About nvanderwalt_spl

nvanderwalt_spl · ‎03-02-2020

And is the summary showing as complete? Perhaps the summary is not in a usable state yet?

nvanderwalt_spl · ‎02-19-2020

It would be useful to know which version you were on before when it was working, and whether the inputlookup is done as a subsearch.

nvanderwalt_spl · ‎07-28-2019

Sounds like you don't want partial results at the end. If you are visualising with timechart, try |timechart partial=false count by whatever

nvanderwalt_spl · ‎06-30-2019

Hi, You did not provide your Splunk version, but this sounds like a bug that was fixed in Splunk 6.3.2 and 6.4.0

nvanderwalt_spl · ‎06-30-2019

When you are looking at historic data, you may see something that is there now, but may not have made it in to the system in time when when the job ran because of indexing lag index=searched index host=host_that_did_not_get_triggered other relevant filters | eval lagSecs = _indextime - _time | timechart avg(lagSecs) If you are unable to see any results for this job, then perhaps the search has not run in a while. You did mention you did not see any errors in scheduler log. Is this search actually running when scheduled?

nvanderwalt_spl · ‎06-30-2019

The user that runs |metadata needs get_metadata capability, which the user role should have by default, but you may want to check that. Make sure you select the correct time in the timepicker, and change the index name as appropriate Also, the command listed above will return sourcetypes. If you want sources, you need | metadata type=sources index=indexname

nvanderwalt_spl · ‎06-30-2019

Well, that is indexed in the _internal index, which is disabled. May have to use grep on the filesystem there...

nvanderwalt_spl · ‎06-30-2019

Your subsearch has this at the end: | rename Account_Name as "Siglas dos usúarios com acessos indevidos" The final field has to be a field that is in your data. If you remove this line, you will have what you need, as the field passed to the base search will now be a field that actually exists in the index.

nvanderwalt_spl · ‎06-30-2019

You probably need something along these lines (adjust fields and indexes as needed) index=auth type=login [search index=auth type=failed earliest=-4h |stats count by user |fields user]

nvanderwalt_spl · ‎04-29-2019

You might be able to get more info by opening the javascript console in your browser, but might want to start by restarting the search head. If all else fails, see the below instructions on how to create a HAR file, and reach out to the developer. https://lukemurphey.net/projects/splunk-lookup-editor/wiki/Troubleshooting

nvanderwalt_spl · ‎04-29-2019

If Splunk was started as root at any time, some files will now belong to root, and you will have to chown everything in the Splunk install directory back to the user that is supposed to own it.

nvanderwalt_spl · ‎04-29-2019

Are you forwarding the data from the LM to the index cluster as per best practice? If not, you will not be able to search the license data from the SH.

nvanderwalt_spl · ‎04-29-2019

Are the events all coming from data extracted by a single app/TA? If so, make sure that the app is imported into ES (if it is an ES search head), and make sure the permission on the app and KO are correct.

nvanderwalt_spl · ‎04-29-2019

Hi The problem is that you are not allowed to POST OR DELETE from within the UI. You can only make GET requests. You will need to use something like curl to delete the search using REST: curl -k -u admin:pass --request DELETE https://localhost:8089/servicesNS/admin/search/saved/searches/MySavedSearch Note that if the search is shared at an app level, you will have to use the user nobody, and special characters may also give you problems, as the search string needs to be URI encoded. Pro Tip: look at the id flield in the |rest splunk_server=local /servicesNS/-/-/saved/searches endpoint to see what the encoded path is.

nvanderwalt_spl · ‎04-28-2019

Splunk runs as a service on your machine, and you have to use a browser to access it (for the most part). Make sure to install it following these steps: https://docs.splunk.com/Documentation/Splunk/7.2.4/Installation/InstallonMacOS And start it using these steps: https://docs.splunk.com/Documentation/Splunk/7.2.4/Installation/StartSplunkforthefirsttime Cheers, Nico

nvanderwalt_spl · ‎04-28-2019

Hi. If you are looking to display the date, you can do the following: | makeresults |stats earliest(_time) as start_date, latest(_time) as end_date |eval start_date=strftime(start_date, "%D"), end_date=strftime(end_date, "%D") |table start_date,end_date

nvanderwalt_spl · ‎01-20-2019

You can do the following: |bin _time span=1h |eval timerange = strftime(_time, "%H:%M - %H:59") |stats count by timerange

nvanderwalt_spl · ‎01-20-2019

See tcpSendBufSz in the outputs.conf spec file. Ideally you should only adjust this setting if you are very familiar with TCP/IP, or you cam ask the support person you are dealing with for a recommendation https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/Outputsconf

nvanderwalt_spl · ‎01-20-2019

Based on your description, it sounds like you are logging in to the GUI on the indexer, and enabling the data models there. The data models should not be accelerated on the indexers themselves. You should only enable acceleration on the search heads. Note that the data will still reside on the indexers, even though they are enabled on the search heads. It also sounds like acceleration is not enabled on your search head, which is why you do not see any data when using summariesonly=true. Once you enable acceleration on the search heads, you should be able to see data with that option. If it is already enabled, and you are not seeing data with summaries only, it is possible that the acceleration searches are not running for some reason or the other. Look through the _internal logs and the monitoring console search dashboards, if that is the case.

nvanderwalt_spl · ‎08-08-2018

Do you want to put all the things in downtime? If you had only a few hosts in the lookup at any time, you could do something like this: search string NOT [|inputlookup hosts_in_maint.csv | table host| format]

Posts	28
Solutions	6
Karma Given	7
Karma Received	5
Member Since	‎02-27-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Re: Splunk 8.0.2 report acceleration broken for re...

Re: Splunk 8.0.2 report acceleration broken for re...

Re: I want to do `latest=-10m@5m`

Re: "view results in splunk" link in alert mail i...

Re: troubleshooting email alerts in splunk

Re: Is there a page view that shows all Source's f...

Re: Why is _internal index is disabled?

Re: Help with subsearch

Re: Using values from search into subsearch

Re: Lookup editor 3.2.1 "The requested lookup file...

Re: Splunk is not starting on indexer

Re: Splunk license master dashboard not showing d...

Re: C.I.M Authentication Data Model acceleration n...

Re: Need help deleting a saved search from a searc...

Re: Having trouble opening Splunk after install on...

Re: Custome Time picker

Re: Report results for each hour in a day

Re: Splunk UF wineventlog monitoring is too slow

Re: Data-models on a distributed search - Accelera...

Re: Problem with lookup for disabling alerts durin...