Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Hajime
Hajime
Path Finder
Member since:
04-08-2010
06-05-2020
Community Statistics
| Posts | 31 |
| Solutions | 6 |
| Karma Given | 3 |
| Karma Received | 6 |
| Member Since | 04-08-2010 |
Activity Feed
- Karma Re: ログの中から漢字やひらがなを抽出する方法は？ for melonman. 06-05-2020 12:47 AM
- Karma Re: How to generate topological graphs ? for Damien_Dallimor. 06-05-2020 12:46 AM
- Got Karma for A reflected XSS vulnerability in Splunk 4.0 through 4.3?. 06-05-2020 12:46 AM
- Got Karma for A reflected XSS vulnerability in Splunk 4.0 through 4.3?. 06-05-2020 12:46 AM
- Got Karma for A reflected XSS vulnerability in Splunk 4.0 through 4.3?. 06-05-2020 12:46 AM
- Karma Re: Yet another filtering problem. Many transforms in transforms.conf not filtering for gkanapathy. 06-05-2020 12:45 AM
- Got Karma for Re: All files are not indexing. 06-05-2020 12:45 AM
- Got Karma for Re: Manual Field Extraction Configuration. 06-05-2020 12:45 AM
- Got Karma for Re: Inconsistent number of spaces in a space-delimited event.. 06-05-2020 12:45 AM
- Posted Re: How to parse and index a log file that contains multiple character set codes? on Getting Data In. 11-15-2016 09:40 PM
- Posted How to parse and index a log file that contains multiple character set codes? on Getting Data In. 11-14-2016 06:28 PM
- Tagged How to parse and index a log file that contains multiple character set codes? on Getting Data In. 11-14-2016 06:28 PM
- Tagged How to parse and index a log file that contains multiple character set codes? on Getting Data In. 11-14-2016 06:28 PM
- Tagged How to parse and index a log file that contains multiple character set codes? on Getting Data In. 11-14-2016 06:28 PM
- Tagged How to parse and index a log file that contains multiple character set codes? on Getting Data In. 11-14-2016 06:28 PM
- Tagged How to parse and index a log file that contains multiple character set codes? on Getting Data In. 11-14-2016 06:28 PM
- Posted Re: Retirement policy of fishbucket on the universal forwarder on Getting Data In. 11-09-2016 08:49 PM
- Posted Re: インデックスの設定について on Splunk Search. 11-07-2016 05:09 PM
- Posted Re: Retirement policy of fishbucket on the universal forwarder on Getting Data In. 11-06-2016 06:12 PM
- Posted Retirement policy of fishbucket on the universal forwarder on Getting Data In. 10-31-2016 10:45 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 3 |
11-15-2016
09:40 PM
Thank you very much for your answer.
I have already checked the documents that you showed.
Then, I asked above questions.
(Although I am thinking that cannot possible to do that...)
... View more
11-14-2016
06:28 PM
Hello,
I want to index a log file that contains multiple character set codes and recognize the correct character set code.
(e.g. UTF-8 and SHIFT-JIS are mixed in one log file)
So, please let me know whether it is possible to do that.
And please let me know correct settings if it can be that.
Thanks.
... View more
11-09-2016
08:49 PM
Thank you very much for your comments.
I have tried that "file_tracking_db_threshold_mb" parameter set the value.
The result showed that the fishbucket rotated to "/opt/splunkforwarder/var/lib/splunk/fishbucket/splunk_private_db/save" directory according to the value, but the fishbucket data was growing up (total data volume of the fishbucket was continuing to increase).
Is this behavior according to the specification?
Please let me know about this.
... View more
11-07-2016
05:09 PM
違う方法としましては、検索対象の時間範囲を当日のみにすればよいと思いますが、いかがでしょうか。
※前提条件としては、イベントのタイムスタンプがデータの作成・修正時刻となっていることです。
なお、frozenTimePeriodInSecsの設定値については、イベントのタイムスタンプをベースとし、設定値に達したものからフローズンの状態に遷移します（既定ではデータが削除されます）ので、タイムスタンプが正しく設定されていないと期待する動作にはなりません。
... View more
11-06-2016
06:12 PM
Thank you for the information.
