Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About amielke
amielke
Communicator
Member since:
06-27-2013
06-05-2020
Community Statistics
| Posts | 50 |
| Solutions | 1 |
| Karma Given | 27 |
| Karma Received | 7 |
| Member Since | 06-27-2013 |
Activity Feed
- Karma Re: Order Properties in authorize.conf for gcusello. 06-05-2020 12:49 AM
- Karma Re: Can a Heavy Forwarder both be a receiver and a forwarder? for harsmarvania57. 06-05-2020 12:49 AM
- Karma Re: Whats the difference between join command search command while using subsearch? Can someone explain with scenarios please. for 493669. 06-05-2020 12:49 AM
- Karma Re: Can an alert be based on a search that runs but has no matching events? for elliotproebstel. 06-05-2020 12:49 AM
- Karma Re: Can I get info about these components in one place in Splunk? for traxxasbreaker. 06-05-2020 12:49 AM
- Karma Re: Query many fields with the same part in the name for HiroshiSatoh. 06-05-2020 12:49 AM
- Got Karma for Splunk Add-on for Windows in Version 5.0.0. 06-05-2020 12:49 AM
- Got Karma for Splunk Add-on for Windows in Version 5.0.0. 06-05-2020 12:49 AM
- Karma Re: How to edit my search to chart the count of how many sources were indexed in the last hour? for pradeepkumarg. 06-05-2020 12:48 AM
- Karma Re: KV Store failing at SHC for kunalmao. 06-05-2020 12:48 AM
- Karma Re: What does the _bump endpoint do? for sundareshr. 06-05-2020 12:48 AM
- Karma Re: How to prevent duplicate events from occurring when connecting a non-clustered search head with an indexer cluster? for harsmarvania57. 06-05-2020 12:48 AM
- Karma Re: Why am I unable to set up a search head cluster and getting error "Failed to bootstrap this node as a captain"? for ThomasControlwa. 06-05-2020 12:48 AM
- Karma Re: How to modify my search to graph the same 30 minute time period for previous weeks on the same graph? for twinspop. 06-05-2020 12:48 AM
- Karma Re: Splunk License Usage: Does Splunk not count its internal logs against the license? for twinspop. 06-05-2020 12:48 AM
- Karma Re: How to add Sparklines to a status dashboard? for woodcock. 06-05-2020 12:48 AM
- Karma Re: get count of field group by another for gcusello. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk App for Unix and Linux: Why is the app not showing memory info?. 06-05-2020 12:48 AM
- Got Karma for Re: How does a Universal Forwarder send raw and cooked data to an indexer?. 06-05-2020 12:48 AM
- Karma Re: I currently have a Deployer, Deployment Server, and Cluster Master on the same machine as a search head. Should I move one or all of them to a separate host? for Richfez. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-15-2019
12:58 AM
The dash doesn't help 😞
... View more
05-13-2019
11:57 AM
We use
[source:WinEventLog:Security]
TRANSFORMS-classname = Transforms_stanza
and it works for Security fine.
We have the problem at Windows Event Collector:
[source:WinEventLog:WEC/Channel1]
TRANSFORMS-classname = ....
We try
source::../Channel1
or
source::...//Channel1 OR source::..WEC/Channel1 OR source::...\Channel1 OR source::...Channel1
but no solution! 😞
Some Ideas?
... View more
03-25-2019
01:12 PM
We use DB-Connect v 3.1.3 and we try to connec to the HiveDB and get following Error:
Could not open client transport with JDBC Uri: jdbc:hive2://hostname:port/;useSSL=true;sslTrustStore=/opt/splunk/etc/apps/splunk_app_db_connect/certs/store.jks;trustStorePassword=***PW***;transportMode=http;httpPath=gateway/default/hive: Could not create http connection to jdbc:hive2://hostname:port/;useSSL=true;sslTrustStore=/opt/splunk/etc/apps/splunk_app_db_connect/certs/store.jks;trustStorePassword=***PW***;transportMode=http;httpPath=gateway/default/hive. org.apache.http.NoHttpResponseException: The target server failed to respond
( hostname, port and ***PW*** are only placeholder!)
The Server is via IP and Port accessible via ping and netcat.
Any Idea?
... View more
03-25-2019
01:04 PM
the HiveJDBC driver must fill out in a stanza in the db_connect_types.conf like this:
1 [hive]
2 displayName = Hive
3 serviceClass = com.splunk.dbx2.SparkJDBC
4 jdbcUrlFormat = jdbc:hive2://<host>:<port>/<database>
5 jdbcUrlSSLFormat = jdbc:hive2://<host>:<port>/<database>?useSSL=true
6 jdbcDriverClass = com.simba.hive.jdbc41.HS2Driver
7 supportedVersions = 1.0
8 port = 10000
9 ui_default_catalog = $database$
10 connection_properties = {"verifyServerCertificate":"false"}
You must know the right jdbcDriverClass in line 6!
... View more
01-25-2019
12:40 AM
We found a solution for us:
[your_sourcetype]
BREAK_ONLY_BEFORE = \d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2},\d{3}
DATETIME_CONFIG =
LINE_BREAKER = \d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2},\d{3}
NO_BINARY_CHECK = true
category = Custom
disabled = false
pulldown_type = true
... View more
01-24-2019
08:45 AM
We try "TIME_FORMAT", but:
The logfile has a second eventtype included (unordered mix 😞 😞
********** first log of session at 2018-12-14 09:31:42,793
message
*********
In this case only the timestamp upstairs is found, not the second time (*** first log of...) format.
If we not use the "TIME_FORMAT", splunk regognize both timeformats and the unwanted value.
