Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About newbiesplunk
newbiesplunk
Path Finder
Member since:
04-07-2014
06-05-2020
Community Statistics
| Posts | 53 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 5 |
| Member Since | 04-07-2014 |
Activity Feed
- Got Karma for Re: For Splunk Enterprise, Splunk Light, and Hunk pre 6.3, default root certificates expire on July 21, 2016 - Recommendations?. 06-05-2020 12:48 AM
- Got Karma for Re: For Splunk Enterprise, Splunk Light, and Hunk pre 6.3, default root certificates expire on July 21, 2016 - Recommendations?. 06-05-2020 12:48 AM
- Got Karma for send alert thru sms. 06-05-2020 12:47 AM
- Got Karma for set delimiter. 06-05-2020 12:47 AM
- Got Karma for Re: failed to parse timestamp at data preview. 06-05-2020 12:47 AM
- Posted configure alert when results=0 on All Apps and Add-ons. 04-17-2017 12:43 AM
- Posted How to generate a search that will count based on filename in the log? on Splunk Search. 12-07-2016 05:15 AM
- Tagged How to generate a search that will count based on filename in the log? on Splunk Search. 12-07-2016 05:15 AM
- Posted Splunk Hadoop connect app support on Cloudera 4.4? on All Apps and Add-ons. 10-19-2016 06:17 AM
- Posted Re: For Splunk Enterprise, Splunk Light, and Hunk pre 6.3, default root certificates expire on July 21, 2016 - Recommendations? on Security. 07-07-2016 08:03 PM
- Posted Re: How to write a regular expression to filter out any data after a second semi-colon per line? on Splunk Search. 07-27-2015 11:52 PM
- Posted How to write a regular expression to filter out any data after a second semi-colon per line? on Splunk Search. 07-19-2015 05:46 AM
- Tagged How to write a regular expression to filter out any data after a second semi-colon per line? on Splunk Search. 07-19-2015 05:46 AM
- Posted blacklist events from log file on Getting Data In. 05-11-2015 03:31 AM
- Tagged blacklist events from log file on Getting Data In. 05-11-2015 03:31 AM
- Posted duration for first event and last event on Splunk Search. 04-01-2015 04:44 AM
- Posted Re: How to compare a compare a field in an event with a field in a lookup? on Splunk Search. 03-04-2015 07:12 PM
- Posted Re: How to edit my serach to display count in a column chart? on Splunk Search. 03-02-2015 09:44 PM
- Posted Re: How to compare a compare a field in an event with a field in a lookup? on Splunk Search. 03-01-2015 07:09 PM
- Posted How to edit my serach to display count in a column chart? on Splunk Search. 03-01-2015 06:27 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-17-2017
12:43 AM
Hi, can i configure from the "searches & reports" such that it trigger alert when the results=0 or i need to write a script to trigger such alert. If can configure from "searches & reports" how to go about configuring it. thks
... View more
- Tags:
- Alert Manager
12-07-2016
05:15 AM
Hi, i need to count the stat based on different type of source and field (based on 1st 3 char of the filename of the field). E.g. My ultimate goal is to get a timechart of line graph showing stat based on different filetype. thks
12/7/16 12: 14 filename="ABC132323.txt" source="abc.log"
12/7/16 17: 14 filename="DEF.txt" source="def.log"
11/3/16 01: 14 filename="QDAD21.txt" source="wed.log"
08/7/16 12: 14 filename="ABC.txt" source="abc.log"
01/7/16 12: 14 filename="QD444.txt" source="abc.log"
result:
filename count
ABC* 2
DEF* 1
QD* 2
... View more
10-19-2016
06:17 AM
Hi, would like to check whether does the splunk hadoop connect app are compatability and support for Cloudera 4.4? Does https://www.youtube.com/watch?v=TmYHsabpk_Q still valid?
... View more
- Tags:
- hadoopconnect
07-07-2016
08:03 PM
2 Karma
If i run the below command and the ssl is false, do i still need to update the root certificate?
index=_internal source=metrics.log group=tcpin_connections | dedup hostname | table hostname sourceIp fwdType version destPort ssl
... View more
07-27-2015
11:52 PM
Hi,
Not sure if splunk is able to do it, if i want the event to be forwarded to splunk index only when there is changes in the info before the 1st semi-colon? thks
... View more
07-19-2015
05:46 AM
Hi,
I have a file that contains the following format and I wish to only index information before the 1st two semi-colons and remove the data after the 2nd semi-colon. thks
original files:
abc;3244;19Jul2015 12:32;
ab1;testing 123;19/07/2015 12:32
To be forwarded to indexer:
abc;3244
ab1;testing 123
... View more
- Tags:
- regex
05-11-2015
03:31 AM
Hi,
I wish to exclude certain events not to forward to indexer, as below. How to configure that? thks & rgds
.......Directory=.....
