Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About dvg06
dvg06
Path Finder
Member since:
01-07-2015
09-22-2023
Community Statistics
| Posts | 33 |
| Solutions | 1 |
| Karma Given | 26 |
| Karma Received | 11 |
| Member Since | 01-07-2015 |
Activity Feed
- Got Karma for How to create Timechart when no splitby available?. 09-21-2023 10:13 PM
- Got Karma for How to include month name in streamstats as?. 09-21-2023 10:13 PM
- Got Karma for Rest api for authorization. 09-21-2023 10:13 PM
- Got Karma for Migration to smartstore. 09-21-2023 10:13 PM
- Got Karma for Error fetching saved searches. 09-21-2023 10:13 PM
- Got Karma for Re: Timestamp extraction from hec. 09-21-2023 10:11 PM
- Posted Re: Timestamp extraction from hec on Getting Data In. 09-21-2023 10:10 PM
- Karma Re: Timechart when no splitby available for bowesmana. 09-13-2023 07:00 PM
- Tagged Splunk olly rename or exclude n/a on heatmap chart on Splunk Search. 09-11-2023 09:27 PM
- Posted How to create Timechart when no splitby available? on Splunk Search. 09-10-2023 10:23 PM
- Posted How to include month name in streamstats as? on Splunk Search. 04-16-2023 06:09 PM
- Karma Re: Reindex linux log file for somesoni2. 10-18-2021 07:16 PM
- Posted Re: Why are realtime searches disliked in the Splunk world? on #Random. 04-19-2021 10:56 PM
- Posted Re: Rest api for authorization on Knowledge Management. 01-21-2021 03:18 PM
- Posted Rest api for authorization on Knowledge Management. 01-20-2021 08:20 PM
- Karma Re: Is there a REST API call for getting the status of a Search Head Cluster (SHC)? for rbal_splunk. 10-07-2020 03:24 PM
- Got Karma for Error fetching saved searches. 06-05-2020 12:50 AM
- Got Karma for Error fetching saved searches. 06-05-2020 12:50 AM
- Got Karma for Error fetching saved searches. 06-05-2020 12:50 AM
- Karma TA Domain Tools For Splunk rate limit access for jserni. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 4 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-21-2023
10:10 PM
1 Karma
If you are using /services/collector/event end point to send events, try changing it to /services/collector/raw. Test using below commands curl -vvvv -k https://hecendpoint:8088/services/collector/raw -H "Authorization: Splunk XXXXXXXXXXXX" -d '{"id": "raw-message", "createdDateTime": "2023-09-23T11:11:11Z"}' curl -vvvv -k https://splunkviphec.bbl.int:8088/services/collector/event -H "Authorization: Splunk XXXXXXXXXXXXXXX" -d '{"event":{"id": "event-message", "createdDateTime": "2023-09-23T11:11:11Z"}}'
... View more
09-10-2023
10:23 PM
1 Karma
Hi Splunkers
Need some help with a timechart query please.
index=linux host IN (a,b,c,d,e) | timechart span=1week eval(avg(CPU) * avg(MEM)) BY host
This works well if there is atleast an event per host. But I wanted to show zero value when there are no events for a particular host. Is that possible?
eg: I have events only for a,b,c but still wanted to show zero for d and e hosts.
... View more
- Tags:
- splunk search
Labels
- Labels:
-
timechart
04-16-2023
06:09 PM
1 Karma
Hi Legends
How do I give bit more meaningful names for fields last_sum and first_sum in below query?
i.e. something like sum_February and sum_March?
Is there a way to use the value of date_month field in a search?
streamstats current=f window=1 last(sum) as last_sum first(sum) as first_sum
... View more
Labels
- Labels:
-
stats
04-19-2021
10:56 PM
Along with all these configs, I disable them in times.conf too so that users will not see them in the time-range picker.
... View more
01-21-2021
03:18 PM
thanks @manjunathmeti I can update the capabilities using the above command. But any idea how to delete this particular capability? what flag should I use instead of -d?
... View more
01-20-2021
08:20 PM
1 Karma
Hi Splunkers, Trying to disable certain capabilities from roles via rest api, but havent been successful yet. Please help. What is the rest endpoint url that I should use to disable. I tried something like https://127.0.0.1:8089/services/authorization/roles/power/capabilities/rtsearch/disable, but this is invalid end point. Splunk documentation has not been very helpful.
... View more
01-13-2020
09:50 PM
hi @rupeshn
Internal indexes and summary indexes do not count against licensing hence are not captured in license logs.
I ran this in my test environment and can confirm that I dont see any of internal indexes or summary indexes.
Can you check if those missing indexes are summary indexes/internal indexes?
... View more
01-12-2020
06:48 PM
1 Karma
I have 2 multisite clusters, how I migrate certain indexes from old cluster to new cluster, and configure smartstore in new cluster?
