About YoungDaniel

Raja · ‎02-14-2022

Hello Daniel, Can you help me with search query to create services with dependencies with service template assign.

YoungDaniel · ‎05-17-2020

Works! I adde the LANG var to the splunk-launcher script. It also does the job and help out for future restart.

YoungDaniel · ‎07-25-2018

Seems like the dedup is playing games. What happens if you dedup the _raw field ? do you still get different results?

kelvinchan · ‎07-30-2018

@DalJeanis, thanks!! Should have figured that out to speed up the search and performance. Somesh's answer works great, I've upvoted his answer. Thanks.

helius · ‎07-25-2018

Finally figured this out. The entire log wasn't just JSON. It was a mix of text and JSON ON DIFFERENT LINES: 2018-07-25 00:00:04,169 DEBUG [1532476571629] [49] Coral job status response: { "Data": { "id": "-LIDiA9URgCSYRGHoIPj", "created": "2018-07-24T23:56:08Z", "expires": "2018-07-25T23:56:08Z", "status": "PROCESSING", "completed": 1, "reason": "NONE" } } The suggestions by YoungDaniel was helpful, but it was only working if it was pure JSON all on one line. I had a suspicion that MAX_TIMESTAMP_LOOKAHEAD was the real culprit here. Setting MAX_TIMESTAMP_LOOKAHEAD = 1 seems to be working!

YoungDaniel · ‎07-20-2018

ddrillic · ‎07-18-2016

Makes perfect sense. It's just that this app of yours needs to reach the forwarders and the search peers and each one of them at the moment has a specific built-in solution - deployment app and the configuration bundle (the original name of an app ; - ) ) I think you are right in saying that logically both of these operations define a stream of data and therefore should be defined together. I just don't see how it can be done...

jcoates_splunk · ‎02-27-2016

if it's not even loading the configuration page, something is Not Right(TM)... we'd appreciate a bug report so we can figure out what.

woodcock · ‎12-17-2015

Take a look at this question and answer that shows how to use the map command to use times from one search in another search: https://answers.splunk.com/answers/232781/find-all-events-of-type-x-that-do-not-have-an-even.html

renjith_nair · ‎12-10-2015

Easiest way to find whether the index is created is , Click Settings > Access Controls edit or add a role and check in "Indexes searched by default" section to see if the index is listed. or run |tstats count where index=* and see if your index is listed

Posts	17
Solutions	0
Karma Given	5
Karma Received	3
Member Since	‎12-10-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

ITSI: How to create services from search results i...

Is there a best practice for copying configuration...

Splunk DB Connect 2.1.3: When adding a DB Lookup f...

How to create a search based on timestamps from an...

How to show a deployed index in Splunk Web on a se...

Re: ITSI: Creating Services from Search results in...

Re: Splunk web fails to start after upgrade to 8.0...

Re: splunk search produces different results when ...

Re: How to create timechart to show server log ing...

Re: JSON is being cut off at "created" key

Re: Compare stats of current day with previous day

Re: Is there a best practice for copying configura...

Re: Splunk DB Connect 2.1.3: When adding a DB Look...

Re: How to create a search based on timestamps fro...

Re: How to show a deployed index in Splunk Web on ...