Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About markthompson
markthompson
Builder
Member since:
09-29-2014
06-05-2020
Community Statistics
| Posts | 243 |
| Solutions | 17 |
| Karma Given | 67 |
| Karma Received | 68 |
| Member Since | 09-29-2014 |
Activity Feed
- Got Karma for Re: Why am I getting error "The license signature is not a base64-encoded string" trying to add my license in Splunk 6.2?. 01-06-2025 02:27 AM
- Got Karma for How to round stats average to 2 decimal places?. 09-13-2023 03:01 PM
- Got Karma for Re: Can an input be enabled or disabled based on another input?. 03-10-2022 02:39 AM
- Got Karma for How to round stats average to 2 decimal places?. 12-23-2020 01:33 PM
- Got Karma for Re: How to make a drop-down form wider?. 06-05-2020 12:48 AM
- Karma Real time search, how to check if event doesn't exist and return something if it doesn't. for DavidHourani. 06-05-2020 12:47 AM
- Karma Re: Is there a URL Prefix variable in Simple XML? for LukeMurphey. 06-05-2020 12:47 AM
- Karma Re: How can I search and return only the first occurrence of a string? for musskopf. 06-05-2020 12:47 AM
- Karma Can I create a new field for each value contained in an existing field? for mrfredman. 06-05-2020 12:47 AM
- Karma How to search count trends by displaying a 3 column table with source name, count (last 10 min) and count (now)? for vikas_gopal. 06-05-2020 12:47 AM
- Karma Output first event and last event. for ferza. 06-05-2020 12:47 AM
- Karma How to search Splunk indexes' event count for the last one hour including zero counts? for dhavamanis. 06-05-2020 12:47 AM
- Karma Date not parsed if the hour is 24 for reggie_123. 06-05-2020 12:47 AM
- Karma Splunk Time Based Retention for nspatel. 06-05-2020 12:47 AM
- Karma How to edit my inputlookup subsearch to return field values from the csv only if the values were not found? for TobiasBoone. 06-05-2020 12:47 AM
- Karma Re: How to setup an alert if any index size goes over 90%? for MuS. 06-05-2020 12:47 AM
- Karma Re: Where can I find a complete list of data source types that can be indexed in Splunk? for MarioM. 06-05-2020 12:47 AM
- Karma Monitoring Active Directory groups, is it possible to send an email alert to the individual who was added or removed from the group? for 8i5. 06-05-2020 12:47 AM
- Karma Re: How do i file a Splunk Support Case/ contact Splunk Support? for vhallan_splunk. 06-05-2020 12:47 AM
- Karma Re: Using splunk to create and view table metadata for aweitzman. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 4 | |||
| 2 |
04-07-2015
07:35 AM
You should just run a search and use a WHERE clause, take a look at the implementation;
search ... | table Timestamp, Event1 | WHERE (Event1 > 35) AND ()
You will have to come up with what you're looking for inside the last brackets, as I'm not too sure what else you want in there.
... View more
04-07-2015
07:32 AM
Downvoting isn't fair as at the time, the question may have been relevant, and if someone's looking for an answer, it makes it seem like that answer may not work. Plus gives negative reputation for a perfectly valid question / answer.
... View more
04-07-2015
07:31 AM
@piebob - Please provide an official insight into this.
... View more
04-07-2015
07:25 AM
Do you mean on your search results?
If so - On the left hand side is a panel that says "Fields", scroll to the bottom and it'll say "All Fields" Click that and it will bring up a list of all fields on that event. Select the tickbox and clicks save and it will show up.
If not - and you're trying to search for the field, as long as it exists, a simple
search ... | where app = "sencer"
Should do the trick
... View more
04-07-2015
07:23 AM
I would imagine you can use regex for this.... Should be able to generate a field based on a regular expression.
... View more
03-18-2015
05:42 AM
I've experienced the same issue with searches not working in fast or smart mode, but working in Verbose. I wonder if @mus or @piebob can shred any light.
... View more
03-17-2015
08:48 AM
whats the difference? How did you take the first photo?
... View more
03-12-2015
08:07 AM
1 Karma
I have solved this by using;
rex field=_raw "name=heap.max, value=(?<Max>\S+)" | rex field=_raw "name=heap.used, value=(?<Used>\S+)"
... View more
03-12-2015
08:07 AM
Hi,
I'm trying to extract 2 fields from a transacted search, one for the max and one for the usage.
looks like;
2015-03-12 12:10:11,180 INFO metrics - type=GAUGE, name=heap.max, value=1908408320
2015-03-12 12:10:11,181 INFO metrics - type=GAUGE, name=heap.used, value=82831232
... View more
03-11-2015
08:40 AM
I am able to delete all private dashboards via the Web UI on my instance.
... View more
03-11-2015
08:10 AM
Hi,
I believe it's admin_all_objects permission you need.
If you have that, you can see all your dashboards on the "dashboards" tab.
... View more
03-11-2015
07:05 AM
It might be that you're getting too many results. Is this a table? Or is it a graph?
... View more
03-11-2015
06:24 AM
You say when you set it to a 30-sec window it works, but what window do you want to use?
Also, why are you searching for just *?
... View more
03-11-2015
03:27 AM
What do you mean add it?
If you want to extract more, you can add another rex, if you already have it as a field, then add it after Email.
... View more
03-11-2015
03:24 AM
I believe you are able to set variables with an SDK. http://dev.splunk.com/view/java-sdk/SP-CAAAEPZ
... View more
03-10-2015
08:49 AM
You should be able to do this in your conf files, transforms.conf and fields.conf and props.conf
Take a look here, looks like somebody's already answered that question;
http://answers.splunk.com/answers/39405/adding-static-field-value-using-props-transforms-based-on-source.html
... View more
03-09-2015
08:34 AM
No problem Jolver.
you can use < style > tags inside a HTML panel if you wish to add CSS inline.
... View more
03-06-2015
05:50 AM
I don't really get what you're trying to do here, you can set up blacklists/whitelists and set different Host values?
... View more
03-06-2015
05:16 AM
1 Karma
@MuS in other words they weren't in the right directory...
Looking at above comment, didnt do the CD prior to starting
... View more
03-06-2015
04:09 AM
Have you tried using the GUI options to display the axis labels?
... View more
03-06-2015
04:08 AM
I agree with you.
Bins is the only argument that I can see for the timechart command that will be ideal for your situation.
35 should be good if you require about a month span.
... View more
03-06-2015
03:32 AM
Try this:
| stats count | eval msg="No logs!" | table msg
Credit to @hexx from his answer here;
http://answers.splunk.com/answers/50379/table-message-when-no-results-found.html
... View more
03-06-2015
03:28 AM
and is this all part of one page? If so you can use the if statement inside an eval in your search
... View more
03-06-2015
03:28 AM
Is this SQL, or SPL?
... View more
03-06-2015
03:09 AM
As this looks to be standard SQL, or SPL.
You should be able to use numrows or you could use stats count to define a field, and use an if on that field.
... View more
