dont post wrong answers to delete all the data ... View more

@harsmarvania57  I found your solution more relevant to my case. I need to renew the RSA password; is it possible to change RSA password during server.pem renewal? ... View more

You can run from the Monitoring Console (splunk_monitoring_console app context)  to check THP effective state: | rest /services/server/sysinfo splunk_server_group=dmc_group_indexer | table splunk_server version numberOfCores, numberOfVirtualCores physicalMemoryMB ulimits.open_files transparent_hugepages.effective_state | sort +splunk_server ... View more

If you need the functionality that do a search only if first search return something then you should look require command on splunk 8.2. This is probably what you are needing? https://docs.splunk.com/Documentation/Splunk/8.2.2/SearchReference/Require r. Ismo ... View more

Old post, but still relevant and we all face this issue often. hence this reply.  So, to get Splunk Partner benefits, at times, we may need to register with our company email id. and when we will leave that project/company, we will face troubles for accessing our certifications.  Last time when i faced this situation, i sent email to splunk and they resolved pretty fast.  The mail id, as per https://splunkcommunities.force.com/customers/apex/EDU_MyCertificate is: >>> For questions about the certification program or paths email certification@splunk.com  Thanks and best wishes for your splunk certifications journey! ... View more

version 8.0.5 Could someone indicate what they are for or what they do and if they can be deleted or not?   ... View more

Does Splunk officially support for installing 2 UFs for Linux Machines?? I know it doesn't for windows.   ... View more

It would be nice to post updated and working links.  ... View more

It is not how big the volume is, it is how much free space is left. Try this command: df /opt/splunk/var/run/splunk/dispatch/ It will show you how big the hosting volume is, how much space is used and how much is available. The Available will be > 500M if you are getting that warning/symptoms (unless you have changed the default). ... View more

Since we didn't had the backups, so we had to setup the environment again from scratch. Points have been awarded to Somesh. Thanks. ... View more

Hi Kamal, A JIRA has been opened with the engineering team for this update. However, we currently do not have an expected timeline for completing this work. Thanks and apologies for any inconvenience this may have! ... View more

Following should work. Example: Search 1 | table instance * | appendcols [|Search 2 | table instance PID ] | table instance PID * ... View more

Nope, they run at scheduled intervals, and if the event feed is delayed, things can be missed. ... View more

We have 1200 clients configured. Will increasing the phoneHomeIntervalInSecs make any impact. ... View more

And also I know we can check the current threshold level for this using extreme search | inputlookup network_traffic.context.csv | table class,concept,center,count,domainMax,domainMin,points,size,type Add this to look at a given port: | search class=9571 Check the 3 pipe-separated values in points, per concept, e.g.: extreme 5|10|15 ... View more

What about giving read access to other? ... View more

The same issue just started with our tenable add-on. we were receiving data and now it stopped I restarted the Splunk service on the DCN but still doesn't work Anyone have any additional recommendations? ... View more

index=* | dedup sourcetype | table index sourcetype host _time. In the time picker, go to advanced options and put earliest time as now and apply. ... View more

Guess what, type=left was giving me syntax error in the morning and now it started working. I feel sometimes the Splunk doesn't always behave consistently. I am aware of the limitations of join but wanted to see, why isn't it working. Thanks for your reply. ... View more

Okay. Thanks ... View more

Determine if THP is enabled or off (look for effective state = ok) | rest /services/server/sysinfo | table transparent_hugepages.enabled transparent_hugepages.defrag transparent_hugepages.effective_state ... View more

In the script, i will be using this to get the count of the events, which is being processed further. It is easier to write capture values before and after comma in the regex and merge and use it in the script. But since this is being used for all the sourcetypes and I don't want to update script everywhere. I am trying to look for options where I can handle it in a single regex, just be eliminating the comma. ... View more

Hello, I was the same problem with Mysql module that I was install on my Centos server Splunk didn't work with this library, because splunk has they own python library...then you can fix it only added on the begin your script all libraries of python and also you must to add the python Centos library too... as this way Find python packages [root@xxxx]#find / -name site-packages /usr/lib/python2.7/site-packages /usr/lib64/python2.7/site-packages /opt/splunk/etc/apps/Splunk_SA_Scientific_Python_linux_x86_64/bin/linux_x86_64/lib/python2.7/site-packages /opt/splunk/lib/python2.7/site-packages Find python binary [root@xxxx]# whereis python python: /usr/bin/python2.7 /usr/bin/python /usr/lib/python2.7 /usr/lib64/python2.7 /etc/python /usr/include/python2.7 /opt/splunk/bin/python /opt/splunk/bin/python2.7 /usr/share/man/man1/python.1.gz include all at begin your script import sys sys.path.append('/usr/bin/python2.7') sys.path.append('/usr/lib/python2.7/site-packages') sys.path.append('/usr/lib64/python2.7/site-packages') And that's it , you can run mysql module without any problem and create your alerts with this module. Mysql Connection import mysql.connector I hope that this fix will help you Joel Urtubia Ugarte ... View more