Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About pduvofmr
pduvofmr
Path Finder
Member since:
07-01-2019
08-05-2021
Community Statistics
| Posts | 21 |
| Solutions | 1 |
| Karma Given | 8 |
| Karma Received | 0 |
| Member Since | 07-01-2019 |
Activity Feed
- Posted Re: combine where and eval on Splunk Search. 04-08-2021 06:03 AM
- Posted combine where and eval on Splunk Search. 03-25-2021 03:39 AM
- Posted Eval Input Token with Backslashes on Splunk Search. 12-03-2020 07:44 AM
- Posted Splunk creates a blank timestamp field by manual add data on Getting Data In. 07-14-2020 01:08 AM
- Posted Re: Subtract the Results of one search from another search on Splunk Search. 07-01-2020 05:36 AM
- Posted Register Isilon with Dell EMC Isilon Add-on 2.6.0 and 2.7.0 on Splunk Enterprise. 06-17-2020 05:27 AM
- Karma Re: web.conf - updateCheckerBaseURL for manjunathmeti. 06-05-2020 12:51 AM
- Karma Re: How to show the status of an ESXI and display panels for justinatpnnl. 06-05-2020 12:50 AM
- Karma Re: "No spec file" errors when trying to deploy Splunk Add-on for VMware from the index master node for keio_splunk. 06-05-2020 12:50 AM
- Karma How to add the logs of EMC unity storage to splunk? for ahmedzard. 06-05-2020 12:49 AM
- Karma Re: Why are we getting "[subsearch]: Search auto-finalized after time limit (60 seconds) reached" error? for ddrillic. 06-05-2020 12:48 AM
- Karma How to deploy SMTP email config on search heads? for brent_weaver. 06-05-2020 12:47 AM
- Karma Re: Reset splunkforwarder to re-read file from beginning for glitchcowboy. 06-05-2020 12:46 AM
- Karma Re: How to delete data / index (reset start from scratch) for lguinn2. 06-05-2020 12:46 AM
- Posted Re: command="sendemail", SMTP AUTH extension not supported by server. on Reporting. 04-21-2020 05:19 AM
- Posted PDF Report Timeout on Reporting. 04-21-2020 05:03 AM
- Tagged PDF Report Timeout on Reporting. 04-21-2020 05:03 AM
- Tagged PDF Report Timeout on Reporting. 04-21-2020 05:03 AM
- Tagged PDF Report Timeout on Reporting. 04-21-2020 05:03 AM
- Tagged PDF Report Timeout on Reporting. 04-21-2020 05:03 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-25-2021
03:39 AM
Hi Community, how do i combine where and eval? Available field are "Gear" and "Torque_Crankshaft" Discribed in my human brain / language 😉 eval "Torque_Wheel" = (where ("Gear"=1 == ("Torque_Crankshaft"*5.0000)), ("Gear"=2 == ("Torque_Crankshaft"*3.2000")), ("Gear"=3 == ("Torque_Crankshaft"*2.1429)))
... View more
12-03-2020
07:44 AM
Hi @ All, i know, ther are many diskussions about this topic, but nobody sent his solution 😞 MY CODE: <input type="text" token="Source_Folder_Input"> <label>Source Folder</label> <change> <eval token="Source_Folder_Input_Replace">replace($Source_Folder_Input,"\\","\\\\")</eval> </change> <default>C:\SHARE</default> </input> I want to replace single backslash to doubble. Now my Dashboard says "Search is waiting for input... ". If i change for testing change from "TEST" to "SHARE" it works <i´m confused>
... View more
07-14-2020
01:08 AM
Hi Splunky´s ive got a csv with the follwing structure: CreationTime,LastWriteTime,Name,Length,Directory I want to set my timestamp to "Current" when uploading data. My problem is, when i set timestamp to "Current", the splunk generates a new field named "timestamp" and all values in this filed are "none". (see screenshot on right side) This problem is only by choosing "Current", all other options dont have this additional "timestamp" field.
... View more
- Tags:
- csv
Labels
- Labels:
-
field extraction
-
props.conf
-
time
07-01-2020
05:36 AM
Hi, use strptime to convert both time values and push it into two variables. Then you can subtract these two variables with eval...
