Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Naaba
Naaba
New Member
Member since:
12-30-2016
06-05-2020
Community Statistics
| Posts | 22 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 12-30-2016 |
Activity Feed
- Posted incomprehensible value of Scancount on Splunk Search. 07-11-2018 05:49 AM
- Tagged incomprehensible value of Scancount on Splunk Search. 07-11-2018 05:49 AM
- Tagged incomprehensible value of Scancount on Splunk Search. 07-11-2018 05:49 AM
- Tagged incomprehensible value of Scancount on Splunk Search. 07-11-2018 05:49 AM
- Posted Re: Display stats as geostats on Splunk Clustered Single Value Map Visualization app on All Apps and Add-ons. 08-07-2017 02:28 AM
- Posted Re: Deployment error in distributed environment on Deployment Architecture. 08-07-2017 02:23 AM
- Posted Re: Deployment error in distributed environment on Deployment Architecture. 08-07-2017 02:23 AM
- Posted Deployment error in distributed environment on Deployment Architecture. 07-31-2017 12:58 AM
- Tagged Deployment error in distributed environment on Deployment Architecture. 07-31-2017 12:58 AM
- Tagged Deployment error in distributed environment on Deployment Architecture. 07-31-2017 12:58 AM
- Tagged Deployment error in distributed environment on Deployment Architecture. 07-31-2017 12:58 AM
- Posted Re: Display stats as geostats on Splunk Clustered Single Value Map Visualization app on All Apps and Add-ons. 07-31-2017 12:46 AM
- Posted Re: Display stats as geostats on Splunk Clustered Single Value Map Visualization app on All Apps and Add-ons. 07-27-2017 06:05 AM
- Posted Display stats as geostats on Splunk Clustered Single Value Map Visualization app on All Apps and Add-ons. 07-27-2017 02:28 AM
- Tagged Display stats as geostats on Splunk Clustered Single Value Map Visualization app on All Apps and Add-ons. 07-27-2017 02:28 AM
- Tagged Display stats as geostats on Splunk Clustered Single Value Map Visualization app on All Apps and Add-ons. 07-27-2017 02:28 AM
- Posted Re: Group by two or many fields fields on Splunk Search. 03-01-2017 12:57 AM
- Posted Re: Group by two or many fields fields on Splunk Search. 03-01-2017 12:40 AM
- Posted Re: Group by two or many fields fields on Splunk Search. 03-01-2017 12:36 AM
- Posted Re: Group by two or many fields fields on Splunk Search. 03-01-2017 12:33 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-11-2018
05:49 AM
Hi,
I have this SPL request in a search :
index=<my_index> (url_host="yqe-tractors.stenchkrzl.xyz" OR
url_host="stereotype.gumpzzyr.xyz" OR
url_host="tribes.mugsylhb.xyz" OR
url_host="taken-uprisings.coveringsiqnh.xyz" OR
url_host="unmarried.discussedya.xyp") | stats count by url_host
When I launch this request, in the job inspector I have a value for the scanCount.
When I modify my request by changing the extension "xyz" on any line of my request (by example with "org"), my scanCount value is None.
can Anyone explain me why the scanCount value is None when I modify the extension in one line of my request (example by replacing "xyz" by "org" in one line) ?
In my index I have more than 500 millions events for the last 30 days.
I am surprised, when I launch my request (same request as above) for the last 30 days, The search completed in 5 seconds whitout no results.
For me even if they are no results, as I have millions of events, Splunk will take more time to scan the millions of events and show the result. Am i wrong?
Thanks
... View more
08-07-2017
02:28 AM
I wasn't able to zoom to view town because the default tile used by Splunk is not a detailled map.
In default town I juste see some regions
I found a tile on openstreet map where I can see the town, So I use it and I can zoom to view town and street
... View more
08-07-2017
02:23 AM
It was a problem of permission in app directory. I changed file permission and now it works.
Thanks
... View more
08-07-2017
02:23 AM
It was a problem of permission in app directory. I changed file permission and now it works
... View more
07-31-2017
12:58 AM
Hi,
When I try to deploy Apps on my search head (distributed environment) I have this error :
Error while creating deployable apps: Error copying src="/opt/splunk/etc/shcluster" to tmp_staging_area="/opt/splunk/var/run/splunk/deploy.cff46bb28403e9bb.tmp": No such file or directory
The folder deploy.cff46bb28403e9bb.tmp exist in /opt/splunk/var/run/splunk/
$ ll /opt/splunk/var/run/splunk/
drwxr-xr-x. 4 splunk splunk 4096 31 juil. 09:34 deploy.cff46bb28403e9bb.tmp
Can you help me please?
