About dshpritz

isoutamo · ‎05-16-2025

Yes this has added recently into official documentation. But currently there are still e.g. appinspector which didn't accept it in Cloud vetting. What I have heard this will be fixed soon, so then you could use it officially with Cloud too.

mustapha_arakji · ‎01-28-2024

Hi @CarolinaHB , While that's true, changing the server.conf in C:\Program Files\SplunkUniversalForwarder\etc\system\local\ will give you the desired results. It's a best practice to place the server.conf file in a separate app as @jtacy said. That would be in $SPLUNK_HOME/etc/apps/myapp/local/server.conf. Recommended read on config files: https://docs.splunk.com/Documentation/Splunk/9.1.3/Admin/Wheretofindtheconfigurationfiles HTH

ballen1 · ‎06-29-2022

Is this still a valid fix? I've tried something very similar and it didn't work for me. Please see below: rex mode=sed "s/\"name":\s\"[^\"]+\"/"name":"###############"/g"

WillTheOnly · ‎05-23-2022

@cstamilarasan You have to run the query after you edit it in order for the "Save" option to show. It took me a while to figure that out.

dshpritz · ‎01-07-2022

I think something like this would work: SEDCMD-turnthismotherout = s/(?:^-+[\n\r$])(?:.+?[\r\n])(?:^-+[\n\r$])//g

bpenn_splunk · ‎11-04-2021

As an addition to this thread, one of my customers pointed out that they applied their renewal license and received the same "FROM_THE_FUTURE" status. The cause of this is that the "create date" field, which is in epoch form and the actual start date of the renewal, is in the future. This should clear once the create/start date arrives, but it may require a restart of Splunk.

wryanthomas · ‎06-10-2021

We've observed that the cidr match functionality in tstats (as described in answer by woodcock -- thanks!) is working for IPv4 addresses ... but not for IPv6 addresses. Any info on support for cidr match in tstats for IPv6 addresses?

pvarelab · ‎03-04-2021

It's already visible. Many thanks!

sushantnarula · ‎01-10-2021

Hi @woodcock What about if i want the blackout period only on Sunday between 2 am to 6 am Do you have solution on that. I want alert "NOT" to be triggered only between 2 am to 6 am every Sunday. Thanks, Sushant

astatrial · ‎09-03-2020

Is the negative form suppose to work as well? For example: | tstats count FROM datamodel=Network_Traffic WHERE index=* AND All_Traffic.src!="10.0.0.0/8"

dnavia29 · ‎02-27-2020

thank you it really helped

dshpritz · ‎02-27-2020

Search heads need space too, for things like search artifacts: https://docs.splunk.com/Documentation/Splunk/8.0.2/Search/Dispatchdirectoryandsearchartifacts You should check to see where the disk space is being used, and to make sure that your search head is in fact forwarding events to the index tier.

danforlogs · ‎08-29-2019

I'm in! Thanks.

thepittman · ‎02-03-2020

This works great, thanks

dshpritz · ‎04-29-2019

Hey there, The signup process is not automated. It is reviewed on a frequent basis (usually once a week, but people are people). That means that the signup is not instant, but you should receive an invite within two weeks. One problem that can occur is if you have an exiting invite which has already been sent in the past, the system will not resend the invitation, so you may need to search older emails to see if you have a pending invitation. Thanks, Dave

dshpritz · ‎09-19-2018

Didn't know that. This post is solid gold!

DBuhler · ‎06-18-2018

Yeh, I was able to map some fields with the CIM fields, but wasn't getting/receiving any notable events or anything. Anyway, something happened that now it seems my events doesn't match to the web datamodel anymore. Trying to sort it out.

dshpritz · ‎03-18-2019

I haven't tried that particular setting.

ikulcsar · ‎01-05-2018

Welcome. Thank you for your help and time.

dshpritz · ‎06-06-2017

Those are searches for report acceleration. If you get the "savedsearch_id" field from the results it will give you the name of the user and the app, and the "search_type" field will tell you the type of acceleration.

woodcock · ‎04-07-2017

You cannot do any better than Aplura; if it wasn't for these guys, the whole internet would be broken all the time.

dshpritz · ‎02-22-2018

The solution that I found was to install DB Connect on the deployer as well. This is not currently called out in the documentation.

woodcock · ‎02-21-2017

Don't forget to click Accept to close the question.

dshpritz · ‎10-26-2016

in this case, the impact is that the events will be larger, and the errors will go away. Generally, adjusting that value will allow for larger events. If your linebreaker is wrong, and you allow jumbo events, the possibility exists that your indexers/HFs will become unhappy.

jgorman_THG · ‎09-12-2016

So strange. I restarted all the heavy forwarders and still have the same result. There's nothing special that needs to be done since it is forwarding to SplunkCloud? Thanks

Posts	302
Solutions	61
Karma Given	501
Karma Received	400
Member Since	‎12-15-2010

Online Status	Offline
Date Last Visited	‎10-23-2025 07:51 AM

How can I override the timezone for Splunk DBX 3.1...

How can I get actual host names or IPs for Rapid7 ...

Why is syslog right into Splunk so bad/wrong?

SimpleXML, piecharts, percentages and custom drill...

dispatch.finalizeRemoteTimeline taking a long time...

Creating a multivalue field from a result?

Re: Does props.conf support wildcards?

Re: Can you disable the management port (8089) on ...

Re: Why does my sed replace command replace too mu...

Re: Can you alter the Splunk search used for an al...

Re: using SEDCMD to remove repeated lines

Re: Why does Splunk enterprise license show: Statu...

Re: How do I do a cidr match/not match in a tstats...

Re: "Device Port" and "Port" incorrectly extracted...

Re: Can I set a blackout period for a scheduled se...

Re: Is it possible to do a CIDR match in a tstats ...

Re: How to mask a password in a log coming from an...

Re: Why is disk used in my SEARCH HEAD too high?

Re: Splunk Slack Channel

Re: SEP 14.2 RU1 log format change

Re: Splunk slack channel

Re: How do I find what is causing my typing queue ...

Re: How to create matching log with CIM "proxy" da...

Re: How can I override the timezone for Splunk DBX...

Re: CEF logs parsing for Enterprise Security

Re: How to track the cause of skipped saved search...

Re: Anyone familiar with any good SPLUNK consultan...

Re: DB Connect Migration to V3

Re: App for Web Proxies: Why is Action showing as ...

Re: Numerous messages WARN LineBreakingProcessor ...

Re: How to direct incoming data from heavy forward...

Join the Conversation