Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About micahkemp
micahkemp
Champion
Member since:
02-11-2014
12-13-2022
Community Statistics
| Posts | 822 |
| Solutions | 135 |
| Karma Given | 111 |
| Karma Received | 275 |
| Member Since | 02-11-2014 |
Activity Feed
- Got Karma for Re: How to combine wildcard results into one field?. 04-08-2025 06:26 AM
- Got Karma for Re: How to use timepicker from a CSV lookup?. 12-27-2024 01:27 PM
- Got Karma for Re: How to use timepicker from a CSV lookup?. 11-12-2024 03:02 AM
- Got Karma for Re: Why is the inputlookup not returning any records?. 02-05-2024 04:44 AM
- Got Karma for Re: Easiest way to exclude ingestion of events for a specific IP address from a SourceType. 09-21-2023 04:52 PM
- Got Karma for Re: Is it possible to use base search in append sub search?. 05-25-2023 01:44 PM
- Got Karma for Re: How to index all locally and forward specific sourcetype to a 3rd party indexer?. 05-07-2023 11:02 PM
- Got Karma for Re: Indexes.conf. 12-02-2022 06:49 AM
- Got Karma for Re: Splunk Add-on for MS IIS and INDEXED_EXTRACTIONS. 11-02-2022 03:51 AM
- Got Karma for Re: Apply search field extraction to props.conf and/or transforms.conf so extraction done at index-time. 10-10-2022 07:51 AM
- Got Karma for Re: How can I extract a license file from existing license volume. 10-07-2022 07:17 AM
- Got Karma for Re: Why is coalesce working only for one of the two fields I am combining, depending on the sequence the fields are being combined?. 10-05-2022 04:24 AM
- Got Karma for Re: Setting the timestamp when using the collect command. 09-05-2022 03:42 AM
- Got Karma for Re: Help with multivalue field count. 05-22-2022 12:21 AM
- Got Karma for Re: Why is "rex field" not producing results when used in an API call?. 05-19-2022 01:16 AM
- Got Karma for Re: Can I use props/transform to make MULTIPLE changes to the same event from a log?. 04-13-2022 07:48 AM
- Got Karma for Re: How to use timepicker from a CSV lookup?. 03-24-2022 06:24 AM
- Got Karma for Re: Is it possible to use base search in append sub search?. 03-17-2022 01:37 PM
- Got Karma for Re: Can I concatenate a complete search query to the already filtered stats results which only executes if an input checkbox is checked. 03-04-2022 06:59 AM
- Got Karma for Re: How to combine wildcard results into one field?. 09-13-2021 12:11 AM
Topics I've Started
No posts to display.
12-26-2017
11:28 AM
Slave to what? Deployment server, license master, outputs? Which config file is this a part of?
... View more
12-22-2017
08:14 AM
Why do you want to change the sourcetype?
You can use [source:] in props.conf to create search time customizations for summary data.
... View more
12-21-2017
02:21 PM
Unfortunately you are in unsupported territory. From the documentation:
The search heads must run the same or a later version from the peer nodes.
Despite wanting advice different from "upgrade your search head", that's likely your only viable option.
... View more
12-21-2017
02:11 PM
It's pretty difficult to modify searches without knowing:
a) the intent of the search (what you want the results to look like and represent)
b) some sample data to test with
... View more
12-21-2017
03:36 AM
I don't have links to any videos or other trainings, other than the free fundamentals course, which may not have field extraction content. You might want to post another question asking for links to free training options.
... View more
12-20-2017
04:51 PM
I looked into this and found no way to do this via REST, even via undocumented endpoints. I looked at the splunkd_access logs from a timeperiod during which I uploaded a CSV and saw no reference to the upload going through the API. It seems that splunkweb handles the upload and storing the CSV on disk, and then calls a REST endpoint to create the lookup itself using the uploaded file.
Unfortunately I think the answer to this question is simply that it's not possible.
... View more
12-20-2017
04:45 PM
In that case you need to ensure the timepicker range selected encompasses the full time range of the actual _time field that may have events with ALERTDATETIME in the desired range. That may mean users can't select 7 days from the timepicker if they want 7 days based on ALERTDATETIME .
The timepicker will only define your time window based on _time .
... View more
12-20-2017
04:39 PM
My overly simplified summary:
Lookups are for state and/or event enrichment
Summary indexing is for making your data more quickly searched later, when you pretty much know which pieces of the events you need to search/report on at that time. You can think of them as pre-computed segments of a search you want to run later.
... View more
12-20-2017
04:10 PM
Excellent. You should convert this comment to an answer and accept it.
