:
- splunk-enterprise
09-23-2018
11:36 AM
I'm analyzing the possibilities of the platform now. Normally we use 1 min searches as max frequent. But it's probable that I'll need to trigger a bunch of my Splunk monitoring rules every 15 or 30 seconds. And I don't understand why the Software does not allow that in the interface. Or maybe I'm missing something.
... View more
09-23-2018
04:27 AM
Thanks Martin. The thing is that I heard real time searches are not really reliable. Not sure if got it right though.
... View more
09-23-2018
04:23 AM
I'm asking because of my previous question here at answers.splunk.com: https://answers.splunk.com/answers/688181/can-i-trigger-a-saved-search-more-frequently-than.html#sidr
... View more
09-23-2018
04:20 AM
Hey guys,
What are the REST API trigger limits for search head per 1 minute e.g.?
I'm gonna call my search head from 3rd system and wanna know the limits.
Thanks in advance.
... View more
- Tags:
- splunk-enterprise
09-23-2018
12:35 AM
Ok. REST API is configured, it's good.
To your question: I'd like to see what kind of "almost online" monitoring is possible with Splunk.
I was wondering why it's available to trigger search head via REST API quicker than 1 minute, but not available from the interface itself.
Thanks anyway.
... View more
09-22-2018
10:53 AM
Hey guys,
Can I trigger a saved search more frequently than 1 minute?
I have two servers configuration: an indexer and a search head.
The problem is that the schedule can get only * * * * * Cron as the most frequent, if I'm not wrong.
... View more
09-08-2018
12:13 PM
Guys, solved.
The problem was that somehow the forwarding from search head (server_B) to indexer (server_B) Was Broken. I'm not sure, but I did something bad to my deployment server (3rd Splunk instance).
So I justed needed to put "https://serer_A:9997" on my search head via web interface (Settings -> Forwarding ... -> new)
That's it.
Note. Don't make my mistake. If you indicate on your search head which server you want as a peer (in Settings -> Distributed Search) that means FOR SEARCH, NOT COLLECT / INDEX your data. For collecting / indexing your data make sure your forwarding configurations are Ok (via web interface as I described, or via outputs.conf file).
... View more
09-07-2018
12:54 PM
My guess - it looks like some directory is overfull with files, but I cannot figure out which one...
... View more
09-07-2018
12:51 PM
Guys, one thing I forgot to add: it worked perfectly, but broke suddenly yesterday.
Of course, we restarted both servers. Not helped.
Any other idea?
... View more
09-07-2018
10:32 AM
Hi!
i have an indexer on server_A and a search head on server_B
there is an index=test_ind on server_A
i run a search on server_B (search head) to collect some data to test_in to server_B
but
1) i get this error:
Received event for unconfigured/disabled/deleted index=test_ind with source="source::/opt/splunk/var/spool/splunk/3120f8647b3740cb_events.stash_new"
host="host::server_B"
sourcetype="sourcetype::stash".
So far received events from 11 missing index(es).
2) and no data collected to test_ind
Note: When I run collect command from the same Splunk instance where test_ind is located, everything is fine; the data is collected.
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-18-2025
08:23 AM
|
