Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About joshiro
joshiro
Communicator
Member since:
03-08-2021
10-01-2024
Community Statistics
| Posts | 74 |
| Solutions | 6 |
| Karma Given | 32 |
| Karma Received | 6 |
| Member Since | 03-08-2021 |
Activity Feed
- Posted Re: How do you schedule a report that needs to run multiple times for different time ranges? on Splunk Enterprise. 10-01-2024 06:59 AM
- Karma Re: How do you schedule a report that needs to run multiple times for different time ranges? for richgalloway. 10-01-2024 06:59 AM
- Posted How do you schedule a report that needs to run multiple times for different time ranges? on Splunk Enterprise. 09-30-2024 08:46 AM
- Tagged How do you schedule a report that needs to run multiple times for different time ranges? on Splunk Enterprise. 09-30-2024 08:46 AM
- Got Karma for Re: Why export button is grayed out in some of my panels?. 08-09-2024 12:28 AM
- Posted Re: Splunk Secure Gateway connection error on Splunk Enterprise. 06-10-2024 08:31 AM
- Got Karma for Re: Why export button is grayed out in some of my panels?. 05-22-2024 06:16 AM
- Karma Re: Dashboard Studio: Managing Icons and Images for fralcalde. 05-08-2024 11:18 AM
- Posted Re: Building Apps with Dashboard Studio on Splunk Dev. 05-08-2024 11:13 AM
- Posted Re: Receiving error: Could not load lookup=LOOKUP-splunk_security_essentials on Splunk Search. 07-18-2023 08:40 AM
- Got Karma for Re: Why export button is grayed out in some of my panels?. 06-22-2023 04:11 PM
- Posted Re: How can we implement read only columns in the Splunk App for Lookup File Editing? on Splunk Enterprise. 06-21-2023 08:12 AM
- Karma Re: How can we implement read only columns in the Splunk App for Lookup File Editing? for richgalloway. 06-21-2023 08:12 AM
- Posted Re: Why export button is grayed out in some of my panels? on Other Usage. 06-21-2023 07:48 AM
- Posted How can we implement read only columns in the Splunk App for Lookup File Editing? on Splunk Enterprise. 06-21-2023 07:13 AM
- Posted How can we preload a token from a search result in a SimpleXML dashboard for mobile use? on Splunk Enterprise. 06-02-2023 10:49 AM
- Tagged How can we preload a token from a search result in a SimpleXML dashboard for mobile use? on Splunk Enterprise. 06-02-2023 10:49 AM
- Tagged How can we preload a token from a search result in a SimpleXML dashboard for mobile use? on Splunk Enterprise. 06-02-2023 10:49 AM
- Posted Re: How can we hide a panel just for Mobile on Dashboards & Visualizations. 03-16-2023 08:06 AM
- Karma Re: How can we hide a panel just for Mobile for gcusello. 03-16-2023 08:05 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-01-2024
06:59 AM
That is what we thought. We are looking for a better solution to avoid cloning the report if it is possible.
... View more
09-30-2024
08:46 AM
We have a report that generates data with the `outputlookup` command and we are in need to schedule it multiple times but with different time ranges. For this report, we want to run it each day but with different time ranges in sequential order. Each run requires the previous run to finish so it can load the lookup results for the next run. We cant just schedule a single report that updates the lookup because we need it to run on different time ranges each time it triggers. Is there any way we can schedule a report to run in this particular way? We thought about cloning it multiple times and schedule each one of them differently but it is not an ideal solution. Regards.
... View more
Labels
- Labels:
-
administration
06-10-2024
08:31 AM
Hi Marco, i dont really remember what was the problem nor the solution. We are currently working with Splunk Edge Hub on Splunk 9.2.0.1 and we got no problems with the device registration. What i do remember about that time where we implemented the SSG for Mobile use, is that there was a problem with cert inspection on the firewall, it changed something on the cert itself ,and it was no longer recognized as a valid one for the SSG. Regards.
... View more
05-08-2024
11:13 AM
Did you ever tried referencing icons from static directory? Seems that only works for images. Any idea on how to accomplish the same but for icons?
... View more
07-18-2023
08:40 AM
We recently encounter a similar error on some searches and we found out that the source of the problem was the KVStore failing to initialize because expired certificates. After renewing the web certificates the error no longer shows up.
... View more
06-21-2023
08:12 AM
Is there anyway we can "hide" some of these columns in the GUI?, even when they are in the raw lookup files.
