About DanielSp

DanielSp · ‎09-01-2021

Did you found the issue? Alerts with throttle works correctly in distributed environment?

DanielSp · ‎06-02-2021

Thanks a lot¡

DanielSp · ‎06-02-2021

I have a index with the follow data: KEY_ID, GROUP, DATE With for example: 1, group1, 2021-06-01 1, group2, 2021-06-02 2, group1, 2021-06-01 ... I want to obtain next date value to show a table like: 1, group1, 2021-06-01,2021-06-02 1, group2, 2021-06-02,NULL ... I know that I can sort It and use a command like streamstats: | streamstats current=f last(DATE) as DATENEXT by KEY_ID But, my issue is that my index have a million of records, so, the results are truncated to 10.000 Is there any way to obtain the DATENEXT without modify limits.conf for streamstats? Thanks a lot¡ Regards

DanielSp · ‎05-28-2021

Replied below, thanks

DanielSp · ‎05-28-2021

Thanks a lot, with that solution background doesn't work yet, and color of letter works, but only where appears the mouse, I add a new image attached to show It Any Idea?

DanielSp · ‎05-27-2021

Hello, I have a table with background blue, and letter white, this table have a drilldown by row When I move the mouse in the different rows, It appears with background-color: ECF8FF (attached example) I have tried with different ways with <html><style> but I was able to fill with a border to the selected row, but I could not change color font, or background color (instead ECF8FF a green for example) of the selected row I have tried many solutions but It didn't work Could you help me, please? Thanks a lot¡¡¡

DanielSp · ‎04-07-2021

Thanks a lot¡ It works¡

DanielSp · ‎04-07-2021

Hello, I have a dropdown that I need to be filled depending other dropdown Dropdown1: A->X B->Y,Z C->W,Z If I selected A in the first one, I need that appear already selected X in the second dropdown If I selected B in the second one, I need that appear already selected (change from previous selection) to Y,Z in the second dropdown If I selected C in the thirstone, I need that appear already selected (change from previous selection) to W,Z in the second dropdown I tried with a token in the first dropdown and put the follow code in the second dropdown <default>$token$</default> It would work with only ONE value, but I not achieve that work for B and C that have 2 values Could you please help me with It? Thanks a lot

DanielSp · ‎01-16-2021

Hello, I have a .json that contains any multivalue fields. I would like to avoid that any multivalue field be indexed, because It contais a lot of data that I want to avoid index. Is there any way to do It? I have try other options like replace all multivalue text by a character, with the follow command ( | rex field="changelog.histories{}.history" mode=sed "s/(^.+)/x/g" )in a search, and I am able to change: asderdas asd34sdas asdaserwerw by x x x although I have tried with SEDCMD-xyz = s/"changelog.histories{}.history"=^.+/x/g in "Add data"-"Set sourcetype" window- Advanced and I don't achieve It. I would like to avoid index "changelog.histories{}.history" or change: asderdas asd34sdas asdaserwerw by x (changing all multivalue values for only a character(x for example) Is It possible? Thanks a lot and regards Daniel

DanielSp · ‎10-15-2020

Hello, I have the same error in 2 different instances: Unable to initialize modular input "drone_mode_subscription_modular_input" defined inside the app "splunk_app_cloudgateway": Introspecting scheme=drone_mode_subscription_modular_input: script running failed (exited with code 1). Could you please help us with the error? Thanks a lot¡

DanielSp · ‎09-21-2020

Hello, I have not this file in my local web.conf and It appears in web.conf from /opt/splunk/etc/system/default ... # user session configuration # You really don't want to turn this off tools.sessions.on = True tools.sessions.timeout = 60 # Set to False to expire the session cookie when the browser exits tools.sessions.restart_persist = True # Set to False to allow the session cookie to be read by javascript tools.sessions.httponly = True # Set to False to allow the session cookie to be accessible to insecure pages tools.sessions.secure = True # Set to True to force cookie secure flag when splunkweb is behind proxy server tools.sessions.forceSecure = False ... As you can see It already appears by default Thanks¡ Regards

DanielSp · ‎09-18-2020

Hello, Do you know how I can put HttpOnly and Secure to true in cookie login? Security team request It to me. It happens in splunk local account login I have web.conf correctly to true in httponly and set to secure Thanks a lot¡¡ Regards Daniel

Posts	12
Solutions	0
Karma Given	6
Karma Received	2
Member Since	‎09-18-2020

Online Status	Offline
Date Last Visited	‎09-01-2021 09:20 AM

Avoid streamstats truncate to obtain previous valu...

Change hover highlight row table drilldown

Fill default option from dropdown with a token

Remove or replace multivalue field before to index

Cookie login - Secure set to true and httponly

Re: Splunk correlation search with throttling gene...

Re: Avoid streamstats truncate to obtain previous ...

Avoid streamstats truncate to obtain previous valu...

Re: Change hover highlight row table drilldown

Re: Change hover highlight row table drilldown

Change hover highlight row table drilldown

Re: Fill default option from dropdown with a token

Fill default option from dropdown with a token

Remove or replace multivalue field before to index

Re: Problem with upgrade on Splunk Cloud Gateway t...

Re: Cookie login - Secure set to true and httponly

Cookie login - Secure set to true and httponly