Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About splunkmarroko
splunkmarroko
Engager
Member since:
02-25-2022
04-25-2025
Community Statistics
| Posts | 17 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 1 |
| Member Since | 02-25-2022 |
Activity Feed
- Posted Re: How to add dark theme compatibility to custom app? on Splunk Search. 04-25-2025 07:37 AM
- Posted Re: Can Splunk read a CSV file and automatically upload it as a lookup? on Splunk Enterprise Security. 04-25-2025 04:41 AM
- Posted Re: Step by Step to upgrade Splunk? on Deployment Architecture. 04-25-2025 04:31 AM
- Posted Re: Best approach to integrate Jira with Splunk for KPI visualization on Dashboards & Visualizations. 04-25-2025 04:21 AM
- Posted Re: Query that checks if field values have changed to exclude events on Splunk Search. 04-11-2025 04:38 AM
- Posted Re: Splunk App for Salesforce, is it compatible with Splunk Cloud on Splunk Cloud Platform. 04-03-2025 10:16 AM
- Posted Re: Notification when a new update is released on Splunk Enterprise. 04-03-2025 09:57 AM
- Karma Re: How to upgrade the universal forwarder agents in linux from 7.3.0 to latest version. for isoutamo. 04-03-2025 09:26 AM
- Posted Re: Splunk UF WinEventlog Security Event data missing on Splunk Enterprise. 04-03-2025 09:23 AM
- Posted Re: How to upgrade the universal forwarder agents in linux from 7.3.0 to latest version. on Splunk Enterprise. 04-03-2025 09:15 AM
- Posted Re: query to check fixup , SF, RF and data is searchable in splunk on Deployment Architecture. 04-03-2025 09:00 AM
- Posted Why does search to list all missing /non reporting agents instead lists all hosts? on Monitoring Splunk. 04-04-2022 12:42 PM
- Posted Re: absence fichir authorize.conf dans le dossier splunk app windows infrastrcture on All Apps and Add-ons. 02-27-2022 05:20 AM
- Posted Running into an error message while trying to connect indexers to SH on Deployment Architecture. 02-26-2022 02:37 PM
- Posted Re: absence fichir authorize.conf dans le dossier splunk app windows infrastrcture on All Apps and Add-ons. 02-25-2022 07:42 AM
- Posted Re: absence fichir authorize.conf dans le dossier splunk app windows infrastrcture on All Apps and Add-ons. 02-25-2022 07:18 AM
- Posted Re: absence fichir authorize.conf dans le dossier splunk app windows infrastrcture on All Apps and Add-ons. 02-25-2022 06:20 AM
Topics I've Started
04-25-2025
07:37 AM
try this: on the app.conf file add below stanza: [ui] is_visible = true show_app_dark_theme = true
... View more
04-25-2025
04:41 AM
Splunk UF can read a CSV file but cannot as lookup. UF recognize it as regular log file. and no splunk does not automatically upload it as lookup. you might consider using splunk UF to monitor the CSV file. create a monitoring stanza: [monitor://path...] sourcetype= index= and then set the props.conf on the indexer with this setting: [theCSVfile] INDEXED_EXTRACTION=csv
... View more
04-25-2025
04:31 AM
hello, first and formost, always start with creating a backup: 1- create a backup of $SPLUNK_HOME/etc of every single splunk server you have 2- start with stand alone servers and move on to clusters 3- grab wget command from splunk.com 4- if you choose to use rpm, - stop splunk : /opt/splunk/bin/splunk stop - run: rpm -U splunk_package.... 5-start splunk: /opt/splunk/bin/splunk start --accept-license 6- check if everything went well: tail -f /opt/splunk/var/log/splunk/splunkd.log
... View more
04-25-2025
04:21 AM
hello, it looks like both add-ons are archived. Consider creating a script if not, http event collector HEC will be your best bet. as far as I know Jira support HEC.
... View more
04-11-2025
04:38 AM
try this: base search ``` index=xyz sourcetype=abc``` | where status!=resolved ```if you already have the "resolved field", if not consider extracting that field.
... View more
04-03-2025
10:16 AM
this app is compatible with Splunk enterprise NOT splunk cloud. You will have to open a case with splun and ask if it can be vetted or check github.com if there any.
... View more
04-03-2025
09:57 AM
hello @Knust : try this query: |rest services/server/info |eval new_version = "9.4.0" ```replace it with the version you're upgrading to``` |eval current_version = version |eval old_version = if(new_version > current_version, "yes", "no") |table current_version new_version old_version on the table: if the old_version column says yes, you need to upgrade if it says no no need you can also rename the the way you would prefer by using | rename command please let me know if this helps.
... View more
04-03-2025
09:23 AM
hello @rukshar , the stanza looks good, make sure it is placed in the right location: either: /opt/splunkforwarder/etc/system/local or : /opt/splunkforwarder/etc/apps/<yourapp>/local also double check you have an outputs.conf , also a quick restart won't hurt.
... View more
04-03-2025
09:15 AM
I believe it's do-able just make sure : to go over few prerequisite things: 1 to check compatibility: refer to splunk documentation for more info about compatibility and update ways. 2- to check system requirements: ensure that your system meets the requiment for splunk 9.4 or whatever version you're upgrading to. 3- and most importantly DON'T forget to take a backup of your /etc in case something goes wrong.
... View more
04-03-2025
09:00 AM
try this: | rest/services/data/indexes | table title searchFactor replicationFactor and to check if data is searchable : |metadata type=source |search source IN(your_datasource)
... View more
04-04-2022
12:42 PM
the below search is for an alert, it is supposed to list all missing / non reporting agents. when I run it it lists all hosts ? can anyone help fix the search please below. greatly appreciated.
index=indexname sourcetype="sourcetypename" | bin _time span=4d | eval days_since = floor((now()-lastSeen)/86400) | stats latest(lastSeen) as lastSeen , values(days_since) as days_since by host | search days_since>4 | eval lastSeen=strftime(lastSeen, "%Y-%m-%d %H:%M:%S")
... View more
Labels
02-27-2022
05:20 AM
may be you should give more information about your environment. why do you need authorize.conf?
... View more
02-26-2022
02:37 PM
Hello splunkers, while trying to build splunk environment for the first time . I came across the above error message while trying to connect the 2 indexers to the SH. I also tried to run: ./splunk add search-server <ipaddress>:8089 -auth admin:password -remoteUsername admin -remotePassword password. yet running to the same error message: An error occurred: Error while sending public key to search peer: Connect Timeout root@spunk-sh:/opt/splunk/bin# someone please help me set the environment . thank you
... View more
Labels
- Labels:
-
distributed search
02-25-2022
07:42 AM
before you so , are you admin? if not , you can't create such config files
... View more
02-25-2022
07:18 AM
you have to run the above command from backend (ssh) make sure you can ssh, otherwise use UI program files and manually look for authorize.conf if it's not there you have to create a new configuration file and use the right stanza, check the below link: https://docs.splunk.com/Documentation/ITSI/4.12.0/Configure/authorize.conf
... View more
02-25-2022
06:20 AM
par défaut l'emplacement est : $SPLUNK_HOME/etc/system/default
si vous ne le trouvez pas, vérifiez le dossier local
si ce n'est pas le cas, exécutez ceci : splunk btool authorize list --debug |grep authorize.conf
... View more
