Activity Feed
- Posted Is it possible to set a hardcoded value for the "Items per page" on the searches, reports, and alerts page? on Alerting. 07-05-2022 10:42 AM
- Posted De-nesting JSON during indexing on Getting Data In. 08-02-2021 03:44 PM
- Got Karma for Re: How to upload updated lookup CSV to Splunk Cloud using REST API WITHOUT using the UI?. 06-05-2020 12:47 AM
- Posted Re: How to upload updated lookup CSV to Splunk Cloud using REST API WITHOUT using the UI? on Splunk Search. 12-23-2015 03:33 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
07-05-2022
10:42 AM
Is it possible to set a hardcoded value for the "Items per page" on the Searches, Reports, and Alerts page? Each time I open the console, it resets to "10" and I would like to keep it set to 100 for all users at all times.
... View more
08-02-2021
03:44 PM
I have the following event from GCP pubsub: { attributes: { } data: { insertId: dbp95qcbup logName: organizations/xxxxxxx/logs/cloudaudit.googleapis.com%2Fdata_access protoPayload: { [+] } receiveTimestamp: 2021-08-02T05:52:58.861079027Z resource: { [+] } severity: NOTICE timestamp: 2021-08-02T04:01:48.076823Z } publish_time: 1627883579.307 } Is there any way to use a forwarder to only send the contents of data{} to Splunk? I essentially want to strip off the outer parts of the JSON attributes{}, publishtime and have the event sent as the contents of the data{} field:" { "insertId": "dbp95qcbup", "logName": "organizations/xxxxxxx/logs/cloudaudit.googleapis.com%2Fdata_access", "protoPayload": {}, "receiveTimestamp": "2021-08-02T05:52:58.861079027Z", "resource": {}, "severity": "NOTICE", "timestamp": "2021-08-02T04:01:48.076823Z" }
... View more
Labels
- Labels:
-
JSON
-
universal forwarder
12-23-2015
03:33 PM
1 Karma
I also have this question. It doesn't seem to be possible via the API, which is silly considering you can use the GUI to upload lookup tables remotely without having to jump through the staging area hoops. Hopefully the API has or will implement similar capabilities.
... View more
