Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About dglass0215
dglass0215
Path Finder
Member since:
12-16-2014
07-19-2024
Community Statistics
| Posts | 52 |
| Solutions | 0 |
| Karma Given | 5 |
| Karma Received | 2 |
| Member Since | 12-16-2014 |
Activity Feed
- Posted Re: Transpose - Include data in column vs row on Splunk Enterprise. 07-18-2024 12:38 PM
- Posted Transpose - Include data in column vs row on Splunk Enterprise. 07-18-2024 12:02 PM
- Posted Re: v9.1 upgrade issues - Why does Top tool bar shows Loading? on Splunk Enterprise. 08-30-2023 11:59 AM
- Posted Dashboard Studio - Marker Map - Drilldown? on Dashboards & Visualizations. 12-29-2022 08:14 AM
- Posted Re: Active Directory Credentials on Splunk Enterprise. 09-12-2022 11:26 AM
- Posted Active Directory Credentials- How do I prevent AD disabling accounts? on Splunk Enterprise. 09-06-2022 12:26 PM
- Posted Cell background color - Stats Table on Splunk Search. 04-28-2021 06:36 AM
- Posted Re: Query Performace on Splunk Search. 04-28-2021 06:23 AM
- Posted Re: Query Performace on Splunk Search. 04-28-2021 06:22 AM
- Posted Query Performace on Splunk Search. 04-27-2021 11:02 AM
- Posted Are the App Data Input fields extractable? on Splunk Search. 03-19-2021 10:34 AM
- Posted Re: Role Capability to Query Lookup on Security. 03-19-2021 10:19 AM
- Posted Re: Role Capability to Query Lookup on Security. 03-19-2021 09:22 AM
- Posted Re: Role Capability to Query Lookup on Security. 03-19-2021 09:07 AM
- Posted Role Capability to Query Lookup on Security. 03-19-2021 08:48 AM
- Posted csv lookup number vs string on Splunk Search. 09-30-2020 09:39 AM
- Posted Linux dashboards on Dashboards & Visualizations. 09-24-2020 09:37 AM
- Got Karma for Re: Finding out which users have certain software installed. 06-05-2020 12:51 AM
- Got Karma for Re: Finding out which users have certain software installed. 06-05-2020 12:51 AM
- Karma Re: Help with REGEX to create field extraction for rbechtold. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-18-2024
12:38 PM
First, let me say thank you! It certainly works and is exactly what I was looking for. But man, isn't there any other easier way? lol
... View more
07-18-2024
12:02 PM
Hello! Wondering if someone can help me fine tune my query. I have it very close but not quite what I want.
Here is my query in addition to screenshot of what the results currently look like:
[SomeSearch] | stats sum(FRCount) as totalHourCount by QSDateOfTxn, QSHourOfTxn limit=1000
| eval PPM = round(totalHourCount/60,2)
| transpose 0 header_field=QSHourOfTxn
I would like the date to be a column (it is possible there would be multiple dates) but still show both totalHourCount and PPM as is per every hour.
Thanks,
David
... View more
Labels
- Labels:
-
development
-
troubleshooting
08-30-2023
11:59 AM
I see they just released 9.1.1 today. Wondering if anyone can confirm if this issue is fixed in 9.1.1? Additionally if anyone who opened a case could respond, I'd like to hear what support is suggesting as I am currently experiencing this on some important screens. Thanks, David
... View more
12-29-2022
08:14 AM
Hello, Can someone help me figure out how to create a drilldown by clicking on a marker in a Dashboard Studio map? Additionally I need to be able to either customize the mouseover tooltip or at least at another field other that it just displaying the Lat Lon. Thanks, David
... View more
Labels
- Labels:
-
Dashboard Studio
09-12-2022
11:26 AM
Surprised that I have not received a response. Is this not the right place for this type of question? And if not, can someone point me to where I might get a better reply? Thanks David
... View more
09-06-2022
12:26 PM
Hello,
My Splunk environment is integrated with Active Directory for Logins per DoD STIG Requirement. However one of the Active Directory STIGs requires AD accounts to be disabled if not logged in the past 30 days. And it does not seem that logging in via Splunk notifies AD that the user has logged in. Please help as I have certain users that only login via the Splunk UI and every month AD is disabling their accounts.
