Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About spisiakmi
spisiakmi
Communicator
Member since:
06-26-2019
07-21-2023
Community Statistics
| Posts | 73 |
| Solutions | 9 |
| Karma Given | 2 |
| Karma Received | 5 |
| Member Since | 06-26-2019 |
Activity Feed
- Posted Re: Invalid key in stanza [webhook] alert_actions.conf splunk forwarder on Splunk Enterprise. 07-21-2023 03:18 AM
- Posted Invalid key in stanza [webhook] alert_actions.conf splunk forwarder on Splunk Enterprise. 07-17-2023 11:17 PM
- Got Karma for How to unset token if I choose other values from dropdown. 04-19-2023 06:32 AM
- Posted Re: query from mulivalue attibute on Splunk Search. 03-29-2023 09:05 AM
- Posted How to create query for multi value attribute? on Splunk Search. 03-29-2023 06:47 AM
- Got Karma for Re: How can I write in summary index from dashboard input on change?. 03-23-2023 09:52 AM
- Posted Re: How can I write in summary index from dashboard input on change? on Splunk Enterprise. 03-23-2023 09:19 AM
- Posted How can I write in summary index from dashboard input on change? on Splunk Enterprise. 03-23-2023 03:55 AM
- Karma Re: How to change value of an attribute using condition before indexing for gcusello. 12-06-2022 03:16 AM
- Posted Re: How to change value of an attribute using condition before indexing on Getting Data In. 12-06-2022 03:09 AM
- Posted Re: How to change value of an attribute using condition before indexing on Getting Data In. 12-02-2022 08:10 AM
- Posted How to change value of an attribute using condition before indexing? on Getting Data In. 12-02-2022 07:22 AM
- Posted Re: Indexed time doesn't change on Getting Data In. 09-22-2022 08:35 AM
- Posted Re: Indexed time doesn't change on Getting Data In. 09-22-2022 08:16 AM
- Posted Why doesn't the indexed time change? on Getting Data In. 09-22-2022 06:07 AM
- Got Karma for Re: Different xml files have not been indexed: directory monitoring.. 07-28-2022 11:57 PM
- Posted _json query problem on Splunk Search. 08-19-2021 05:58 AM
- Posted Re: How to count the delta of the first and the last event on Splunk Enterprise. 07-02-2020 04:39 AM
- Posted Re: How to count the delta of the first and the last event on Splunk Enterprise. 07-02-2020 04:30 AM
- Posted Re: How to count the delta of the first and the last event on Splunk Enterprise. 07-02-2020 04:17 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-21-2023
03:18 AM
The problem has been fixed by splunk admins. Unfortunately I don't know how. Problem appeared when they deleted old indexers from the cluster and the still have been configured on the FW side.
... View more
07-17-2023
11:17 PM
Hi, can anybody help, please? I'm using Splunk Universal Forwarder 9.0.4 (build de405f4a7979) and from 15.07.2023 I have no indexed data in Splunk. .After restart there is only 1 error: Invalid key in stanza [webhook] in C:\Program Files\SplunkUniversalForwarder\etc\system\default\alert_actions.conf, line 229: enable_allowlist (value: false). Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug' I tried this step: 1. removed [webhook] enable_allowlist = false or 2. changed it into true nothing helped. Any advice, please?
... View more
Labels
- Labels:
-
using Splunk Enterprise
03-29-2023
09:05 AM
Hi somesoni2, this is amazing simple. Absolutely perfect. Thank you very much. Works fine.
... View more
03-29-2023
06:47 AM
Hi, can I ask you for helping me with this small problem, please?
If I read the content of the lookUp using any criteria I receive attribute Attr1. This Attr1 is multivalue attribute.
Attr1
7470486
7470487
7470597
7470543
I want to create query, where will be index=test ID=7470486 OR 7470487 OR 7470597 OR 7470543
... View more
03-23-2023
09:19 AM
1 Karma
Hi richgalloway, thank you for response, I solved this problem. In fact you were absolutely right. I sent the value through a token to search of any element, can be also hidden, and this search ends like | collect index=machinedata_w48_sum testmode=false
... View more
03-23-2023
03:55 AM
Hi, can anybody help, please?
Problem:
In dashboard I have label. If I write something in the label <number> and press Enter, I would like to make an action: write something in summary index.
Label: serial_num Index: index_sum Fields to be saved in summary index: $Label$, <actual_time>, identifier
... View more
Labels
- Labels:
-
using Splunk Enterprise
12-06-2022
03:09 AM
Hi @gcusello I wanna thank you very much. Your solution with calculated field was brilliant. Very simple and effective. Thank you.
... View more
12-02-2022
08:10 AM
Hi @gcusello I try calculated field definitely. If you have a time to help me with it, it would be perfect. In this exact example. m
... View more
12-02-2022
07:22 AM
Hi, I want to index simple xml file.
<?xml version="1.0" encoding="utf-8"?> <unitData xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xsi:noNamespaceSchemaLocation="unitData-1.0.xsd" unit="0000006000" equipment="W052A-22G0014" operator="admin" starttime="2022-11-22T06:10:53+01:00" endtime="2022-11-22T06:15:07+01:00" state="ok"> </unitData>
Before indexing I would like to create new additional attribute machine which should have value depended of these conditions:
case equipment="W052A-22G0014" machine =machine1
case equipment="W052A-22G0013" machine =machine2
Can anybody help, please?
