Dear Splunkers, I want to add a drill down link to my dashboard that redirects to a remote website. Currently, I do it with the following URL using the <link> tab inside drill down.
<link>http[:]//website.com/param1=xyz</link>
The problem is when the user clicks on the link the param1=xyz is part of the URL and is visible in the browser. Does drilldown support HTTP POST so that I can hide the param1=xyz from being displayed in the browser? Regards.
... View more
Hi Splunkers,
I have a simple drilldown on my Splunk dashboard that links to an external website. How can I get Splunk to log the URL that was clicked by the user ?
I would like to see a log of all the URLs clicked by each user for audit purpose.
Regards.
... View more
Hi Splunkers,
I have a simple drilldown configured that links to an external website. The link generated by the drilldown has data clearly visible in the URL like http[:]//site.com/name=joe
Is it possible to POST data to an external website using drilldown I would prefer my url to be http[/]site.com and the name=joe to be set as POST parameter.
Regards.
... View more
Hi, No, you can't run btool command to returns what's loaded in memory. To get the current loaded configurations you should execute the "splunk show config" command. Example: To verify the loaded configurations of the inputs.conf file splunk show config inputs
... View more
Hi that’s the way how it has planned to work. You could look more details from job inspector. It’s ok to do it that way. If you are needing high availability, then your should jump to indexer clustering. That’s also give more performance when you have more peers in cluster. https://docs.splunk.com/Documentation/Splunk/8.2.0/Indexer/Aboutindexesandindexers r. Ismo
... View more
All those are used only feature part of license not ingesting part. You should use central license server to share license to all of your splunk enterprise nodes. You could found more here: https://docs.splunk.com/Documentation/Splunk/8.2.0/Admin/TypesofSplunklicenses r. Ismo
... View more
Hi if I recall right there is no option to do that as you want to use second group as fallback address. The Splunk way is to use several host on output stanza or even better if you can use indexer discovery for getting current working indexers. https://docs.splunk.com/Documentation/Splunk/8.2.0/Indexer/indexerdiscovery r. Ismo
... View more
Hi @niketn This is an amazing solution to the problem and it works perfectly well. How can I get this solution to work if I have multiple Radial Gauges ? Thanks, Termcap.
... View more
Hi @termcap I have tested it, 'App context' available to choose on my 8.1.3 single instance Splunk and HF both. could be a bug in your version and find for errors in installation, try configure it from backend inside one of app.
... View more
Hi, Since you are using a default sourcetype syslog which comes with default configuration to extract a host from _raw data. [syslog]
pulldown_type = true
maxDist = 3
TIME_FORMAT = %b %d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 32
TRANSFORMS = syslog-host
REPORT-syslog = syslog-extractions
SHOULD_LINEMERGE = False
category = Operating System
description = Output produced by many syslog daemons, as described in RFC3164 by the IETF Path of default config - /opt/splunk/etc/system/default/props.conf ------------------------------------- An upvote would be appreciated if it helps!
... View more
I have a CSV with the following data 19,john doe,blue car,NAY,NA,YAY,,NIL,,,,NA,, There are 14 fields in the above line, but when I try the automatic field extractor via "Extract more fields", It only recognizes 13 fields. Why is the field extractor dropping the last field ?
... View more
Don't trust flash card sites. The information in them is of questionable quality and have been found to be incorrect in the past. Stick with the Splunk-provided material. I think you'll be better off spending your flash-card time on hands-on activity with Splunk.
... View more
Hello @termcap
My name is Yeasuh and I'm a Community Specialist for Splunk.
Splunk Partners are those who choose to purchase and use Splunk Products.
Since mostly companies do so, that is what is meant by a Company Account.
If you have any more questions about Training and Certification, we now have a board located here on the Community page.
Thank you for being a part of our Community! Happy Splunking 🙂
... View more
Hi @termcap, answering to your questions: No, buying 50 GBof Splunk and 50 GB of ES you haven't 100 GB you have 50 GB of Splunk and ES. Yes you have to upgrade both the products: Splunk Enterprise and ES; For my knowledge you cannot buy a different value for Splunk and ES; ES Installation requires a training on ES because it has some attentions to use in the installation process, e.g. differently to how you might think, the ES is not installed immediately after Splunk, but first all the TAs must be installed and then the ES. Ciao. Giuseppe
... View more
The issue was that I am working with t2.micro AWS cloud instance with really limited RAM, the search job was causing the RAM requirements to shoot up, which was not a problem because behind the scenes it seems I was using my burstable memory credits. Once I ran out of credit, the OOM killer kicked in and started to kill the Splunkd process that was running the job! Changing the instance type of the Linux machine fixed the issue.
... View more
What you have stated is the default behavior of the UF. I was I was able to get the UF to re-process the whole file by adding random junk characters and enabling the crcSalt = <SOURCE> for the file. Then exclude those junk characters using transforms.conf.
... View more
Hi @termcap, in this case, you could have a different approach: schedule a search (e.g. each hour, or every ten minutes) that takes all the values you ned deduping the values and save results in a summary index or in a lookup. In this way you're sure to have the updated values in this lookup or summary index and then you can make your searches (if summary index using my query) here, obviously you always have an update time related to the frequency of your scheduled search. Ciao. Giuseppe
... View more
You can take the exams prior to Architect without the courses. To be pedantic, you must successfully complete the courses, not just buy them.
... View more