Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About super_saiyan
super_saiyan
Communicator
Member since:
03-31-2022
06-08-2023
Community Statistics
| Posts | 73 |
| Solutions | 0 |
| Karma Given | 50 |
| Karma Received | 0 |
| Member Since | 03-31-2022 |
Activity Feed
- Posted Re: How to increase the number of results in "show source" in Splunk to 10000? on Splunk Enterprise. 06-07-2023 10:03 PM
- Posted How to increase the number of results in "show source" in Splunk to 10000? on Splunk Enterprise. 06-07-2023 03:06 AM
- Posted Splunk SPL- How to the pass the users field values to the second event if the Ids and System values match? on Splunk Enterprise. 05-03-2023 02:46 AM
- Posted Re: splunk explore data on Splunk Enterprise. 04-19-2023 12:32 AM
- Tagged Re: splunk explore data on Splunk Enterprise. 04-19-2023 12:32 AM
- Karma Re: splunk explore data for gcusello. 04-19-2023 12:30 AM
- Posted Re: splunk explore data on Splunk Enterprise. 04-18-2023 11:54 AM
- Karma Re: UF parsing capability for scelikok. 02-16-2023 01:35 AM
- Posted Re: Receiving an error while using the mvexpand command (does not exist in the data) on Getting Data In. 11-25-2022 02:19 AM
- Posted Re: Receiving an error while using the mvexpand command (does not exist in the data) on Getting Data In. 11-25-2022 01:45 AM
- Posted Re: getting an error while using the mvexpand command (does not exist in the data) on Getting Data In. 11-21-2022 10:53 PM
- Posted Receiving an error while using the mvexpand command (does not exist in the data) on Getting Data In. 11-21-2022 10:09 PM
- Karma Re: How to manipulate field values in raw log for ITWhisperer. 10-17-2022 08:06 AM
- Karma Re: How to manipulate field values in raw log for richgalloway. 10-17-2022 08:06 AM
- Posted How to manipulate field values in raw log? on Splunk Enterprise. 10-17-2022 06:09 AM
- Posted Is it possible to use WMI to collect windows event logs from different windows server instead of splunk forwarder? on Splunk Enterprise. 10-12-2022 08:44 AM
- Posted Re: Include two index events without using JOIN command on Splunk Enterprise. 10-07-2022 07:32 AM
- Posted Re: Include two index events without using JOIN command on Splunk Enterprise. 10-07-2022 07:24 AM
- Karma Re: Include two index events without using JOIN command for kamlesh_vaghela. 10-07-2022 07:16 AM
- Posted How to include two index events without using JOIN command? on Splunk Enterprise. 10-07-2022 07:01 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-07-2023
10:03 PM
any help ?
... View more
06-07-2023
03:06 AM
How do i increase the Number of results in "show source" in Splunk to 10000. Now the maximum limit is 1000. Please refer to the screen print.
... View more
Labels
- Labels:
-
configuration
05-03-2023
02:46 AM
URGENT
In the above screen print i have fields called Ids and System. In the 3rd event Ids represent the username and the 2nd event Ids value is equal to the System value.
I want to the pass the users field values to the second event if the Ids and System values match. How can i do it ?
Thanks in advance.
... View more
Labels
- Labels:
-
development
-
troubleshooting
04-19-2023
12:32 AM
Thanks for the response. I find it very very strange that there is no Splunk official documents available for this feature. @gcusello
... View more
- Tags:
- t's
11-25-2022
02:19 AM
Hi, I have shared the logs with you in DM
... View more
11-21-2022
10:53 PM
Thanks much @kamlesh_vaghela I have shared the logs in DM, please check
... View more
11-21-2022
10:09 PM
Hi everyone, currently, i am trying to expand one of the multiple field values but i am getting the result with the below error. Field 'deployment' does not exist in the data. index=json |rex mode=sed "s/.*-\s//g" |spath |rename ops{}.steps{}.steps{}.address{}.deployment as deployment |mvexpand deployment |mvexpand operation |table deployment
... View more
Labels
- Labels:
-
data
10-17-2022
06:09 AM
How do i replace the Hyphen with dot.
For example i have a field call IP and the value are 10-20-11-120 but i want to convert this to 10.20.11.120.