... View more
- Tags:
- splunk-enterprise
02-26-2019
09:19 PM
1 Karma
Support says this is known issue (SPL-153976) and fixed as part of 7.1.3 (https://docs.splunk.com/Documentation/Splunk/7.1.3/ReleaseNotes/Fixedissues), I am upgrading tonight to check if it works.
... View more
11-28-2018
01:56 PM
hi @RogerMay
No, I have raised a case with splunk support and they are still investigating.
... View more
10-31-2018
07:08 PM
When the dashboard refresh, it will contact the captain to get the latest sid and then get the result from the local dispatch directory with the returned sid by captain. The problem seems to be caused by the intermittently failed of replicated search result to search head member.
... View more
10-29-2018
10:21 PM
hi @iamarkaprabha
I do not see any messages relevant in splunkd.log. I did a search for app name, dashboard name, panel name, saved search name but was not able to find anything useful.
Please let me know what component in splunkd I should be looking at?
... View more
10-29-2018
06:48 PM
4 Karma
hi Splunkers,
I have a dashboard with refresh configured as 120, and most of the panels gets data from saved searches.
Eg:
<search ref="ReportName"></search>
I see "Error fetching saved searches" multiple times a day and for multiple panels.
I initially thought that the issue is with TTL configs for savedsearches, hence updated dispatch.ttl to 4p, and now can see that at any point of time, 4 results of these savedsearches are retained.
Any idea why the panels throws "Error fetching saved searches"?
... View more
- Tags:
- splunk-enterprise
09-13-2018
08:32 PM
thanks @traxxasbreaker.
Do we get an option to configure this period for checks?
... View more
09-13-2018
06:59 PM
Thanks traxxasbreaker
... View more
09-13-2018
05:26 PM
Hi Splunkers,
We have set search_process_memory_usage_threshold to 3GB, but noticed that searches are terminated when the usage reaches much higher values, example below.
Is this expected behaviour, or is there any other parameter to be enabled make it work better?
09-13-2018 10:59:00.013 +1000 WARN SearchProcessMemoryTracker - Dispatch Command: The search processs with sid=XXXX was forcefully terminated because its physical memory usage (5626.160000 MB) has exceeded the 'search_process_memory_usage_threshold' (3000.000000 MB) setting in limits.conf.
... View more
09-06-2018
12:46 AM
I was able to fix similar issue by changing directory/file permissions.
770 for kvstore, mongo, dump directories. Mongo and dump are sub directories of kvstore.
600 for splunk.key file inside mongo directory.
... View more
08-16-2018
04:06 PM
@SloshBurch - Happy to accept it as an answer, but I dont see an option to accept this as an answer, can you help me where to find that?
I did upvote the answer though....
... View more
08-15-2018
07:27 PM
"resync the buckets against the discarding peers." worked for me
Thanks @rbal_splunk
... View more
06-11-2018
08:36 PM
Hi Splunk experts,
I am running below query and the results get loaded much faster for admin users compared to regular users.
| tstats count from datamodel=Web where earliest=-7d latest=-15m index=************* by _time span=15m | sort -_time
Searches ran by admin gets completed in less than a minute and user searches runs for many hours. Please can someone help?
Regards,
Dinesh
... View more
- Tags:
- splunk-enterprise
03-19-2018
04:30 PM
These could be real time searches.
I ran a search like "index=*" for 30 seconds realtime, and the apiStartTime was displayed as Zero_time
search total_run_time _time apiStartTime apiEndTime search_type user
search index=* 2018-03-20 10:28:09.913 ZERO_TIME ZERO_TIME ad hoc test_user01
search index=* 2018-03-20 10:28:13.560 ZERO_TIME ZERO_TIME ad hoc test_user01
... View more
03-15-2018
01:33 AM
This disables the all time from presets, but you can actually do an all time search if you update earliest time in advanced to 0.
... View more
06-15-2017
03:17 AM
Due to some unknown reason, splunk is accepting etc/system parameters only, not the parameters which I put in app-context.
[splunk@ip-10-0-1-11 etc]$ more /opt/splunkforwarder/etc/apps/itoa-monitoring-data/default/server.conf
[general]
serverName=100.200.200.200
[splunk@ip-10-0-1-11 etc]$ /opt/splunkforwarder/bin/splunk cmd btool server list --debug | grep serverName
Warning: overriding $SPLUNK_HOME setting in environment ("/opt/splunk") with "/opt/splunkforwarder". If this is not correct, edit /opt/splunkforwarder/etc/splunk-launch.conf
/opt/splunkforwarder/etc/system/local/server.conf serverName = 100.100.100.100
[splunk@ip-10-0-1-11 etc]$
... View more
06-15-2017
02:01 AM
hi Experts,
Can I put server.conf file within an application, and use deployment server to push it to forwarders?
Regards,
Dinesh
... View more
- Tags:
- deployment
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-22-2023
12:09 AM
|
Karma from
Karma given to
