Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About linu1988
linu1988
Champion
Member since:
12-18-2012
06-05-2020
Community Statistics
| Posts | 979 |
| Solutions | 75 |
| Karma Given | 127 |
| Karma Received | 251 |
| Member Since | 12-18-2012 |
Activity Feed
- Karma Re: Is there a way to change the font size or bold text in alert emails? for martin_mueller. 06-05-2020 12:48 AM
- Karma Re: Require input value in text box for dfoster_splunk. 06-05-2020 12:47 AM
- Karma Re: How to prevent | stats count in a macro from triggering a remote search? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time? for devicenul1. 06-05-2020 12:47 AM
- Karma Re: What is the easiest way to identify my universal forwarder versions for kscher. 06-05-2020 12:47 AM
- Karma Re: http://localhost/en-US/debug/refresh from terminal/console for MuS. 06-05-2020 12:47 AM
- Karma Re: Alert if source stops indexing for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: How do i ignore the new line character in the _raw field? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Python Script Not working via search command for psobisch. 06-05-2020 12:47 AM
- Karma Re: How to join value using wildcard? (Urgent) for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Are there any search and performance pitfalls with keeping data in hot buckets for 1 month and moving it from hot to cold directly? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: Is it possible to update a table with a drilldown value from another table's field in the same browser tab? for vtsguerrero. 06-05-2020 12:47 AM
- Karma Re: how to get 1st 2nd and 3rd place results? - based on value of a field - not frequency. for colineltringham. 06-05-2020 12:47 AM
- Karma Re: 6.1.3 issue with mounted Bundles for michael_herbert. 06-05-2020 12:47 AM
- Got Karma for Re: indexer configured but inactive on new Linux servers. 06-05-2020 12:47 AM
- Got Karma for Re: How to fix perfmon errors "Object specified...in conf file is not valid"?. 06-05-2020 12:47 AM
- Got Karma for Re: How to fix perfmon errors "Object specified...in conf file is not valid"?. 06-05-2020 12:47 AM
- Got Karma for Re: DBX JOIN 2 databases together. 06-05-2020 12:47 AM
- Got Karma for Re: How to remove columns from search results table?. 06-05-2020 12:47 AM
- Got Karma for Re: How to remove columns from search results table?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
02-28-2019
01:37 PM
Hi
Struggled for 2-3 hours. Figured out the static folder needs to be placed out on the parent app folder rather than the appserver folder. Works fine with correct resolution PNG files.
Thanks,
L
... View more
Did this bug just re-appear in Splunk 7? Not able to see the indexes in the role window anymore after the upgrade from 6.0.0 -> 7.0.0
... View more
09-19-2016
10:41 AM
There is a solution to it
https://answers.splunk.com/answers/73843/splunk-will-not-start-and-is-waiting-for-config-lock.html
... View more
07-09-2016
01:19 AM
Adding to Martin's point, you may as well create a scripted solution which will give you more flexibility.
Moreover if you are just copying the sendemail.py to your own app it will not be overwritten upon upgrade but may malfunction upon the original sendemail.py structure change for on splunk instance. I have been following the same method for colors, font, resizing text + own scripted alerts.
... View more
06-02-2016
06:11 AM
Hi,
Why dont you keep it simple?
(host=xxx* "url1") AND (host=yyy* "url2") |eval execute_time2=case(host=yyy*,execute_time)| timechart span=30m p50(execute_time) AS xxx50 |appendcols [search host=yyy* "url2" | timechart span=30m p50(execute_time) AS xxx50, p50(execute_time2) AS yyy50]
Thanks,
L
... View more
06-02-2016
02:48 AM
Hi,
What do you want to do with 7z files? Splunk does support reading compressed file, but what are the contents? There is a very easy way if doesn't read, just trigger the 7z exe to unzip the files to a location from where splunk can read them
Thanks,
L
... View more
06-02-2016
02:38 AM
Hi,
Please try to set the below setting with your preferred field. Always try to table to data you require. Moreover the throttling period is only 1 minute, so if you have events matching it will generate the alert. If you want hourly then throttle it to send 1 hour per host in the suppress triggering option.
Thanks,
L
... View more
11-30-2015
09:00 AM
Hi,
The below link will help in resolving the issue. I have used DBConnect 1.2.2 with the patched jar file.
http://sourceforge.net/p/jtds/bugs/725/?limit=10&page=1#7b2b
Search for the text and link:
Attachments
jtds-1.3.1-v20140512.jar
Thanks,
L
... View more
07-16-2015
09:48 AM
Daniel the props.conf will have to be set up on the indexer not forwarder. They will get adjusted according to your config for the newer entries. you can modify anything for the indexed items or better re-index them.
... View more
05-18-2015
09:36 AM
Hi,
Best way to troubleshoot is to check the splunkd.log files and see if you are making any mistake on the input stanza. Did u check the permission on the input files? they don't forward if splunk is not able to read them. so go to security tab and see who all are having the permission. Then give the necessary permissions.
Thanks,
L
... View more
03-03-2015
04:08 AM
Hi Eddel,
Use the below one as an alert to get notified on your license Master.
index=_internal source=*license_usage.log type=Usage earliest=-0d@d | stats sum(b) as tot | eval GB=tot/1024/1024/1024 |table host,GB| where GB > 4
OR
Quicker
| rest /services/licenser/pools|where stack_id="enterprise" |eval used_bytes=used_bytes/(1024*1024*1024)|table splunk_server,used_bytes|where used_bytes >4|eval used_bytes=used_bytes." GB"|rename used_bytes as "Usage"
Thanks,
L
... View more
01-28-2015
06:27 AM
1 Karma
why dont you just put endswith="complete"
that should cover both the ending points.
... View more
01-05-2015
05:49 AM
I was refering to the script which is configured for a realtime alert. I personally feel there is not much use of a realtime alert. rather schedule it to run every minute or two. It will affect the performance for sure as the CPU core will be occupied. There is no best practice available currently but you will know this by experimenting in your test environment.
... View more
Adding to that, Don't configure the script for real time alerts, it will continuously trigger the script every minute irrespective of the results found or not.
... View more
01-05-2015
03:29 AM
Hi Sbeamro,
i am not able to get the complete details as the symbols got omitted in your comment. But what i can understand is you want to include the alert subject in your SMS !? You can take advantage of the parameters which will supply you the values directly. Don't mention the $alert variable while mentioning the script file in the alert set up page. Please see the below argument values.
`
Arg Environment Variable Value
0 SPLUNK_ARG_0 Script name`
1 SPLUNK_ARG_1 Number of events returned
2 SPLUNK_ARG_2 Search terms
3 SPLUNK_ARG_3 Fully qualified query string
4 SPLUNK_ARG_4 Name of report
5 SPLUNK_ARG_5 Trigger reason.
For example, "The number of events was greater than 1."
6 SPLUNK_ARG_6 Browser URL to view the report.
7 SPLUNK_ARG_7 Not used for historical reasons.
8 SPLUNK_ARG_8 File in which the results for the search are stored.
Contains raw results.
`
... View more
Use error logging in the bat file or put the bat file in someother location and try to trigger with absolute path.
... View more
12-30-2014
08:22 PM
whats the query? or is it the dbinfo view throwing error?
... View more
12-30-2014
08:22 PM
whats the query? or is it the dbinfo view throwing error?
... View more
12-23-2014
01:20 AM
First try disabling the firewall. if not then ask your network team to look into it
telnet IP_Add 8089
it has to be successful to make it work further
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
| User | Karma Count |
|---|---|
| 15 | |
| 1 | |
| 1 | |
| 7 | |
| 1 |
