About HansK

altink · ‎01-20-2021

Hello @HansK Did you find a solution for Deleting the Alert? I have the same issue, yet not resolved. best regards Altin

wluca · ‎01-31-2019

well done HansK

AKG · ‎05-19-2015

Hi Just an update, our splunk was upgraded to 6.2.3 recently and it broke our SSO. we had to use appServerPorts = 0 option for time being. Thank you

HansK · ‎09-19-2014

For future refence, this is the regex to solve the extraction: [\n\r].*--\s*(?<INCATOT>[0-9]*)\s*(?<PRERTEAB>[0-9]*)\s*(?<INFAIL>[0-9]*)\s*(?<NATTMPT>[0-9]*)\s*(?<NOVFLATB>[0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)\s*([0-9]*)

msarro · ‎08-01-2013

My best suggestion is to use summary indexing periodically. If you want it in realtime, you're going to need to optimize splunk as much as possible. I also recommend setting up index-time field extraction to help too.

martin_mueller · ‎03-14-2013

In order for that sum to work you first need to rename the result of your timechart. Switch to the table view instead of the graph to better understand this. The columns listed there is what eval can use as input. Once you correctly eval yourself a new field it automagically becomes a column there, and will automagically appear in the timechart.

Ayn · ‎11-29-2012

Grab the first 3 digits - there are multiple ways to do this. Either you use eval and substr : ... | eval areacode=substr(yourphonefield,1,3) Or you could use rex : ... | rex field=yourphonefield "^(?<areacode>\d{3})"

HansK · ‎07-04-2012

hmm, still alerting when there are 10 occurence of any DN, not when a single DN is >10

Kate_Lawrence-G · ‎06-29-2012

I don't believe you can add another line but you could modify the placement of the warning indicator (although it won't be dynamic) Here's the link to the available properties for the gauges(Advanced XML) http://docs.splunk.com/Documentation/Splunk/4.3.3/Developer/CustomChartingConfig-ChartLegend#fillergauge ~Kate

cphair · ‎06-28-2012

No problem, @HansK. Could you click the checkmark to accept the answer?

HansK · ‎06-11-2012

host=ivr* [search host=ivr* | top 20 FIELDNAME | fields FIELDNAME] | timechart count by FIELDNAME

dshakespeare_sp · ‎06-08-2012

I think the sourcetype was the key. Once the backlog has cleared I would suggest backing off the max_fd to a value in the hundreds as too high a value could well affect performance. As you know the max_fd defines the maximum number of file descriptors that Splunk will keep open, to capture any trailing data from files that are written to very slowly. You should see if you are hitting the max_fd limit as there will be errors in the splunkd.log TailingProcessor - File descriptor cache is full (100), trimming..

_d_ · ‎10-10-2011

Hi HansK, It is very likely that the Windows App is still wired to use the old WMI method of capturing data from Windows machines. i.e. the app expects wmi sourcetypes/sources instead of perfmon. Check this out for more info: http://blogs.splunk.com/2011/04/20/sssk-1-stuff-splunkers-should-know-perfmon-wmi-collection-in-4-2/ Best, d.

Posts	39
Solutions	6
Karma Given	4
Karma Received	12
Member Since	‎08-24-2011

Online Status	Offline
Date Last Visited	‎08-21-2020 02:39 AM

SNMP Splunk MA App for Netcool is not sending trap...

Read Table

user is not able to delete alert

calculate call per second (CPS) from call detail r...

timechart and sum seperate events

cdr analysis area code

field value occurence treshold

Marker gauge, high water mark

timechart fields

line graph multiple field values

Re: user is not able to delete alert

Re: SNMP Splunk MA App for Netcool is not sending ...

Re: Why site doesn't load trying to access Splunk ...

Re: Read Table

Re: calculate call per second (CPS) from call deta...

Re: timechart and sum seperate events

Re: cdr analysis area code

Re: field value occurence treshold

Re: Marker gauge, high water mark

Re: timechart fields

Re: line graph multiple field values

Re: many small files

Re: splunk for windows app and splunk universal fo...