Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About simpkins1958
simpkins1958
Contributor
Member since:
11-25-2014
06-05-2020
Community Statistics
| Posts | 153 |
| Solutions | 4 |
| Karma Given | 4 |
| Karma Received | 32 |
| Member Since | 11-25-2014 |
Activity Feed
- Got Karma for Re: How to get time-based lookups working with KV Store?. 02-02-2021 04:36 PM
- Got Karma for How to get time-based lookups working with KV Store?. 02-02-2021 04:36 PM
- Got Karma for Data Model Acceleration TSTATS where clause NOT working. 11-23-2020 04:45 AM
- Got Karma for Re: Want to condition match when a value is a single asterisk. 06-11-2020 11:58 PM
- Got Karma for Accelerated data model and _indextime field. 06-05-2020 12:50 AM
- Got Karma for After updating a system to 7.2 and changing the tsidxWritingLevel value to 2, will existing indexes be regenerated to the new format?. 06-05-2020 12:50 AM
- Got Karma for Re: mstats latest(_time) not working. 06-05-2020 12:50 AM
- Karma Re: Simple XML Setting Token Value from Javascript not working for niketnilay. 06-05-2020 12:49 AM
- Got Karma for default.xml color option in Splunk 7.1 different then 7.0. 06-05-2020 12:49 AM
- Got Karma for Re: Background color in navbar is gone in 7.1 and 7.2. 06-05-2020 12:49 AM
- Got Karma for What is causing HotBucketRoller errors?. 06-05-2020 12:49 AM
- Got Karma for Re: Want to condition match when a value is a single asterisk. 06-05-2020 12:49 AM
- Got Karma for Re: Want to condition match when a value is a single asterisk. 06-05-2020 12:49 AM
- Got Karma for Splunk extract for localization is not pulling strings from prebuilt panels. 06-05-2020 12:49 AM
- Got Karma for Data Model Acceleration TSTATS where clause NOT working. 06-05-2020 12:49 AM
- Got Karma for Referencing a saved search in simple xml not returning the most recent saved search anymore. 06-05-2020 12:49 AM
- Got Karma for Is this a known issue that splunk-optimize.exe on windows is faulting?. 06-05-2020 12:49 AM
- Got Karma for Export PDF option does not work. 06-05-2020 12:49 AM
- Karma Re: multiple description for shaskell_splunk. 06-05-2020 12:48 AM
- Karma Re: Why would INDEXED_EXTRACTIONS=JSON in props.conf be resulting in duplicate values? for mattymo. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-09-2019
07:20 PM
I would like to see examples of perfmon inputs.conf settings. I tried setting up Windows perf mon using the Splunk web as documented here: https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/MonitorWindowsperformance
I expected an inputs.conf file to have the settings I configured using the Splunk Web. But I can find no inputs.conf file that has been modified and has the perfmon information.
When configuring perfmon from Splunk Web where are the setting stored? Does not seem to be in a conf file.
... View more
08-27-2019
01:22 PM
No. That does not work either.
Error in 'stats' command: The argument '_index_earliest=-h@h' is invalid.
... View more
08-27-2019
12:14 PM
1 Karma
We have an accelerated data model and would like to be able to use a where clause from TSTATS that includes:
_index_earliest=-h@h AND _index_latest=@h
_indextime does seem to be a field that is available in the DMA. But trying to use the where clause above does not work.
We want to generate TSTATS values for events that have been indexed in the previous hour.
Here is the full SPL:
| tstats
min(_time) as _time
sum(nmds_app_dest_survey.bytes) as bytes
sum(nmds_app_dest_survey.flow_count) as flow_count
FROM datamodel=nmdm_app_dest_survey
WHERE _index_earliest=-h@h AND _index_latest=@h
BY nmds_app_dest_survey.dest_and_port
... View more
Labels
- Labels:
-
data model
-
report acceleration
08-02-2019
12:07 PM
I have a dashboard that I only want to have visible if specific user roles, admin and miq_admin. When I log in as a user with miq_user role menu item is still there and can click and view the dashboard. Using splunk 7.3.0. I have restarted splunk and still not working as expected.
