About neusse

genesiusj · ‎06-19-2020

@efavreau Thanks for your reply. There is no copy-n-paste of code from the dashboard to a search. I click the search magnifying glass at the bottom right of the panel. The results in this search page do not match those in the dashboard. Thanks and God bless, Genesius

neusse · ‎06-10-2019

I downvoted this post because this statement of non compatibility of time is inaccurate.

neusse · ‎10-28-2016

Is there a way to detect gaps in the middle like the chart shows above? So the red is two time spans. I can think of a way to detect that. If the data is always overlapping this works. But my data is not always overlapping. Thanks,

woodcock · ‎07-26-2016

Apps sometimes work differently on different OS. I tried on Windows and it worked fine.

gjanders · ‎05-08-2020

Other alternatives include: https://github.com/paychex/Splunk.Conf19 PayChex cover your assets (conf presentation/example queries) https://splunkbase.splunk.com/app/4182/ Git Version Control for Splunk You may also wish to vote for https://ideas.splunk.com/ideas/E-I-7 on the ideas.splunk.com website but make sure you understand how it works first, you will find the Ideas documentation here

cesaccenturefed · ‎11-26-2018

You are a lifesaver. I tried depth_limit and match_limit were no help. Had to do a little google foo to get this answer. Seem silly to pick 4k as a limit vs something like 8k is default for syslog-ng and 10k for other splunk limits. having our events cascading through multiple meta data modification has not been an issue, then we noticed long events were being singled out and not routing where they are supposed to be going.

neusse · ‎03-08-2011

Yes there is a solution. I found nothing anywhere describing this in splunk.com. My issue of not being able to search into the event deep enough at index time was solved by using the simple command LOOKAHEAD in transforms.conf. Turns out splunk does not look far ahead related to REGEX at all when indexing. It seems to only be looking for the end ofthe transaction as a priority. Here are my working props.conf and transforms.conf: transforms.conf [nomore] LOOKAHEAD = 100000 REGEX=(?m)(404\sNot\sFound) DEST_KEY=queue FORMAT=nullQueue props.conf [mod_security] SHOULD_LINEMERGE = true MUST_NOT_BREAK_AFTER = (--[a-z0-9]+-A--) MUST_BREAK_AFTER = (--[a-z0-9]+-Z--) TRUNCATE = 0 TRANSFORMS-notfounderror = nomore At least it is working now!

Posts	21
Solutions	2
Karma Given	7
Karma Received	13
Member Since	‎03-01-2011

Online Status	Offline
Date Last Visited	‎09-19-2024 01:43 PM

How to derive earliest and latest from a list of e...

Service not available error.

Transforms REGEX will not search past first line o...

Yet another filtering problem. Many transforms in ...

Re: Why would the SPL run in the Search App give d...

Re: How to get date picker to work with dates outp...

Re: How to derive earliest and latest from a list ...

Re: Service not available error.

Re: How can I backup and maintain a version of das...

Re: Transforms REGEX will not search past first li...

Re: Yet another filtering problem. Many transforms...

Join the Conversation