Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About jrodriguezap
jrodriguezap
Contributor
Member since:
08-06-2013
06-22-2025
Community Statistics
| Posts | 110 |
| Solutions | 1 |
| Karma Given | 19 |
| Karma Received | 16 |
| Member Since | 08-06-2013 |
Activity Feed
- Posted Re: separate rows from columns with multivalue on Splunk Search. 06-22-2025 11:04 AM
- Posted Re: separate rows from columns with multivalue on Splunk Search. 06-22-2025 11:02 AM
- Posted separate rows from columns with multivalue on Splunk Search. 06-16-2025 05:01 PM
- Got Karma for Where to add custom artifact types to use in the workbench?. 01-12-2023 02:57 AM
- Got Karma for How to display dashboard panels dynamically?. 12-29-2022 11:09 AM
- Posted Re: Where to add custom artifact types to use in the workbench? on Splunk Enterprise Security. 12-19-2022 05:03 PM
- Posted Where to add custom artifact types to use in the workbench? on Splunk Enterprise Security. 12-04-2022 02:12 PM
- Karma Re: command map not working for to4kawa. 06-05-2020 12:51 AM
- Karma Re: How to write a search to merge logs with transaction where OR if? for OL. 06-05-2020 12:47 AM
- Karma Re: Can inner join be used to join null fields? for musskopf. 06-05-2020 12:47 AM
- Karma Re: How to get top 2 MB users per website? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: How to prevent field names with periods (.) OR hyphens (-) from getting replaced with underscores (_)? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: return command works only with numeric values? for musskopf. 06-05-2020 12:47 AM
- Got Karma for Re: return command works only with numeric values?. 06-05-2020 12:47 AM
- Got Karma for How to display dashboard panels dynamically?. 06-05-2020 12:47 AM
- Got Karma for How to display dashboard panels dynamically?. 06-05-2020 12:47 AM
- Got Karma for Re: How to display dashboard panels dynamically?. 06-05-2020 12:47 AM
- Got Karma for How to get top 2 MB users per website?. 06-05-2020 12:47 AM
- Got Karma for Can inner join be used to join null fields?. 06-05-2020 12:47 AM
- Got Karma for How to write a search to merge logs with transaction where OR if?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 3 | |||
| 0 | |||
| 0 |
06-22-2025
11:04 AM
Thank you very much @PrewinThomas , with what you commented along with @bowesmana I was able to specify what I needed
... View more
06-22-2025
11:02 AM
Applying this suggestion worked for me... I've tested it with more data, and so far there have been no inconsistencies. I really appreciate the input! 😄
... View more
06-16-2025
05:01 PM
I'm trying to split a pair of rows with a pair of multivalued columns. The value in both columns is related to each position of the multivalued column. To make myself clear, I'm displaying the initial result table, and below that is the table for the desired result. I tried mvexpand, but that doesn't give me the expected result. Example: I have rows like this: Domain Name Instance name Last Phone home Search execution time Domain1.com instance1.com instance2.com instance3.com instance4.com instance5.com 2022-02-28 2022-03-1 2022-03-2 2022-03-4 2022-03-5 And I would like to transform them into this: Domain Name Instance name Last Phone home Search execution time Domain1.com instance1.com 2022-02-28 2022-03-01 Domain1.com instance2.com 2022-02-28 2022-03-02 Domain1.com instance3.com 2022-02-28 Domain1.com instance4.com 2022-02-28 2022-03-04 Domain1.com instance5.com 2022-02-28 2022-03-05
... View more
12-19-2022
05:03 PM
Is there anyone who has gone through the same situation? maybe i found a solution
... View more
12-04-2022
02:12 PM
1 Karma
Hello everyone In the Investigation view, in the Workbench section, I want to add a different artifact type than the ones that appear (asset, identity, file, url), I would like an artifact type: Device, and another type: Index. Where to add custom artifact types to use in the workbench?
... View more
Labels
03-14-2020
08:35 PM
Hi everyone
Someone who has used the map command who can help me, I am trying to bind the username of the 12 hours before the first search, but the result does not give any value
This is my query, maybe I'm doing something wrong
host=10.10.10.30 direction=in earliest=-15m latest=-1m| stats count by src_ip | map search="host=10.10.10.30 earliest=-12h latest=-15m src_ip=$src_ip$ username=*"
... View more
03-10-2020
10:52 AM
It happens the same to me too.
Could someone correct it? please!
... View more
10-09-2017
08:16 AM
will there be someone who has happened to him?
... View more
10-06-2017
07:48 AM
Hello.
I explain the scenario:
I have 2 servers destined to different functions ServerA (receive and index, few searches) and ServerB (full searches)
In particular, the ServerB will be the database with /dbsplunk partition with 3TB.
While the ServerA, it will receive the data and index it on the NFS /dbsplunk mounted drive from the ServerB.
