Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About DonaldvdHoogenb
DonaldvdHoogenb
Path Finder
Member since:
03-15-2016
06-05-2020
Community Statistics
| Posts | 15 |
| Solutions | 1 |
| Karma Given | 3 |
| Karma Received | 1 |
| Member Since | 03-15-2016 |
Activity Feed
- Karma Re: Multi value field extraction props.conf transforms.conf for somesoni2. 06-05-2020 12:48 AM
- Karma How to show search history of ALL users but one specific APP? for annakeuchenius. 06-05-2020 12:48 AM
- Got Karma for Multi value field extraction props.conf transforms.conf. 06-05-2020 12:48 AM
- Karma How do I populate a multivalue input with itself during a drilldown? for thisissplunk. 06-05-2020 12:47 AM
- Posted Re: How do I search for accented characters? on Splunk Search. 09-21-2017 02:50 AM
- Posted How do I search for accented characters? on Splunk Search. 09-21-2017 01:31 AM
- Tagged How do I search for accented characters? on Splunk Search. 09-21-2017 01:31 AM
- Tagged How do I search for accented characters? on Splunk Search. 09-21-2017 01:31 AM
- Tagged How do I search for accented characters? on Splunk Search. 09-21-2017 01:31 AM
- Posted Re: Multi value field extraction props.conf transforms.conf on Getting Data In. 12-30-2016 12:22 AM
- Posted Re: Multi value field extraction props.conf transforms.conf on Getting Data In. 12-29-2016 07:46 AM
- Posted Re: Multi value field extraction props.conf transforms.conf on Getting Data In. 12-29-2016 07:15 AM
- Posted Multi value field extraction props.conf transforms.conf on Getting Data In. 12-29-2016 06:20 AM
- Tagged Multi value field extraction props.conf transforms.conf on Getting Data In. 12-29-2016 06:20 AM
- Tagged Multi value field extraction props.conf transforms.conf on Getting Data In. 12-29-2016 06:20 AM
- Tagged Multi value field extraction props.conf transforms.conf on Getting Data In. 12-29-2016 06:20 AM
- Tagged Multi value field extraction props.conf transforms.conf on Getting Data In. 12-29-2016 06:20 AM
- Posted Re: Why was the maximum number of real time concurrent searches not increased? on Splunk Search. 09-30-2016 01:41 AM
- Posted Why was the maximum number of real time concurrent searches not increased? on Splunk Search. 09-26-2016 12:45 AM
- Tagged Why was the maximum number of real time concurrent searches not increased? on Splunk Search. 09-26-2016 12:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
09-21-2017
02:50 AM
HI Giuseppe,
I tried with the following command: | regex _raw="ę"
This also returns 0 events.
Is there anything else I can try?
... View more
09-21-2017
01:31 AM
Hi,
I have some text data with some accented characters in it.
However, I am not able to search them properly with a Splunk search query.
I have tested some stuff and I noticed the following:
This query works fine and returns the message I created:
| noop | stats count as message | eval message = "hęllo how are you" | search message=*ę*
This query does not work since it gives me 0 results (even though it should return 4 results, since there are 4 messages with this character in it:
index=twitter | search displayBody=*ę*
This query works like it's supposed to and returns many results:
index=twitter | search displayBody=*e*
Also other accented characters cannot be searched in my indexes: (é è ë etc..)
So it seems that Splunk recognizes these characters but I am not able to search them somehow...
Is there a setting of some sort to make sure I can search these characters in my indexes?
... View more
12-30-2016
12:22 AM
This works like a charm! Thank you very much!!! 🙂
I didnt know you should add that (?m) in the REGEX, but now I do.
Have a wonderful new year 🙂
... View more
12-29-2016
07:46 AM
Thank you.
I still have a question though.
I tested this on my local Splunk (which is a Search Head and Indexer). Then I do not need the seperate props.conf do I? Why is it not working the way I used it?
Thank you for answering so fast 🙂
... View more
12-29-2016
07:15 AM
Correct, but I want to do it at index time, and not by using the makemv/mvexpand commands. Do you have any idea how I can achieve this?
... View more
12-29-2016
06:20 AM
1 Karma
Hello fellow Splunker,
I have a question about my props.conf and transforms.conf.
I want to extract a multi valued field for the messages in which are displayed in the following .txt file.
