About jbechchar

jbechchar · ‎11-17-2015

Hi, when i search index=_internal It seems that I have no ldap authorization... But it is not an ldap user... And I have an another user with the same configuration and it works with api rest.

jbechchar · ‎11-17-2015

Hi aljohnson, Thanks for your answer. But, I have already theses capabalities for my role. That's why I don't understand why I cannot do a curl request... It is possible to request on the api with the Admin user... Another idea ? 🙂

jbechchar · ‎11-16-2015

Hi everybody, I have a problem with a user. I've just created a new user and it seems ok when I use it with Splunk. However, I have no authorization when I try to use it with REST. Is there a particular parameter to use the REST API with a certain user? Thanks in advance best regards,

jbechchar · ‎11-06-2015

Thanks all for your answers. It is possible to put a value in the _key field ? for Example my technical key... I cannot see an exemple anywhere. Thanks in advance.

jbechchar · ‎11-04-2015

I everybody. I have a problem on splunk. I have a sourcetype with my orders and a sourcetype with my customers. I have a customer technical key in my customers table and in my orders table. It is possible to simulate left join ? I have a lot of customers (more than 10 millions...) ... so it is not possible to use the join command. Thanks in advance for your answers.

jbechchar · ‎08-06-2015

Thanks for your answer. But the script help to get the data I want but the data are already indexed. I really would like to have a unique event for each invoice in my index. And not to have 2 events for an invoice. I do not know if it's possible with my problem.

jbechchar · ‎08-06-2015

Hi everybody, Here is my problem: I have a table in an Oracle database. My Goal is to index each invoice once, and it's possible for some lines to be created with a 7 day delay. Example : yesterday, a new line was added in my table with and older creation_invoice date. So to be sure to get the line it, means that each day I have to get the data from the last 7 days. (I do not have a system creation date of each line) and use my creation_invoice date from timestamp. The problem is when I get the data from the last 7 days, it will index some data which is already indexed. I would like to index only the new line to avoid duplicate events. Do you have any ideas ? I heard about kv stor,e but no idea if it can be help me. Thanks in advance for yours answers. Regards, Jordan

Posts	7
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎08-06-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How do I authorize a user to use the REST API?

Join between 2 source type with a lot of data

Splunk DB Connect: How do I avoid indexing duplica...

Re: How do I authorize a user to use the REST API?

Re: How do I authorize a user to use the REST API?

How do I authorize a user to use the REST API?

Re: Join between 2 source type with a lot of data

Join between 2 source type with a lot of data

Re: Splunk DB Connect: How do I avoid indexing dup...

Splunk DB Connect: How do I avoid indexing duplica...