Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About markthompson
markthompson
Builder
Member since:
09-29-2014
06-05-2020
Community Statistics
| Posts | 243 |
| Solutions | 17 |
| Karma Given | 67 |
| Karma Received | 68 |
| Member Since | 09-29-2014 |
Activity Feed
- Got Karma for Re: Why am I getting error "The license signature is not a base64-encoded string" trying to add my license in Splunk 6.2?. 01-06-2025 02:27 AM
- Got Karma for How to round stats average to 2 decimal places?. 09-13-2023 03:01 PM
- Got Karma for Re: Can an input be enabled or disabled based on another input?. 03-10-2022 02:39 AM
- Got Karma for How to round stats average to 2 decimal places?. 12-23-2020 01:33 PM
- Got Karma for Re: How to make a drop-down form wider?. 06-05-2020 12:48 AM
- Karma Real time search, how to check if event doesn't exist and return something if it doesn't. for DavidHourani. 06-05-2020 12:47 AM
- Karma Re: Is there a URL Prefix variable in Simple XML? for LukeMurphey. 06-05-2020 12:47 AM
- Karma Re: How can I search and return only the first occurrence of a string? for musskopf. 06-05-2020 12:47 AM
- Karma Can I create a new field for each value contained in an existing field? for mrfredman. 06-05-2020 12:47 AM
- Karma How to search count trends by displaying a 3 column table with source name, count (last 10 min) and count (now)? for vikas_gopal. 06-05-2020 12:47 AM
- Karma Output first event and last event. for ferza. 06-05-2020 12:47 AM
- Karma How to search Splunk indexes' event count for the last one hour including zero counts? for dhavamanis. 06-05-2020 12:47 AM
- Karma Date not parsed if the hour is 24 for reggie_123. 06-05-2020 12:47 AM
- Karma Splunk Time Based Retention for nspatel. 06-05-2020 12:47 AM
- Karma How to edit my inputlookup subsearch to return field values from the csv only if the values were not found? for TobiasBoone. 06-05-2020 12:47 AM
- Karma Re: How to setup an alert if any index size goes over 90%? for MuS. 06-05-2020 12:47 AM
- Karma Re: Where can I find a complete list of data source types that can be indexed in Splunk? for MarioM. 06-05-2020 12:47 AM
- Karma Monitoring Active Directory groups, is it possible to send an email alert to the individual who was added or removed from the group? for 8i5. 06-05-2020 12:47 AM
- Karma Re: How do i file a Splunk Support Case/ contact Splunk Support? for vhallan_splunk. 06-05-2020 12:47 AM
- Karma Re: Using splunk to create and view table metadata for aweitzman. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 4 | |||
| 2 |
02-24-2015
02:39 AM
Vinod I believe what Ed is trying to achieve is to list it in his map, not to have an answer to the question.
... View more
02-24-2015
02:14 AM
@Dark_Ichigo - I'm afraid I have to agree with dwaddle, it appears that it's not officially supported as I've just been through all the documentation on upgrading and haven't seen anything about upgrading from a BETA to a release version.
... View more
02-24-2015
02:00 AM
You say this is happening on the dashboard, does it happen when you use the search functionality?
If so, is there a certain date which causes it to error?
... View more
02-24-2015
01:26 AM
Hi Madhan,
If you use a website such as www.tinypic.com
You can upload your image there, and it will provide you with a link for you to put here, and then we just load up that link and it will display the image.
... View more
02-24-2015
01:16 AM
Unfortunately it's just showing as a broken image
We cannot see localhost as it's running on your machine, please take a picture using Snipping Tool
... View more
02-24-2015
01:01 AM
Can you please provide a screenshot of your dashboard, so that we can see it?
Thanks
... View more
02-24-2015
12:59 AM
Have you tried looking at metadata, you can use that to list sourcetypes etc?
... View more
02-24-2015
12:57 AM
1 Karma
@MuS @ppablo_splunk @piebob - Just updated the post to include some images of what I'm seeing
... View more
02-24-2015
12:53 AM
The first thing I'd try would be to restart the Splunk instance, it might have just disappeared due to a bug or something, rebooting the system usually helps reset things like this
... View more
02-24-2015
12:52 AM
Madhan,
Please provide more detail in the form of;
Was it there before?
If so, what changed?
Whats on the dashboard?
... View more
02-24-2015
12:51 AM
@Stabbles - Can you view it in the job inspector and share a screenshot please
... View more
02-24-2015
12:50 AM
Can you explain in a bit more detail? I'm struggling to understand what you want to table.
... View more
02-23-2015
07:44 AM
Try this:
(index="imwaccesslog" AND sourcetype=IMWAccessLog) OR (index="nbdrest-performance" AND sourcetype="PerfNBDCustomTSV" )
... View more
02-23-2015
07:32 AM
Thats good 🙂
Try:
sort -count
OR
sort +count
... View more
02-23-2015
07:12 AM
1 Karma
Right, so for that you would need the Count function of the stats command,
please read this documentation:
http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Stats
It will provide you with an overview of one of the other output commands, Stats which will be useful for ou in the future
... View more
02-23-2015
07:04 AM
OK, so lets start with the formatting of the date, I believe, as you're still learning, that you should make the most of the commands, and not take the easy way out, so instead of using a regex to extract your date, we can use the convert functionality.
So;
convert timeformat="%b %d %H:%M" ctime(_time) as Time
This will transform your _time stamp into the format that you require, into a new field called Time
What do you mean by *5?
... View more
02-23-2015
06:56 AM
Which parts of the data do you need to produce to your management?
... View more
02-23-2015
06:54 AM
Hi Paul,
No problem,
If you can give us sort of a template that your data follows, and anything sensitive just put *******, atleast then we can get the jest of your data.
Just a quick comment, instead of replying in the form of an answer, it'll make the thread look untidy, if you just comment on one of our answers 🙂
... View more
02-23-2015
06:48 AM
1 Karma
Hi Vinod,
Pivot is a good idea, I mean, I like it and I considered suggesting it, but given the circumstances and @renopaul wanting to learn more about how searching works etc, I suggested he start with table and by outputting his results.
From here he can start using pivot, I mean, I don't use it that much, I prefer to table things and chart things on a dashboard as we are in the process of going paperless.
... View more
02-23-2015
06:38 AM
Hi renopaul,
No worries, everyone starts somewhere!
You could use the table command, which is one of the output commands and is used in the format: | table
So you could use:
table _time, User
But if you can provide an example of your data, I'm sure there are plenty of other things that we can help you to achieve.
... View more
02-23-2015
06:12 AM
Alternatively,
Sourcetypes only exist if data are set with them, unless they are defined in props.conf.
So delete all indexed data, using;
sourcetype=test_csv* | delete
Then re-index it, setting your sourcetype of your input to test_csv
🙂
... View more
02-23-2015
06:09 AM
The first point, is that the if statement only takes 3 arguments, if(condition, iftrue, iffalse).
... View more
02-23-2015
05:57 AM
Not to worry,
try using this instead in props.conf
[old_sourcetype] rename = new_sourcetype]
This will rename your existing sourcetypes with one sourcetype, meaning you don't have to delete it.
Let me know if it works
... View more
02-23-2015
05:28 AM
Hi Ben,
Glad it helped.
Please vote up!
... View more
02-23-2015
05:14 AM
Please accept the answer and vote up so that others who experience the same issue can easily locate the correct answer.
Thanks
... View more