Thanks
David
... View more
Labels
- Labels:
-
administration
04-28-2021
06:36 AM
I have a statistics table that returns values based on timechart span=1h count by status. There are two statuses. I would like to color the first status if it is greater than the second status. Thanks for the help. David
... View more
Labels
- Labels:
-
timechart
04-27-2021
11:02 AM
Hello, I am building a query to be able to display a line graph of status (offline, online) over a period of 30days. Query currently is so slow it usually doesn't finish. looking for assistance to see if I can do something different to speed it up. thanks! Current query: index=mydata sourcetype="mySourceType" (_raw=*offline* OR _raw=*online*) | eval status=if(like(_raw, "%offline%"),"Offline","Online") | timechart span=1d count by status
... View more
Labels
- Labels:
-
timechart
03-19-2021
10:34 AM
I have an app that configures data inputs with columns for "Name" and "Destination". Once there is data in the sourcetype is it possible to know which "Name" it belongs to? Hope that makes sense. Thanks! David
... View more
Labels
- Labels:
-
field extraction
03-19-2021
10:19 AM
I am the admin who has access to that app. The issue is that we do NOT want to give read access to the app for new custom role, but we want them to be able to query the Lookup.
... View more
03-19-2021
09:22 AM
I think I found the problem but I do not know the solution. While I have given read permission to the lookup specifically for the custom Role, the role does not have permission to the app that created the lookup. Not sure what I can do. I definitely DO NOT want the role to have access to the app but I need the role to be able to query the lookup. Thanks! David
... View more
03-19-2021
09:07 AM
The lookup has Read permission for Everyone (including the custom Role I am having issues with). Thanks! David
... View more
03-19-2021
08:48 AM
Hello, I am trying to figure out which Role Capability controls being able to use a lookup in a query. If I select all the capabilities then the role certainly can query a lookup. However if I select only the capabilities that I want the role to have, they lose the ability to query the lookup. Looking at the documentation (https://docs.splunk.com/Documentation/Splunk/8.1.2/Security/Rolesandcapabilities) it does not specify which capability allows for the querying of a lookup. Thanks! David
... View more
Labels
- Labels:
-
access control
09-30-2020
09:39 AM
I have a csv lookup that has a column with numerical data (specifically integers). When I do the lookup, splunk is treating it as string data. For example if I use this column to sort the numbers 1,2,3,10,11 it sorts as 1,10,11,2,3. Any help is appreciated.
... View more
Labels
- Labels:
-
lookup
09-24-2020
09:37 AM
My Splunk Infrastructure is ALL Windows. And every Server/Workstation is windows with the exception of one Server which is Linux. I was able to deploy the universal forwarder to the Linux Server and I have began receiving data at my Splunk Indexer. My question is: Is there an app similar to the App for Windows Infrastructure with built in dashboards for Linux that I can install on my Indexer/Search head (Which is windows)? Thanks!
... View more
Labels
- Labels:
-
other
01-16-2020
07:57 AM
OK, so you need to look further into exactly what is in the DisplayName when you run just the query sourcetype="Script:InstalledApps"
... View more
01-16-2020
07:41 AM
When you run a query and do not get any results, you need to lessen the criteria until you do to help figure out where the problem is.
For example: Do you get data if you search sourcetype="Script:InstalledApps" DisplayName="\"Microsoft Visio Viewer 2013"\"
... View more
01-16-2020
07:30 AM
oh... for DisplayName you need DisplayName="\"Microsoft Visio Viewer 2013"\"
... View more
01-16-2020
07:27 AM
Do you have events if you just search sourcetype="Script:InstalledApps"
... View more
01-16-2020
07:00 AM
You can use the field named "DisplayName". Something like this:
sourcetype="Script:InstalledApps" DisplayName="\"McAfee*"\"
... View more
01-14-2020
07:51 AM
2 Karma
Take a look at the splunk add on for windows app (https://docs.splunk.com/Documentation/WindowsAddOn/7.0.0/User/SourcetypesandCIMdatamodelinfo) if you are not already using it. This has a sourcetype - Script:InstalledApps which will index all the installed applications.
... View more
01-09-2020
06:59 AM
Thanks! So far so good. I have not seen an incorrect merging of lines since I added TIME_FORMAT. Will keep monitoring and will mark this as the answer soon.
... View more
01-08-2020
09:26 AM
Hello,
i am trying to understand the documentation surrounding SHOULD_LINEMERGE. It says the default is SHOULD_LINEMERGE = true and BREAK_ONLY_BEFORE_DATE = true. If my understanding is correct this means that if a logfile has multiple lines, the multiple lines will be part of one event that is indexed up until the next date/timestamp is found and then that would be another event.
I have a logfile with the following two lines:
2019-12-30 09:16:41:908: Requestor: IMM_Mobile, IsLocal: False
2019-12-30 09:16:41:908: 637132942019089151: Scanned CID: BARCODE:
However, they get indexed as one event and this is not what I want. A previous suggestion to me was to make SHOULD_LINEMERGE = false, however I do not think I want to do that because there are certain entries in the logfile that do span multiple lines.
Any assistance is greatly appreciated!
David
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-19-2024
12:39 AM
|
Karma given to
