Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About paulbannister
paulbannister
Communicator
Member since:
09-30-2016
06-05-2020
Community Statistics
| Posts | 63 |
| Solutions | 8 |
| Karma Given | 22 |
| Karma Received | 15 |
| Member Since | 09-30-2016 |
Activity Feed
- Karma Re: Help on navigation sub-menus for ALXWBR. 06-05-2020 12:50 AM
- Karma Re: What are the available load balancing method in Splunk Forwarders for mbagali_splunk. 06-05-2020 12:50 AM
- Karma Re: Unable to break JSON events from a REST Modular input (SPLUNK CLOUD) for Damien_Dallimor. 06-05-2020 12:50 AM
- Karma Re: Is it possible to play an audio alert when a search (single viz) on a dashboard changes? for ALXWBR. 06-05-2020 12:50 AM
- Got Karma for Re: Can we track changes to a file. 06-05-2020 12:50 AM
- Karma Cannot update Qualys API credentials for martin_mueller. 06-05-2020 12:49 AM
- Karma Re: Why am I unable to see the events on the indexer when forwarding a large CSV file from UF to HF to indexer? for woodcock. 06-05-2020 12:49 AM
- Karma Re: Where can I find documentation on how to update a macro by using the API? for whiterd434. 06-05-2020 12:49 AM
- Karma Re: How to add icon to a panel instead of table so there are no borders? for niketnilay. 06-05-2020 12:49 AM
- Karma Re: search to find Bush's stolen watch for skoelpin. 06-05-2020 12:49 AM
- Karma Re: How to make Splunk recognize a timestamp that is logged across 2 fields with 3 digit time for woodcock. 06-05-2020 12:49 AM
- Got Karma for Re: Cannot update Qualys API credentials. 06-05-2020 12:49 AM
- Got Karma for Re: Can I monitor change on a remote file share directory?. 06-05-2020 12:49 AM
- Got Karma for Re: Why are my users unable to change the permissions of a lookup?. 06-05-2020 12:49 AM
- Got Karma for Re: Why are my users unable to change the permissions of a lookup?. 06-05-2020 12:49 AM
- Karma Re: how to disable "ALL time" for user role for hhGA. 06-05-2020 12:48 AM
- Karma Re: DB Connect 3.0.2 Not Honoring Sourcetype in Props.conf for hhGA. 06-05-2020 12:48 AM
- Karma Re: How to write a cron schedule to execute a search everyday at 9:30am CST? for SplunkersRock. 06-05-2020 12:48 AM
- Karma Re: How to write a cron schedule to execute a search everyday at 9:30am CST? for rjthibod. 06-05-2020 12:48 AM
- Karma Re: How to write a cron schedule to execute a search everyday at 9:30am CST? for adonio. 06-05-2020 12:48 AM
02-07-2020
07:57 AM
HI There
One thing you could try is adding a base search to the dashboard who's sole purpose is to generate these secondary time tokens for you using makeresults, then pull the tokens from this to use in the other search
|makeresults
|eval newearliest=$token1.earliest$-604800, newlatest=$token1.latest$-604800
A little crude but should do the job
... View more
02-07-2020
07:44 AM
Ok, then yes you'll need to login with the admin account and it should prompt you to change the license type, if not then head to Settings > Licensing and you'll be able to change the details from there
... View more
02-07-2020
07:10 AM
Hi There,
Is this an instance of Splunk you've installed yourself on your own machine?
... View more
02-07-2020
07:01 AM
The exactly one hour part makes me think timezone related for some reason, mainly as we've had to deal with GMT\BST data issues here, possibility at all?
... View more
09-13-2019
06:48 AM
Hi There,
What version of DB Connect and Splunk were the original inputs created under, also why is there a requirement to create said inputs under a separate app?
But as quick fix, as I've experienced a db migration issue before, just re-create the db input as a new input and all should work fine
... View more
07-19-2019
03:37 AM
UPDATE
Currently we are exploring the fact that in might be a limit issue on the size of messages that HEC can handle, to resolve this we've updated our HF to 7.0.6 so that we are able to set the maxEventSize in the inputs.conf for [HTTP]
So far all feeds concerned seem stable and are continuing to ingest data, but we have had periods of stability like this before so we're going to let it sit for a week or so to confirm
FIXED
So doing the above seemed to have fixed the issue, updating to 7.0.6 which allowed us to use the maxEventSize config setting, an obscure issue but hopefully this will prove helpful to someone down the line.