... View more
06-17-2020
05:27 AM
Hi Community, my Isilon OS: iOneFS Version: 8.1.2.0 ive got the following two errors, depends on Splunk and Addon version combinations: Encountered the following error while trying to update: Error while posting to url=/servicesNS/nobody/TA_EMC-Isilon/isiloncustom/isilonendpoint/setupentity Error occurred while authenticating to server - Splunk 7.3.6 and emc-isilon-add-on-for-splunk-enterprise_240 > working - Splunk 7.3.6 and emc-isilon-add-on-for-splunk-enterprise_250 > working - Splunk 7.3.6 and emc-isilon-add-on-for-splunk-enterprise_260 > not working - Splunk 7.3.6 and dell-emc-isilon-add-on-for-splunk-enterprise_270 > not working - Splunk 8.0.4.1and emc-isilon-add-on-for-splunk-enterprise_260 > not working - Splunk 8.0.4.1and dell-emc-isilon-add-on-for-splunk-enterprise_270 > not working MY oppinion is, that ther is a problem to check the certificate option. All working Addon versions have a checkbox to enable or disable to check certificate. My Problem is to combine Splunk 8 and my Isilon system... Please advice - Markus
... View more
Labels
04-21-2020
05:03 AM
Hi Splunkys,
i have problems to generate my PDF Report.
It crashes every report generation randomly after 5 or 10 Minutes, not 3 or 7 Minutes, exact 5 or 10 Minutes...
python.log
2020-04-17 10:30:01,273 +0200 INFO sendemail:1160 - sendemail pdfgen_available = 1
2020-04-17 10:30:01,274 +0200 INFO sendemail:1301 - sendemail:mail effectiveTime=1587112200
2020-04-17 10:35:02,955 +0200 ERROR sendemail:1167 - An error occurred while generating a PDF: Failed to fetch PDF (status = 400): Unable to render PDF.<br/><ul><li>Exception raised while trying to prepare "File Monitor" for rendering to PDF. Timed out waiting for status to become available on job=1587112202.62</li></ul>
I tried following config options... without positiv result
web.conf > appServerProcessShutdownTimeout
web.conf > splunkdConnectionTimeout
pdf_server.conf > firefox_timeout
Any idea?
Greetings - Markus
... View more
Labels
- Labels:
-
PDF
-
scheduled search
03-26-2020
01:33 AM
Hi @ All,
i´ve got problems to parse the following file / content:
"CreationTime","LastWriteTime","LastAccessTime","Name","Length","Directory"
"25/03/2020 10:27:21","25/03/2020 10:27:36","25/03/2020 10:27:21","01.txt","5","C:\Share"
"25/03/2020 11:12:10","13/12/2019 11:48:07","25/03/2020 11:12:10","splunkforwarder-8.0.1.msi","68755456","C:\Share"
"25/03/2020 10:28:04","25/03/2020 10:28:17","25/03/2020 10:28:04","01.txt","13","C:\Share\A"
"25/03/2020 10:28:04","25/03/2020 10:28:32","25/03/2020 10:28:22","02.txt","12","C:\Share\A"
"25/03/2020 10:28:53","25/03/2020 10:28:53","25/03/2020 10:28:53","Empty.zip","22","C:\Share\B"
my problem is, that splunk dont regognise / use the header infomations and dont split per line.
i tried with probs.conf CSV option, header check, filds delmiter, header delimter, quotes option, field names, etc etc...
All options displays the same result... the header as event and one of the lines (randomly) as event...
Anybody who can help me?
THX - Markus
... View more
02-17-2020
06:19 AM
Hi @ All,
i create a little app to set "updateCheckerBaseURL" value to "0".
Then i copied it to "/opt/splunk/etc/deployment-apps" on Deployment Server and changed folder permissions to the splunk user.
The app where deployed to the clients and "./splunk cmd btool web list settings" displays "updateCheckerBaseURL = 0", but the update notification where still there.
If i set "updateCheckerBaseURL = 0" direct to "$SPLUNK_HOME/etc/system/local/web.conf", then the update notification where disabled.
Please advise - Markus
... View more
10-14-2019
06:09 AM
the problem is that the graph shows zero until the evaluation is complete. (10-30 seconds)
With join the graph builds up ...
... View more
10-14-2019
06:03 AM
host = ESX Server
supervisor = ???
actualy the top5 ESX server where sorted alphabetically, not by load
... View more
10-14-2019
02:31 AM
Correction:
there is a host list, was a performance problem, sorry, dev center 😉
Now, how to sort hosts to display from maximum to minimum load?
thx
... View more
10-14-2019
02:27 AM
Hi,
works, but it dont sort the host list vom maximum to minimum load.
