About harryc42

harryc42 · ‎09-26-2022

Not quite the same - but my cloned boxes were not coming up in the queries - in the end had to update rev-DNS for them as the host group was defined by hostname .

harryc42 · ‎05-14-2021

TY - that worked - the Windoze box is allowed to hit splunk, but the gutted IE on it didn't work with the Splunk site.

harryc42 · ‎05-10-2021

Working on a Windoze box with limited resources - only IE and that doesn't seem to work with splunk.com . I can do wget - what is the specific URL to wget for the 8.1.3 agent for windows ? Don't want to mess with IE as that would involve security and I would rather not point out this hole until after I have the forwarder downloaded and installed.

harryc42 · ‎04-23-2021

Resolved - ty all for the pointers. This is because Peter has created an entry in props.conf to define AEMerror XTRACT-message4,AEMError = (?<message4>doPost: )(?P<AEMError>.+)\;\.* A wholesale copy of props.conf from /opt/abanet/splunk/etc/users/markosp/search/local/props.conf to /opt/abanet/splunk/etc/users/harryc/search/local/props.conf solved the problem for me (harryc). If others already have a props.conf we can probably just add the line.

harryc42 · ‎04-21-2021

The search returns hits for anyone, just the formatting of the "stats" tab does not work for anyone except the original author. What is the AEMError (the very last argument) called ? Is that a format or an additional table ?

harryc42 · ‎04-20-2021

New to this so probably a very basic question.... A user has a query that comes out with a nicely formatted statistics tab when he runs it. When another user runs the same query the statistics are blank - It appears that the last item is what generates the stats - how do we make this global or share it with the other users ? index=* ERROR host IN(AEMpub01,AEMpub02,AEMpub03, AEMpub04) | top limit=100 AEMError

Posts	6
Solutions	2
Karma Given	5
Karma Received	0
Member Since	‎04-20-2021

Online Status	Offline
Date Last Visited	‎03-15-2024 11:15 AM

wget forwarder

Search statistics format not shared

Re: Why is our new cloned server reflecting an old...

Re: wget forwarder

wget forwarder

Search statistics format not shared

Re: Search statistics format not shared

Search statistics format not shared