Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About andrew_f_trobec
andrew_f_trobec
Explorer
Member since:
11-09-2016
10-06-2026
Community Statistics
| Posts | 8 |
| Solutions | 1 |
| Karma Given | 3 |
| Karma Received | 0 |
| Member Since | 11-09-2016 |
Activity Feed
- Posted Re: Does Splunk ITSI 4.21 support per-entity adaptive thresholding or not? on Splunk Enterprise. 10-06-2026 04:56 AM
- Karma Re: Does Splunk ITSI 4.21 support per-entity adaptive thresholding or not? for PickleRick. 10-06-2026 04:54 AM
- Posted Does Splunk ITSI 4.21 support per-entity adaptive thresholding or not? on Splunk Enterprise. 10-05-2026 02:37 AM
- Tagged Does Splunk ITSI 4.21 support per-entity adaptive thresholding or not? on Splunk Enterprise. 10-05-2026 02:37 AM
- Tagged Does Splunk ITSI 4.21 support per-entity adaptive thresholding or not? on Splunk Enterprise. 10-05-2026 02:37 AM
- Posted Re: How can I retrieve ServiceNow field values with . (period) in the name through Splunk's Add-on for ServiceNow? on Getting Data In. 07-16-2021 02:28 AM
- Karma Re: How can I retrieve ServiceNow field values with . (period) in the name through Splunk's Add-on for ServiceNow? for abhishek_solank. 07-16-2021 02:21 AM
- Posted How can I retrieve ServiceNow field values with . (period) in the name through Splunk's Add-on for ServiceNow? on Getting Data In. 07-02-2021 03:53 AM
- Tagged How can I retrieve ServiceNow field values with . (period) in the name through Splunk's Add-on for ServiceNow? on Getting Data In. 07-02-2021 03:53 AM
- Posted Re: Why does NLP Text Analytics on Splunk 8.0.5 (Python 3.7.4) freeze searches when encountering accented characters? on All Apps and Add-ons. 11-13-2020 01:56 AM
- Posted Why does NLP Text Analytics on Splunk 8.0.5 (Python 3.7.4) freeze searches when encountering accented characters? on All Apps and Add-ons. 11-12-2020 10:01 AM
- Tagged Why does NLP Text Analytics on Splunk 8.0.5 (Python 3.7.4) freeze searches when encountering accented characters? on All Apps and Add-ons. 11-12-2020 10:01 AM
- Karma Re: How do I return the number of times a specified value appears in a field? for somesoni2. 06-05-2020 12:48 AM
- Posted Re: How do I return the number of times a specified value appears in a field? on Splunk Search. 11-11-2016 01:56 AM
- Posted How do I return the number of times a specified value appears in a field? on Splunk Search. 11-09-2016 07:01 AM
- Tagged How do I return the number of times a specified value appears in a field? on Splunk Search. 11-09-2016 07:01 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-06-2026
04:56 AM
Thanks @PickleRick for second opinion, I'm also hedging on the latter part of your statement 🙂 I'm gonna go ahead and get official statement anyways...
