Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sameera123
sameera123
Explorer
Member since:
08-31-2015
06-05-2020
Community Statistics
| Posts | 17 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 08-31-2015 |
Activity Feed
- Got Karma for How to schedule a powershell script to run and send out put to splunk from windows 8 server?. 06-05-2020 12:47 AM
- Posted Re: How to restrict specific data to be indexed locally, not interrupting data being forwarded and indexed on remote servers? on Getting Data In. 07-13-2016 02:01 AM
- Posted Re: How to restrict specific data to be indexed locally, not interrupting data being forwarded and indexed on remote servers? on Getting Data In. 07-13-2016 01:24 AM
- Posted How to restrict specific data to be indexed locally, not interrupting data being forwarded and indexed on remote servers? on Getting Data In. 07-12-2016 11:42 PM
- Tagged How to restrict specific data to be indexed locally, not interrupting data being forwarded and indexed on remote servers? on Getting Data In. 07-12-2016 11:42 PM
- Tagged How to restrict specific data to be indexed locally, not interrupting data being forwarded and indexed on remote servers? on Getting Data In. 07-12-2016 11:42 PM
- Tagged How to restrict specific data to be indexed locally, not interrupting data being forwarded and indexed on remote servers? on Getting Data In. 07-12-2016 11:42 PM
- Tagged How to restrict specific data to be indexed locally, not interrupting data being forwarded and indexed on remote servers? on Getting Data In. 07-12-2016 11:42 PM
- Posted Re: How to compare a search result with a lookup? on Splunk Search. 06-08-2016 03:12 AM
- Posted Re: How to write a search to calculate percentages for success and failure rates from my user log data? on Splunk Search. 03-01-2016 10:46 PM
- Posted I removed a host from serverclass.conf for an app deployed via deployment server, why was the app not removed from that client until a manual restart? on Deployment Architecture. 03-01-2016 10:24 PM
- Tagged I removed a host from serverclass.conf for an app deployed via deployment server, why was the app not removed from that client until a manual restart? on Deployment Architecture. 03-01-2016 10:24 PM
- Tagged I removed a host from serverclass.conf for an app deployed via deployment server, why was the app not removed from that client until a manual restart? on Deployment Architecture. 03-01-2016 10:24 PM
- Tagged I removed a host from serverclass.conf for an app deployed via deployment server, why was the app not removed from that client until a manual restart? on Deployment Architecture. 03-01-2016 10:24 PM
- Tagged I removed a host from serverclass.conf for an app deployed via deployment server, why was the app not removed from that client until a manual restart? on Deployment Architecture. 03-01-2016 10:24 PM
- Tagged I removed a host from serverclass.conf for an app deployed via deployment server, why was the app not removed from that client until a manual restart? on Deployment Architecture. 03-01-2016 10:24 PM
- Posted Re: Why am I not able to exclude events from getting indexed with my current props and transforms.conf? on Getting Data In. 02-19-2016 02:34 AM
- Posted Why am I not able to exclude events from getting indexed with my current props and transforms.conf? on Getting Data In. 02-19-2016 02:25 AM
- Tagged Why am I not able to exclude events from getting indexed with my current props and transforms.conf? on Getting Data In. 02-19-2016 02:25 AM
- Tagged Why am I not able to exclude events from getting indexed with my current props and transforms.conf? on Getting Data In. 02-19-2016 02:25 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
07-13-2016
02:01 AM
I dont think we need to change all other inputs stanza's with the _TCP_Routing if you have already specified defaultGroup as reomote server(indexer).
Can we create dedicated outputs.conf under the app where we need the inputs which needs the data index locally?if we do so the precedence goes to system/local or app/local since we have the inputs localy in the app?
General precedence s system /local but not sure about in case of above condition occurs...
Please clarify
... View more
07-13-2016
01:24 AM
Thanks Giuseppe!! I too got this option. but the thing is inorder to implement this option i should edit my outputs.conf which i dont like to since after a deploy poll push it may get change ..
Can we restrict to an app to send the data to dedicated indexer or local?
I mean to ask can we create outputs.conf where we can specify the data should index data locally in app?
... View more
07-12-2016
11:42 PM
I have a small scale Splunk Enterprise instance installed on one server which does not index the data locally. Data is pointed to a central server to index it. Outputs on that server are configured/polled through deployment server. However, I now want to configure inputs which need to be indexed locally without disturbing the existing outputs.conf. If someone helps me with ideas, it would be a great help.
... View more
06-08-2016
03:12 AM
index=123 |lookup alert.csv IP_PN OUTPUTNEW IP_PN AS status|search NOT status=*|table CURRENTTIME,IP_PN
... View more
03-01-2016
10:46 PM
yoursearch |stats count AS "Total",count(eval(Type=="ERROR")) AS Failure|eval Faliurerate=(Failure/Total)*100|eval successrate=100-Faliurerate|table Total,successrate,Failurerate
... View more
03-01-2016
10:24 PM
I had pushed one app through deployment servers to 4 hosts.
Now we have removed one of the host entries from the serverclass.conf for that particular app, which means that it should delete the app from that host in which it was removed from the serverclass.conf.
But unfortunately, that App didn't get removed from that host. It was only removed after restarting the forwarder.
Do we really need to log on to the forwarders and restart the service to fully remove an app? Is there any other way to do this? Can you please explain?
... View more
02-19-2016
02:34 AM
Want to exclude events which has mango in the event.
... View more
02-19-2016
02:25 AM
Not able to exclude events from indexing on Splunk Enterprise Free version. Can anyone help me out here?
Sample data:
Name:mango
Name:Mango
Name:ManGo
Name:apple
Name:banana
Name:strawberry
Name:pineapple
props.conf
[txt1]
DATETIME_CONFIG = CURRENT
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Custom
pulldown_type = true
TRANSFORMS-set= setnull
transforms.conf
[setnull]
REGEX = mango
DEST_KEY = queue
FORMAT = nullQueue
... View more
02-15-2016
12:44 AM
Thanks Jcoates.. it fixed my issue
... View more
12-20-2015
10:46 PM
index=B tag="tagY" | join type=outer field1 [search index=A tag="tagM"|eval field2=field1|table field1,field2 ]|search NOT field2=*|table field1
... View more
12-20-2015
10:39 PM
can you try this
index="device" | dedup device_id | join device_id [search index=“asset" | rename assoc_device_id as device_id |dedup device_id|table _time,device_id] | table _time, device_id
... View more
12-04-2015
04:21 PM
if you don't mind pasting the table_icon_rangemap.js file here please.I was able to do it for only 2 tables in single js not more than that.and what version you are using??
... View more
12-03-2015
10:37 PM
Not able to use more than 4 table icon rangemaps in Splunk 6.x dashboards. Can any one please suggest on this?
I'm using table icon rangemaps for 4 tables by creating for each table and each js file. I did the same thing with the 5th table, but it's not working.
... View more
09-22-2015
03:45 AM
got it thanks !!!
... View more
09-22-2015
12:36 AM
This looks good, but I'm calling a lookup using |inputlookup not regular search query.
for example my search starts like below.
|inputlookup lookup1.csv .....
... View more
09-21-2015
11:03 PM
How to schedule a search biweekly (week over week) on monday in splunk?
I was unable to get the proper cron entry for this, can anyone help me out?
... View more
09-15-2015
03:30 AM
1 Karma
How to schedule a powershell script to run and send out put to splunk from windows 8 server?
... View more
