About fz

fz · ‎07-01-2018

Also, Can you please verify the timestamp are same for both indexed and missed records, In some-case Splunk will discard the records if the timestamp arent recognized.

fz · ‎03-12-2018

Hi edrivera3, You can use mvexpand with eval to do this. Here is the sample query for you. Your base query | eval tagged=mvzip(testNUM, connBlock) | mvexpand tagged | makemv tagged delim="," | eval testNUM=mvindex(tagged,0) | eval connBlock=mvindex(tagged,1) | table * Hopefully this will get you what your expecting to do. Cheers!

fz · ‎10-16-2017

Hi, I guess your indexer trying to add into CM with the encrypted pass4symmkey, Since the Indexer was already added to CM with old IPand the pass4symmkey was encrypted. Can you try adding the Pass4symmkey value on the indexer and restart it after adding. Hope this helps!

fz · ‎11-14-2016

Hi splk! I doubt that it might be permission issue. I guess you need to take a look on the "Indexes searched by default" settings under the settings>access control>roles, make sure that you include the pan_logs index in selected indexes.

fz · ‎11-13-2016

Exactly mmodestino! Thanks for the compliment.!

fz · ‎11-13-2016

Hi Andresito123! I can see that you have been using "compressed=true" attribute in the outputs.conf file in your forwarders. Does your Indexer also holds the same attribute "compressed=true" in inputs.conf file? Because you need to enable the compression on the indexer side as well.

fz · ‎03-30-2016

I guess its issue with DBconnect App, Please take a look on this https://answers.splunk.com/answers/149193/db-connect-configuration-unable-to-save-database-inputs-and-slow-search-query.html

Posts	7
Solutions	1
Karma Given	0
Karma Received	6
Member Since	‎03-30-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Re: Why is Splunk dbconnect v3 batch input unable ...

Re: Separate multi-value field in individual field...

Re: Getting a failed to join cluster error from an...

Re: Palo Alto Dashboard is blank, sub dashboards a...

Re: Forwarded events not indexed

Re: Forwarded events not indexed

Re: Splunk DB Connect 1: Why am I getting error "S...