About mihenn

adonio · ‎03-10-2020

try to find the value for the sourcetype your event / data has then run this search: | rest services/saved/sourcetypes | search title=<your_sourcetype> if the list is huge, you can use the command: | fieldsummary look for the resutls and itll give you all the EVAL- REPORT- etc definitions for your fields hope it helps

mihenn · ‎07-26-2019

I wrote my own TA with the Addon-Bulider and I got the same error when trying to send the request. After that I did some research I found out, that it is a problem related to string formatting in Python. You have to use the same method all over the script. I mixed up two different types. But I will test your TA with this settings and report the result here.

mihenn · ‎03-21-2018

I know. TRUNCATE=0 is very dangerous. But you cannot set TRUNCATE higher than 999999 and that ist too small. The props.conf is not final yet. Line Breaking and time formats are missing. This was just an sandbox testing. Now I have to implement it on the real events.

mihenn · ‎02-07-2018

Hello, I have an unusual requirement for Splunk. I have a source that returns error messages from Java applications. These applications process messages from a Kafka cluster. If an error occurs, the message from Kafka is sometimes appended to the error message. These messages are about 5MB in size. I get the events in Splunk. However, the display of this data is a problem. If I search the corresponding index, I get back these very big events among other smaller ones. These cause SplunkWeb to stop responding. Is it possible to truncate events in SplunkWeb. The events should be available in the index, but should not be visible in their full length in Splunk. I have already tried ui-prefs. conf. This allows me to limit the display of events to a certain number of lines via display. events. maxLines. However, this only applies to the preview. The complete event is still included in the HTML code of the page. Is there any way to limit this data earlier? Thank you very much.

pratibha2018 · ‎03-19-2018

@alacercogitatus Do I get the documentation of https://splunkbase.splunk.com/app/2717/ ??

anand_singh17 · ‎05-29-2017

mvexpand 'field_name' works!!

manuelostertag · ‎09-13-2019

Hi Gregg, thanks for the hint, it seems this tool could solve my problem described at 771002. I will take a look at this tool.

Posts	21
Solutions	1
Karma Given	7
Karma Received	1
Member Since	‎08-17-2016

Online Status	Offline
Date Last Visited	a month ago

Trace a value in Splunk / data lineage

How to monitor the HTTP Alert Action?

dynamicly assigning index based on eventsize

How to truncate events in SplunkWeb

How to build a multi-level piechart?

How to split event into multiple rows in a table?

Re: Trace a value in Splunk / data lineage

Re: How to monitor the HTTP Alert Action?

Re: dynamicly assigning index based on eventsize

How to truncate events in SplunkWeb

Re: How to build a multi-level piechart?

Re: How to split event into multiple rows in a tab...

Re: Encrypt data during anonymization