About tkdguq0110

tkdguq0110 · ‎03-24-2023

Thanks your response, but my company's splunk enviroment, if I add inputs in gui other cluster members get same input value.. I do not know specific enviroment.. it can happen?? my test enviroment not replicated as you say.

tkdguq0110 · ‎03-23-2023

I have a SHC with 3 search head with Enterprise when I add user, field, dashboard in GUI, everting is good to replicate to other SHC member. BUT add anything in 'Setting' -> 'Data inputs' meau, not replicated to other member. any idea? Thanks

tkdguq0110 · ‎03-09-2023

Hi all. I have one SHC with 3 search heads I thought if I create a HEC using web gui in specific memer, others were replicated HEC But NOT how should I do to fix that? my SHC member have replication_port = 9887 in server.conf

tkdguq0110 · ‎03-07-2023

I found solution.! firewall is not open 8191 port, so I open it, It goes well !! # Web firewall-cmd --zone=public --add-port=8000/tcp --permanent # Management / REST API firewall-cmd --zone=public --add-port=8089/tcp --permanent # KV store firewall-cmd --zone=public --add-port=8191/tcp --permanent # Data firewall-cmd --zone=public --add-port=9997/tcp --permanent # Replication firewall-cmd --zone=public --add-port=8080/tcp --permanent firewall-cmd --reload

tkdguq0110 · ‎03-06-2023

Hi all I have demo Enterprise Security instance IDX(1), SH(3), FWD(1), master and deployer(1) I got one SHC with SH(3) when Install app "splunk_app_stream" in deployer and deploy to SHC splunkd works but splunk web acess not working.. I set this below master_node -> replication_factor = 1, search_factor = 1 SH_node -> replication_factor = 3 I do not know what this problem is..

tkdguq0110 · ‎06-06-2021

How can I use abstract command? My query is | makeresults | eval test = " 123456789 123 456" | abstract maxlines=1 This query shoud be "test = 123456789" I think.. But whole charecter is shown Am I wrong understand?..

tkdguq0110 · ‎05-25-2021

Hi I'm a Splunk beginner. When I read a Splunk document(https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/tokens), I got a question. Using token with job properties, panel can be hide. So my dashboard code is below. <search> <query> | makeresults | eval test = "123" </query> <progress> <condition match = "'job.resultCount' == 1"> <set token = "show_html">True</set> </condition> </progress> </search> What I understand is resultCount == 1 (result is _time, test fields with one row. so resultCount is 1) So that panel should be hide I guess. Am I wrong understand? Thanks.

tkdguq0110 · ‎12-10-2020

Thank you for you answer. renjith_nair If I input index field, Is it possible to use both Index and makeresults ?

tkdguq0110 · ‎12-09-2020

Hey guys. I'm a beginner of Splunk I have a one question. I get a input value but value has a space. so I want to remove it here's my code <input type="text" token="field55"> // field55 is 'temp token' <lable>test </lable> <change> <eval token="field5"> trim($value$)</eval> // field5 is 'real token' </change> </input> ..... <query> index=mail mail_sender= "$field5$" | table mail_sender </query> if I input like 'test123 ' the result value is 'test123' (no spaces) how can I do that?? So sorry hard to read please help me out!!

tkdguq0110 · ‎05-25-2020

yes. I did

tkdguq0110 · ‎05-25-2020

This is what I wanted ! Thanks 🙂

tkdguq0110 · ‎05-25-2020

There is no way using only title tag? <title> hello \n world</title> like hello world

tkdguq0110 · ‎05-25-2020

Hi all I want to add new line in dashboard title tag for instance, <table> <title> hello world</title> </table> result value is below hello world Is it possible thing? Thanks all

tkdguq0110 · ‎05-04-2020

Hi all I'm testing sendemail command but it's not sending email. here's my search code index=main | table _time | sendemail to=tkdguq0110@gmail.com subject=sendemail_test server=mail.google.com and here's a log above 2020-05-04 19:32:27,700 +0900 ERROR sendemail:1435 - 'utf8' codec can't decode byte 0xbf in position 14: invalid start byte Traceback (most recent call last): File "C:\Program Files\Splunk\etc\apps\search\bin\sendemail.py", line 1428, in results = sendEmail(results, settings, keywords, argvals) File "C:\Program Files\Splunk\etc\apps\search\bin\sendemail.py", line 474, in sendEmail errorMessage = str(e) + ' while sending mail to: ' + ssContent.get("action.email.to") UnicodeDecodeError: 'utf8' codec can't decode byte 0xbf in position 14: invalid start byte I do not know what the problem is. I would appreciate if you give me any help Thanks

