Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About mendesjo
mendesjo
Path Finder
Member since:
07-14-2015
12-10-2020
Community Statistics
| Posts | 79 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 4 |
| Member Since | 07-14-2015 |
Activity Feed
- Got Karma for How do you search IronPort events and return the whole email transaction?. 09-09-2021 09:05 PM
- Posted Re: Splunk send alert if event count reaches some value with server which has that value. on Alerting. 12-10-2020 08:39 AM
- Karma Re: Dedup with removal of null columns for Fenrir. 12-09-2020 07:11 AM
- Got Karma for Re: Is it possibl to get a list of available indices ?. 09-25-2020 06:16 AM
- Got Karma for Re: |metadata - Need results for Custom time range. 06-05-2020 12:47 AM
- Got Karma for Re: How do I limit the "export results" action to export only the fields that were presented to the client using FieldPicker module with StrictMode param set to "True"?. 06-05-2020 12:45 AM
- Posted Re: Anybody seen search/indexer performance degradation after installing Meltdown patches on Linux on Splunk Search. 01-10-2018 01:34 PM
- Posted Re: Anybody seen search/indexer performance degradation after installing Meltdown patches on Linux on Splunk Search. 01-10-2018 01:22 PM
- Posted Re: Splunk DB Connect 2: After upgrading Splunk to 6.4.1, why is a "select * from" statement added to our query? on All Apps and Add-ons. 12-06-2017 10:31 AM
- Posted Re: How to get size counters for Splunk indexes over a period of time to check how fast volume utilization is growing? on Getting Data In. 05-02-2017 03:40 PM
- Posted Re: After configuring LDAP authentication with Active Directory in Splunk, why are LDAP user details for some users deleted after a login attempt? on Security. 04-17-2017 09:31 AM
- Posted Re: With my current Splunk environment running on Linux, what happens with service account password changes? on Deployment Architecture. 02-20-2017 02:52 PM
- Posted Re: With my current Splunk environment running on Linux, what happens with service account password changes? on Deployment Architecture. 02-20-2017 07:33 AM
- Posted With my current Splunk environment running on Linux, what happens with service account password changes? on Deployment Architecture. 02-16-2017 07:57 AM
- Tagged With my current Splunk environment running on Linux, what happens with service account password changes? on Deployment Architecture. 02-16-2017 07:57 AM
- Tagged With my current Splunk environment running on Linux, what happens with service account password changes? on Deployment Architecture. 02-16-2017 07:57 AM
- Tagged With my current Splunk environment running on Linux, what happens with service account password changes? on Deployment Architecture. 02-16-2017 07:57 AM
- Tagged With my current Splunk environment running on Linux, what happens with service account password changes? on Deployment Architecture. 02-16-2017 07:57 AM
- Posted Re: How to combine multiple searches and output results into one CSV file? on Getting Data In. 01-12-2017 12:57 PM
- Posted Re: How to combine multiple searches and output results into one CSV file? on Getting Data In. 01-12-2017 12:55 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
02-12-2016
03:26 PM
Results displayed.. Meaning when I query Splunk, first colum that says time is in UTC format. I want that to display in local time. Thanks
... View more
02-12-2016
12:35 PM
Yes but how do you display your query in local time? In stead of UTC?
... View more
02-11-2016
10:09 AM
I'm seeing the same thing on one of our dashboards, i do the same exact query from the search bar, vs the dashboard and get different results.
... View more
02-02-2016
07:35 AM
Excellent!
... View more
02-02-2016
07:30 AM
another query posted that doesn't work.. at least for me.. changing idx to i also gives no results found 😞
... View more
01-28-2016
10:05 AM
same here.. nothing.. another query that doesn't work.
... View more
01-28-2016
10:01 AM
I find that allot ... people with good intentions providing query's (that I'm gratefull saves allot of time) but many don't work..
... View more
01-26-2016
01:08 PM
Yes.. and after I restarted splunk I think newly created diretories and data being created in my new cold bucket location. Simply, as I stated what I would like to do is query for data that I did not copy over (with the expected result of no data retrieved for that time period), then manually copy cold bucket data from old location to new location, re-query and now see the data.
... View more
01-26-2016
08:05 AM
Thank you! Ok, that seemed to work but this is what I do not understand. I'm querying for data sitting in our old cold directory using the time stamp and i'm getting results, how? What I was expecting is that I would get no results, then manually copy the data to new cold directory as specified then re-try the query and I would get results, in order to test moving data from old cold directory to new.
... View more
01-25-2016
11:11 AM
Hello, I modified my cold bucket location, and I want to perform some test queries for data residing in cold buckets storage only. Is there a way to do this?
