About rohit1793

cbreitenstrom

Thank you @rohit1793, this spreadsheat is very helpfull!

rohit1793 · ‎05-30-2023

I am replying to very old thread but for members who will face this issue in future: below the correct way: [general] serverName = pass4SymmKey = site = site(0|1|2) [clustering] manager_uri = https://xxxx:8089 mode = searchhead pass4SymmKey = multisite = true

VatsalJagani · ‎04-19-2023

@random_event - Most of the | rest command gives constant output regardless of time-range selected. So if you want something specific, then you have to filter with | where condition. So look at the results there must be some field in it with time in it, on which you can apply the where condition to filter as you like. I hope this helps, upvote if it does!!!

rohit1793 · ‎04-04-2022

Hey, 1. You can try your login password as it seems Splunk taking SSO sign in. 2. If that doesn't work, you can create AD account and get necessary splunk access to that account.

rohit1793 · ‎04-04-2022

Hi @Shadolu , [<spec>] TIME_PREFIX = Timestamp --change as per your raw data MAX_TIMESTAMP_LOOKAHEAD = 21 TIME_FORMAT = write regex as per your data , if timestamp is start of your event[%Y-%m-%d %H:%M:%S.%Z] Yes this is possible, you have to change the parameter in props.conf file. let's say you have data coming in xyz sourcetype, you have to Add above parameter.

rohit1793 · ‎02-16-2022

There is a command multikv, it works for tabled data like we get from Unix/Linux machines: index=foo host=abc* sourcetype=vmstat | bucket _time span=5m | multikv fields | stats avg(memUsedPct) as MemoryUsed by host

rohit1793 · ‎07-28-2020

II am facing the same issue, did you found any workaround for this issue?

richgalloway · ‎03-23-2020

The report itself cannot be password-protected nor (AFAIK) can an attached PDF. You can, however, have your emailed report contain only a link to the results. That will require the recipient to sign in to Splunk to view them.

Posts	10
Solutions	2
Karma Given	3
Karma Received	3
Member Since	‎04-10-2019

Online Status	Offline
Date Last Visited	‎03-25-2024 01:28 AM

Password protected reports from Splunk

Help with extracting the fields and related data ...

Re: Splunk Add-on for 0365: Why am I receiving Inv...

Re: Multisite and Single-Site Environment

Re: What timeframe do REST API searches use?

Re: How do I find the credentials to connect Splun...

Re: Link Timestamp from data to Time picker

Re: issue with VMSTAT data coming from OS logs

Re: Splunk App for Infrastructre

Re: Password protected reports from Splunk