Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About oda
oda
Communicator
Member since:
03-13-2017
01-09-2024
Community Statistics
| Posts | 72 |
| Solutions | 7 |
| Karma Given | 4 |
| Karma Received | 4 |
| Member Since | 03-13-2017 |
Activity Feed
- Posted Re: How to combine rows based on parent-child relationship on separate fields on Splunk Search. 12-26-2023 06:20 PM
- Posted Re: How to combine rows based on parent-child relationship on separate fields on Splunk Search. 12-21-2023 11:42 PM
- Posted Re: Windows Event Log differs depending on the volume displayed in extx format and the Splunk index volume. on Installation. 04-06-2022 02:43 AM
- Posted Why does the Windows Event Log differs depending on the volume displayed in extx format and the Splunk index volume? on Installation. 04-03-2022 09:55 PM
- Posted The license cannot be renewed until the renewal date. on Installation. 12-21-2020 11:24 PM
- Posted About import(monitor) excluding csv header on Splunk Enterprise. 10-01-2020 01:01 AM
- Posted Re: Compatibility of Palo Alto and Add-on on Splunk Enterprise. 09-02-2020 11:35 PM
- Posted Re: Compatibility of Palo Alto and Add-on on Splunk Enterprise. 07-17-2020 06:59 PM
- Posted Compatibility of Palo Alto and Add-on on Splunk Enterprise. 07-17-2020 07:21 AM
- Got Karma for Re: Compare columns in same table. 06-05-2020 12:51 AM
- Karma Re: Premium apps について for CurryPan. 06-05-2020 12:49 AM
- Karma Re: Splunk for Blue Coat ProxySG: why can't I import using a universal forwarder? for yutaka1005. 06-05-2020 12:49 AM
- Got Karma for Re: Help with a join command. 06-05-2020 12:49 AM
- Got Karma for Re: Is there an app for a decision tree graph?. 06-05-2020 12:49 AM
- Karma Is it possible to use Splunk DB Connect to search MongoDB? for diogofgm. 06-05-2020 12:48 AM
- Karma Re: Change the message of "mouse over field" for niketn. 06-05-2020 12:48 AM
- Got Karma for Re: How to remove blank spaces from table in dashboard in splunk ?. 06-05-2020 12:48 AM
- Posted Re: インデックス別データ取り込み量確認方法 on Splunk Search. 04-07-2020 01:59 AM
- Posted Re: Compare columns in same table on Splunk Search. 02-25-2020 04:56 PM
- Posted Re: 誤って追加してしまったデータの削除方法 on Getting Data In. 10-03-2019 06:45 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-26-2023
06:20 PM
Oops I understand your explanation. That's difficult to achieve with Splunk. Please refer to the URL below for details. https://community.splunk.com/t5/Splunk-Search/recursively-join-the-same-table/m-p/140079 If you have other conditions, you may be able to do it. Example - This log is an experiment log and can be identified for each experiment. - Logs that are always parent and child will be displayed below.
... View more
12-21-2023
11:42 PM
I would like to create an answer, but could you please tell me the final form you would like to create?
... View more
04-06-2022
02:43 AM
I understood it again that It is difficult to calculate the log correct amount of windows event log. It is difficult to data import in advance because it is before purchasing additional licenses. Isn't there any reference material or .conf's PDF?
... View more
04-03-2022
09:55 PM
Hi, I understand that importing the evtx format into Splunk consumes more licenses than the volume displayed. (Because evtx is a compressed format.)
Am I right in thinking that I will consume about 2 to 5 times more licenses?
I think I saw the material about this somewhere, can anyone share it?
I would be grateful if you could help me.
... View more
Labels
- Labels:
-
Windows
12-21-2020
11:24 PM
In the production environment, the following message will be displayed and the license cannot be renewed until the renewal date. "failed to add because: license is from the future; its active span has not begun yet" I found similar question in Splunk Answers. https://community.splunk.com/t5/Archive/failed-to-add-because-license-is-from-the-future-its-active-span/m-p/44122 But as far as I can verify, this doesn't seem to be the case. Has anyone had the same thing happened?
... View more
Labels
- Labels:
-
license
10-01-2020
01:01 AM
I'm trying to import a csv file Using the monitor function. The imported csv file will be updated (overwritten). Since the header line is included in duplicate, I put the setting of "HEADER_FIELD_LINE_NUMBER=1". Initially it works, but when I reboot it doesn't. Does anyone know the answer or the issue?
