About whitefang1726

whitefang1726 · ‎05-20-2025

Hello Splunkers, Good Day! I'm getting this error consistent. Out of confusion, those this mean it's the estimated KVStore size? max_size_per_result_mb value is current set by default (50 MB). KVStorageProvider [123456789 TcpChannelThread] - Result size too large, max_size_per_result_mb=52428800, Consider applying a skip and/or limit Thanks!

whitefang1726 · ‎04-10-2025

I think I haven't put the correct question. So right now we have a deployment server will need to migrate it into Cloud. I think the possibly biggest concern for us is the network latency in Cloud from/to the target endpoints. Is there a search query that can help and check the network traffic actively flowing?

whitefang1726 · ‎04-08-2025

Hello Guys, I have an existing deployment server and I'm reviewing the average network bandwidth of the server. That could help me before migrating the server into a new box. Any thoughts? Thanks!

whitefang1726 · ‎10-30-2024

Nice, that works sir! Apologies, I just need to update the sample data to avoid oversharing of work items. We have a lot of this fields in our environment. Do you think this is possible using transforms and props? Thanks!

whitefang1726 · ‎10-30-2024

Hi Splunkers, How can I create a single value field based on multiple fields? Also, let's assume that the field names can be sample_1_country_1_name to sample_99_country_1_name and sample_1_country_1_name to sample_1_country_99_name. Example: sample_1_country sample_2_country sample_99_country sample_37_country Denmark Chile Thailand Croatia Result sample_country_name Denmark, Chile, Thailand, Croatia Thanks!

whitefang1726 · ‎07-17-2024

@payl_chdhry this one works. thanks! any idea what rest url to get all the guids? I saw a majority of the guids but still missing a couple of there hostnames. | rest /services/server/info | rest splunk_server_group=* /services/cluster/master/peers | rest splunk_server=* /services/search/distributed/peers

whitefang1726 · ‎07-16-2024

Thanks for the response. However, I need the license usage per cluster. That's provides the total license today.

whitefang1726 · ‎07-16-2024

HI Splunk Answers, Is there a way to get license count by Cluster Peer? Example if I have 3 splunk cluster, I need to get the license by cluster (location) and by index (sourcetype if possible). Internal logs doesn't include the indexer based on host (h). I'm thinking of different SPL query but no idea where I can get it. Need your help. thanks! 07-16-2024 21:14:52.451 -0500 INFO LicenseUsage - type=Usage s="test:source::/opt/splunk/var/log/test_2024-07-16.log" st="test-st" h=hosttest o="" idx="testidx" i="sadsadasdasdadasdasdasdasdasda" pool="auto_generated_pool_enterprise" b=503 poolsz=1234567891012

whitefang1726 · ‎07-17-2023

I was expecting for the specific file but anyway, this solved our issue. thanks!

whitefang1726 · ‎06-22-2023

I search for the java.properties but it not existing on the server.

whitefang1726 · ‎06-21-2023

Hello Guys, How can we adjust the JAVA heap space value to Splunk DBConnect app (Example from 2GB to 8GB)? Thanks!

whitefang1726 · ‎02-28-2023

I've used eval (recipients fields) same with the documentation, but "," does not worked and recipients doesn't received any emails. Example: | eval recipients=if(country, "US", "ameri@gmail.com", if(country, "Mexico", "ameri@gmail.com, mexico@gmail.com"), "ameri@gmail.com")

whitefang1726 · ‎02-28-2023

Hello Splunkers, How can we send email to multiple email addresses using Splunk alert? I saw below documentation in Splunk site, but it doesn't have any sample for multiple emails. https://docs.splunk.com/Documentation/Splunk/9.0.4/Alert/Emailnotification Example: If country=US, recipients will be ameri@gmail.com If country=Argentina, recipients will be ameri@gmail.com, argentina@gmail.com If country=Mexico, recipients will be ameri@gmail.com, mexico@gmail.com If no match, then ameri@gmail.com Thanks!

whitefang1726 · ‎04-05-2022

Hello, I looking for options to add a non-existing field in tstats command. The scenario is the field doesn't exist. Normally I create regex for searches, however, it doesn't work similar with tstats. Example Query: index=something sourcetype=something:something | rex field=source".....(?<new_field>[0-9A-Z]+)" This command will create new_field field based on source field. For tstats, the idea should be.. | tstats count max(_time) as _time where .... Is this possible? Sorry for the lack of details.

whitefang1726 · ‎02-07-2022

Hello, how can I ingest logs starting with a specific word: Sample Log Entry: SPLUNKD-123456: Hello World Hello World123 Hello World456 Hello World789 SPLUNKD-0000: Hello World SPLUNKD-0012: Hello World Hello World0123 Hello World0456 Logs that will be ingested into Splunk: SPLUNKD-123456: Hello World SPLUNKD-0000: Hello World SPLUNKD-0012: Hello World Thanks!

whitefang1726 · ‎01-06-2022

This works, thanks!

