Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About davesplunk01
davesplunk01
Path Finder
Member since:
02-08-2017
06-05-2020
Community Statistics
| Posts | 17 |
| Solutions | 2 |
| Karma Given | 57 |
| Karma Received | 6 |
| Member Since | 02-08-2017 |
Activity Feed
- Got Karma for Re: How to show total count of stacked chart on the top of column?. 01-30-2023 06:42 AM
- Got Karma for Re: How to show total count of stacked chart on the top of column?. 06-26-2022 12:57 PM
- Karma Re: extract uri for vasanthmss. 06-05-2020 12:50 AM
- Karma Re: How to freeze ONLY first column in table when scrolling the table to right or left for vasanthmss. 06-05-2020 12:50 AM
- Karma Re: What is wrong with my eval for this token? for vasanthmss. 06-05-2020 12:50 AM
- Karma Re: Listonly desired accounts for vasanthmss. 06-05-2020 12:50 AM
- Karma Re: How can I direct a role to a specific dashboard at login? for vasanthmss. 06-05-2020 12:49 AM
- Karma Re: How can I retrieve a list of LDAP users in my Splunk search? for vasanthmss. 06-05-2020 12:49 AM
- Karma Re: How can I direct a role to a specific dashboard at login? for ben_leung. 06-05-2020 12:49 AM
- Karma Re: How can I retrieve a list of LDAP users in my Splunk search? for vasanthmss. 06-05-2020 12:49 AM
- Karma Re: How can I retrieve a list of LDAP users in my Splunk search? for vasanthmss. 06-05-2020 12:49 AM
- Karma Re: How can I retrieve a list of LDAP users in my Splunk search? for vasanthmss. 06-05-2020 12:49 AM
- Karma Re: Can I receive an alert in Splunk when I receive an Outlook email? for vasanthmss. 06-05-2020 12:49 AM
- Karma Re: Is there a way to combine field values from different events? for vasanthmss. 06-05-2020 12:49 AM
- Karma Re: Lines break when indexing JSON data using props.conf attributes for vasanthmss. 06-05-2020 12:49 AM
- Karma Re: Can I change alert name in .conf without restarting Splunk? for vasanthmss. 06-05-2020 12:49 AM
- Karma Re: Why are there many duplicate events in the indexer cluster? for vasanthmss. 06-05-2020 12:49 AM
- Karma Re: Why are there many duplicate events in the indexer cluster? for vasanthmss. 06-05-2020 12:49 AM
- Karma Re: Different query's based on the result of previous Token for vasanthmss. 06-05-2020 12:49 AM
- Karma Re: How to write multiple fields into one column as values? for vasanthmss. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-14-2017
11:38 AM
5 Karma
Alternative approach ,
search ... | addtotals
Add totals gives you the row total with the field name Total
Click visualization select column chart
Click format and enable the stack mode .
select show data values as on
Click chart overlay and Click the text box and select Total field.
make View as Axis as off
Click Apply.
you will get the stacked chart with numbers. overlay will be an line chart shows number.
... View more
07-07-2017
04:04 PM
Good one. for safer side use year also in the sorting ,
|inputlookup ChargeVolume.csv |stats sum(Charge Volume (USD)) as "Charge Volume" , sum(Pre Auth volume) as "Pre Auth Volume" by "Reporting Month-YEAR" | Rename "Reporting Month-YEAR" to "Month" | eval rank=case(Month like "Jan-%",1,Month like "Feb-%",2,Month like "Mar-%",3,Month like "Apr-%",4,Month like "May-%",5,Month like "Jun-%",6,Month like "Jul-%",7,Month like "Aug-%",8,Month like "Sep-%",9,Month like "Oct-%",10,Month like "Nov-%",11,Month like "Dec-%",12,1=1,13) |rex field=Month "-(?<rank_year>\d+)" | sort 0 rank_year, rank| fields - rank rank_year
... View more
07-07-2017
10:41 AM
upgrade to 6.6 did the magic.
... View more
06-28-2017
10:39 AM
How to populate the timechart based on the input dropdown (avg, max, min, perc90).
looking something like .......| timechart $token$(field) as field Any thoughts?
... View more
04-24-2017
03:56 PM
1 Karma
Configured the db connect user and their roles, but Why I am getting the below warning in the search logs?
WARN AuthorizationManager - Capability 'db_connect_read_dbinput' is not recognized by Splunk. Ignoring...
WARN AuthorizationManager - Capability 'db_connect_read_dboutput' is not recognized by Splunk. Ignoring...
... View more
02-21-2017
09:46 AM
thanks for the comment. Could you please help me to understand the issue? There is something wrong would like to find and fix.
... View more
02-21-2017
09:43 AM
we are running 6.3.4 Splunk version - Search head cluster. Saved search scheduled 10 10 * * * and working fine. deployed through the deployer. After updating the search, bundle replicated to all the search head (checked manually) but the scheduled dispatch search still referring the old search. How to debug this?
... View more
02-17-2017
09:59 AM
Splunk 6.3.4 - While looking search log - inspect - search.log, I saw this error log, ERROR HTTPClient - Should have received at least 3 tokens in status line, while getting response code. Only got 0. Help me to understand further, is there something I want to worry about? where can I find the details about this?
... View more
02-17-2017
09:50 AM
search error from the search.log (job inspect - search.log). DispatchThread - Error reading runtime settings: File /opt/splunk/var/run/splunk/dispatch/subsearch_scheduler_...../runtime.csv does not exist
What does it mean? Searches are taking log time to execute (no error in the Splunk Web). Splunk version 6.3.4
Additional info while looking Splunk Answers found: https://answers.splunk.com/answers/104690/error-dispatchthread-error-reading-runtime-settings-file-does-not-exist-splunk-6-0-upgraded.html
... View more
02-13-2017
06:13 PM
Thanks. We were planning to increase the servers and dont want to do the manual installs. I should have aksked directly. Thanks much!!
... View more
02-13-2017
09:27 AM
Installed Splunk 6.5.1 and followed the steps from https://docs.splunk.com/Documentation/Splunk/6.5.2/Security/Howtoself-signcertificates and enabled the Splunk Web SSL. Still facing the issue
Chrome:
"Your connection is not private". while debugging more saw the error: NET::ERR_CERT_AUTHORITY_INVALID from the chrome browser.
IE:
"There is a problem with this website’s security certificate".
Is there any configuration missing? I have followed all the steps and there are no error in internal logs also.
thanks,
... View more
02-13-2017
09:21 AM
how to create application specific user roles. I have multiple applications, need to keep an set of users to perform read and another set of users to write. but the same set of users may required edit permission on the other applications.
Example
user1 - app1_read, app2_power, app3_read
user2- app1_read, app2_read, app3_power
user3 - app1_power,app2_read, app3_read
app_read - can only access like basic user
app_power - can edit the knowledge objects and update the permission of other users like (admin).
thanks,
... View more
02-10-2017
05:44 PM
Its a physical log file . how the event collector will help?
... View more
02-10-2017
05:24 PM
Thanks for reply. Installing universal forwarder in all server is not possible with my case. We looking remote or alternative feature.
... View more
02-10-2017
04:59 PM
New to splunk. We have a clustered environment with 100 of serveres involved. Without installing universal forwarder how to monitor the logs from those servers. We dont want to install plugin or anything all 100 servers.
We have contoll on all the servers so what would be the best way.
Any ideas or topics to cover will help
Thanks.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
