Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About yutaka1005
yutaka1005
Builder
Member since:
09-04-2016
06-05-2020
Community Statistics
| Posts | 269 |
| Solutions | 24 |
| Karma Given | 20 |
| Karma Received | 43 |
| Member Since | 09-04-2016 |
Activity Feed
- Got Karma for Re: map command works but need more fields. 12-07-2022 03:59 PM
- Got Karma for Re: How can I merge events from powershell input?. 10-27-2022 01:24 PM
- Got Karma for Re: About configuration in forwarding by using SSL.. 01-30-2021 01:51 AM
- Got Karma for Re: About specification of "initCrcLength" option and "crcSalt" option.. 09-10-2020 01:29 PM
- Got Karma for About using "rising column" in DBconnect v3.. 09-04-2020 04:02 AM
- Got Karma for about splunk list monitor command. 07-19-2020 12:10 PM
- Got Karma for Re: Error message is displayed when I rebuild archive data.. 06-11-2020 11:16 AM
- Got Karma for I can't change "action.summary_index" to enable summary indexing in alert.. 06-05-2020 12:51 AM
- Karma Re: Using span option with timechart causes incorrect column names. for gcusello. 06-05-2020 12:50 AM
- Karma Re: After upgrading to Splunk8.0, when I re-change column color setting in table view, "format" tags are duplicated. for scottpestyk. 06-05-2020 12:50 AM
- Karma Can't activate summary indexing for scheduled alert Splunk 8.0.0 for falcalde. 06-05-2020 12:50 AM
- Karma Splunk Add-on for Box works on 7.3.2 but on 7.3.3 it gives [Loading] Input page for yuichirosuzuki. 06-05-2020 12:50 AM
- Karma Re: About "https://docs.splunk.com/Documentation/Splunk/7.2.3/Data/Configureindex-timefieldextraction#Add_an_entry_to_fields.conf_for_the_new_field". for woodcock. 06-05-2020 12:50 AM
- Karma Re: After log rotation, UF does not forward logs. for woodcock. 06-05-2020 12:50 AM
- Got Karma for Why deployment-server can't display app of UF by handshake failure?. 06-05-2020 12:50 AM
- Got Karma for Re: Why deployment-server can't display app of UF by handshake failure?. 06-05-2020 12:50 AM
- Got Karma for Re: map command works but need more fields. 06-05-2020 12:50 AM
- Got Karma for Re: map command works but need more fields. 06-05-2020 12:50 AM
- Got Karma for Re: Why I can't use case insensitive match in lookup with WILDCARD?. 06-05-2020 12:50 AM
- Got Karma for Re: Why I can't use case insensitive match in lookup with WILDCARD?. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 3 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-04-2023
08:39 AM
Splunk-MonotorNoHandle.exe is a modular input. It is designed to monitor live IO writes to files without opening a Windows File Handle. It can be configured by adding a stanza to etc\local\inputs.conf. If it has not been configured, it will by default, start-up and run it's introspection every 60 seconds. It can be disabled complete (i.e. never run) by setting its default stanza with the following keys: run_introspection = false disabled = true
... View more
01-07-2022
08:02 AM
Hi @yutaka1005 You got the answer for your query? If yes, can you please explain it?
... View more
06-22-2021
06:54 AM
powershell inputs expect the command to return PS Objects and every object will be a separate event. Find a template to convert string output to objects here: https://community.splunk.com/t5/Getting-Data-In/powershell-input-working-example-and-some-pitfalls/m-p/556695#M92128
... View more
01-30-2021
01:50 AM
Hello, isn't Splunk default certificate considered as selfsigned? Thanks.
... View more
04-06-2020
01:12 PM
After I changed action.summary_index to true in savedsearches.conf, I got the error when attempted to modify again the alert on the UI 'scheduled search action=summary_index is not supported with per result alerting', which in my case makes sense, as my alert had this kind of 'multiline' results. So you might be able to convert your alert to trigger 'once' instead for each result depending on your case.
... View more
04-17-2020
09:37 AM
I see this box.conf file with these configs already in /splunk/etc/apps/Splunk_TA_box/default/ on Splunk 7.3.3.
Did your add-on work after this?
... View more
02-07-2020
09:47 AM
Same in version 7.3.3 for setting up color formatting on columns in a normal Splunk search. I'm hopeful that once we get the latest 8.x version this will be fixed for us as well.
... View more
10-10-2019
12:55 AM
Sorry, it was solved by myself.
