About cchange

cchange · ‎06-19-2020

Thanks for the response but it is not working.

cchange · ‎06-18-2020

HI, Is there a way where I can disable all alerts in single API call without providing saved search/alert name in all apps? Thx

cchange · ‎06-18-2020

Hi, I'm trying to ingest json data but it showing data twice for each event field. I used below in props.conf and not sure what is causing the issue. [sourcetype] INDEXED_EXTRACTIONS = json KV_MODE=none #( tried both KV_MODE=json and None) SHOULD_LINEMERGE=true pulldown_type=true TIMESTAMP_FIELDS=<timestamp field> AUTO_KV_JSON=false NO_BINARY_CHECK = true Data in SH: Title: [RESOLVED] Increased Error Rates [RESOLVED] Increased Error Rates

cchange · ‎04-08-2020

Thanks Rich, I overlooked the syntax. Problem is with my where clause. I used logic wrongly and it is not matching filter condition. After correcting my logic, results started to display correctly for first method. Thanks for your help once again.

cchange · ‎04-08-2020

Hi, I'm trying to filter the results of the lookup depend upon the time selection from the dashboard. I have date field in the lookup. Below is the sample of the lookup. ReportedAt Id status 2020-04-09 5:00:00 567 Pass I'm trying with below logics but it is not working. |inputlookup file.csv |eval timeep = strptime('ReportedAt', "%Y-%m-%d %H:%S") | addinfo | where timeep > info_max_time and timeep < info_min_time ==== inputlookup file.csv | where Reportedat > $t1.earliest$ and Reportedat < $t1.latest$ Can you please let me know is there a way to display the results depend upon time selection in the dashboard.

cchange · ‎11-12-2019

Thanks it got worked.

cchange · ‎11-11-2019

search query | table students | rename students as Students (Total/Pres/Abs) Current Output: Students (Total/Pres/Abs) 100/80/20 Desired Output: Students (Total/Pres/Abs) 100/80/20

cchange · ‎11-11-2019

I need to show my table column header in below format. I need to get column name and static header under my column. Students Total/Pres/Abs Can someone please let me know how I can get this format.

cchange · ‎10-21-2019

what is the index or how did you calculate this value?

cchange · ‎09-20-2019

I configured email alerts to trigger if my results are zero. Depend upon alert, I need to run the search once again after few hours to verify if they were any results were written. If so, those results need store in a lookup file. Please let me know how this can be achieved.

cchange · ‎11-12-2017

I added crcSalt = and missing files were ingested successfully.

cchange · ‎10-26-2017

Hello. It look like this. monitor:\\directory index=test sourcetype=test1 disabled=0

cchange · ‎10-25-2017

Hi, I configured inputs.conf to monitor a directory. All the files in the directory were not ingested to Splunk. Some XML files are being missed. I don't see any errors in the _internal logs. Can you please let me know if I'm missing any property in my configuration file? my sample inputs.conf index=test sourcetype=test

cchange · ‎04-03-2017

I have python script that I need to pass in Windows batch file. I'm not sure how to pass it. I'm trying below but it is not working. set ZENOSS_SERVER_STANZA=zenoss C:\Program Files\Splunk\bin\splunk cmd python C:\Program Files\Splunk\bin\splunk\etc\apps\TA-zenoss\bin\zenoss_create_event.py -s %ZENOSS_SERVER_STANZA% -f %SPLUNK_ARG_8_% I need to pass this batch file for alerts. Any help is appreciated.

cchange · ‎03-16-2017

I need to provide my AppD secure URL as a input to Add-on. When I provide https URL, I'm getting SSL certificate error. Can you please let me know where I need to import\place AppD certificate on AppD app directory ?

cchange · ‎03-14-2017

When I am configuring HTTPS url in the Splunk Add-on for AppDynamics, I'm getting SSL certificate error. I placed certificates in tempcerts folder but still I'm getting same error. Can anyone please let me know how I can resolve this issue?

cchange · ‎02-27-2017

Thanks Txiao. It worked. Now we have upgraded version in Splunk.

cchange · ‎02-16-2017

My app resides on all search head cluster. I need to modify default files and place in local directory and push across all search heads. I'm placing my app on shcluster folder on deployment server and issued "splunk apply shcluster-bundle -target ". But new files were not placed into the local directory. Can anyone let me know where I need to place the files to update across all the search heads.

cchange · ‎02-15-2017

I installed Puppet app on UF and it is able to collect required information of PE servers and populating in the defined dashboards.

cchange · ‎02-14-2017

I'm using 6.3.6. I tried with json:jenkins:old but still I don't see any data being indexed. I'm not sure if we have any bug with this app for v6.3?

cchange · ‎02-07-2017

I'm trying to monitor puppet environment.

cchange · ‎02-07-2017

I configured Splunk App for Jenkins. When I tested with v6.5, all dashboards are loading without any issues. But when I test with Splunk v6.3, some dashboards are not loading the default view and also not getting any data into dashboards. I tested with sourcetype _json and Jenkins:json:old. Let me know what files need to be modified to populate all the dashboards?

cchange · ‎02-04-2017

Did anyone integrated Puppet Enterprise to Splunk? I'm not getting proper documentation how to setup. I found Puppet Enterprise App for Splunk but I don't see much documentation how to set it up and what puppet files need to be given as a input to the Universal Forwarder to monitor?

cchange · ‎01-23-2017

Hi, I upgraded Splunk App for AWS from v4.2 to v5. Tags are not being populated under Historical Monthly bills after upgrade. When I select billing input type to enable the tags, it refers to "Detailed Billing report" which I already scheduled and also able to view the tags in tags_billing.csv file. But these are not being populated under the report. Any inputs are appreciated. thanks

cchange · ‎11-09-2016

Below logic didn't work. I tried in other way and achieved solution by creating a panel and showed static values depend upon the selection from drop down.

Posts	32
Solutions	1
Karma Given	0
Karma Received	3
Member Since	‎09-27-2016

Online Status	Offline
Date Last Visited	‎06-19-2020 01:10 PM

How to Disable all alerts through API

Why is JSON Event Data Showing Duplicate Values?

Filtering the results in Dashboard from InputLooku...

Append Column Header Field with Multivalues

Rerun Search Depend upon Alert results

Some files are not being indexed

Need to wrap a Python script in Windows Batch File

Splunk App and Add-on for AppDynamics: Where do I ...

App Modifications on Search Head Cluster

Splunk App for Jenkins: How to resolve when all da...

Re: JSON Event Data Showing Duplicate Values

How to Disable all alerts through API

Why is JSON Event Data Showing Duplicate Values?

Re: Filtering the results in Dashboard from InputL...

Filtering the results in Dashboard from InputLooku...

Re: Append Column Header Field with Multivalues

Re: Append Column Header Field with Multivalues

Append Column Header Field with Multivalues

Re: What's the best easter egg in Splunk 4.2?

Rerun Search Depend upon Alert results

Re: Some files are not being indexed

Re: Some files are not being indexed

Some files are not being indexed

Need to wrap a Python script in Windows Batch File

Re: Splunk App and Add-on for AppDynamics: Where d...

Splunk App and Add-on for AppDynamics: Where do I ...

Re: Splunk App for Jenkins: How to resolve when al...

App Modifications on Search Head Cluster

Re: Has anyone integrated Puppet with Splunk?

Re: Splunk App for Jenkins: How to resolve when al...

Re: Has anyone integrated Puppet with Splunk?

Splunk App for Jenkins: How to resolve when all da...

Has anyone integrated Puppet with Splunk?

Splunk App for AWS: Why are Custom Tags in Billing...

Re: How to use text box to dynamically display ext...