Under $SPLUNKHOME$/etc/apps/splunkhttpinput/local/inputs.conf we merely added the stansa:
[http]
maxEventSize=15728640
... View more
07-18-2019
12:31 AM
Our current setup has a Heavy Forwarder running Enterprise 6.5 and DB Connect 3.1.3 that handles all our database connections and a few other miscellaneous connections to send to both our Cloud and Enterprise instances, for obvious reasons we are looking to upgrade our HF and have a newly configured one ready to go sitting on Enterprise 7.0.3 and DB Connect 3.1.3
We have one database connection that throws up an issue anytime we try to enable it, as it would appear that it can't keep up the rising column, and after ingesting an amount of data drops the rising column value back by a 1000 and starts duplicating events in the index and becomes stuck in a loop of this activity until we manually change the rising column.... and then shortly after it will repeat the issue, basic connection details as below:
Rising Column
Max Rows to Retrieve = 15000
Fetch Size = 300
Execution Frequency = 30
The db itself can contain some quite large column values, in excess of 20k in some cases, but the old 6.5 HF has been handling it happily for some time, to make matters worse the old 6.5 HF is almost completely undocumented so tracking down any specific conf changes can be fun (some have even been made in default files)
We have tried all the obvious changes we can think of and are now running a blank as to what this issue might be, so any help would be very much appreciated
... View more
07-03-2019
06:58 AM
No problem, its always the little things that trip us up!
... View more
07-03-2019
06:48 AM
You know what, it might be as simple as adding in an alias for the wrap:
SELECT * FROM (SELECT TOCHAR(D.SYSDATE,'YYYY-MM-DD HH24:MI:SS') AS LOGDATE,
TONUMBER(TOCHAR(D.ROLLUPDATE, 'yyyymmddhh24miss')) AS LASTUPDATE,
S.SERVERNAME AS SNAME,
S.SERVERNAME,D.FILESYSTEM,
D.MOUNTEDON, D.KBYTES
FROM SERVERDATA.SERVER S, SERVERDATA.SERVERDFKCURRENT D
WHERE D.SERVERNAME = S.SERVERNAME) t
LEFT OUTER JOIN SERVERDATA.ORACLEINFO O ON SNAME = O.SERVER_NAME
Note the simple "t" after the ")"
... View more
07-02-2019
08:01 AM
Hi There,
There is a deprecated feature called FSCHANGE that is still does exactly that, although it is down as deprecated it there is no immediate plan to drop it completely to my knowledge
inputs.conf should be something along the lines of:
[fschange:*YOURFILEPATH*]
fullEvent=true
pollPeriod=3600
recurse=true
sendEventMaxSize=100000
signedaudit=false
disabled=0
It may require some tweaking to the file path ensure it works with your use case and after a UF restart may also require patience if the directory itself is quite cumbersome
... View more
07-02-2019
07:41 AM
Hi There,
I'm not sure it is possible at all to have a sparkline over a bar chart, one solution would be to create 2 panels on the dashboard, one displaying the bar chart and then a panel beneath displaying the sparkline, either that or you could amend the SPL slightly and utilise the Chart Overlay function to display another line over the Bar Chart... it all depends on what you want to display
... View more
07-02-2019
07:33 AM
Hi There,
It might be as simple as cleaning up the SQL and being a bit more specific with the column names and use the format [TABLENAME].[COLUMNNAME] instead of just the column name, there may be a column in both tables in the query of the same name
... View more
06-20-2019
06:54 AM
1 Karma
Hi There,
There is a deprecated input method called "fschange" that monitors for file system changes which may provide what you are looking for, as I said it is being deprecated but still currently works for us, example inputs below:
[fschange:\YOURFILEPATH]
fullEvent=true
pollPeriod=3600
recurse=true
sendEventMaxSize=100000
signedaudit=false
disabled=0
... View more
01-31-2019
06:10 AM
1 Karma
Unsure if this is still required or unanswered by try this as it worked for us, patience may be need if the directory is large and a full restart of the UF if you're using one:
[fschange:\servername\E$\Monitor]
index=sservice
sourcetype=MonitorDir
fullEvent=true
pollPeriod=60
recurse=true
sendEventMaxSize=100000
signedaudit=false
disabled=0
... View more
11-15-2018
02:39 AM
We managed to resolve this issue on our instance and from memory it turned out to be a conflict with Java and the folder structure, in our case we had a scripted input that was causing the issue as it was using a conflicting naming convention, once this script was amended the issue was resolved
Apologies for the vagueness in the description but it might help you look in the right direction for another potential solution
... View more
10-05-2018
06:47 AM
Hi There,
I'm assuming that you have already created the field "Response_time" prior to the case statement? What isse are you running into with the search?
... View more
10-05-2018
06:10 AM
Hi There,
Might need a few more details on this, are you look to join fields together to making the 4 columns into 2 or omit 2 columns completely?
... View more
10-05-2018
06:07 AM
Apologies, try this:
|eval Response_time=
case(Response_time>3000, "gt3SEC", Response_time>1000 AND Response_time<3000, "bet1-3Sec", Response_time<1000, "lt1Sec")
... View more
10-05-2018
06:00 AM
Hi There,
You may want to try a case statement for this, unless there are any other variables you need to create:
|eval FIELDNAME=case(Responsetime>3000, Responsetime="gt3SEC", Responsetime>1000 AND Responsetime<3000, Responsetime="bet1-3Sec", Responsetime<1000, Response_time="lt1Sec")
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