So far, the indexing works very well, the data is stored without problems. But when doing searches, both can search the buckets WARM or COLD, but bucket HOT can not be searched. I understand because Splunk blocks the HOT at the time of writing, but I know that Splunk can replicate the HOT files so that other searchers can access the search (1 for each search), according to the following link: http://docs.splunk.com/Documentation/Splunk/6.6.0/Indexer/HowSplunkstoresindexes#Bucket_names
How could I get the ServerA and ServerB to search in bucket HOT at the same time. I know that in the indexes.conf file there is the parameter repFactor = auto, but I do not know how to get it.
... View more
10-05-2017
08:06 AM
Hello
Its possible?
... View more
03-11-2015
10:00 PM
yes.
Thanks
... View more
03-11-2015
09:23 PM
Thanks satishsdange
I understand the use of inputs and props. But that more than anything is to filter or manipulate the data to be indexed, which already have done.
The detail is that my indexB usually consume 2.8GB, but sometimes exceeds 3.9GB, and this affects me. As always wanted to reach a maximum of 3GB per day.
May be this?
... View more
03-11-2015
08:35 PM
Hello everyone
I am trying to limit the ability of indexing per day of for each of my indexes as follows:
indexA = 5GB
indexB = 3GB
indexC = 8GB
In my indexes.conf file I have the following:
[indexA]
maxDataSize = 5120
[indexB]
maxDataSize = 3072
[indexC]
maxDataSize = 8192
However, this amount exceeds indexing daily. Am I doing something wrong or am I missing something? I'm grateful for your help.
Regards
Jorge
... View more
11-25-2014
10:16 PM
Hi somesoni2
Thanks for you answer.
I'm testing your example with following parameters
maxHotSpanSecs = 3600
maxHotBuckets=3
maxWarmDBCount = 21
In 15 hours i get results, and I commented
a query.
With this I mean that when you reach total buckets will be sent to colddb. What if between maxHotSpanSecs splunk restart the service, but I'm wrong a new bucket is created. So this would impact total buckets.
thanks
Regards
... View more
11-25-2014
09:01 AM
Hi
I have indexed logs from more than nine months ago in the default directory: $SPLUNK_DB\dbcustom1\db
And I wish to run a task every month to send all logs older than 3 months to $SPLUNK_DB\dbcustom1\colddb
I would appreciate a clue please.
Regards.
Jorge
... View more
11-17-2014
10:28 AM
Martin understand, this is for a report that is generated monthly with a "bucket"
For example: Top 3 mailserver for day
This is stored in a summary, and then it is called by some dashboards.
Thankz
Jorge
... View more
11-17-2014
10:23 AM
Excellent @martin_mueller!!!
I knew you could
thank you very much
... View more
11-17-2014
10:07 AM
Hi Martin
What is happening after setting the props and transforms, is showing me the above fields and new fields
client_host | client_id | report_id | igoogleinicio_com | igoogleinicio.com | webair_com | webair.com | smtp_ec_br | smtp.ec.br | your_server_de | your-server.de
... View more
11-16-2014
04:03 PM
Thanks for the tip.
I wish it were as comets, but those who come are dynamic fields, often reaching 10 to 20 "fields =" with different domain names.
consultation, which would put the value CLEAN_KEYS
Currently the SourceType is "report" and am configuring props.conf
[report]
REPORT-rpt_1=no_clean_keys
In transforms.conf
[no_clean_keys]
DELIMS = ",", "="
CAN_OPTIMIZE = false
MV_ADD = true
CLEAN_KEYS = false
Extract the fields well, as needed. But keep the above fields, there will be way to clean?
... View more
11-16-2014
11:11 AM
Hi
I have the following logs:
10/01/2014 00:00:00 -0500, client_host="172.24.1.41", client_id=db01, report_id=RAS04, igoogleinicio.com=3491, webair.com=13148
10/01/2014 00:00:00 -0500, client_host="172.24.1.41", client_id=db01, report_id=RAS04, smtp.ec.pe=1313, your-server.de=13148
These data need to view them as a table: ... | table *
And show me the header like this:
client_host | client_id | report_id | igoogleinicio_com | webair_com | smtp_ec_br | your_server_de
As you can see, the fields that have: _ and . are replaced by _ (underline).
There will be no way around this?
I thank You in advance.
Regards
Jorge
... View more
11-14-2014
02:31 PM
1 Karma
hi somesoni2
Thank you very much for the tip, I was reviewing the code.
There will be way to do this with one dropdownlist?
... View more
11-14-2014
11:02 AM
3 Karma
Hi
Anyone know how to achieve the following XML Dashboard:
I have a drop-down with 3 input values: ValueA, ValueB, ValueC.
Below I want 3 Panels to be generated based on the selected values in the drop-down.
PanelA is a column chart, PanelB is a line chart, PanelC is a Table
How can I do this so that when you select in the Dropdown:
ValueA shows PanelA
ValueB shows PanelB
ValueC shows PanelC
I would appreciate assistance with this please.
regards
... View more
10-11-2014
04:03 PM
that's the detail. The same happens to me with an F5 ASM
... View more
10-10-2014
10:54 PM
Hi jrodman
I tried also with syslog via TCP / 514, and also truncated, that's normal?
I am what I am doing from ironport wsa
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-22-2025
11:00 AM
|
