Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About DarthDMader
DarthDMader
Explorer
Member since:
11-09-2016
06-05-2020
Community Statistics
| Posts | 7 |
| Solutions | 2 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 11-09-2016 |
Activity Feed
- Posted Re: How to edit my search to show only the last field value from a field for each IP? on Splunk Search. 11-10-2016 01:51 PM
- Posted Re: How to route and filter data on the Heavy Forwarder to separate indexer groups? on Getting Data In. 11-10-2016 01:19 PM
- Posted Re: How to identify seasonal event log messages? (every weekend, every month, every day at a certain time, etc.) on Splunk Search. 11-10-2016 12:53 PM
- Posted Re: What is the regular expression for my use case? on Splunk Search. 11-10-2016 12:09 PM
- Posted Re: Is there any technical limitation to the number of indexes an indexer cluster can host? on Deployment Architecture. 11-10-2016 10:53 AM
- Posted Re: Will Splunk ingest a TAR file with a .diag extension? on Getting Data In. 11-10-2016 01:02 AM
- Posted Re: How to get the status of forwarder using rest or curl ? on Deployment Architecture. 11-09-2016 11:57 PM
Topics I've Started
No posts to display.
11-10-2016
01:51 PM
When it show "all" results it seams you have in one or more 'by' fields differences.
Put everything expect IP in latest() in front of the 'by' and this should be what you are searching for.
... View more
11-10-2016
01:19 PM
Hi,
In your description is the inputs missing:
You are searching for '_TCP_ROUTING ='
See also:
the docs for outputs.conf (the last example) and the inputs.conf
Kind Regards
Darth
... View more
11-10-2016
12:53 PM
Hi,
I would concentrate my search for the date_* fields also stats and eval functions.
Without example data I can't figure out all possibilities.
Kind Regards
Darth
... View more
11-10-2016
12:09 PM
rex "dv_state=\"(?<dv_state>[^\"]*)\""
Regular Expressions is a Language for it's own... there are many good creators for that.
online I often use regexr(dot)com
On Mac is regExRX a good choice
Kind regards
Darth
... View more
11-10-2016
10:53 AM
Hi,
A customer of my company has round about 70 indexes on a single node splunk enterprise indexer, without index numbers indicated problems. Almost the same count on a Cluster too.
Think 100 for a Cluster shouldn't be a problem.
Maybe you have to configure the size. Every index has in standard config a size of 500 GB.
Kind Regards
Darth
... View more
11-10-2016
01:02 AM
Hi
uncompressed tar files with suffix .diag are working
compressed tar files with suffix .diag are NOT working
following error message occurs in splunkd.log when it's gziped:
11-10-2016 09:50:12.793 +0100 WARN FileClassifierManager - The file '/opt/splunk/blub.diag' is invalid. Reason: binary
Kind Regards
Darth
... View more
11-09-2016
11:57 PM
Hi
This features should only work with a non-standard admin password on Universal Forwarder.
You can change it with the CLI command like:
./splunk edit user admin -password 'S3cret-1'
Kind Regards
Darth
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