Can you helm me again?
thx
... View more
10-11-2019
06:21 AM
Hi Splunkies,
this is my search:
index="vmware-perf" sourcetype="vmware:perf:cpu" hypervisor_id="*"
| join hypervisor_id [search index="vmware-inv" sourcetype="vmware:inv:hostsystem"]
| timechart avg(cpu_load_percent) by hypervisor_name
my Problem:
This search will list all hosts.
But, i would like to have an evaluation of the top 5 hosts.
The idea was to calculate the sum of average values from one host over a period of time.
Then i compare this result with the other hosts and could sort a top 5 list...
Does anyone have an idea how to modify the search?
... View more
07-15-2019
07:05 AM
Hi Community,
I would like to show the status of an ESXI via pictures.
If I displayed the search on a table then the values are shown correctly.
Why do the different panels not display?
Please advice...
<panel>
<table>
<search>
<query>
index="vmware-inv" | spath type | search type=HostSystem | spath moid | search moid="host-9" AND changeSet.summary.overallStatus!=""
| stats latest(changeSet.summary.overallStatus) as ManagedEntityStatus by host
</query>
<done>
<condition match="$result.ManagedEntityStatus$ == green">
<set token="show_Green">true</set>
<unset token="show_Grey"></unset>
<unset token="show_Yellow"></unset>
<unset token="show_Red"></unset>
</condition>
<condition match="$result.ManagedEntityStatus$ == red">
<set token="show_Red">true</set>
<unset token="show_Grey"></unset>
<unset token="show_Yellow"></unset>
<unset token="show_Green"></unset>
</condition>
<condition match="$result.ManagedEntityStatus$ == yellow">
<set token="show_Yellow">true</set>
<unset token="show_Grey"></unset>
<unset token="show_Green"></unset>
<unset token="show_Red"></unset>
</condition>
<condition match="$result.ManagedEntityStatus$ == grey">
<set token="show_Grey">true</set>
<unset token="show_Green"></unset>
<unset token="show_Yellow"></unset>
<unset token="show_Red"></unset>
</condition>
</done>
</search>
</table>
</panel>
<panel depends="$show_Green$">
<html>
<img src="http://sr.photos3.fotosearch.com/bthumb/CSP/CSP993/k14957243.jpg"></img>
</html>
</panel>
<panel depends="$show_Red$">
<html>
<img src="https://photos.gograph.com/thumbs/CSP/CSP742/k17687405.jpg"></img>
</html>
</panel>
<panel depends="$show_Yellow$">
<html>
<img src="http://www.bodyandmind.co.za/kidz/crying-baby.jpg"></img>
</html>
</panel>
<panel depends="$show_Grey$">
<html>
<img src="http://www.lindon.us/sitebuildercontent/sitebuilderpictures/Unbekannt.jpg"></img>
</html>
</panel>
... View more
07-08-2019
06:56 AM
Hi,
compare these both searches.
The only difference is, that in the second search the option "server=" isnt set.
In general splunk server options the mail host, seurity, username and password where set.
Why mailsent works in first search with the "server=" option and the second search wothout "serch=" didnt?
... View more
07-07-2019
11:18 PM
Hi,
compare these both searches.
The only difference is, that in the second search the option "server=" isnt set.
In general splunk server options the mail host, seurity, username and password where set.
Why mailsent works in first search with the "server=" option and the second search wothout "serch=" didnt?
... View more
07-05-2019
06:12 AM
Hi splunker´s,
have a problem to send mails by splunk.
index=main | head 5 | sendemail to=my.name@XXX.com server=XXX.mail.protection.outlook.com subject="Here is an email notification" message="This is an example message" sendresults=true inline=true format=raw sendpdf=true Mail has been sent
index=main | head 5 | sendemail to=my.name@XXX.com subject="Here is an email notification" message="This is an example message" sendresults=true inline=true format=raw sendpdf=true Get this error: command="sendemail", SMTP AUTH extension not supported by server.
Server settings > email settings were set
Without the specification of the server no mails will be sent. Thus, automatic reports do not send mails. any idea?
... View more
Labels
- Labels:
-
other
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-05-2021
04:56 AM
|
Karma given to