... View more
06-21-2023
07:48 AM
3 Karma
It still grayed out on Splunk Enterprise 9.0.1 when using a post process search. There is a workaround mentioned by @gjanders in a Splunk Ideas comment about this issue involving the use of the loadjob command. https://ideas.splunk.com/ideas/EID-I-1937 Here is the comment: Consider this example for a base/post-process search:
<search id="basesearch">
<query>| makeresults count=1 | streamstats count</query>
<done>
<set token="sid">$job.sid$</set>
</done>
</search>
<row>
<panel>
<title>loadjob of basesearch</title>
<table>
<title>Can export</title>
<search>
<query>| loadjob $sid$</query>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
That should do what you expect, note that the loadjob isn't technically the same as a post-process search but you can use to achieve the same goal...
... View more
06-21-2023
07:13 AM
We are using Splunk Enterprise 9.0.1 OnPrem, with Splunk App for Lookup File Editing version 3.6.0. We need to get a user to modify a column in a lookup, so we give him access and capabilities to do so. But we dont want this user to have the power to modify all the columns in that lookup. Is there anyway that we can restrict which columns a user can edit? Regards. EDIT: Here is an open idea for this feature request: https://ideas.splunk.com/ideas/APPSID-I-529. Please vote if you consider it is useful.
... View more
- Tags:
- lookup
Labels
- Labels:
-
administration
06-02-2023
10:49 AM
We are using Splunk Enterprise 9.0.1 and we are developing SimpleXML dashboards. Im currently using a mobile device with Android. The problem is that we need to preload a few tokens with search results and we cant make it work in the mobile dashboard. To achieve this we are running a search directly in the <dashboard> xml tag just like a base search. This approach works for the web dashboards but the mobile one does not load those tokens because the search never runs. The same thing happens when we run the search inside a hidden panel using the depends attribute for <panel>, it shows well on web but it fails to run the search on mobile. We cant make this panel visible for all web and mobile, as it is just a table with values that we need to preload on tokens. Does anyone managed to work around this issue? UPDATE 2023-06-05: The same thing happens with the Dashboard Studio, loading tokens from searches only works for web dashboards.
... View more
Labels
- Labels:
-
development
03-16-2023
08:06 AM
Thanks for the feedback, we are going to evaluate your workaround. Regards
... View more
03-16-2023
07:47 AM
We have a simpleXML dashboard that we want to get visible for Splunk Mobile use. The problem is that this dashboard contains a panel with a visualization that isnt Mobile compatible. We dont want to clone this dashboard and remove this single panel just for Mobile use, because this creates a maintenance burden where we need to keep track of the duplicated Mobile dashboards and replicate the changes of the main dashboards over to the Mobile ones. Is there anyway we can "hide" specific panels for the Mobile view only?
... View more
- Tags:
- mobile
Labels
- Labels:
-
dashboard
-
simple XML
03-08-2023
10:03 AM
Yes, that is what we thought, but since we dont know how much nesting depth we are going to use, we just cant hardcode the escaped backslashes all the way down.
... View more
03-08-2023
07:56 AM
Thanks for the feedback. This approach is also working correctly, no longer raises the same error when removes the double quotes from the "@y". But it wont work if you nest the macros more than 2 times.
... View more
03-07-2023
09:29 AM
It turns out that the useACK option in outputs.conf was the source of the problem. The rolling restart of the indexers doesnt wait for the ACK to be returned to the HF. So the HF will send again the data creating duplicates. If we were to keep using the ACK then we must stop the HF manually before the rolling restart and start if after it is done.
... View more
03-07-2023
09:14 AM
We managed get a workaround this issue by creating a third macro with the whole string we are passing as the argument: `args` -> | makeresults | eval arguments = tostring(floor(relative_time(_time, "@y"))) | return $arguments Now we can run he following SPL without the parsing error: | makeresults
`test_arguments2("[`args`]")`
| table arguments By using the third macro with the arguments, we avoid Splunk to parse the arguments directly and removing the double quotes.
... View more
03-03-2023
07:21 AM
We have this scenario where two nested macros using the same argument raises an error at the parsing of the second one because of the double quotes in the arguments dissapear. If we define the two macros as the following: "test_args2(1)" -> `test_args("$args$")` "test_args(1)" -> | eval arguments = $args$ And then run the following search: | makeresults
`test_arguments2("[| makeresults | eval arguments = tostring(floor(relative_time(_time, "@y"))) | return $arguments]")`
| table arguments It raises the following error: And the search log shows that after expanding the first macro then it removes the double quotations from the argument: PARSING: | makeresults \n`test_arguments2("[| makeresults | eval arguments = tostring(floor(relative_time(_time, "@y"))) | return $arguments]")`\n| table arguments
AFTER EXPANDING MACROS: | makeresults \n| eval arguments = [| makeresults | eval arguments = tostring(floor(relative_time(_time, @y))) | return $arguments]\n| table arguments It doesnt work either if we scape the doble quotes as: | makeresults
`test_arguments2("[| makeresults | eval arguments = tostring(floor(relative_time(_time, \"@y\"))) | return $arguments]")`
| table arguments Has anyone encounter a similar issue? How did you get around it or solve it?
