Activity Feed
- Posted Re: Is there an alternative to using > in a search string? on Splunk Search. 08-28-2018 05:34 AM
- Posted Is there an alternative to using > in a search string? on Splunk Search. 08-21-2018 07:19 AM
- Tagged Is there an alternative to using > in a search string? on Splunk Search. 08-21-2018 07:19 AM
Topics I've Started
Subject | Karma | Author | Latest Post |
---|---|---|---|
0 |
08-28-2018
05:34 AM
Thank you both for your quick responses, and apologies for the delay in getting back to you. I've been on vacation.
Unfortunately this doesn't work for me, the modified search returns no results in the dashboard, where there were several when using the >.
It is possible that I've done something incorrectly - I simply replaced the > with >, (no spaces) and also tried > with no luck.
I'll keep digging - thanks again!
... View more
08-21-2018
07:19 AM
My basic question is as follows: Is there a text alternative for specifying greater or less than, rather than using the symbol?
This is why I ask:
I have a search that queries failed login attempts greater than 10 across all servers in the index. It works a treat!
I've added that search to a Splunk Dashboard, and it populates beautifully and serves us well.
However, unlike every other section in the dashboard, clicking an entry returns a permission error: You don't have permission to access /en-US/app/search/search on this server.
If I edit the search string to remove "search count>10 ", the links are clickable and go straight to the search app. I tested on a second dashboard search with the same results.
I don't' know if this is an issue with Splunk, or more likely our SSO blocking > as the URL is passed to the search application.
Rather than explore allowing > in the URLs, I'd prefer to just specify an alternate term, if such a term exists.
PS - this is my first post. I did look for an answer to this, and apologize if it exists and I just didn't find it!
... View more
- Tags:
- splunk-enterprise