×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
thipsz
Explorer
Member since: ‎11-09-2010
‎06-05-2020
Community Statistics
Posts 7
Solutions 0
Karma Given 0
Karma Received 1
Member Since ‎11-09-2010
Activity Feed
View All

Re: Possible bugs/typos

by in Monitoring Splunk
‎10-29-2013 08:41 AM
‎10-29-2013 08:41 AM
My appologies. ... View more

Possible bugs/typos

by in Monitoring Splunk
‎10-29-2013 08:29 AM
‎10-29-2013 08:29 AM
Propably event format for field transformations "outbound_interface_for_checkpoint" is incorrect and it should be "outbound_interface::$1" Also fields extraction "opsec : REPORT-rule_for_opsec" refers to transform rule that doesn't exist. ... View more

Re: How to display matching lookup definitions in...

by in Splunk Search
‎03-06-2013 10:40 AM
‎03-06-2013 10:40 AM
syslog contains src and dst fields with IP address as value. The goal is to identify src that talks to dst matching any of the IPs in the two lists. The query works as intended, but it would be also nice to know which list contains matching dst IP. This is being taken from getwatchlist app. ... View more

How to display matching lookup definitions in a s...

by in Splunk Search
‎03-05-2013 10:34 AM
‎03-05-2013 10:34 AM
Is there a way to display lookup definition name or lookup table file name that contains matching value in a search? Example of query: source=syslog | dedup src,dst | lookup listA ip_address as dst OUTPUTNEW | lookup listB ip_address as dst OUTPUTNEW | where isbad="true" | table device, src, dst Expected result: device src dst listA device src dst listB device src dst listA device src dst listA ...etc ... View more

Re: Indexed volume search shows results only for t...

by in Installation
‎11-09-2010 10:23 PM
‎11-09-2010 10:23 PM
Hi Crhis, Thx for the info and link, it provides what I'm looking for. We're utilizing distributed search and the below query pulls information from peers as well. We've tried localop to limit query to local server, it doesn't work. Is there a way to limit license usage information to one splunk instance? | file /opt/splunk/var/log/splunk/license_audit.log | localop | search LicenseManager-Audit todaysBytesIndexed | kv | eval totalGB=todaysBytesIndexed/1024/1024/1024 | timechart sum(totalGB) ... View more

Indexed volume search shows results only for the p...

by in Installation
‎11-09-2010 06:08 PM
1 Karma
‎11-09-2010 06:08 PM
1 Karma
Hello, Various search queries found here at Splunk Answers can provide index volume information. Several of them that I tried seem to never provide any results from time period prior to 1 month ago. Is there a way to find out why? Searching for data older than 1 month works fine. Update: Looks like index volume information is limited to earliest event in _thefishbucket index. That's not the case. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:02 AM
Karma from
View All