Hi all, I want to preset Search Results in Dashboard Text. If I want to change name, can change name. search string |rest /services/authentication/current-context text source <input type="text" token="name"> <label>username</label> <default>$result.username$</default> </input> If I want to preset search results in text, What should I do? Thank you for hepling me. ... View more

Hi all. Thank you for helping me. entities did not show up. I use SUSE Linux Enterprise Server 12 SP4. Where should I check to solve this problem? I check index=_internal and my uf can connect. I did this command in UF ./splunk list forward-server And this returned. Active forwards: ×.×.×.×:9997 Configured but inactive forwards: None I think collectd is running. I did this command. service collectd status Active: active (running) since Tue 2020-01-21 08:10:37 UTC; 6s ago Docs: man:collectd(1) man:collectd.conf(5) Main PID: 4924 (collectd) Tasks: 11 (limit: 512) Memory: 2.4M CPU: 10ms CGroup: /system.slice/collectd.service └─4924 /usr/sbin/collectd Jan 21 08:10:37 ip-*.*.*.* collectd[4924]: [2020-01-21 08:10:37] plugin_load: plugin "df" successfully loaded. Jan 21 08:10:37 ip-*.*.*.* collectd[4924]: plugin_load: plugin "load" successfully loaded. Jan 21 08:10:37 ip-*.*.*.* collectd[4924]: [2020-01-21 08:10:37] plugin_load: plugin "load" successfully loaded. Jan 21 08:10:37 ip-*.*.*.* collectd[4924]: plugin_load: plugin "disk" successfully loaded. Jan 21 08:10:37 ip-*.*.*.* collectd[4924]: [2020-01-21 08:10:37] plugin_load: plugin "disk" successfully loaded. Jan 21 08:10:37 ip-*.*.*.* collectd[4924]: plugin_load: plugin "interface" successfully loaded. Jan 21 08:10:37 ip-*.*.*.* collectd[4924]: [2020-01-21 08:10:37] plugin_load: plugin "interface" successfully loaded. Jan 21 08:10:37 ip-*.*.*.* collectd[4924]: Systemd detected, trying to signal readyness. Jan 21 08:10:37 iip-*.*.*.* systemd[1]: Started Collectd statistics daemon. Jan 21 08:10:37 ip-*.*.*.* collectd[4924]: Initialization complete, entering read-loop. Why my SAI can not show entities? When I set up in Windows, entities shows up. ... View more

Hi, all. I have a cluster environment. (1 search head, 2 indexer) I want to change the character code of the data. So, I rewritten and reloaded props.conf of the application under deployment-apps of the cluster master. But when I look at the splunk answer, it looks different. https://answers.splunk.com/answers/107512/where-do-i-edit-props-conf-in-a-cluster.html Why is this answer instead of creating props.conf for apps under deployment-apps? I understand that I should go through props.conf before indexing, but I can't understand the difference with deployment-apps. Could you help me? Thank you. ... View more

Hi all I have event like that. 2019-10-26 15:00:09.158, servicename="ROOT2", area="SCP", place="tokyo", path="AAA12345", Default="B", Sn="B", SC="B", update="person" "path" "place" "area" "servicename" and "Sn" are automatically appear in the field. When a field is specified, a value such as B appears. But 　"SC" did not appear automatically. I think it is few. I need value like B. I want to make table. index=main |table path, area, Sn, SC path,area,Sn,SC AAA12345,tokyo,B,B AAA23456,osaka,A,A AAA34567,nagoya,C,A What should I do? Thank you for helping. ... View more

Hi all, I have no idea. I have many event like this. /abc_d/efg_h/abcd_ef/1234/ghi_jk/ /abc_d/efg_h/zxcv_vf/56789/sdfg_h/ abc_d/egf_h/dfghh_h/5y865/ghjk_r/ /abc_d/efg_h/ is common. so, I want to do regular expression by specifying the beggining. I think it is working. |rex field=_raw"(?<unitpath>[/abc_d/efg_h]/\w+_\w+/\w+/\w+_\w+)" but Error happen. I know I am wrong, but I have no idea. I wish this was recognized as a field by default..........(;;) Could you help me? Thank you. ... View more

Hi,all I have a question about how to write throttle alert. I want to specify two fields. But, I can not find document. my field is "name" and "region". I think name AND region OR name, region If you know that, please help me. Thank you. ... View more

Hi, all I would like to create a mechanism that generates an alert when a regular expression extracted matches. However, I cannot come up with a search statement that says when the extracted regular expression matches a certain character. Here is my regular expression. index=main sourcetype=text |rex field = title(?<description>(\[).*(\])) Field of title has values [SUCCESS],[FAILED],[SKIPPED]etc... I thought that this search statement would return results that matched SUCCESS. index=main sourcetype=text |rex field = title(?<description>(\[).*(\])) description = "SUCCESS" But, it does not work. Could you please help me? ... View more