About maada

maada · ‎08-13-2018

Hi, i would like to run a search (to collect data in a summary index) triggered by an alert, which is checking for new data. e.g. if the start of a new dataset comes in, i would like to enrich, manipulate and collect the last dataset into a summary index. if the collect search only runs on a time schedule, i may get inconsistencies in between the collected dataset due to cutting in between. i'm looking for something like a custom alert action to trigger another saved search. Thanks in advance.

maada · ‎11-18-2017

Hi @aljohnson_splunk, thanks for the token js provided - that works almost perfect for me. I'm just having some issues when i want to integrate with other scripts (e.g. for buttons to reset the token, from dashboard examples app) and i have problems that my searches are not getting updated when the token changes (if i have a fieldset defined, i have the function "search on change"). I'm looking for a solution to both: reseting the the token and automatic search on change. Many thanks in advance! BR Matthias

maada · ‎05-09-2017

Hi, does Splunk logs somewhere internal how / when buckets are rolled, e.g. from cold to frozen? reason: frozen buckets are archived in a diferent location, if a certain bucket from a certain time period needs to be restored it would be great to search for the name / time frame to find that and bring only this (or a couple of buckets) back instead of e.g. two years of data. thanks.

maada · ‎03-08-2017

we tried as described above - the xml is enhanced by the TAGS information (Tag + Name) but don't geht the "TAGS" field extracted in Splunk - all other fields appear ...any recommendation? we are using Splunk 6.5.2. any changes necessary to props.conf / transforms.conf / fields.conf Thanks

maada · ‎01-10-2017

thanks for the quick reply. yes. the license master is provided by central it department. different business departments (industry) operate their own Splunk instance and need to check during development of apps how much license the use case consumes and what impact adjustments to data sources have on the license volume. the way going always to central IT for reports is a bit complicated.

maada · ‎01-10-2017

Hi, thanks. yes that works - as long as that individual indexer is not connected to a license master. Afterwards there is no information locally on the license slave to license usage. is there any possibility to log that information as well on the license slave? THANKS!

maada · ‎01-09-2017

I would like to qurey from a license host on the _internal index the license usage of specific, individual defined sourcetypes in separate apps. If I run the search on the _internal index i dont see my sourcetypes? the goal is to have a report based on each own app (use case) and a breakdown to the data source / sourcetype included in the app. Thanks!

Posts	7
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎10-20-2015

Online Status	Offline
Date Last Visited	‎06-15-2020 01:55 PM

Run a search based on alert result

bucket roll logging

License usage by own sourcetype / App

Run a search based on alert result

Re: Heatmap - Custom Visualization: How can I add ...

bucket roll logging

Re: IS there way to pull extra information from Qu...

Re: License usage by own sourcetype / App

Re: License usage by own sourcetype / App

License usage by own sourcetype / App