Thanks
... View more
07-31-2017
12:46 AM
Thanks for your answer.
I finally use tiles
... View more
07-27-2017
06:05 AM
Hi,
The map of the native Splunk is not detailled as I want.
For example if I have many bubbles in one town, Geostats will display a unique booble because the map is not detailled.
My final goal is to display stats on a map with one bubble for every location on the map.
can we change the native map of Splunk used by Geostats?
Thanks
... View more
07-27-2017
02:28 AM
Hi,
I would like to display stats (pie charts) on a map generated with the Clustered Single Value Map Visualization app.
Is it possible?
... View more
03-01-2017
12:57 AM
Hi,
Thanks for your help.
This worked for me :
| stats sum(Count) as Count by Location Book
| stats list(Book) as Book list(Count) as Count by Location
... View more
03-01-2017
12:36 AM
Hi,
I tried your command but. The data are listed as I want but the count column is empty.
Do you know why?
... View more
02-28-2017
10:35 AM
this is the link https://answers.splunk.com/answers/186874/how-to-use-group-by-with-two-fields-1.html
... View more
02-28-2017
10:33 AM
Hi
This is my data :
I want to group result by two fields like that :
I follow the instructions on this topic link text , but I did not get the fields grouped as I want. They are grouped but I don't have the count for each row.
Can anyone help me?
Thanks
... View more
02-27-2017
06:02 AM
Hi,
I am importing data from Gitlab to Splunk.
The data imported are in French and contains special characters like é, à, è, ê.
Data imported in Splunk are not well encoded.
For example when importing "Définition" I got "D�finition" in Splunk
I tried to configure Splunk (props.conf) with others charsets (UTF-8, latin-1) but nothing works.
Can anyone help me please?
Thank you
... View more
02-02-2017
08:44 AM
Thank you for your answer but It doesn't give the result i want.
I want to be able to use the fields the two events :
Event 1 = mail :
id_mail : 1
title_mail : test
mail_srv : host1
Event 2 = server:
id_srv : 3
srv_name : host1
srv_ip : 192.168.0.1
I want to be able to print a table like this :
id_mail, title_mail, host1,id_srv ,srv_name ,srv_ip
... View more
02-02-2017
07:20 AM
Hi,
I have two different events of data :
Event 1 = mail :
id_mail : 1
title_mail : test
mail_srv : host1
Event 2 = server:
id_srv : 3
srv_name : host1
srv_ip : 192.168.0.1
I want to print Event 1 (mail) data with a column containing the server IP like this : id_mail, title_mail, mail_srv, srv_ip
How can I do this?
Thanks
... View more
01-26-2017
12:32 AM
With this command I don't have the Label in the cells.
I have projets and months but not labels.
How can I add labels in cells?
... View more
01-25-2017
09:49 AM
Hi,
I have datas with these fields (this is a sample)
Project : Splunky
Label : Integration
Month : January
Project : Splunky
Label : Preproduction
Month : January
Project : Splunky
Label : Production
Month : April
Project : Mail
Label : Production
Month : February
Project : Share
Label : Integration
Month : March
Project : Share
Label : Production
Month : June
I want to print the results by Project by Month group by label
Is it possible?
Thanks
... View more
12-30-2016
07:13 AM
Hi Skoelpin,
I send data in JSON format to splunk :
{
event: test
description: splunk test
issue_id: 1
updated_at: 2016-01-04T15:31:39.996Z
}
I have two serveurs : One server with my script and the second one with Splunk
I want to make request to Splunk from my first server to retrieve/update the value save in "updated_at".
Is it possible?
... View more
12-30-2016
05:45 AM
Hi,
I use Talend Open Studio to collect data on Gitlab (via Gitlab API) and send them to Splunk.
As Gitlab continually has new data over time, I want to save the pull position. So at the next pull I will pull only the new data.
Is it possible to create a variable on Splunk, save a value on this variable, and update the variable?
If it is possible to create a variable on Splunk, is it possible to make (HTTP?) request to Splunk to retrieve the value of a variable?
Thank you for your answer
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