I have tried the | rex mode=sed but it's only replacing the first hyphen with dot. Please refer to my below SPL
SPL
| makeresults | eval IP="10-20-11-120" | rex mode=sed field=IP "s/-/./"
... View more
Labels
- Labels:
-
configuration
10-12-2022
08:44 AM
Hi everyone,
New splunker here. I want to use WMI to collect windows event logs from different windows server instead of splunk forwarder.
is it doable ?
if yes, please provide steps how to collect logs remotely and send it to splunk ?
What pull method do i need to use from splunk UI OR do i need to use Push method?
... View more
Labels
- Labels:
-
configuration
-
installation
10-07-2022
07:32 AM
But there is only one problem. I am getting multiple comments values in a single table events. Can we segregate that as well ? @kamlesh_vaghela
... View more
10-07-2022
07:24 AM
Are you a magician? Because your magic spell(SPL) actually worked without giving any errors. Thanks much
... View more
10-07-2022
07:01 AM
Hi Splunkers, There is one field is common in 2 indexes. Using that field how can i co-relate and make a table out of it without using JOIN, Append & Appendpipe command ? Because those command will take a lot of time and Please refer to the below pictures Thanks & regards
... View more
Labels
- Labels:
-
troubleshooting
09-15-2022
09:40 PM
Hi @richgalloway Many thanks for your quick response. Below is my props.conf TIME_PREFIX = (Sun|Mon|Tue|Wed|Thu|Fri|Sat)\s TIME_FORMAT = %b %d %H:%M NO_BINARY_CHECK = true SHOULD_LINEMERGE = false
... View more
09-15-2022
06:40 AM
I've deployed below props to extract the time splunk. There are WARN messages in splunkd logs as follows DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (12) characters of event. Defaulting to timestamp of previous event.
please refer to the below log
Hounsaya add_user 4 Thu Sep 15 10:09 - 26:39 (60+00:47)
Can you please help and let me know if i need to make any changes?
... View more
Labels
- Labels:
-
configuration
-
troubleshooting
08-23-2022
06:27 AM
Every time i run a specific SPL query( can not reveal due to some security process ).
I am getting the below error.
Currently displaying the recent 1000 events in the select range .Select a narrow range or zoom in to see more events.
Please help me resolve this issue.
Please provide splunk documentation if any.
... View more
Labels
- Labels:
-
troubleshooting
08-18-2022
05:27 AM
Hello Splunkers,
How to check when splunk's automatic processing has been executed ?
for example:-
1.scheduled processing
2.real-time processing
... View more
Labels
- Labels:
-
configuration
-
installation
08-14-2022
11:58 PM
While using the mvexpand command, i am getting the below error.
ERROR -
command.mvexpand: output will be truncated at 1000 results due to excessive memory usage. Memory threshold of 500 MB as configured in limits.conf /[mvexpand]/max_mem_usage_mb has been reached.
Question 1- How can i resolve the above error ?
Question 2 - Is there any other alternative command of mvexpand ?
... View more
Labels
- Labels:
-
using Splunk Enterprise
07-28-2022
11:14 PM
Thanks for your quick response @somesoni2 could you please also provide the spl using "isnull" ? Really appreciate your support.
... View more
07-28-2022
11:11 PM
I am getting error while using the below SPL Query Could you please help me with that ? appreciate your help.
... View more
07-28-2022
07:25 AM
Hi splunkers,
I want to use "null" command in below query. If the message is "null" then it should replace with the below message otherwise it should only display the already extracted message.
| eval message= if(Actor="superman","super hero", if(Actor="emma watson","model"))
Thanks.
... View more
Labels
- Labels:
-
troubleshooting
07-15-2022
03:17 AM
Thank you for your quick response. could you please share some insights regarding "DailyRollingFileAppender" ?
... View more
07-15-2022
02:52 AM
is it possible to change the log rotation timing for the internal logs that Universal Forwarder and Heavy Forwarder output to the OS.
For example, splunkd.log. Currently, the logs are rotated by file size, but can we rotate on a daily basis.
is it possible ?
... View more
Labels
- Labels:
-
administration
-
configuration
07-15-2022
02:48 AM
i am not having any performance issue. i am just curious if i can optimize the performance more by doing some changes in setting in os kernal level.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-08-2023
01:24 AM
|
Karma given to
