Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About dglass0215
dglass0215
Path Finder
Member since:
12-16-2014
2 weeks ago
Community Statistics
| Posts | 48 |
| Solutions | 0 |
| Karma Given | 5 |
| Karma Received | 2 |
| Member Since | 12-16-2014 |
Activity Feed
- Posted Re: Active Directory Credentials on Splunk Enterprise. 2 weeks ago
- Posted Active Directory Credentials- How do I prevent AD disabling accounts? on Splunk Enterprise. 3 weeks ago
- Posted Cell background color - Stats Table on Splunk Search. 04-28-2021 06:36 AM
- Posted Re: Query Performace on Splunk Search. 04-28-2021 06:23 AM
- Posted Re: Query Performace on Splunk Search. 04-28-2021 06:22 AM
- Posted Query Performace on Splunk Search. 04-27-2021 11:02 AM
- Posted Are the App Data Input fields extractable? on Splunk Search. 03-19-2021 10:34 AM
- Posted Re: Role Capability to Query Lookup on Security. 03-19-2021 10:19 AM
- Posted Re: Role Capability to Query Lookup on Security. 03-19-2021 09:22 AM
- Posted Re: Role Capability to Query Lookup on Security. 03-19-2021 09:07 AM
- Posted Role Capability to Query Lookup on Security. 03-19-2021 08:48 AM
- Posted csv lookup number vs string on Splunk Search. 09-30-2020 09:39 AM
- Posted Linux dashboards on Dashboards & Visualizations. 09-24-2020 09:37 AM
- Got Karma for Re: Finding out which users have certain software installed. 06-05-2020 12:51 AM
- Got Karma for Re: Finding out which users have certain software installed. 06-05-2020 12:51 AM
- Karma Re: Help with REGEX to create field extraction for rbechtold. 06-05-2020 12:50 AM
- Karma Re: How to reroute index for props/transform for DavidHourani. 06-05-2020 12:50 AM
- Karma Re: deployment server clients not showing up for harsmarvania57. 06-05-2020 12:50 AM
- Karma Re: How to get support for the Splunk App for Web Analytics? for jbjerke_splunk. 06-05-2020 12:47 AM
- Karma Re: Disable Delete Capability - Free Edition for dwaddle. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
2 weeks ago
Surprised that I have not received a response. Is this not the right place for this type of question? And if not, can someone point me to where I might get a better reply? Thanks David
... View more
3 weeks ago
Hello,
My Splunk environment is integrated with Active Directory for Logins per DoD STIG Requirement. However one of the Active Directory STIGs requires AD accounts to be disabled if not logged in the past 30 days. And it does not seem that logging in via Splunk notifies AD that the user has logged in. Please help as I have certain users that only login via the Splunk UI and every month AD is disabling their accounts.
Thanks
David
... View more
Labels
- Labels:
-
administration
04-28-2021
06:36 AM
I have a statistics table that returns values based on timechart span=1h count by status. There are two statuses. I would like to color the first status if it is greater than the second status. Thanks for the help. David
... View more
Labels
- Labels:
-
timechart
04-27-2021
11:02 AM
Hello, I am building a query to be able to display a line graph of status (offline, online) over a period of 30days. Query currently is so slow it usually doesn't finish. looking for assistance to see if I can do something different to speed it up. thanks! Current query: index=mydata sourcetype="mySourceType" (_raw=*offline* OR _raw=*online*) | eval status=if(like(_raw, "%offline%"),"Offline","Online") | timechart span=1d count by status
... View more
Labels
- Labels:
-
timechart
03-19-2021
10:34 AM
I have an app that configures data inputs with columns for "Name" and "Destination". Once there is data in the sourcetype is it possible to know which "Name" it belongs to? Hope that makes sense. Thanks! David
... View more
Labels
- Labels:
-
field extraction
03-19-2021
10:19 AM
I am the admin who has access to that app. The issue is that we do NOT want to give read access to the app for new custom role, but we want them to be able to query the Lookup.
... View more
03-19-2021
09:22 AM
I think I found the problem but I do not know the solution. While I have given read permission to the lookup specifically for the custom Role, the role does not have permission to the app that created the lookup. Not sure what I can do. I definitely DO NOT want the role to have access to the app but I need the role to be able to query the lookup. Thanks! David
... View more
03-19-2021
09:07 AM
The lookup has Read permission for Everyone (including the custom Role I am having issues with). Thanks! David
... View more
03-19-2021
08:48 AM
Hello, I am trying to figure out which Role Capability controls being able to use a lookup in a query. If I select all the capabilities then the role certainly can query a lookup. However if I select only the capabilities that I want the role to have, they lose the ability to query the lookup. Looking at the documentation (https://docs.splunk.com/Documentation/Splunk/8.1.2/Security/Rolesandcapabilities) it does not specify which capability allows for the querying of a lookup. Thanks! David
... View more
Labels
- Labels:
-
access control
09-30-2020
09:39 AM
I have a csv lookup that has a column with numerical data (specifically integers). When I do the lookup, splunk is treating it as string data. For example if I use this column to sort the numbers 1,2,3,10,11 it sorts as 1,10,11,2,3. Any help is appreciated.
... View more
Labels
- Labels:
-
lookup
09-24-2020
09:37 AM
My Splunk Infrastructure is ALL Windows. And every Server/Workstation is windows with the exception of one Server which is Linux. I was able to deploy the universal forwarder to the Linux Server and I have began receiving data at my Splunk Indexer. My question is: Is there an app similar to the App for Windows Infrastructure with built in dashboards for Linux that I can install on my Indexer/Search head (Which is windows)? Thanks!
... View more
Labels
- Labels:
-
other
01-16-2020
07:57 AM
OK, so you need to look further into exactly what is in the DisplayName when you run just the query sourcetype="Script:InstalledApps"
... View more
01-16-2020
07:41 AM
When you run a query and do not get any results, you need to lessen the criteria until you do to help figure out where the problem is.
For example: Do you get data if you search sourcetype="Script:InstalledApps" DisplayName="\"Microsoft Visio Viewer 2013"\"
... View more
01-16-2020
07:30 AM
oh... for DisplayName you need DisplayName="\"Microsoft Visio Viewer 2013"\"
... View more
01-16-2020
07:27 AM
Do you have events if you just search sourcetype="Script:InstalledApps"
... View more
01-16-2020
07:00 AM
You can use the field named "DisplayName". Something like this:
sourcetype="Script:InstalledApps" DisplayName="\"McAfee*"\"
... View more
01-14-2020
07:51 AM
2 Karma
Take a look at the splunk add on for windows app (https://docs.splunk.com/Documentation/WindowsAddOn/7.0.0/User/SourcetypesandCIMdatamodelinfo) if you are not already using it. This has a sourcetype - Script:InstalledApps which will index all the installed applications.
... View more
01-09-2020
06:59 AM
Thanks! So far so good. I have not seen an incorrect merging of lines since I added TIME_FORMAT. Will keep monitoring and will mark this as the answer soon.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
2 weeks ago
|
Karma given to