... View more
08-02-2019
11:33 AM
The documentation at https://docs.splunk.com/Documentation/Splunk/latest/Viz/DashboardPermissions#Update_dashboard_permissions
says "Navigate to the Dashboards page". I can not find a "Dashboards" page in Splunk 7.3. Where is it located?
... View more
07-30-2019
07:58 PM
rest_properties_get has been enabled and still not working.
... View more
07-30-2019
06:26 PM
User with these capabilities fails, but ADMIN user works.
This SPL works fine when logged in as ADMIN, but does not work when logged in as a poweruser account. What capabilities do I need to turn on for user when not ADMIN?
| rest splunk_server=local /services/authentication/httpauth-tokens
| search NOT userName="splunk-system-user"
| eval _time = strptime(timeAccessed, "%c")
| rename userName AS user
| table _time user
Failed to fetch REST endpoint uri=https://127.0.0.1:8089/services/authentication/httpauth-tokens?count=0 from server https://127.0.0.1:8089. Check that the URI path provided exists in the REST API.
... View more
07-11-2019
09:10 AM
Seeing lots of "SearchEvaluator - using old evaluator" in search.log for TSTAT with DMA.
Could someone please explain what this means?
Only seeing this with Splunk 7.3. Not seeing for the same search with 7.2.5.
... View more
04-03-2019
08:07 AM
Should srchMaxTime work with data models and tstats? See my question at: https://answers.splunk.com/answers/738545/trying-to-limit-search-duration-with-srchtimewin-a.html
... View more
04-03-2019
07:47 AM
Trying to limit search duration to 30 days. Working as expected except with data models and tstats. Should srchTimeWin work with tstats?
authorize.conf:
[role_user]
srchTimeWin = 2592000
... View more
03-27-2019
08:49 AM
@ashleyherbert - this is working well when using on a dashboard interactively. When have multiple selections working well. But if refresh the page selections go back to "All". If save as a book mark and open from the bookmark the multiple selections are not selected, back to "All".
... View more
03-05-2019
02:16 PM
Adding this to props.conf fixed the issue:
[nm_MobileDiagnosticsReportData]
KV_MODE = json
... View more
03-05-2019
10:12 AM
When the events are inserted via HEC running a fieldsummary DOES NOT show report field. When the same raw event is input via a file fieldsummary DOES show report field.
... View more
02-10-2019
03:56 PM
No the report field is not listed.
... View more
01-29-2019
08:30 AM
Have a field in our HEC input that is larger the 10,000 characters. When searching the data input from HEC the field is has not been extracted. It is in _raw and I can pull it out of there. Really would like to be able to have the field extracted.
props.conf has:
TRUNCATE = 0
I can manually input the same data via a text file and the large field (a blob of JSON text) is extracted and available fine. Just not when input via HEC.
See screen shots
... View more
01-09-2019
10:56 AM
Works perfectly. Thanks!!
... View more
01-09-2019
09:17 AM
I'm trying to implement a solution similar to https://answers.splunk.com/answers/149649/clean-all-filter-inputs-with-a-button.html.
The one issue I am having is the HTML is displaying on a new row. Want it aligned with the other INPUTs.
</change>
</input>
<html><a>Reset Filters</a></html>
</fieldset>
... View more
01-09-2019
08:23 AM
When I add the HTML section to the FIELDSET it is presented on a new line instead of the row with other INPUTS . Anyway to keep HTML on same row with other INPUTs ?
... View more
10-11-2018
09:15 AM
1 Karma
Misunderstanding on my part. I thought we could get the earliest/latest time value. Now I see that latest()/earliest() are for the metric value not _time value.
In 7.2 there are new time functions latest_time() and earliest_time() that get the time values.
... View more
10-11-2018
09:02 AM
I am not able to get the latest (or earliest) _time values using mstats.
| mstats sum(bytes) latest(_time)
where index=metrics_app_dest_survey by app_name
is returning:
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
