About wfresch

wfresch · ‎07-12-2019

Where would I find that file though? Can I find it from the splunk web instance? I don't have access to any raw server files.

wfresch · ‎07-12-2019

I need to create the same alert for several splunk instances. Is there an easy way to do this using the underlying js or xml? I've done this for Dashboards by exporting/importing the underlying xml. Note - I'm a Power User, but I'm not an admin.

wfresch · ‎01-10-2019

How do I make that work on an enterprise query that uses an index? ie "index=mylog path='/routeX/*' ?

wfresch · ‎01-10-2019

will this work, even if I don't know the actual GUIDs ahead of time?

wfresch · ‎01-10-2019

will this work, even if I don't know the actual GUIDs ahead of time?

wfresch · ‎01-10-2019

Suppose I have the following data, but I don't know the GUIDs ahead of time: Path /boat/826ec68b-cc87-41f9-b93b-5bfae6f21c52/duck /car/39bdd442-167b-46b0-95fd-1e8e0423e7f8/fox /car/2c2d27d4-4c07-460e-8c0e-11aad4e4c34a/cat /car/2c2d27d4-4c07-460e-8c0e-11aad4e4c34a/fox /car/2c2d27d4-4c07-460e-8c0e-11aad4e4c34a I'd like to get counts like this: Count Path 1 /boat/*/duck 2 /car/*/fox 1 /car/*/cat 1 /car/* Is this possible? I can even get close to this. I'd be happy — like, a count of 4 for "/car/*" would still be better than nothing.

Posts	6
Solutions	0
Karma Given	15
Karma Received	4
Member Since	‎10-29-2018

Online Status	Offline
Date Last Visited	‎11-14-2023 03:22 PM

Easily copy alerts to multiple splunk instances

How do you get counts with wildcards?

Re: Easily copy alerts to multiple splunk instance...

Easily copy alerts to multiple splunk instances

Re: How do you get counts with wildcards?

Re: How do you get counts with wildcards?

Re: How do you get counts with wildcards?

How do you get counts with wildcards?

Join the Conversation