Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About joshiro
joshiro
Communicator
Member since:
03-08-2021
11-10-2023
Community Statistics
| Posts | 70 |
| Solutions | 6 |
| Karma Given | 30 |
| Karma Received | 4 |
| Member Since | 03-08-2021 |
Activity Feed
- Posted Re: Receiving error: Could not load lookup=LOOKUP-splunk_security_essentials on Splunk Search. 07-18-2023 08:40 AM
- Got Karma for Re: Why export button is grayed out in some of my panels?. 06-22-2023 04:11 PM
- Posted Re: How can we implement read only columns in the Splunk App for Lookup File Editing? on Splunk Enterprise. 06-21-2023 08:12 AM
- Karma Re: How can we implement read only columns in the Splunk App for Lookup File Editing? for richgalloway. 06-21-2023 08:12 AM
- Posted Re: Why export button is grayed out in some of my panels? on Other Usage. 06-21-2023 07:48 AM
- Posted How can we implement read only columns in the Splunk App for Lookup File Editing? on Splunk Enterprise. 06-21-2023 07:13 AM
- Posted How can we preload a token from a search result in a SimpleXML dashboard for mobile use? on Splunk Enterprise. 06-02-2023 10:49 AM
- Tagged How can we preload a token from a search result in a SimpleXML dashboard for mobile use? on Splunk Enterprise. 06-02-2023 10:49 AM
- Tagged How can we preload a token from a search result in a SimpleXML dashboard for mobile use? on Splunk Enterprise. 06-02-2023 10:49 AM
- Posted Re: How can we hide a panel just for Mobile on Dashboards & Visualizations. 03-16-2023 08:06 AM
- Karma Re: How can we hide a panel just for Mobile for gcusello. 03-16-2023 08:05 AM
- Posted How can we hide a panel just for Mobile? on Dashboards & Visualizations. 03-16-2023 07:47 AM
- Posted Re: Why nested macros using the same argument wont work when the argument has strings in double quotes? on Splunk Search. 03-08-2023 10:03 AM
- Karma Re: Why nested macros using the same argument wont work when the argument has strings in double quotes? for PickleRick. 03-08-2023 10:03 AM
- Posted Re: Why nested macros using the same argument wont work when the argument has strings in double quotes? on Splunk Search. 03-08-2023 07:56 AM
- Karma Re: Why nested macros using the same argument wont work when the argument has strings in double quotes? for PickleRick. 03-08-2023 07:56 AM
- Posted Re: Why DB Connect duplicates events on indexer cluster rolling restart? on All Apps and Add-ons. 03-07-2023 09:29 AM
- Posted Re: Why nested macros using the same argument wont work when the argument has strings in double quotes? on Splunk Search. 03-07-2023 09:14 AM
- Posted Why nested macros using the same argument wont work when the argument has strings in double quotes? on Splunk Search. 03-03-2023 07:21 AM
- Tagged Why nested macros using the same argument wont work when the argument has strings in double quotes? on Splunk Search. 03-03-2023 07:21 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-18-2023
08:40 AM
We recently encounter a similar error on some searches and we found out that the source of the problem was the KVStore failing to initialize because expired certificates. After renewing the web certificates the error no longer shows up.
... View more
06-21-2023
08:12 AM
Is there anyway we can "hide" some of these columns in the GUI?, even when they are in the raw lookup files.
... View more
06-21-2023
07:48 AM
1 Karma
It still grayed out on Splunk Enterprise 9.0.1 when using a post process search. There is a workaround mentioned by @gjanders in a Splunk Ideas comment about this issue involving the use of the loadjob command. https://ideas.splunk.com/ideas/EID-I-1937 Here is the comment: Consider this example for a base/post-process search:
<search id="basesearch">
<query>| makeresults count=1 | streamstats count</query>
<done>
<set token="sid">$job.sid$</set>
</done>
</search>
<row>
<panel>
<title>loadjob of basesearch</title>
<table>
<title>Can export</title>
<search>
<query>| loadjob $sid$</query>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
That should do what you expect, note that the loadjob isn't technically the same as a post-process search but you can use to achieve the same goal...
... View more
06-21-2023
07:13 AM
We are using Splunk Enterprise 9.0.1 OnPrem, with Splunk App for Lookup File Editing version 3.6.0. We need to get a user to modify a column in a lookup, so we give him access and capabilities to do so. But we dont want this user to have the power to modify all the columns in that lookup. Is there anyway that we can restrict which columns a user can edit? Regards. EDIT: Here is an open idea for this feature request: https://ideas.splunk.com/ideas/APPSID-I-529. Please vote if you consider it is useful.