#######################################
System: System_02
Message
--------------- RHSA-2016:0001 Important: security update - 1 12/23/16 RHSA-2016:0002 Important: security update - 2 12/24/16 RHSA-2016:0003 Important: bug fix update - 1 12/25/16
#######################################
I want to extract the messages as a multi-valued field. Therefore I have written the following props.conf and transforms.conf. (by looking at similar questions asked on splunk answers.)
props.conf
[mymessagetest]
MUST_BREAK_AFTER = #####
TIME_FORMAT = %m/%d/%y
category = Custom
disabled = false
pulldown_type = true
REPORT-mv_sec = mv_sec
transforms.conf
[mv_sec]
REGEX = (?<mv_sec>RHSA-[\d\:]+.+)
MV_ADD = true
However, these .conf files are not extracting the messages as a multi-value field, but as one field.
Does anyone has an idea why this is happening and how I can extract a mv-field?
To be clear, the output is now one field and looks like this:
RHSA-2016:0001 Important: security update - 1 12/23/16 RHSA-2016:0002 Important: security update - 2 12/24/16 RHSA-2016:0003 Important: bug fix update - 1 12/25/16
Thank you very much for the help!
... View more
09-30-2016
01:41 AM
I do not know for sure how that will help me. The historical searches are very fluctuating over the entire time period (between 0 and 20) while when I had the real-time dashboard open the real time searches were between 10 to 15 before the change and also 10 to 15 after the change. So it looks like my adjustment of the limits.conf did nothing (even though I performed a restart of the search heads after adjusting it).
... View more
09-26-2016
12:45 AM
Hi fellow splunkers,
I have multiple search heads on which I want to increase the maximum number of (historical and) real time concurrent searches.
I have checked splunk answers on how to do it, and changed the limits.conf in the .../etc/system/local folder of Splunk on every search head. I put the following code in the limits.conf file: base_max_searches = 24 . Since the standard number of base_max_searches is 6, I thought an increase in the concurrency of 18 historical and/or real time searches would happen.
However, this was not the case, since I still had 14 concurrent searches. Then I thought, it would have to be a user limit or maybe a role limit, so I checked the concurrency with two different users (both admin priveleges) and assigned extra concurrent searches to a role, but both did not increase the maximum concurrency.
Does anyone have an idea what I did wrong or how I can increase the concurrency of both historical as well as real time searches?
... View more
06-15-2016
06:24 AM
Thanks for your answer. It only happened one time though and I never had any more problems since it happened.
... View more
06-15-2016
06:23 AM
Sorry for my late reaction, I use Splunk 6.4.0
... View more
06-06-2016
02:14 AM
Hi fellow Splunkers,
On May 30, Splunk was very slow and was not showing any images in the navigation menus.
I would like to know from you if you can think of any reason why this was happening?
Does this occur every 30th day of the month, was it just a fluke, does it happen when your internet connection is weak, or maybe it happens when you have no encryption?
I have no clue, so I hope that one of you can provide me with Insights in why this was happening.
Thank you very much for your answer.
Kind regards,
Donald
... View more
05-13-2016
06:01 AM
Your answer only gives the app in which the search is executed, which is always the search app. It does not specify in which app the search results will be returned. You did great by coming up with this search, but the results are unfortunately not what they are supposed to be.
... View more
03-24-2016
01:20 AM
I have figured it out thanks to Mr. Bond, the creator of the app "Tour Creation App".
The url of my dashboard ends on the following: ...........test_dashboard?earliest=0&latest=now
But if you append your tour to the url it will open the tour. So change the url to the following:
...........test_dashboard?earliest=0&latest=now&tour=my_tour
Thank you very much Mr. Bond for your answer.
... View more
03-16-2016
01:01 AM
Hey asimagu,
Thank you for directing me to that app, I am sure I will learn a few things from it.
Unfortunately, the "welcome" app does not provide me with any information on how to solve the question above.
If you (or anyone else for that matter) know a way how to link tours to specific dashboards, please let me know!
... View more
03-15-2016
01:21 AM
I want to add a custom tour to a dashboard so that every time you open the dashboard, you have to work through the tour.
I am aware that in the local folder of the app I want the tour to appear in ("tour_makr"/local) you should place a ui-tour.conf file with the tour. I made my tour with the splunk app "Tour Creation App" so the ui-tour.conf file gets made automatically.
Now I want my tour to appear every time I open the dashboard named "Test_Dashboard" (which is in the "tour_makr" app)
In the ui-tour.conf file there is the following code:
[my_tour]
context = tour_makr
imgPath = /my_tour
label = my_tour
type = image
imageCaption1 = Slide number one
imageName1 = OpeningFile10.png
imageCaption2 = Slide number two
imageName2 = Slide11.png
imageCaption3 = Slide number three
imageName3 = Slide12.png
So can anybody tell me what I should do in order to make this tour appear every time I open the Dashboard called "Test_Dashboard"?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