... View more
- Tags:
- macro
Labels
- Labels:
-
search job inspector
02-13-2023
08:15 AM
Good to know, any ETA for this new version?
... View more
- Tags:
- instrumentation
02-13-2023
07:12 AM
We "solve" it fixing the conf in local so it doesnt go against the manifest. It still raises the warning but the actual search works.
... View more
02-03-2023
08:26 AM
Hi, we are having a similar issue, have you managed to solve it? We need to clean the dispatch directory in a SH clustered environment. We didnt found any best practices for the clean-dispatch command and the Splunk documentation doesnt help either. https://docs.splunk.com/Documentation/Splunk/9.0.3/Search/Dispatchdirectoryandsearchartifacts Should we run the clean-dispatch command node per node? Stop node, clean-dispatch, start node? Or should we stop the whole SH cluster, then clean-dispatch each node, and then start the nodes?
... View more
02-03-2023
08:24 AM
We need to clean the dispatch directory in a SH clustered environment. We didnt found any best practices for the clean-dispatch command and the Splunk documentation doesnt help either. https://docs.splunk.com/Documentation/Splunk/9.0.3/Search/Dispatchdirectoryandsearchartifacts Should we run the clean-dispatch command node per node? Stop node, clean-dispatch, start node? Or should we stop the whole SH cluster, then clean-dispatch each node, and then start the nodes?
... View more
02-03-2023
08:23 AM
We need to clean the dispatch directory in a SH clustered environment. We didnt found any best practices for the clean-dispatch command and the Splunk documentation doesnt help either. https://docs.splunk.com/Documentation/Splunk/9.0.3/Search/Dispatchdirectoryandsearchartifacts Should we run the clean-dispatch command node per node? Stop node, clean-dispatch, start node? Or should we stop the whole SH cluster, then clean-dispatch each node, and then start the nodes?
... View more
01-20-2023
05:52 AM
We got lots of inputs, we can try to remake them, but its going to take time. This is the last thing we are trying. We found that the cron expression validation changed between versions: '1/10 * * * *' was a valid expression in 3.7, now its no longer valid. We have to do '1-59/10 * * * *'. Also we have to disable and then enable the input for it to start working again, changing the cron is not enough.
... View more
01-20-2023
05:15 AM
We already saw that documentation, and we didnt try to migrate that way because it doesnt match our context. We are already on 3.7 and that document is for an upgrade from 2.x to 3. And we were using DB Connect 3 for a long time without problems, this just happened recently when updating to the latest version, from 3.7.0. Might check what the upgrade scripts do, and see if they help us in any way. Thanks.
... View more
01-19-2023
10:55 AM
1 Karma
Splunk Enterprise 9.0.1. We upgrade DB Connect from 3.7.0. to 3.11.1 and we started to notice that some inputs were not working. Also on _internal we found an event that lists inputs that require migration. INFO c.s.d.s.m.s.DbInputToModularInputInstanceMigrator - DB Inputs requiring migration: [...] The actual documentation doesnt say anything about this migration. https://docs.splunk.com/Documentation/DBX/3.11.1/DeployDBX/MigratefromDBConnectv1 Is there any other documentation on how to migrate to the latest version? UPDATE: We found that the cron expression validation changed between versions: '1/10 * * * *' was a valid expression in 3.7, now its no longer valid. We have to do '1-59/10 * * * *'. Also we have to disable and then enable the input for it to start working again, changing the cron is not enough.
... View more
- Tags:
- DB Connect
Labels
- Labels:
-
administration
-
upgrade
01-18-2023
11:03 AM
Splunk Enterprise OnPrem 9.0.1. We are troubleshooting an issue where some alerts are beign triggered incorrectly, and found a correlation between this odd triggers and _internal events with sourcetype = splunkd_remote_searches. The events are described as: 01-18-2023 14:03:00.178 -0300 INFO StreamedSearch - Streamed search connection closed: search_id=remote_<node>_subsearch_searchparsetmp_ ... What does searchparsetmp mean in the context of the subsearch? Also whats is the difference with remote_<node>_subsearch_scheduler_ ... also describing similar events on _internal?
... View more
Labels
- Labels:
-
search performance
-
splunkd
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-01-2024
02:50 PM
|
Karma from
Karma given to
