About dscoland

dscoland · ‎07-09-2014

Nice, it worked! Thank you.

martin_mueller · ‎07-02-2014

Yeah, this is what throttling by field values was built for: http://docs.splunk.com/Documentation/Splunk/6.1.1/Alert/Defineper-resultalerts#Set_up_throttling_for_a_per-result_alert

lguinn2 · ‎06-27-2014

All you should need to do is to put the full path to the script in the right box of the alert actions.

dscoland · ‎06-30-2014

Installed Python on our central Splunk instance, and uploaded the SDK via the web interface of Splunk.

dscoland · ‎06-24-2014

It looks like this can't be run as a real-time alert because it will alert every time that there is a match in the subsearch. Is that a bug?

kristian_kolb · ‎03-24-2014

Yes, you need to restart splunkd - either from the outside, like restarting the service, or from the inside, in the GUI, or hit the refresh endpoint url; http(s)://your_splunk:8000/en-US/debug/refresh That will also reload most configs. Purely search-related configs, such as field extractions will be reloaded for each search. /k

Posts	20
Solutions	1
Karma Given	2
Karma Received	3
Member Since	‎02-25-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Monitor DHCP Logs Via Wildcard?

Is there a way to suppress an alert based upon fie...

Execute .cmd Splunk CLI Script alert with .sh She...

How to Install Python SDK for Splunk on Windows Se...

Creating Indirect / Cascading Search

Heavy Forwarder REGEX Filting Issues

Re: Monitor DHCP Logs Via Wildcard?

Re: Is there a way to suppress an alert based upon...

Re: Execute .cmd Splunk CLI Script alert with .sh...

Re: How to Install Python SDK for Splunk on Window...

Re: Creating Indirect / Cascading Search

Re: Heavy Forwarder REGEX Filting Issues

Join the Conversation