... View more
10-05-2026
02:37 AM
There are conflicting statements in Splunk ITSI 4.21 documentation about being able to use adaptive thresholding on per-entity basis, please help to clarify. Statement 1 "In ITSI 4.21, adaptive thresholding has been enhanced to support entity-level data, providing users with greater granularity and precision in monitoring KPIs." https://help.splunk.com/en/splunk-it-service-intelligence/splunk-it-service-intelligence/visualize-and-assess-service-health/4.21/advanced-thresholding/migrate-anomaly-detection-to-adaptive-thresholding-in-itsi Statement 2 "You currently can't perform adaptive thresholding on a per-entity basis. If you want to perform thresholding at the per-entity level, you must use the standard thresholding procedure." https://help.splunk.com/en/splunk-it-service-intelligence/splunk-it-service-intelligence/visualize-and-assess-service-health/4.21/advanced-thresholding/create-adaptive-kpi-thresholds-in-itsi Please clarify. Thank you. Andrew
... View more
- Tags:
- adaptive
- thresholds
Labels
- Labels:
-
administration
-
Other
-
troubleshooting
07-16-2021
02:28 AM
@abhishek_solank Amazing, thank you so much, this solved the issue! The custom field is now syncing: Not sure if I updated the regex correctly, but it now looks like this (I added the two periods (.)): "^(u_|[a-z$.])([_]?[a-z$.\d]+)*$" Since it works I'm not gonna go searching for trouble 🙂 Best regards, Andrew
... View more
07-02-2021
03:53 AM
Hello! I am using the Splunk Add-on for ServiceNow to retrieve data from standard ServiceNow tables, in particular the "sc_req_item" table for service requests. The form has a custom field that I need to extract and it has an internal id of "variables.4d1b6d291b2fd4d025d5eb186e4bcb19". When calling the ServiceNow REST API with Postman I can retrieve the field without issue: When trying to retrieve the same field using the Splunk Add-on for ServiceNow I get the message: "Values should begin with a letter or '$', and can include '_' and numbers, but got the value: variables.4d1b6d291b2fd4d025d5eb186e4bcb19" I can sync all the fields I need through the connector with the exception of the custom which has a . (period) in the name. I have tried using quotes and replacing . (period) with _ (underscore) but I cannot get the field synced. Here is the input configuration for reference: Is what I am trying to do possible with the Splunk Add-on for ServiceNow? Thanks! Andrew
... View more
Labels
- Labels:
-
scripted input
11-13-2020
01:56 AM
I figured it out, and the issue was with the cleantext custom command packaged with NLP Text Analysis. This command seems only to work with python2. I suspected this and updated the cleantext stanza local/commands.conf with python.version = python2. After restarting nothing changed. After further investigation it seems Splunk 8.0.x comes packaged with both python 3 and python 2, with python.version in default/server.conf set to python2. In my case I had a value force_python3 value set in local/server.conf, which means that setting python.version anywhere else (like in local/commands.conf for the cleantext command) will be ignored. I updated that value to python3, restarted, and everything started working. So I think NLP Text Analytics assumes that users leave the python.version value in default/server.conf as python2. In my case that value was updated in local/server.conf which screwed everything up. This might be written in the documentation somewhere, but I'm not going to lie: I didn't even check it... I hope this may clarify some things for others!
... View more
11-12-2020
10:01 AM
Hello, I've noticed post upgrade to Splunk Enterprise 8.0.5 that NLP Text Analytics searches freeze when encountering accented characters as well as some additional characters such as: à “ ” – (long dash) I am certain there are more, but I just want to know how to make them compatible with the NLP Text Analytics searches. I did not have this problem with Splunk 7.3.2 running Python 2.7.x. I am using lookups to put my data in, but the same happens when the data is coming from an index. I tried creating and recreating the lookup with various methods to ensure that it's UTF-8 encoding but I could not resolve. If I put one of the characters mentioned above into the pride_prejudice sample CSV files and it breaks that as well (to try it, use field "sentence" and search "| inputlookup pride_prejudice.csv | head 1" on the Counts dashboard). I have the following components installed: nlp-text-analytics - 1.1.0 Splunk_SA_Scientific_Python_linux_x86_64 - 2.0.2 Splunk_ML_Toolkit - 5.2.0 Does anybody know how to solve? Thanks! Andrew
... View more
- Tags:
- nlp-text-analytics
Labels
- Labels:
-
troubleshooting
11-11-2016
01:56 AM
Stupid double quotes! Thank you!
... View more
11-09-2016
07:01 AM
Hello,
I have a simple issue that I can't resolve, and was hoping for support. I have the following data:
OBJECT ID,NEW STATE
1,STATE ONE
1,STATE TWO
1,STATE THREE
2,STATE ONE
2,STATE TWO
2,STATE ONE
My objective is to return the amount of times that "STATE ONE" appears. I have the following code:
index = "SAMPLE INDEX" | stats count(eval("NEW STATE" = "STATE ONE")) as "COUNT"
I was hoping that this would return "COUNT" = 3, but it keeps returning 0.
What am I missing?
Any help would be greatly appreciated. Thank you!
Andrew
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-06-2026
04:54 AM
|