Thank you for comment!
... View more
06-25-2019
12:51 AM
Awesome, thanks!
... View more
05-29-2019
08:26 AM
The problem is actually in how milliseconds work, not in how Splunk works. For your examples:
Wed May 15 13:00:00.4 ... (*it is 400 miliseconds)
Wed May 15 13:00:00.82 ... (*it is 820 miliseconds)
Wed May 15 13:00:00.110 ... (*it is 110 miliseconds)
Going the other way:
Wed May 15 13:00:00.004 ... (*it is 4 miliseconds)
Wed May 15 13:00:00.082 ... (*it is 82 miliseconds)
Wed May 15 13:00:00.110 ... (*it is 110 miliseconds)
So almost certainly everything is A-OK.
... View more
05-29-2019
01:59 AM
Thank you for answer.
But I don't think that it is way that I'm searching.
... View more
04-17-2019
08:54 PM
According to the following, I let all members had the same identity.dat , then it worked without problems.
https://answers.splunk.com/answers/306846/splunk-db-connect-2-identities-and-connections-not.html
... View more
03-28-2019
02:41 AM
Thank you for answer!
I can solve it by this solution.
But I can't do by below settings. It's weird...
<eval token="form.arg">replace($text$,"(\w{2})-(\w{2})","\1:\2")</eval>
... View more
03-28-2019
02:33 AM
I can't find problem with THP and ulimit .
Also cpu usage and memory usage is not too high.
The only point of concern is that the utilization of the partition where the hot and warm data of each Indexer are stored is close to 95%, so is this related?
... View more
03-26-2019
07:26 PM
1 Karma
My environment:
Splunk Instance ver 7.2.5 * 4 (3 search head members, 1 deployer)
Splunk DB connect ver 3.1.4
Although configuration files such as db_connections.conf are replicated, only app.conf and dbx_settings.conf are not replicated among the members.
So other than the member who was initially set up, I'm asked for a setup, everytime I enter DB connect UI page.
Of course, if I login to all other members and do the setup, it will solve it, but is there any other good way?
Since the distribution from deployer is merged to /opt/splunk/etc/apps/splunk_app_db_connect/default/ , and the original file is overwritten, so I think that this method is difficult.
... View more
03-24-2019
11:25 PM
Wow, you're right.
I confirmed that All logs that can be summarized at "~00:00:00" had this format.
Thank you for Answer and comment!
... View more
03-24-2019
10:40 PM
That is a bug. Open a support case and post the jira back here for reference.
... View more
03-18-2019
06:45 PM
マクロのValidation Expressionは使わないのが正解なんじゃないですか？
少し検証してみましたが、isnull、isnotnullくらいしかうまく動かない感じです。使いたければこの２つで制御するのをお勧めします。
Ver.7.0.3
... View more
03-18-2019
05:54 PM
English version of above answer.
The summary index is for summarizing the logs included in the index. Log events are for generating new log events. Log events consume licenses because they capture new logs.
... View more
03-13-2019
11:11 PM
確かにappend=tで元ファイルを取り込んで、dedupするみたいなサーチで実現はできるんですが、macroの動作仕様が気になるので、別途質問しようかと思います…。
... View more
03-04-2019
11:49 PM
limits.confに以下の設定をしたら、うまく動きました。
[lookup]
max_memtable_bytes = 20000000
仕様なんですかね…。
... View more
03-03-2019
06:04 PM
I can do it by changing props.conf and transforms.conf like below.
props.conf
[syslog_test]
TRANSFORMS-routing = syslogRouting,tcpnull
DATETIME_CONFIG =
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
category = custom
disabled = false
transforms.conf
[syslogRouting]
REGEX=.
DEST_KEY=_SYSLOG_ROUTING
FORMAT=syslogGroup
[tcpnull]
REGEX=.
DEST_KEY=_TCP_ROUTING
FORMAT=
... View more
03-03-2019
05:00 PM
Thank you for Answer.
I hope that this limit value will be expanded someday...
For now, I will consider another way to calculate.
... View more
03-13-2019
11:15 PM
After all, scripted input was not done many times.
Because parsing and aggregation of data takes time and Indexer can not return ACK, the result of scripted input and the internal log to the effect that scripted input were executed have been repeated many times by the useACK retransmission function.
... View more
03-06-2019
10:22 PM
Wow, you are right.
By setting INDEXED_VALUE = false, it was possible to search even field that special extraction was done from middle of words.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma from
Karma given to