... View more
- Tags:
- lookup
Labels
- Labels:
-
administration
06-02-2023
10:49 AM
We are using Splunk Enterprise 9.0.1 and we are developing SimpleXML dashboards. Im currently using a mobile device with Android. The problem is that we need to preload a few tokens with search results and we cant make it work in the mobile dashboard. To achieve this we are running a search directly in the <dashboard> xml tag just like a base search. This approach works for the web dashboards but the mobile one does not load those tokens because the search never runs. The same thing happens when we run the search inside a hidden panel using the depends attribute for <panel>, it shows well on web but it fails to run the search on mobile. We cant make this panel visible for all web and mobile, as it is just a table with values that we need to preload on tokens. Does anyone managed to work around this issue? UPDATE 2023-06-05: The same thing happens with the Dashboard Studio, loading tokens from searches only works for web dashboards.
... View more
Labels
- Labels:
-
development
03-16-2023
08:06 AM
Thanks for the feedback, we are going to evaluate your workaround. Regards
... View more
03-16-2023
07:47 AM
We have a simpleXML dashboard that we want to get visible for Splunk Mobile use. The problem is that this dashboard contains a panel with a visualization that isnt Mobile compatible. We dont want to clone this dashboard and remove this single panel just for Mobile use, because this creates a maintenance burden where we need to keep track of the duplicated Mobile dashboards and replicate the changes of the main dashboards over to the Mobile ones. Is there anyway we can "hide" specific panels for the Mobile view only?
... View more
- Tags:
- mobile
Labels
- Labels:
-
dashboard
-
simple XML
03-08-2023
10:03 AM
Yes, that is what we thought, but since we dont know how much nesting depth we are going to use, we just cant hardcode the escaped backslashes all the way down.
... View more
03-08-2023
07:56 AM
Thanks for the feedback. This approach is also working correctly, no longer raises the same error when removes the double quotes from the "@y". But it wont work if you nest the macros more than 2 times.
... View more
03-07-2023
09:29 AM
It turns out that the useACK option in outputs.conf was the source of the problem. The rolling restart of the indexers doesnt wait for the ACK to be returned to the HF. So the HF will send again the data creating duplicates. If we were to keep using the ACK then we must stop the HF manually before the rolling restart and start if after it is done.
... View more
03-07-2023
09:14 AM
We managed get a workaround this issue by creating a third macro with the whole string we are passing as the argument: `args` -> | makeresults | eval arguments = tostring(floor(relative_time(_time, "@y"))) | return $arguments Now we can run he following SPL without the parsing error: | makeresults
`test_arguments2("[`args`]")`
| table arguments By using the third macro with the arguments, we avoid Splunk to parse the arguments directly and removing the double quotes.
... View more
03-03-2023
07:21 AM
We have this scenario where two nested macros using the same argument raises an error at the parsing of the second one because of the double quotes in the arguments dissapear. If we define the two macros as the following: "test_args2(1)" -> `test_args("$args$")` "test_args(1)" -> | eval arguments = $args$ And then run the following search: | makeresults
`test_arguments2("[| makeresults | eval arguments = tostring(floor(relative_time(_time, "@y"))) | return $arguments]")`
| table arguments It raises the following error: And the search log shows that after expanding the first macro then it removes the double quotations from the argument: PARSING: | makeresults \n`test_arguments2("[| makeresults | eval arguments = tostring(floor(relative_time(_time, "@y"))) | return $arguments]")`\n| table arguments
AFTER EXPANDING MACROS: | makeresults \n| eval arguments = [| makeresults | eval arguments = tostring(floor(relative_time(_time, @y))) | return $arguments]\n| table arguments It doesnt work either if we scape the doble quotes as: | makeresults
`test_arguments2("[| makeresults | eval arguments = tostring(floor(relative_time(_time, \"@y\"))) | return $arguments]")`
| table arguments Has anyone encounter a similar issue? How did you get around it or solve it?
... View more
- Tags:
- macro
Labels
- Labels:
-
other
-
search job inspector
02-13-2023
08:15 AM
Good to know, any ETA for this new version?
... View more
- Tags:
- instrumentation
02-13-2023
07:12 AM
We "solve" it fixing the conf in local so it doesnt go against the manifest. It still raises the warning but the actual search works.
... View more
02-03-2023
08:26 AM
Hi, we are having a similar issue, have you managed to solve it? We need to clean the dispatch directory in a SH clustered environment. We didnt found any best practices for the clean-dispatch command and the Splunk documentation doesnt help either. https://docs.splunk.com/Documentation/Splunk/9.0.3/Search/Dispatchdirectoryandsearchartifacts Should we run the clean-dispatch command node per node? Stop node, clean-dispatch, start node? Or should we stop the whole SH cluster, then clean-dispatch each node, and then start the nodes?
