About AzJimbo

AzJimbo · ‎06-19-2024

worked like a champ - note it is a restart required. Debug Refresh (I tried a short cut) did not work. There were several spots in the files that needed the change. Thanks!

JyPl4wNYu7GV1uL · ‎02-26-2024

I know this is ancient, but I had the same issue with blank results because of this: https://community.splunk.com/t5/Splunk-Search/What-would-intermittently-cause-less-events-to-return-the-raw/m-p/490525

AzJimbo · ‎11-17-2021

this old problem bit me today. Go to 'All Fields' and deselect all fields, then close that window. Once that was settled, I was able to reselect the 'All Fields' option and the Event Viewer repopulated. Not sure why it worked, but it did and thought I'd share.

AzJimbo · ‎08-12-2021

Is there a trick to adding "value", "type" and "color" to the 'to' entities in this viz? I'm only getting the default values for recipients in one way relationships.

AzJimbo · ‎08-05-2021

been there, tried that. they couldn't get them now either. Also, in the quantities I'm looking for, that's a challenge. I go through up to between 5 to 10 a quarter. I used to pick up between 20 and 30 at then end of .conf and they lasted a year. Also, I'm not always the only group within my org that need/wants them. If I could buy them from the store, that'd be a sound and fair option.

CSmoke · ‎01-29-2021

Thanks, this worked for me. Had to add stanza, as it was not in default\phantom.conf [verify_certs] value = false

jawaharas · ‎09-30-2019

Thanks. Can't we use below one? https://<splunk-base-url>/en-GB/debug/refresh?entity=admin/health-report-config

AzJimbo · ‎06-21-2018

Thank you for doing what you do. It's a great app. I've got it pointed at my stream app and am finding some interesting results. I'm on version 2.0 of the app- just installed it last night. I'm using Firefox 60.0.2 (64-bit) on a windows 10. I've got the feature enabled, confirmed looking in the xml. I have disabled browser plug-ins that might interfere. I still can't find the feature.

jeffland · ‎02-14-2017

You're welcome, glad I could help! Unfortunately I won't be at .conf this year, but I'll get back to your offer if we meet another year 🙂 CSS should not interfere with your js. If it works in the search app but not in another one, then I could imagine incorrect paths/filenames as the culprit. If the file system permissions are all right (which you pointed out above), then there is no reason for some js to work in search but not in another app - the only dependencies are those coordinated by requirejs. Oh, and you did restart splunk after creating the js file, right? That's also required.

AzJimbo · ‎06-10-2015

Thanks MuS - The disable in the UI wasn't enabled. I figured it out - I had to go into the data input and repoint the syslog inputs (UDP & TCP) back to the main index. Luckily, my custom field extractions were re-enabled. Once I repointed the data inputs, the 'disable' option in the apps tab was there.

AzJimbo · ‎03-05-2015

Thanks for getting back to me. I'm currently working on getting YAF with DPI to work, but would really rather have Stream.

AzJimbo · ‎07-20-2016

Awesome! Stream app 6.6.0 now has ICMP. Thank you.

AzJimbo · ‎07-09-2014

Unfortunately, they are not three different connections. Sometimes a single connection is interrupted in the logs, becoming two lines. (Lines 2 and 5) and sometimes the exact same tuples will occur again, but later than a logical connection would last (line 7). I think I need some combination of a maxspan from transaction and your suggestion with stats. The transaction command uses only the _time field (not shown in sample) not the internal times from the log lines. stats doesn't group similar lines together.

jzapantis · ‎05-02-2017

I like this solution. Very nice.

AzJimbo · ‎02-06-2017

I think this is new in 6.5, but I've been able to set variables with an env call in xml <row> <panel> <html> <h1>Welcome $env:user_realname$ </h1> You are logged in as $env:user$ </html> </panel> </row>

Posts	30
Solutions	0
Karma Given	15
Karma Received	15
Member Since	‎06-19-2013

Online Status	Offline
Date Last Visited	4 weeks ago

network diagram viz

Quick Reference Guide Card

In Splunk Enterprise 7.2, Can you help me clear th...

How can I use Pan Zoom on Force Directed Data VIz?

How to use an "input type=button" to reset a token...

How do I disable the Home Monitor app without losi...

Has anyone gotten the Splunk App for Stream to wor...

Looking for ICMP in Stream?

calculate duration of multiple seperate log lines

Re: Failed to load source for Wordcloud visualizat...

Re: Events return blank results

Re: Why does Splunk Web sometimes not show the eve...

network diagram viz

Re: Quick Reference Guide Card

Re: Phantom APPs can not be set.

Re: In Splunk Enterprise 7.2, Can you help me clea...

Re: How can I use Pan Zoom on Force Directed Data ...

Re: How to use an "input type=button" to reset a t...

Re: How do I disable the Home Monitor app without ...

Re: Has anyone gotten the Splunk App for Stream to...

Re: Looking for ICMP in Stream?

Re: calculate duration of multiple seperate log li...

Re: Retrieve names of all fields

Re: current user in search?

Join the Conversation