... View more
Labels
- Labels:
-
props.conf
-
transforms.conf
-
XML
09-22-2022
08:35 AM
Hi Giuseppe, I stopped splunk fw and defined DATETIME_CONFIG = CURRENT in props.conf. After that I started the service again and I will run it till tomorrow. I will observe if all events become the proper _time. I think, it could help. I cannot combine these 2 time/date variables, because it isn't the real time of the event. I will let you know. Thank you and enjoy the day.
... View more
09-22-2022
08:16 AM
Hi Giuseppe, thank you very much for a help. I have 2 important attributes in the event. Time and Date. How it is possible to define indextime from these 2 attributes?
... View more
09-22-2022
06:07 AM
Hi, can anybody help, please? I'm using classical forwarder to index regular CSV file. The time/date of the CSV logFile changes always if a new entry comes. Each event has TIME Attribute. If I choose time interval TODAY there have been indexed 100 events. The indexed time _time is always the same (similar to the time of the first event). The time attribute of each event changes of course. Does anybody have an idea, where is the problem? If I restart the forwarder, the problem appears on the next day.
... View more
Labels
- Labels:
-
index
-
indexer
-
universal forwarder
08-19-2021
05:58 AM
Hi, can anybody help me please? I have _json indexed events in Splunk. 19.08.21 08:26:27,746 { [-] name: S8.ManuelFail value: false } 19.08.21 08:26:25,746 { [-] name: S8.Pruefprogramm_PG value: S3_450 } 19.08.21 08:26:27,746 { [-] name: S8.ManuelFail value: true } 19.08.21 08:27:25,746 { [-] name: S8.Pruefprogramm_PG value: S3_450 } 19.08.21 08:28:25,746 { [-] name: S8.Pruefprogramm_PG value: S3_600 } 19.08.21 08:29:25,746 { [-] name: S8.Pruefprogramm_PG value: S3_600 } In the dashboard I choose specific time interval with the time pick up element. E.g. last 24 hours. I would like to have % number for each name: S8.Pruefprogramm_PG and its value, where name: S8.ManuelFail has value: true. It means % all name: S8.ManuelFail value: true against all name: S8.ManuelFail value: true/false. It is even possible? E.g. in this case I would like to have a table output: S8.Pruefprogramm_PG S8.ManuelFail [%] S3_450 50
... View more
Labels
- Labels:
-
subsearch
07-02-2020
04:39 AM
@to4kawa ou yeah. very very elegant.
... View more
- Tags:
- range()
07-02-2020
04:30 AM
Hi @gcusello no, you need to do max-min. The counter always increase.
... View more
07-02-2020
04:17 AM
@enjith_nair you have absolutely right. It was so easy and I made it already so many times. Thank you very much.
... View more
07-02-2020
02:11 AM
Hi, can you help me to solve this problem, please? I have index=index1 In a specified time range, e.g. 3 hours, I have these events. Time is a regular time point, where the electric power has been measured. ID is the name of the electrical counter, which counts the electrical measurements. Value is the measured electrical power [kW]. Time ID Value 02.07.2020 06:00:00 counter1 1000 02.07.2020 06:00:00 counter2 2000 02.07.2020 06:00:00 counter3 3000 02.07.2020 07:00:00 counter1 2000 02.07.2020 07:00:00 counter2 3000 02.07.2020 07:00:00 counter3 4000 02.07.2020 08:00:00 counter1 3000 02.07.2020 08:00:00 counter2 4000 02.07.2020 08:00:00 counter3 5000 How can I count the consumption of each counter in this time range? I need this output ID consumption counter1 2000 counter2 2000 counter3 2000 Thank you
... View more
Labels
- Labels:
-
using Splunk Enterprise
06-30-2020
01:09 AM
Hi. I create simple file.bat file, which I placed it into .etc/apps/appname/bin I created commands.conf in ./etc/apps/appname/local and its content is: [sps_export_vitocharge] filename = sps_export_vitocharge.bat chunked = true I restarted teh Splunk instance I try to run this search: my_search | outputcsv sps_export_vitocharge | script sps_export_vitocharge and I receive error message: Error: External search command <file.bat> returned error code 1. The file.bat is only simple move of this generated csv file. It works from the shell window. Can anybody help me, please?
... View more
Labels
- Labels:
-
using Splunk Enterprise
06-02-2020
06:12 AM
Hi 493669. Your answer/help is amazing. It works absolutely great. Thank you very much.
... View more
06-02-2020
04:37 AM
Hi. I have summary index_sum, which has 2 events, 2 attributes:
A1_sum, A2_sum
1590482539, 7722527
1591080961, 7722525
I have also index2, where a lot of time events are stored. The index time _time is important. I want to search the max(A1_sum) from index_sum and use this value to filter values from the index2.
something like this:
index2
| where _time>max(A1_sum)
can you help me, please, with this problem?
... View more
Labels
- Labels:
-
summary indexing
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-21-2023
06:39 AM
|
Karma from