... View more
01-24-2019
08:19 AM
This is the full event:
2018-12-14 09:01:42,793
statement:
SELECT t0.id,t0.name1 FROM DUMMY t0, DUMMY2 t1
WHERE (t0.id = :I1) AND (t1.id = t0.id
)
parameters: :I1:=1109002298;
CPL Stacktrace - Start ...
CPL Stacktrace - End
2018-12-14 09:01:43,793
NEW EVENT
... View more
01-24-2019
08:05 AM
We found the following message in the data and Splunk recognizes it as a timestamp. How can I prevent this interpretation and add it to the event before it?
parameters: :I1:=1109002298;
thx
... View more
07-25-2018
07:41 AM
@bhargavnariyani: Yes the documentation read fine and is clear, but if I start to setup the Splunk App for windows infrastructure, the app expected version 4.8.4. This is not accept in my eyes 😞
That means for me I cannot use the Splunk Add-On for Windows in version 5.0.0, because the Splunk App for Windows infrastructure in version 1.4.4 does not accept the new version.
... View more
07-08-2018
10:16 AM
2 Karma
In the Add-On for Windows, the index declaration has been removed in version 5.0.0 , do the inputs have to send to certain indices?
In the inputs.conf is no key-value entry for the index.
The Splunk Add-on for Microsoft Active Directory still has an indexes.conf file and in the inputs.conf are also at each Stanza indexes = * entries. Is the MS -AD Add-on not yet updated or is there an error in the add-on for Windows?
... View more
05-09-2018
09:37 AM
3 Karma
Hi,
the solution with user-seed.conf was helpful.
I create the config-file in the folder $Splunk_HOME$/etc/system/local, like this:
[user_info]
USERNAME = admin
PASSWORD = myPassword
After a restart, the login was successful with this credintials.
... View more
05-02-2018
05:08 AM
Hi,
I've read the steps, but unfortunately I don't want it that way. I renamed the passwd file, rebooted the system. I still can't login with admin and changeme. Splunk does not create a new passwd file for me either. There is also no standard initial login screen with admin and changeme.
Anybody have an idea?
... View more
03-27-2018
01:14 AM
Thank you, it is like I say, only the _internal index is available.
... View more
03-27-2018
12:29 AM
Question about "About the connection between the license master and license slaves", is this the same behavior like before Splunk Enterprise 6.5? I can only search in the _internal index ?
... View more
- Tags:
- splunk-enterprise
03-23-2018
01:51 AM
Oh, we use a single site or say no site Cluster.
Is this in this case necessary?
... View more
03-23-2018
12:57 AM
Is the -site option necessary or can I omitting this?
... View more
01-31-2018
12:48 PM
In our case the get a XML-file. I think you need a XML-File.
You can stack more license keys.
Here is a link to the docs, how to install a License:
http://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/Installalicense
... View more
01-31-2018
12:05 AM
The Jogin command allows you depends on a field to bring two groups of search results together.
Example: search one have a result with the field IP-address and in the second search the results have a field IP-address, too.
If in both results the value of IP-adress equals the join will bring both result events together.
Result 1: IP-Adresse =192.168.1.1 and result 2 IP-address 192.168.1.1 will be joined.
Result 1: 182.168.1.2 and Result 2: 192.168.1.1 will Not joined.
Hope this helps
... View more
01-29-2018
09:10 AM
Hi,
is there a possibility to disconnect in Splunk a Server from the Splunk License Master that is not allow to connect to the Master.
I know with a firewall is it possible.
... View more
01-03-2018
07:46 AM
Have you tried "CDATA", like this:
<link>
<![CDATA[http://mywebsite.com/no/report.asp?ticket_id=$click.value2$&TIPO_STAMPA=INT]>
</link>
more infos: docs.splunk.com
... View more
11-15-2017
01:30 AM
the answer sounds good. I will create the stanza automatically and some parts a constant and some dynamically.
thank you
... View more
11-15-2017
12:51 AM
Is the Order in a Stanza in the authorize.conf important? Is it possible to change the example from the documantation to
[role_ninja]
rtsearch = enabled
importRoles = user
srchIndexesAllowed = *
srchIndexesDefault = mail;main
srchJobsQuota = 8
rtSrchJobsQuota = 8
srchDiskQuota = 500
srchFilter = host=foo
The "srchFilter" is now at the bottom.
anmie
... View more
09-12-2017
05:06 AM
Hi,
I have a customer, with some customer Java MBeans with a hierarchy in 3 levels. This looks like
root-Level
1. Sublevel
2. Sublevel
and the MBean with attributes and values
The configuration for MBeans domain java.lang was no problem and works fine.
The test with the wildcard failed.
<mbean domain="root-level" properties="type=*"">
<!-- simple array attributes -->
<attribute name="attr1:part1" outputname="attri1Out"/>
<attribute name="attr2:part2" outputname="attri2Out"/>
</mbean>
How is it possible to connect to the customer MBeans?
... View more
08-29-2017
11:34 PM
index=a sourcetype=2 |stats min(field*) as min_field* max(field*) as max_field*
Works fine, Thank you 🙂
... View more
08-29-2017
11:06 PM
Hi,
i have events in one sourcetype with over 90 similar fields like field1, field2 ... field90.
I can write a query like: search index=a sourcetype=2 field1=* field2=* ..field90=* | stats min(field1), max(field1, min(field2), max(field2)
is there a way reduce the long query to something like: index=a sourcetype=2 field*=* | stats min(field*) max(field*) ?
THX
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
| User | Karma Count |
|---|---|
| 1 | |
| 2 | |
| 2 | |
| 1 | |
| 2 |
