Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About wpreston
wpreston
Motivator
Member since:
06-04-2012
09-28-2022
Community Statistics
| Posts | 263 |
| Solutions | 60 |
| Karma Given | 9 |
| Karma Received | 250 |
| Member Since | 06-04-2012 |
Activity Feed
- Got Karma for Re: Why is the "map" command not working in dashboard and the corresponding panel displays "Waiting for inputs"?. 08-25-2022 01:35 AM
- Got Karma for Re: Why is the "map" command not working in dashboard and the corresponding panel displays "Waiting for inputs"?. 07-28-2022 08:54 AM
- Got Karma for Re: how do i combine multiple fields in to a single field??. 02-03-2022 06:47 AM
- Got Karma for Re: Why am I just getting a chart, but no trend line after using trendline command?. 11-11-2021 02:06 AM
- Got Karma for Re: How to calculate the time between events based on a field change grouped by another field?. 04-01-2021 06:29 PM
- Got Karma for Re: Why is the "map" command not working in dashboard and the corresponding panel displays "Waiting for inputs"?. 07-24-2020 12:37 PM
- Karma Does Windows Protected Event Logging work with Splunk? for MonkeyK. 06-05-2020 12:48 AM
- Karma Re: How do I search specified fields with the same keyword list without searching the entire index? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Is it possible to create a field in Splunk based off a user's input? for alacercogitatus. 06-05-2020 12:47 AM
- Karma How to get complex transactions over two fields for lwolter. 06-05-2020 12:47 AM
- Karma Why am I getting "Splunk Enterprise setup wizard ended prematurely..." trying to upgrade to Splunk 6.2 on Windows 7 64 bit? for Afef. 06-05-2020 12:47 AM
- Karma Why does login page show "Your browser could not connect to Splunk.com..." after upgrading server to 6.2 in a closed environment with web.conf configuration? for pil321. 06-05-2020 12:47 AM
- Got Karma for Re: Advanced search question, match logs entries against other entries by string, show diff?. 06-05-2020 12:47 AM
- Got Karma for Re: How to use Splunk to search values pulled from an Oracle DB table?. 06-05-2020 12:47 AM
- Got Karma for Re: How to use Splunk to search values pulled from an Oracle DB table?. 06-05-2020 12:47 AM
- Got Karma for Why time range picker on default Splunk 6.1.x UI shows "Earliest time cannot be greater than latest time" errors?. 06-05-2020 12:47 AM
- Got Karma for Why time range picker on default Splunk 6.1.x UI shows "Earliest time cannot be greater than latest time" errors?. 06-05-2020 12:47 AM
- Got Karma for Why time range picker on default Splunk 6.1.x UI shows "Earliest time cannot be greater than latest time" errors?. 06-05-2020 12:47 AM
- Got Karma for Why time range picker on default Splunk 6.1.x UI shows "Earliest time cannot be greater than latest time" errors?. 06-05-2020 12:47 AM
- Got Karma for Why time range picker on default Splunk 6.1.x UI shows "Earliest time cannot be greater than latest time" errors?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 11 | |||
| 0 | |||
| 4 | |||
| 0 | |||
| 0 | |||
| 6 |
07-28-2017
11:22 AM
Answer from support is that this functionality is not currently included.
... View more
07-21-2017
08:36 AM
You'll probably have to use some regex-fu to make this work. Create a field using the rex command and use a negative lookbehind to find "Drake " or "drake " preceding "drive" to discard those matches. Then search for any events with a value in your new field. Something like this:
base search
| rex "(?i)(?<Valid_Drive>(?<!drake\s)drive)"
| search Valid_Drive=*
... View more
07-17-2017
08:58 AM
If you go to Settings --> Fields --> Field Transformations, you can create a field transform (a field extracting regular expression) that uses the "source" field as the source-key.
Next go to Settings --> Fields --> Field Extractions and create a new extraction, being sure to set the "Type" to Transform and using the Transform you created above.
Be sure to put both of these in the correct app.
... View more
07-14-2017
02:38 PM
You could also test it directly from the search bar using the sendalert command. Docs here and here.
... View more
07-06-2017
08:16 AM
Just a post-holiday bump. Any ideas?
... View more
07-03-2017
10:40 AM
I have a simple app which, among other things, adds a custom alert action. This custom alert action adds a new parameter in alert_actions.conf. I need to require a value for this new parameter when the users install the app, but I haven't found a way to make a field required/mandatory in setup.xml. Is there a way to do this?