... View more
02-03-2023
08:24 AM
We need to clean the dispatch directory in a SH clustered environment. We didnt found any best practices for the clean-dispatch command and the Splunk documentation doesnt help either. https://docs.splunk.com/Documentation/Splunk/9.0.3/Search/Dispatchdirectoryandsearchartifacts Should we run the clean-dispatch command node per node? Stop node, clean-dispatch, start node? Or should we stop the whole SH cluster, then clean-dispatch each node, and then start the nodes?
... View more
02-03-2023
08:23 AM
We need to clean the dispatch directory in a SH clustered environment. We didnt found any best practices for the clean-dispatch command and the Splunk documentation doesnt help either. https://docs.splunk.com/Documentation/Splunk/9.0.3/Search/Dispatchdirectoryandsearchartifacts Should we run the clean-dispatch command node per node? Stop node, clean-dispatch, start node? Or should we stop the whole SH cluster, then clean-dispatch each node, and then start the nodes?
... View more
01-20-2023
05:52 AM
We got lots of inputs, we can try to remake them, but its going to take time. This is the last thing we are trying. We found that the cron expression validation changed between versions: '1/10 * * * *' was a valid expression in 3.7, now its no longer valid. We have to do '1-59/10 * * * *'. Also we have to disable and then enable the input for it to start working again, changing the cron is not enough.
... View more
01-20-2023
05:15 AM
We already saw that documentation, and we didnt try to migrate that way because it doesnt match our context. We are already on 3.7 and that document is for an upgrade from 2.x to 3. And we were using DB Connect 3 for a long time without problems, this just happened recently when updating to the latest version, from 3.7.0. Might check what the upgrade scripts do, and see if they help us in any way. Thanks.
... View more
01-19-2023
10:55 AM
1 Karma
Splunk Enterprise 9.0.1. We upgrade DB Connect from 3.7.0. to 3.11.1 and we started to notice that some inputs were not working. Also on _internal we found an event that lists inputs that require migration. INFO c.s.d.s.m.s.DbInputToModularInputInstanceMigrator - DB Inputs requiring migration: [...] The actual documentation doesnt say anything about this migration. https://docs.splunk.com/Documentation/DBX/3.11.1/DeployDBX/MigratefromDBConnectv1 Is there any other documentation on how to migrate to the latest version? UPDATE: We found that the cron expression validation changed between versions: '1/10 * * * *' was a valid expression in 3.7, now its no longer valid. We have to do '1-59/10 * * * *'. Also we have to disable and then enable the input for it to start working again, changing the cron is not enough.
... View more
- Tags:
- DB Connect
Labels
- Labels:
-
administration
-
upgrade
01-18-2023
11:03 AM
Splunk Enterprise OnPrem 9.0.1. We are troubleshooting an issue where some alerts are beign triggered incorrectly, and found a correlation between this odd triggers and _internal events with sourcetype = splunkd_remote_searches. The events are described as: 01-18-2023 14:03:00.178 -0300 INFO StreamedSearch - Streamed search connection closed: search_id=remote_<node>_subsearch_searchparsetmp_ ... What does searchparsetmp mean in the context of the subsearch? Also whats is the difference with remote_<node>_subsearch_scheduler_ ... also describing similar events on _internal?
... View more
Labels
- Labels:
-
search performance
-
splunkd
01-13-2023
05:13 AM
I guess we got something wrong with the SH cluster, it is not scheduling the searches evenly across the nodes. And the one with the highest count is not even the captain. Thanks again for the reply, we ll open a support case and try to troubleshoot this issue.
... View more
01-12-2023
09:13 AM
Thanks for the reply. Very helpful, but i still cant clearly understand what the number 46 means. Are the 46 concurrent historical searches that shows this panel scheduled and running at this moment? Or are they currently scheduled to run at another time (not running)?
... View more
01-12-2023
07:46 AM
We are trying to troubleshoot some memory consumption issues with one of the SH cluster nodes. We found that this instance shows high concurrency of scheduled reports 46/15 historical while the other nodes are way below this number. Also in the running historical scheduled reports panel we got a column Mode that shows "historical" as value. What does a "historical" report mean in this context? The Splunk documentation for DMC doesnt explain it. https://docs.splunk.com/Documentation/Splunk/9.0.3/DMC/Scheduleractivity Regards.
... View more
Labels
01-04-2023
08:19 AM
Thanks for the reply. The thing is that the HeavyForwarder that contains DB Connect is always online during the rolling restart of the indexers, so unless its using the KV Store of the indexers it shouldnt be unavailable. It might use the KV Store of the indexers for something else but we dont know. We are going to try to stop the HF before the rolling restart of the indexer and then start it after it finishes.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-10-2023
10:23 AM
|
Karma given to