... View more
- Tags:
- splunk-enterprise
01-14-2016
04:55 PM
Thanks, now the problem is, I don't have mid as field. I did install the add-on but no luck with any of the fields that I see in the props.conf that came with the app pre-defined, such as MID ICID etc.. Even when i use a query with MID defined using regex, I get the field now but no data.. I don't get it. here is my test query, note that the MID seen is phony but the one I use does exist. What I'm expecting is for the query to group all events with that MID. But something else is wrong as again I have the add-on installed but none of the fields are present for this index are present like MID, ICID, dcid, from, subject etc etc.
index=email sourcetype=/home/jm/2016-01-10.log | rex field=_raw "MID (?\d+)" | table mid 1234567
... View more
01-14-2016
11:05 AM
Same problem.. I installed this add-on on my test box.. and I was hoping that now all the fields would appear to query such as MID, ICID etc, and then use transaction command to query and group an entire email transaction just like Ironport does it when you perform message tracking on the ironport itself and it groups all the events for a single email transaction nicely. This is proving to be very difficult. I even tried using the regex's that were included in this app for example for MID they have regex as MID (?\d+), I tried rex field=_raw "MID\s(?\d+)" in a query and that doesn't even work right. So.. frustrated.
... View more
01-14-2016
06:49 AM
Thank you.. I tried transaction command but wasn't working. I then realized why MID wasn't working, it's because MID hasn't been defined as a field. Ok.. I'll have to figure that out. Thanks for the suggestions I'm definetly closer now.
... View more
01-13-2016
06:21 PM
1 Karma
Can anyone suggest how you query IronPort logs? When I query mail logs on the ironport itself, say for an email from xzy@whatever.com, and I click on details, it groups all the events of that transaction together nicely so I can see what happened start to finish. When I search in Splunk, it doesn't do that.. so question is, how do I do that? I found one or two other folks that I think have the same problem or asking the same question as I, and the transaction command looks promising, tried a few searches, but no results. I'm fairly new to Splunk so any suggestions would be appreciated.
... View more
11-13-2015
12:15 PM
Thanks for the reply. So, does this app somehow coorelate existing data in my splunk environment with Verizon's data? How will it obtain the Verizon information, does it down load it somehow?
... View more
11-13-2015
05:07 AM
Ok I installed the app, now what? I have some pretty pull down menus... what do you do next?
... View more
10-09-2015
03:39 PM
I setup a brand new splunk box, and I go to forwarder managment and I get "there is an error in your serverclass.conf which is preventing deployment server from initializing. Please see your serverclass.conf.spec file for more information." Thought this might help but from reading above I dont' don't know how to create a a serverclass.conf or where it goes. What should it be for a new blank server?
... View more
10-06-2015
04:44 PM
Beautiful that work, thanks so much! Now I wanted a GUI to manage this, and after some reading the suggestion was to load fedora workstation, so I did a "sudo dnf group install "Fedora Workstation" which worked, not how do I start the gui? Also, it did something else, if I reboot my server I can't SSH anymore says connection refused. After some digging I found that the service wasn't started, I have to "start sshd start" then I can SSH. God I miss windows, thank you in advance.
... View more
10-05-2015
06:36 PM
Ok, I'm new to Splunk and new to unix.. I never thought I would miss Windows server but I do. Anyway, I'm trying to learn so I can manage our production environment and so I set up a fedora 22 box as a VM on my system to learn. All went well, after a lot of googling about different things, but a few things still don't work, and I have a few questions hoping someone may help.
1)Modified the bash file to include the Splunk bin directory in the path in my case /apps/splunk/bin I reboot and path is there, but doesn't work. I have to go to /apps/splunk/bin directory to do anything. Why?
2)At work all I have to do is type splunk status or whatever I want, on my home test system I have to type ./splunk status. Why?
3)My biggest issue is I can't connect to http://splunkserver:8000. Why? I checked firewall, that seems to be ok. I did a netstat it seems to say listening so I think it's ok. As part of Fedora, it installs this free ipa software that works on port 8089 and a using a web browser to that port that free IPA software loads, so I think maybe it's Splunk, but what? A splunk status says splunkweb is running, and again port 8000 says listening. What else could it be? I loaded version 6.0.1 as that's what we are running at work and I want to test a 6.3 upgrade.
Any help would be appreciated.
... View more
09-14-2015
11:53 AM
1 Karma
same issue as above, any solution?
... View more
09-02-2015
02:41 PM
| eventcount summarize=false index= index=_ | dedup index | fields index
doesn't work I get "no results found"
... View more
09-02-2015
02:40 PM
1 Karma
Brand new stupid user here, my results:
1st suggestion:
| eventcount summarize=false index=* index=_* | dedup index | fields index
= error in eventcount command: this command is not supported in a real-time search
index=* | dedup index | fields index
This works, but doesn't give you a nice list, rather provides tons of individual lines of data
$SPLUNK_HOME/bin/splunk list index
No results at all.
So for me, again newbie here none of these worked for me..
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-10-2020
02:00 PM
|