I have already checked this page.
I want to know whether a size of the fishbucket continue to expand even though "file_tracking_db_threshold_mb" parameter is set.
If you know about that, please let me know.
... View more
10-31-2016
10:45 PM
Hello,
I want to know a retirement policy of the fishbucket on the universal forwarder for a disk sizing.
The data retention period for the fishbucket on the universal forwarder
The maximum size for the fishbuket on the universal forwarder
Could you tell me about it?
Thanks.
... View more
02-23-2016
09:35 PM
Thank you for your kind advice!
... View more
02-23-2016
05:12 PM
Thank you for your answer.
I agree with you.
Also I wish to be written this description to the manuals.
... View more
02-22-2016
06:09 PM
I think the precedence for "SEDCMD" attribute within single stanza is ASCII order.
For example props.conf:
[foo]
SEDCMD-01 = s/foo/bar/g
SEDCMD-02 = s/bar/foo/g
In this case, SEDCMD-01 is done firstly and then SEDCMD-02 is done.
Is this correct?
Please let me know that.
... View more
04-12-2014
05:23 AM
Please see the documents.
http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/Rangemap
... View more
04-09-2014
09:08 PM
Yes. You need to configure css.
... View more
04-09-2014
07:13 PM
Hello, I think the method described in the following documentation is good. (see Example 1)
http://docs.splunk.com/Documentation/Splunk/6.0.2/SearchReference/Rangemap#Examples
As a supplemental explanation, the following parameter's color is defined.
severe, high, elevated, guarded, low
They are defined the following CSS file.
$SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/css/skins/default/default.css
.SingleValue .severe .singleResult {
color: #ff1f24;
}
.SingleValue .high .singleResult {
color: #ff7e00;
}
.SingleValue .elevated .singleResult {
color: #ffb800;
}
.SingleValue .guarded .singleResult {
color: #4da6df;
}
.SingleValue .low .singleResult {
color: #00b932;
}
... View more
11-28-2013
04:58 AM
Thank you for your answer.
However, I want to predict using two time-series data.
Please let me know if you have any good ideas.
... View more
11-19-2013
11:20 PM
Can you calculate the predicted value from any two points (e.g. the data of 1 month ago and the data of 2 months ago) using "predict" command?
In addition, is there any other way?
... View more
- Tags:
- predict
06-09-2013
04:27 AM
Thank you for answering my questions.
... View more
06-06-2013
08:01 PM
Hello wouterr,
I think as you said bmacias84, and may be set as follows.
TIME_PREFIX=","
OR
TIME_PREFIX=,"
... View more
06-06-2013
07:38 PM
3 Karma
Hi,
Does the reflected cross-site scripting vulnerability (SPL-59895, CVE-2012-6447) affect to Splunk 4.0 through 4.3?
If that versions are affected, please tell me what to do.
Thanks,
... View more
- Tags:
- vulnerability
03-17-2011
01:42 AM
I understand you don't want select any .tmp files.
But I think it is difficult to exclude .tmp files.
The reason can not use "(?!.tmp)" and "(?<!.tmp)" because there are no clear boundaries.
...If you want to search, I think that you extract "Object Name" field and adding the searching conditions: | regex field!=ObjectName ".tmp$"
... View more
03-15-2011
01:12 AM
Hmm, it's difficult... How about this one.
REGEX = (?msi)^EventCode=(4663|567|560).Object Name:\t+..tmp.*Accesses:\t+(DELETE|WRITE_DAC|WriteData)
... View more
03-14-2011
05:15 AM
Hello DB,
Try this one:
REGEX = (?msi)^EventCode=(4663|567|560).*Object Name:.*\.tmp\s.*Accesses:\s(DELETE|WRITE_DAC|WriteData)
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:02 AM
|