....Module=abc....
... View more
- Tags:
- blacklist
04-01-2015
04:44 AM
Hi,
If i wish to find out the duration for the first event and the last event in hour, minutes and second, what would be the likely approach?
... View more
- Tags:
- duration
03-04-2015
07:12 PM
Hi,
If i want to display all the columns in the lookup, and the stats of the column from the event as shown in next example, the lookup file have only one column "ownername", what will be the approach?
result of the search:
ownername # of car
tom
harry 1
Kim 2
John
... View more
03-02-2015
09:44 PM
Hi, I can display what i want using my own query, it just that i wish to display for each column e.g display count=9 for jbridge error, 675 for splunkd error etc. thks
... View more
03-01-2015
07:09 PM
Hi,
The result show two column with name, gd only. how do i know which info is shown in lookup and not in event? thks
... View more
03-01-2015
06:27 PM
HI,
I have the following search:
sourcetype=* | chart count(eval(status="info")) AS info, count(eval(status="Error")) AS error, count(eval(status="warn")) AS warn by sourcetype
If I wish to display the count in a column chart, what will be the changes for my search? thks
... View more
03-01-2015
05:29 PM
Hi,
I wish to monitor linux server info like number of CPU, processor, linux version etc in Splunk. What will be the recommended info to get from linux server and how do I do this? thks
... View more
03-01-2015
04:18 AM
Hi, my Splunk version is 5.0.4,is there any examples in the Splunk 5.x Dashboard Examples app? thks
... View more
02-27-2015
09:18 PM
Hi,
Based on the search:
sourcetype="splunkd" | stats count by log_level
it will provide the table below. If I wish to display the table cell/row such that ERROR will be the color red, warn is orange and info is green, how do I get these colors displayed in a dashboard in Splunk 5.0.4? thks
log_level count
ERROR 149
INFO 564123
WARN 225
... View more
02-26-2015
12:06 AM
i want to compare secondname in lookup table with name in the event. And gender in lookup table with gd in the event. So there might be a case whereby gd and/or name in the event is empty.
... View more
02-25-2015
11:38 PM
Hi, 1234 is the user found in the event but was not tag to the field "user".
... View more
02-25-2015
11:33 PM
Hi, for better understanding your answers.
Lookup filename: test33
Firstname,secondname,gender
If my event contain only the name and gd,
if index=index name [|inputlookup test33|table secondname,gender]|table name, gd correct?
thks
... View more
02-25-2015
06:03 PM
Hi,
I wish to do a comparison of the field in the event with the lookup to determine the occurrence of the field in the lookup? thks
... View more
- Tags:
- lookup
02-25-2015
04:22 PM
Hi,
If my event does not contain the user field, and i need to have the automatic lookup for the user info based on the user=1234 as the example below, what will be the approach? thks
2/26/15 10:03:30 AM 1.1.1.1 - 1234 xxxxx
... View more
- Tags:
- lookup
02-25-2015
04:04 PM
Hi,
When I add a new automatic lookup, if I put * at the Apply to: Sourcetype, it does not work, but if i put the specific sourcetype, it works. Does it mean that i need to create a lot of automatic lookups for the same lookup table?
thks
... View more
02-22-2015
11:44 PM
hi, i saw there is a rebuild index function (splunk rebuild ), can i use for my case? thks
... View more
02-22-2015
11:23 PM
Hi,
I have a search and if within an event, I have two values that I want to tag to the same field, what will be the likely method to use?
Example:
12/17/14 12:23:34 AM Name=abc........Name=qwe
thks
... View more
02-22-2015
11:19 PM
Hi, I know this search but i need to remove it permanently from the index, what will be the advise? thks
... View more
02-22-2015
10:51 PM
Hi,
I have two sourcetypes forwarded to an index, but I just want to delete one of the sourcetypes from this index. What is the approach? thks
... View more