tkdguq0110 · ‎05-04-2020

Thanks for your helping. My goal is not to see search result set incoming within 5 minutes comparing previous _time. for instance, there are two fields and values in search result set. src_ip _time 2.2.2.2 10:00 and new search result set data added, like src_ip _time 2.2.2.2 10:00 2.2.2.2 10:03 comparing previous _time(10:00) and new added _time(10:03) and new added _time(10:03) is just incoming within 5 minutes just comparing previous _time(10:00) so, I do not want to see new added _time(10:03) in search result set. but, if search result set is below src_ip _time 2.2.2.2 10:00 2.2.2.2 10:06 new added _time(10:06) is just incoming after 5 minutes comparing previous _time(10:00) I want to see this search result set. Thanks

tkdguq0110 · ‎05-03-2020

I do not want to see time results incoming within 5 minutes. for example, if search result is below _time 10:00 10:01 10:02 10:03 10:04 10:05 I do not want to see the result 10:01 to 10:04 I only want to see search result below _time 10:00 10:05 Is it possible? Thanks

tkdguq0110 · ‎04-29-2020

I mean, if there is a '_time' field data incomming within 5 minutes, I do not want to see that result(I thought this was delete). I used 'bin' command before but that was just to combine time using '_time' field..

tkdguq0110 · ‎04-29-2020

Hi. When I search a '_time' field, there are two result values like '2020/04/30 18:00' and '2020/04/30 18:03' I just want to delete the result values within 5 minutes. for example, _time 2020/04/30 18:00 2020/04/30 18:06 Above is ok but, following result search I do not want. _time 2020/04/30 18:00 2020/04/30 18:03 Is it possible to delete data value in '_time' field within 5 minutes? My goal is _time 2020/04/30 18:00 2020/04/30 18:03 **(delete automatically in search)** I would appreciate it if you give me some tips. Thanks.

tkdguq0110 · ‎04-27-2020

Thanks 🙂

tkdguq0110 · ‎04-27-2020

Hi. I'm a beginner of splunk search query. I saw below search query and I did not understand what a function in sql select query. | dbxquery connection="test_db" query="select col1, col2, func_comcode(col1,'col2').... from test_table" my question is Is this function(func_comcode) user defined function?? if yes, how can I find the function definition. I think so silly question. I appreciate your answer. Thanks

tkdguq0110 · ‎04-19-2020

thanks for your help!

tkdguq0110 · ‎04-19-2020

thanks for your help!

tkdguq0110 · ‎04-17-2020

I just want to create csv file automatically everyday for example, today just is created 20200417.csv tomorrow will be created 20200418.csv ... Is it possible??

tkdguq0110 · ‎07-03-2019

How to get results in IP band

tkdguq0110 · ‎07-03-2019

index=* signature="SQL*" .... In this way, I want to see the list of source IPs detected as signatures with the string "SQL" in the B class band.

Posts	31
Solutions	0
Karma Given	15
Karma Received	1
Member Since	‎06-25-2019

Online Status	Offline
Date Last Visited	‎04-21-2025 12:59 AM

Why is SHC not being replicated to other member?

SHC not syn conf to other member

When installing app "splunk_app_stream" in deploye...

How can I use abstract command

About Splunk Job properties

Help) spl query

How to add a new line in dashboard title tag

Sendemail command does not work

How can I delete search data result incoming withi...

about dbxquery in splunk

Re: SHC not replicated to other member

Why is SHC not being replicated to other member?

SHC not syn conf to other member

Re: When installing app "splunk_app_stream" in dep...

When installing app "splunk_app_stream" in deploye...

How can I use abstract command

About Splunk Job properties

Re: Help) spl query

Help) spl query

Re: How to add a new line in dashboard title tag

Re: How to add a new line in dashboard title tag

Re: How to add a new line in dashboard title tag

How to add a new line in dashboard title tag

Sendemail command does not work

Re: How can I delete search data result incoming w...

Re: How can I delete search data result incoming w...

Re: How can I delete search data result incoming w...

How can I delete search data result incoming withi...

Re: about dbxquery in splunk

about dbxquery in splunk

Re: How can I create lookup table file(csv file) a...

Re: How can I create lookup table file(csv file) a...

How can I create lookup table file(csv file) autom...

Re: Query indicating IP detected as one signature ...

Query indicating IP detected as one signature as B...

Are you a member of the Splunk Community?