... View more
Labels
07-17-2020
06:59 PM
Thank you for your answer. I confirmed no compatibility statement found for Palo Alto Networks App for Splunk and Palo Alto Networks Add-on for Splunk. I also confirmed that Splunk 8 is supported. I understand it's probably compatible, but is there somewhere else? (EX)https://splunk.paloaltonetworks.com/compatibility.html App Add-on (TA) Version 6.0 Splunk_TA_paloalto 6.0
... View more
07-17-2020
07:21 AM
I read the following document but I couldn't find any description. https://splunk.paloaltonetworks.com/compatibility.html Are the latest versions of APP and Add-on compatible?(Version 6.2) And is it available in Splunk 8.X?
... View more
04-07-2020
01:59 AM
下記にも記載がありますが
index=_internal source="license_usage.log" type=usage idx="" | eval MB = round(b/1048576,2) | eval st_idx = st.": ".idx | timechart span=1d sum(MB) by st_idx | addtotals
と検索いただくと確認できるかと存じます。
https://answers.splunk.com/answers/355874/how-to-find-license-usage-by-indexes.html
... View more
02-25-2020
04:56 PM
1 Karma
Try the following command.
| table column1, column2 |where column1!= column2
... View more
10-03-2019
06:45 PM
もしsourcetypeが異なるようであれば
jacobevans さんが回答している内容で削除してください。
同一のsourcetypeであれば下記のコマンドで取り込みを行った時間を表示することが可能です。
index=someindex | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S")
その後、誤って取り込んでしまった時刻のデータのみに絞り込み
| delete
コマンドで削除してください。
... View more
06-12-2019
10:07 PM
I want to get time in this log file.
[sample log]
1234 567 789^G20190613^G14:00^Gsample_log
^G mean control code.
TIME_PREFIX was done.
However, TIME_FORMAT does not work.
How should I write it?
... View more
- Tags:
- splunk-enterprise
06-10-2019
06:23 PM
Have you confirmed this setting?
https://answers.splunk.com/answers/670922/phantom-app-for-splunk-why-is-there-error-loading.html
I hope you will find it useful.
... View more
02-19-2019
12:26 AM
I saw it.
https://docs.splunk.com/Documentation/Forwarder/7.2.4/Forwarder/Compatibilitybetweenforwardersandindexers
I am using IDX of 6.4 and UF of 7.2.
However, I can not communicate from client hello to x.
An S in a cell indicates that this version of forwarder can send data to this version of indexer after you change the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) version and cipher suite on the forwarder. See Known Issues in the Splunk Enterprise Release Notes for instructions on changing the SSL/TLS version and cipher suite.
I do not understand what settings I should add to UF.
Please teach me
... View more
10-22-2018
10:46 PM
I want to delete events automatically in Phantom.
I know that it can be deleted by hand like a picture.
How do I write on Playbook?
... View more
- Tags:
- Phantom Audit
09-20-2018
08:23 PM
By default Splunk assumes the same file when the first 256 bytes are the same.
How is Splunk structured data judged?
For example csv file.
props.conf
[testcsv]
INDEXED_EXTRACTIONS=csv
If the file names are the same, it seems to be regarded as the same file.
Do you know something?
Is there a description in the manual?
For files with the same name, the second time is not recognized as a header line.
Please give me some help.
Thanks.
... View more
- Tags:
- splunk-enterprise
08-19-2018
10:28 PM
I'm sorry I did not understand simple things.
I downloaded it and moved on directory of /opt/splunk/app/etc/apps/Splunk_TA_paloalto/default/ and /opt/splunk/app/etc/apps/Splunk_TA_paloalto/sample/...
However, it does not move.
Is there anything else you must do?
... View more
08-15-2018
09:12 PM
In the old Paloalto APP there was an Eventgen but I can not find it now.
I want to generate a log automatically, is not there a good way?
Thanks guys.
... View more
06-05-2018
07:05 AM
I am sorry that I am not good at English.
I can install a "no-enforcement" key on an older version of Splunk.
And it is supported by Splunk.
Is it OK?
... View more
06-04-2018
06:25 PM
Thank you for answering.
I confirmed that I can install it.
What does "cut" mean?
... View more
06-04-2018
05:36 PM
Thanks for your comment.
I dont need the new capability.
Is it still necessary to upgrade?
The license server is a search head.
... View more
06-04-2018
05:27 PM
Thanks for your comment.
It was the same as my link.
It has a description "in order to get the new capability"
I will not use new features.
What do you think?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-09-2024
04:13 AM
|