... View more
06-30-2017
04:15 PM
I like this idea! We are using a glusterfs / Pacemaker cluster and this sounds exactly like what we need. I had been thinking about sym-linking the fishbucket but this is a more robust solution. I'll have to get in touch with the server admins and see if we can get this going. Thanks for the idea!
... View more
06-30-2017
03:58 PM
This is interesting... I wonder if it will work? I'll have to try setting this up and testing it out as well. Thanks for the suggestion!
... View more
06-30-2017
08:18 AM
Is there a high-availability or multi-node configuration for Splunk forwarders?
I have a small RHEL cluster writing data to shared storage. Any cluster node could be writing to any one of the files on the shared storage. I need to monitor the data written to the shared storage at all times, even if one or more cluster members goes down, however I don't want to index multiple copies of the data. Can forwarders be used in this way? Two or more forwarders monitoring the same data but not sending duplicate data? Or possibly some kind of primary/backup configuration for the forwarders? Any help/ideas would be greatly appreciated!
... View more
08-29-2016
12:31 PM
The free version of Splunk has an indexing limit of 500 Mb per day. Did you perhaps index more than that after the trial license expired? If you index above your licensing limit more than 3 times in a 30 day window on the free version, the search functionality becomes disabled until you either get an unlock key, input a new license or one of the violations rolls past the 30 day window and your total licensing violations fall to 3 or less.
See this document about licensing for more information if you think this is what happened.
... View more
02-16-2016
11:19 AM
Given your example in problem 1 of your question ( (AB)[AB]CDA... ), and given the structure of the sample data you've provided in the above comment, what in the data would tell you to discard the first (AB) in problem 1? Anything?
... View more
02-03-2016
05:53 AM
What version of Internet Explorer are you using?
... View more
01-21-2016
06:08 AM
Looking at your other question about not all fields being extracted in your transaction, it makes me wonder if uri is not extracted prior to your where command. Try rearranging the search so that | fields * comes before | where isnotnull(uri) and give that a shot.
index=* | rename correlationId as CID | transaction CID | fields * | where isnotnull(uri) | table uri, serviceName,operationName,host
... View more
01-21-2016
06:05 AM
Are your search results set to 'Fast Mode'? If so, Splunk will only extract the fields that it needs (like the default host, source, sourcetype, _time, etc) and the fields that you explicitly state in your search. If you want most or all fields extracted you will need to use either 'Smart Mode' or 'Verbose Mode'.
... View more
01-20-2016
06:30 AM
Glad this helped you out! And yes, the duration will be in seconds but you can eval it into minutes, hours or whatever else you might need.
... View more
01-19-2016
01:54 PM
4 Karma
You can accomplish this using either streamstats or transaction . First, here's a streamstats example:
... your base search ... | streamstats window=1 current=f last(_time) as newTime last(ipaddress) as newIP by userid | eval duration = newTime - _time | table userid newIP ipaddress duration
You can accomplish the same thing with transaction like this:
... your base search ... | transaction userid maxevents=2 mvlist=ipaddress | eval oldIP=mvindex(ipaddress, 0) | eval newIP=mvindex(ipaddress, 1) | table userid newIP oldIP duration
Something along those lines, anyway. Hope this helps out!
... View more
01-19-2016
08:20 AM
Sorry, should have included that!
Splunk version: 6.3
OS: Windows 2008 R2
... View more
01-19-2016
06:42 AM
I've got a kvstore lookup who's data is updated every day from a scheduled search. I built it using the ideas that @dwaddle and @starcher presented at .conf2015 (presentation here if anyone is interested). This worked great for a few months, but now I'm getting an error message whenever the updating search runs. Neither the updating search nor structure of the data have changed so I don't think it has anything to do with the search itself. When the updating search runs, it returns a table of data but gets the following message when it tries to write to the kvstore:
"Could not append to collection 'CollectionOfIncidents': an error occurred while saving to the collection. See search.log for more details."
When I look in search.log there is one more message:
ERROR KVStoreLookup - KV Store Lookup output failed with code -115 and message ''
Any ideas as to what this error code means or what could be causing the update to fail?
... View more
01-07-2016
07:20 AM
Absolutely, I agree that stats is more efficient. I'm just a fan of transaction and thought to spread the word 🙂
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-28-2022
11:03 AM
|
Karma given to
