About tries

tries · ‎01-12-2018

There is a second slack notification app within the Splunk apps available: https://splunkbase.splunk.com/app/3525/#/details It seems to be possible using this app to configure a Slack Webhook URL within the trigger actions for each alert. So you should be able to define this on alert level and send to multiple channel depending on the webhook you're using.

tries · ‎01-11-2018

Thanks Jason for clarification. Your answer perfectly explain why I was running into a another issue when trying to download a CSV via this app and using the Splunk capabilities of indexing CSV files didn't work. I was able to find a workaround for this ignoring the first line and using a key/value extraction at search time so not a big deal in that case. Just to make sure I got your right, you recommend, at least for now, to download the files manually and than index the data using a filter/folder monitor input?

tries · ‎01-04-2018

Is it possible to index gz archives files from a Azure Storage account into Splunk using the Splunk Add-on for Microsoft Cloud Services Import of not archived files via the Splunk Add-on for Microsoft Cloud Services is working perfect. I already tested using the following parameters for source and/or sourcetype but Splunk is still import only "weird symbols"/the raw gz file. props.conf (tested within source + sourcetype stanza) invalid_cause = archive unarchive_cmd = gzip -cd - I also tested to NO_BINARY_CHECK = false to explicitly ignore the gz files (which is not really my goal) but also that doesn't work at all. Downloading the gz file manually and import into Splunk manually is working fine. So I assume that issue is related to the way the Splunk Add-on for Microsoft Cloud Services is consuming and forwarding the data. Hopefully someone else was running into the same issue/able to fix that issue. Thanks for your help in advance, Thorsten

tries · ‎05-02-2017

Only workaround idea I have is to use the table command to sort the columns (e.g. | table Plan, ISP, count(*) ) But I agree it would be great if that can get fixed and work as it used to work within v2

tries · ‎02-05-2017

Does the "Punchcard Gallery" dashboard also not working or this is an issue only related to a custom search ? Punchcard Gallery URL: YOUR_SPLUNK_URL/en-US/app/punchcard_app/gallery If it's only related to your custom search just post some search details here. If this issue is app related I recommend to open a support ticket at Splunk (as this app is from Splunk they should be able to provide some help)

tries · ‎02-03-2017

Using 6.5.1 I have the current version (1.1.0) installed. I have something (not 100% sure) in mind I had to delete my browser cache after upgrading to get rid of this error message. Probably something you can try and provide feedback if that solved your issue (just to help other if they running into the same issue)

tries · ‎12-13-2016

Did someone try this using a Mac and a german keyboard ? Even using BetterTouchTool I'm not able to simulate that shortcut.

tries · ‎10-07-2016

Had a similar issue with 6.4.3 and this app. Rollback the app version to Version 1.0.0 and everything worked fine for me again. Seems to be an issue with the current version or the current version only works with Splunk 6.5 (didn't had the time to test). Hope that helps

tries · ‎08-04-2014

I have a dashboard with the following specs and like to see how often this dashboard is used : SPECS (Dashboard): 1 input (text) - where user can type in a email address ~20 search panels which generates charts/reports depending on the email address which is typed into the input field I like to monitor, using the internal Splunk log files, how often the dashboard is used. Each time the dashboard is used with a filled input the count should be increased by one. Example (for new usage): - User is typing in manually a new email address inside the dashboard - User is using a link to the open that dashboard where an email address is already included as a parameter I didn't find a proper way yet. I thought this muss be possible using the _internal Splunk log files but it didn't seem so. I tried using the web_access.log and remote_searches.log but both sources couldn't show me a valid result. Any ideas ? Thanks, Thorsten

tries · ‎11-15-2013

just checked this with Splunk 5.0.5 and it's working. Seems like an Splunk 6.0 bug. I'll open a Splunk ticket.

tries · ‎11-15-2013

I'm having exactly the same issue. My props.conf: [host::rabbitmq] SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE = \<\?xml\sversion Is there a solution available for this issue ? Thanks, Thorsten

Posts	11
Solutions	0
Karma Given	7
Karma Received	5
Member Since	‎01-17-2013

Online Status	Offline
Date Last Visited	‎01-11-2022 06:34 AM

Index gz archive files from Storage Account via Sp...

How to monitor Splunk dashboard usage using intern...

Re: Multiple Channel posts with Slack Notification...

Re: Index gz archive files from Storage Account vi...

Index gz archive files from Storage Account via Sp...

Re: DB Connect 3 ignoring column order in SELECT s...

Re: Failed to load source for Punchcard visualizat...

Re: Failed to load source for Punchcard visualizat...

Re: Keyboard Shortcut to Format Search

Re: Failed to load source for Punchcard visualizat...

How to monitor Splunk dashboard usage using intern...

Re: XML Input / first character is missing

Re: XML Input / first character is missing