×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
benjiminhugh
Explorer
Member since: ‎07-06-2012
‎06-05-2020
Community Statistics
Posts 5
Solutions 0
Karma Given 2
Karma Received 0
Member Since ‎07-06-2012
Activity Feed
View All

role permission

by in Security
‎07-19-2012 09:07 AM
‎07-19-2012 09:07 AM
I create a role [role_mmuser] admin_all_objects = enabled change_authentication = enabled edit_deployment_client = enabled list_deployment_client = enabled edit_deployment_server = enabled edit_dist_peer = enabled edit_forwarders = enabled edit_httpauths = enabled edit_input_defaults = enabled edit_monitor = enabled edit_roles = enabled edit_scripted = enabled edit_search_server = enabled edit_server = enabled edit_splunktcp = enabled edit_splunktcp_ssl = enabled edit_tcp = enabled edit_udp = enabled edit_user = enabled edit_web_settings = enabled indexes_edit = enabled license_edit = enabled license_tab = enabled list_forwarders = enabled list_httpauths = enabled rest_apps_management = enabled restart_splunkd = enabled This enables the windows specific capabilities for admin edit_win_eventlogs = enabled edit_win_wmiconf = enabled edit_win_regmon = enabled edit_win_admon = enabled edit_win_perfmon = enabled list_win_localavailablelogs = enabled list_pdfserver = enabled write_pdfserver = enabled importRoles = power;user srchIndexesAllowed = ;_ srchIndexesDefault = main;os srchFilter = * srchTimeWin = 0 srchDiskQuota = 10000 srchJobsQuota = 50 rtSrchJobsQuota = 100 I have made it the same as admin, but still can't input data?Why and how? Thanks! ... View more

Re: problem about Monitor Files

by in Getting Data In
‎07-18-2012 02:35 PM
‎07-18-2012 02:35 PM
And why when i add d to the file, it is a,b,c,d. why not be a,b,c,a,b,c,d ... View more

Re: problem about Monitor Files

by in Getting Data In
‎07-18-2012 02:31 PM
‎07-18-2012 02:31 PM
Is there any way to avoid this? ... View more

problem about Monitor Files

by in Getting Data In
‎07-18-2012 01:47 PM
‎07-18-2012 01:47 PM
I choose "Continuously index data from a file or directory this Splunk instance can access" to input a file. Give a example, there are a, b, c, three records in the file, when I add another d, the searching result in splunk is right, a,b,c,d But when i delete one, from a,b,c to a,b then the searching result is a,b,a,b,c. I want it to be a,b How to fix it? ... View more

Search based on transformation field

by in Splunk Search
‎07-10-2012 12:12 PM
‎07-10-2012 12:12 PM
I came across a very strange problem: I have a transformation field: [record] FORMAT = event_type::Record_DVR dvr_start_time::$1 dvr_end_time::$2 dvr_sid::$3 dvr_freq::$4 REGEX = RecordingManager.record(LocatorRecSpec<(\w{3} \w{3} \d{2} \d{2}:\d{2}:\d{2} EST\d+EDT \d{4}) to (\w{3} \w{3} \d{2} \d{2}:\d{2}:\d{2} EST\d+EDT \d{4}) OcapLocator[SId=([-|\d]) freq=([-|\d]) prog#=([-|\d]) ([\d|\w])]>) And a search: sourcetype=Message event_type=Record_DVR This is doesn't work. However If i change event_type::Record and event_type=Record It can work. if I change both to Record_Dvr still doesn't work if change to record, it works again! I try a lot of ways, but the result is also very strange. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM
Karma given to
View All