whitefang1726 · ‎01-05-2022

This is a sample output using stats values. Sorry, I give a wrong example. Here's the current one. from: field1 field2 field3 field4 row1 1.1.1.1 XXX alpha.splunk.com alpha row2 2.2.2.2 YYY beta.splunk.com BETA row3 3.3.3.3 ZZZ delta.splunkanswers.com delta row4 4.4.4.4 AAA abcdefgh To: field1 field2 field3 field4 row1 1.1.1.1 XXX alpha.splunk.com row2 2.2.2.2 YYY beta.splunk.com row3 3.3.3.3 ZZZ delta.splunkanswers.com row4 4.4.4.4 AAA abcdefgh So, for field4, alpha.splunk.com and alpha is just one value (multi-value), beta and beta.splunk.com is one value (multi-value), so on... I want to remove the redundant names (hostname only and host with FQDN) as long it same value (example: alpha and alpha.splunk.com)

whitefang1726 · ‎01-05-2022

Okay, here's another example. from: field1 field2 field3 field4 row1 1.1.1.1 XXX alpha.splunk.com alpha row2 2.2.2.2 YYY beta.splunk.com BETA row3 3.3.3.3 ZZZ delta.splunkanswers.com delta row4 4.4.4.4 AAA abcdefgh to: field1 field2 field3 field4 row1 1.1.1.1 XXX alpha.splunk.com row2 2.2.2.2 YYY beta.splunk.com row3 3.3.3.3 ZZZ delta.splunkanswers.com row4 4.4.4.4 AAA abcdefgh or: field2 field3 field4 1.1.1.1 XXX alpha.splunk.com 2.2.2.2 YYY beta.splunk.com 3.3.3.3 ZZZ delta.splunkanswers.com 4.4.4.4 AAA abcdefgh

whitefang1726 · ‎01-05-2022

Hello Splunk Answers, How can I remove this duplicate line? See sample below: From: row1 row2 row3 1.1.1.1 XXX alpha.splunk.com alpha 2.2.2.2 YYY beta.splunk.com BETA 3.3.3.3 ZZZ delta.splunkanswers.com delta 4.4.4.4 AAA abcdefgh to: row1 row2 row3 1.1.1.1 XXX alpha.splunk.com 2.2.2.2 YYY beta.splunk.com 3.3.3.3 ZZZ delta.splunkanswers.com 4.4.4.4 AAA abcdefgh Thanks!

whitefang1726 · ‎05-10-2021

Hello, it is possible to generate notables only based on number of matched events? Example, if the correlation search more than 20 events, it will not generate the events, instead it will send an email notification (if possible). If it did not reached more than 20 events, it will generate the notables.

whitefang1726 · ‎04-27-2021

I was expecting a non-timechart command, but that works. Better than creating long queries. 😄 Thanks!

whitefang1726 · ‎04-27-2021

When using stats count on searches, it does not show zero values on specific time intervals. Example: index=main sourcetype=test (event=eventA OR eventB) | bin _time span=1h | stats count by _time, event Sample Result: _time Event count 04/27 1:00AM EventA 10 04/27 2:00AM EventA 10 04/27 1:00AM EventB 10 How can I show row with zero value? _time Event count 04/27 1:00AM EventA 10 04/27 2:00AM EventA 10 04/27 3:00AM EventA 0 04/27 1:00AM EventB 10 04/27 2:00AM EventB 0 04/27 3:00AM EventB 0

whitefang1726 · ‎04-26-2021

Nice, that works, I usually used append to add fields , never thought it would work on events as a rows. Thanks, big help @manjunathmeti !

whitefang1726 · ‎04-26-2021

I want to run a search query but the _bin span value will change based on the field values. Example: Instead of using this, index=main sourcetype=test (host=hostnameA OR hostnameB OR hostnameC) | bin _time span=1h | stats count by _time, host for hostnameA -> I want the span value to be every 10m for hostnameB -> every 30m for hostnameC -> every 1h Thanks!

whitefang1726 · ‎03-10-2020

How can I use cidrmatch or case using 2 conditions? Example: I only want to get list of IPs where row_A is 11.0.0.0/24 and row_B is 8.8.8.0/24 Current Table: row_A row_B 10.0.0.1 11.0.0.1 10.0.0.2 12.0.0.1 11.0.0.1 8.8.8.8 11.0.0.2 8.8.8.9 12.0.0.1 8.8.8.8 12.0.0.2 8.8.8.9 Target Result: row_A row_B 11.0.0.1 8.8.8.8 11.0.0.2 8.8.8.9 Thanks!

Posts	28
Solutions	0
Karma Given	8
Karma Received	0
Member Since	‎06-20-2018

Online Status	Offline
Date Last Visited	‎05-20-2025 12:47 AM

KVStorageProvider max_size_per_result_mb limit

Recommended Deployment Server Size

Create Single Field and Multifield Values Based on...

How to Get License Count by Cluster Peer

How can we increase JAVA Heap Space in DBConnect?

How to add multiple email addresses in Splunk Aler...

How to add a non existing field in tstats command?

How to Ingest Splunk Lines starting with

Remove Alike Values in a Field

Create Notables based on Number of Matched Events

KVStorageProvider max_size_per_result_mb limit

Re: Recommended Deployment Server Size

Recommended Deployment Server Size

Re: Create Single Field and Multifield Values Base...

Create Single Field and Multifield Values Based on...

Re: How to Get License Count by Cluster Peer

Re: How to Get License Count by Cluster Peer

How to Get License Count by Cluster Peer

Re: How can we increase JAVA Heap Space in DBConne...

Re: How can we increase JAVA Heap Space in DBConne...

How can we increase JAVA Heap Space in DBConnect?

Re: How to Add Multiple Email Addresses in Splunk ...

How to add multiple email addresses in Splunk Aler...

How to add a non existing field in tstats command?

How to Ingest Splunk Lines starting with

Re: Remove Alike Values in a Field

Re: Remove Alike Values in a Field

Re: Remove Alike Values in a Field

Remove Alike Values in a Field

Create Notables based on Number of Matched Events

Re: Add zero value when using _time field

Add zero value when using _time field

Re: How can I set bin _time value based on differe...

How can I set bin _time value based on different f...

eval case/cidrmatch using two fields as a conditio...

Join the Conversation