... View more
12-20-2017
04:07 PM
If you open that panel in search, does it have the results you expect it to have, or is it also lacking some fields?
... View more
12-20-2017
10:55 AM
2 Karma
From the transforms.conf docs:
* At index time only, you can use FORMAT to create concatenated fields:
* Example: FORMAT = ipaddress::$1.$2.$3.$4
If you want concatenated fields at search time, you'll have to use a combination of props/transforms and eval (which can go in props).
... View more
Splunk Stream can do SSL decryption, assuming you have the key:
https://docs.splunk.com/Documentation/StreamApp/7.1.1/DeployStreamApp/EnableSSLforStreamForwarder
... View more
12-20-2017
07:08 AM
I agree the initial question was framed inquiring about site-specific retention, which I didn't answer. I made some potentially invalid assumptions about the "question behind the question."
... View more
12-20-2017
06:28 AM
1 Karma
I'm going to make some assumptions that aren't necessarily stated in the original question:
a) You want to make a change to a configuration in indexes.conf in system/local to surgically make one or more changes to the version pushed from the cluster master.
b) This specific change isn't one that will impact the indexer's ability to be a valid member of the cluster ( [volume:] is an example of a parameter that can be different across indexers, and should be fine to set in system/local ).
You can make changes to a clustered indexer in system/local to effect a change specific to only that indexer. Best practice warns against making any changes in system/local , and you can indeed make that change in apps/local according to the Precedence for cluster peer nodes documentation. Note that slave-apps/default takes precedences over apps/default , so it would have to be in apps/local to override slave-apps/local .
So, if you need some indexers to use different volume settings than others, I think this would be a valid method of running disparate configurations on clustered indexers.
... View more
12-20-2017
05:47 AM
1 Karma
I don't think you need the double quotes in your EXTRACT line.
... View more
12-20-2017
03:59 AM
When the user searches for, say, 7 days, do they expect that search to return results where ALERTDATETIME is within that 7 day window, or do they only want the resulting output to make use of ALERTDATETIME ?
... View more
12-20-2017
03:55 AM
The above looks correct, but there is already a TRANSFORMS = syslog-host defined by default for the syslog sourcetype, which might occur after your transform, thus rewriting the host field again based on the contents of the syslog message.
... View more
12-20-2017
03:52 AM
Are you wanting to show the contents of the div ? I think regex would still be you answer for that.
props.conf:
[<sourcetype>]
REPORT-comments = comments_contents
transforms.conf:
[comments_contents]
SOURCE_KEY = Comments
REGEX = >(?<comments_contents>[^<]+)<
... View more
12-19-2017
04:28 PM
4 Karma
Try this:
import sys,re
from splunklib.searchcommands import dispatch, StreamingCommand, Configuration
@Configuration()
class ExtractDicom(StreamingCommand):
def stream(self, records):
for record in records:
record['blah'] = None
record['meh'] = None
if "Attribute" in record['_raw']:
record['blah'] = "test"
else:
record['meh'] = "test2"
yield record
if __name__ == "__main__":
dispatch(ExtractDicom, sys.argv, sys.stdin, sys.stdout, __name__)
I ran into something incredibly similar, and the issue was that the first result returned from your custom search command dictates which fields will be handled by Splunk.
The solution is to set all of the possible fields to a default value every time, but most importantly the first time, you return a result.
... View more
12-19-2017
10:57 AM
rex "(?<plain_bike>Bike(?![ON]))"
That will create a field plain_bike when the word Bike is not followed by O or N .
Or, this will create a field you can use to count by bike :
rex "(?<bike>Bike(NEW|OLD)?)"
... View more
12-19-2017
08:04 AM
Assuming your last values (a, b, c...) are of an unknown quantity, you could do something like this:
props.conf:
[<sourcetype>]
REPORT-sourcetypevalues = severityxy,othervalues
transforms.conf:
[severityxy]
REGEX = ^(?<timestamp>[^|]+)\|(?<severity>[^|]+)\|(?<x>[^|]+)\|(?<y>[^|]+)\|(?<othervalues>.*)$
[othervalues]
SOURCE_KEY = othervalues
REGEX = (^|\|)(?<othervalue>[^|]+)($|\|)
MV_ADD = true
... View more
12-19-2017
05:16 AM
Is it always severity, x, y, then a variable number of pipe delimited values afterwards that should all be in one potentially multivalue) field?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-13-2022
02:28 PM
|
Karma given to
| User | Karma Count |
|---|---|
| 2 | |
| 2 | |
| 2 | |
| 3 | |
| 16 |
