Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About eduardKiyko
eduardKiyko
Explorer
Member since:
04-24-2018
06-05-2020
Community Statistics
| Posts | 11 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 1 |
| Member Since | 04-24-2018 |
Activity Feed
- Karma How to compare results and assign values from Lookup? for dhawanvarun. 06-05-2020 12:49 AM
- Got Karma for How can I make the Powershell add-on script's run on a schedule?. 06-05-2020 12:49 AM
- Posted AppInspect tool does not allow action.email.to by default entry in the alerts on All Apps and Add-ons. 05-15-2020 03:55 AM
- Tagged AppInspect tool does not allow action.email.to by default entry in the alerts on All Apps and Add-ons. 05-15-2020 03:55 AM
- Tagged AppInspect tool does not allow action.email.to by default entry in the alerts on All Apps and Add-ons. 05-15-2020 03:55 AM
- Tagged AppInspect tool does not allow action.email.to by default entry in the alerts on All Apps and Add-ons. 05-15-2020 03:55 AM
- Tagged AppInspect tool does not allow action.email.to by default entry in the alerts on All Apps and Add-ons. 05-15-2020 03:55 AM
- Posted Re: how to perform calculations using eval command? on Splunk Search. 12-12-2019 05:11 AM
- Posted Re: Filter by time where date is in seperate field on Splunk Search. 12-12-2019 05:02 AM
- Posted Re: how to perform calculations using eval command? on Splunk Search. 12-12-2019 04:45 AM
- Posted Splunk CIM data models acceleration issue on Splunk Dev. 04-15-2019 04:13 AM
- Tagged Splunk CIM data models acceleration issue on Splunk Dev. 04-15-2019 04:13 AM
- Posted Can you help me figure out why the "previous 30 days" tab isn't working in the license usage report view? on Installation. 02-19-2019 02:19 AM
- Tagged Can you help me figure out why the "previous 30 days" tab isn't working in the license usage report view? on Installation. 02-19-2019 02:19 AM
- Tagged Can you help me figure out why the "previous 30 days" tab isn't working in the license usage report view? on Installation. 02-19-2019 02:19 AM
- Tagged Can you help me figure out why the "previous 30 days" tab isn't working in the license usage report view? on Installation. 02-19-2019 02:19 AM
- Posted Re: you are using hostname:8000, which is connected to splunkd @000 at https://127.0.0.1:8089 on Security. 02-13-2019 05:50 AM
- Posted Re: Universal forwarder issue in AWS on Getting Data In. 02-13-2019 05:46 AM
- Posted Re: Can anyone help me to match a value into lookup.csv if condition on Splunk Search. 02-13-2019 03:34 AM
- Posted Re: Test if host sends the same logs on Splunk Search. 02-06-2019 12:58 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
05-15-2020
03:55 AM
Hello everyone!
Recently i faced an issue with appinspect and email alert action. I got this message:
"Alert name" has specified the `action.email.to` property with a provided value. This should be left empty or removed. File: default/savedsearches.conf Line Number: 50
However, if I put the email into action.email.cc it works, but I need to have an email address in the "to" option(which is kinda weird on my opinion).
In the Splunk dev documentation(https://dev.splunk.com/enterprise/docs/releaseapps/appinspect/appinspectreferencetopics/splunkappinspectcheck/#Saved-search-standards) it's also mentioned:
Check that email alerts (action.email.to) set in savedsearches.conf do not have a default value.
But my client currently has Splunk Cloud deployment and we want just to put all the alerts into private app for internal usage.
So, it there any way to omit this issue? Because it looks like I cannot upload the private app to the Splunk Cloud having alerts with "email.to" option.
... View more
12-12-2019
05:11 AM
Yes, any type of clause that works with eval according to documentation, will work, but in your case you can use "in" as well.
For example, this search will show errorcount = 0(as there are no events with healthvalue 4%):
| makeresults
| eval healthvalue="100%"
| eventstats count(eval(in(healthvalue, "4%"))) as errorcount
And this one will show errorcount = 1(one event with healthvalue 4%):
| makeresults
| eval healthvalue="4%"
| eventstats count(eval(in(healthvalue, "4%"))) as errorcount
... View more
12-12-2019
05:02 AM
You can create _time field right in search query, like this:
| eval _time=strptime(Created,"%Y-%m-%d %H:%M:%S")
... View more
12-12-2019
04:45 AM
At first, if you use both "stats count" and "stats avg" in the same search, the last expression is going to have no output, because of first one. Try to use eventstats instead.
And at second thing: I'm not sure that "avg" function will work properly with your double quotes and percent mark(maybe Splunk understands "'4%'" expression as a String, not a number). But anyway, hope, it will help:
| makeresults
| eval healthvalue="'4%'"
| eventstats count(eval(in(healthvalue, "'4%'","'5%'","'1%'","'8%'" ,"'12%'"))) as errorcount
| eventstats avg(eval(in(healthvalue, "'4%'","'5%'","'1%'","'8%'" ,"'12%'"))) as errorcount
... View more
04-15-2019
04:13 AM
Hi all!
I am developing Splunk app right now and I observe some really weird stuff related to data models. I ve cloned Network_Resolution data model and I have 2 fully the same data models, but there is one issue: manually cloned data model easy accelerates and Splunk s CIM data model doesn`t. The only difference - these data models belongs to different apps.
Maybe anyone have faced with similar issue before? If yes, how did you fix this?
... View more
- Tags:
- splunk-enterprise
02-19-2019
02:19 AM
Hi all,
There are no results found when I use this dashboard in Splunk 7.2.4, but the first one (today) is working. I have read Splunk documentation about that, but I have just one standalone instance. Btw, all required inputs(license_usage.log) are enabled.
How can i fix that ?
Thank you.
... View more
Labels
- Labels:
-
license
02-13-2019
05:50 AM
What does it mean "using {myhostname}:8000 connected to splunkd @000 at https://127.0.0.1:8089 "? Is it a universal forwarder or Splunk enterprise?
... View more
02-13-2019
05:46 AM
It could be a lot of reasons. Did you configure outputs.conf? Did you configure network setting? Are instances able to ping each other?
... View more
02-13-2019
03:34 AM
Hi, @louisawang
Try this query:
| inputlookup public_holiday.csv
| eval today = strftime(now(),"%Y-%m-%d")
| eval SLA_DEADLINE = 1
| rename datefield AS public_holiday
| eval SLA_DEADLINE = case((public_holiday==today),SLA_DEADLINE+86400,true(),SLA_DEADLINE)
| table today public_holiday SLA_DEADLINE
I added a couple of rows(third and sixth) for better understanding, in my case it works
... View more
02-06-2019
12:58 AM
Hi, @bntdumas
How can I identify these logs? Is "Start of initialisation" a sourcetype something like that?
... View more
04-24-2018
06:18 AM
1 Karma
I have an add-on that I'm deploying on Windows systems. inputs.conf looks like this:
[powershell://Processes-EX1]
script = . "C:\Program Files\SplunkUniversalForwarder\etc\apps\Powershell_add_on\bin\Get-Policies.ps1
schedule = 0 * * *
sourcetype = WindowsPowershell
index = test
disabled = 0
I want this to run at every minute 0, every hour.
But It runs only once when I start Universal Forwarder. Then, when I restart forwarder, it runs again and only once. When forwarder is working for 2 or more hours(script should run at least 2 times) just nothing happens.
How can I make scripts run on schedule?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
