Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About wanling
wanling
Path Finder
Member since:
04-04-2011
06-05-2020
Community Statistics
| Posts | 31 |
| Solutions | 3 |
| Karma Given | 2 |
| Karma Received | 12 |
| Member Since | 04-04-2011 |
Activity Feed
- Got Karma for Re: Host name in WMI:LocalProcesses. 07-13-2020 10:48 AM
- Karma Re: Splunk extension for Ayn. 06-05-2020 12:46 AM
- Karma Re: Splunk extension for Damien_Dallimor. 06-05-2020 12:46 AM
- Got Karma for Re: Could not find all of the specified lookup fields in the lookup table. 06-05-2020 12:46 AM
- Got Karma for Re: Could not find all of the specified lookup fields in the lookup table. 06-05-2020 12:46 AM
- Got Karma for Re: Could not find all of the specified lookup fields in the lookup table. 06-05-2020 12:46 AM
- Got Karma for PDF report with windows indexer. 06-05-2020 12:46 AM
- Got Karma for Splunk PDF report works at "Send Test Email" but failed at scheduled runs. 06-05-2020 12:46 AM
- Got Karma for Re: Splunk PDF report works at "Send Test Email" but failed at scheduled runs. 06-05-2020 12:46 AM
- Got Karma for Re: Splunk PDF report works at "Send Test Email" but failed at scheduled runs. 06-05-2020 12:46 AM
- Got Karma for Re: Splunk PDF report works at "Send Test Email" but failed at scheduled runs. 06-05-2020 12:46 AM
- Got Karma for rebuild statistics to summary index due to network disruption. 06-05-2020 12:46 AM
- Got Karma for Scheduled PDF report on windows. 06-05-2020 12:45 AM
- Got Karma for Scheduled PDF report on windows. 06-05-2020 12:45 AM
- Posted In-page drilldown from tag cloud on Dashboards & Visualizations. 06-24-2014 02:59 AM
- Tagged In-page drilldown from tag cloud on Dashboards & Visualizations. 06-24-2014 02:59 AM
- Posted Re: user-specific configurations to scripted inputs as input arguments on Getting Data In. 04-06-2014 07:36 PM
- Posted user-specific configurations to scripted inputs as input arguments on Getting Data In. 03-28-2014 02:24 AM
- Tagged user-specific configurations to scripted inputs as input arguments on Getting Data In. 03-28-2014 02:24 AM
- Posted Re: Splunk PDF report works at "Send Test Email" but failed at scheduled runs on Reporting. 03-26-2013 11:57 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
07-31-2014
04:05 AM
You would probably have to modify tagcloud.js to customise the drilldown action. See the relevant but yet-to-be-modified code snippet below.
http://dev.splunk.com/view/SP-CAAAEME explains what preventDefault() does. Can't find much on the parameters for handleDrillDown().
events: {
'click a': function(e) {
e.preventDefault();
// Perform automatic drilldown on click on a tag
Drilldown.handleDrilldown({
name: this.settings.get('labelField'),
value: $.trim($(e.target).text())
}, 'row', this.manager);
}
},
... View more
04-06-2014
07:36 PM
Hi MuS, thanks for the suggestion. After taking a look at the webmon app, i cant help thinking that 1) how is it different from modular input? Will modular input be a even better choice? 2) why not make use of the "interval" attribute for a scripted input, instead of implementing a loop with a sleeping break in the script?
... View more
I've further findings on this issue, upon troubleshooting another report having similar problems. The PDF report is available, but "No results found" is shown for each panel. On the other hand, test run is okay.
It turned out that all the knowledge objects (macro, field extraction, events, tags etc) used in the reports must be given global permission, otherwise there will be no result returned during the scheduled run. I suppose the scheduler somehow is also subject to the access control in this case.
... View more
03-08-2013
03:10 AM
Is there a way that I can do the reverse? Display purple and read when the number is low, and blue for high values.
... View more
02-11-2016
07:45 AM
1 Karma
I come to you from the future!
All joking aside, issues such as these were places where Splunk themselves realized the limitations in summary indexing. It is a great tool for some things, but has some serious architectural gaps.
In the modern world - as of Splunk 6.0 or so - we use Data Models and Data Model acceleration in order to achieve the performance advantages of summary indexing without all of the operational downsides of summary indexing. If you are still using Splunk (this is a 4 year old unanswered post afterall) - then the docs on DMs and Acceleration will give you a hint how to proceed:
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutdatamodels
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Acceleratedatamodels
... View more
03-29-2012
10:31 PM
I've figured out it's due to the permission setting of the two macros that are used in the two reports. It was previously set to "Private", but the time-out problem did not occur again for last night's run after i changed to "App". Probably when the job is triggered by the scheduler, the macros are not visible to the credential the scheduler uses and therefore the scheduler fails to get the result. The error message is somewhat not very clear on this.
... View more
03-26-2012
11:01 PM
The problem is solved by adding "from = " to $SPLUNK/etc/system/local/alert_actions.conf file ([email] section)
... View more
02-03-2012
10:13 AM
1 Karma
Yes - You can setup Splunk on a Linux box and install the PDF app into it (after ensuring all the requirements are met to run the app on Linux as per the documentation). You can then configure your Windows Splunk server to use the Linux Splunk server to generate PDF reports as documented at http://docs.splunk.com/Documentation/Splunk/latest/Installation/ConfigurePDFprintingforSplunkWeb#Enable_PDF_printing_on_a_search_head
eg. if your Linux server's IP address is 10.1.2.3 then you would enter https://10.1.2.3:8089/ into the "Remote PDF Server URL" field on your Windows server.
That should be all that's required - You don't need to do anything further to the copy of Splunk on the Linux server as the PDF app will automatically use the Windows server to run the search and collect the data for the report.
... View more
07-15-2016
02:19 AM
Hello. i had the same problem, but this solution didn't work. ami missing something?
how about the index?
... View more
12-08-2011
03:01 AM
That looks just fine! This is good reference material: http://docs.splunk.com/Documentation/Splunk/latest/installation/capacityplanningforalargersplunkdeployment
... View more
11-26-2013
07:31 AM
The first step would be to look over your inputs.conf (on the UF) and outputs.conf (on the IF)configurations for this setup. If you could post the relative details here, we could help you troubleshoot this further.
... View more
10-31-2014
05:40 AM
Hi,
I'm aware you might not be looking for the answer to this question anymore, but for anyone else interested here's the current status:
The GeoASN app hasn't been updated in 3 years so nobody really knows if it still works in Splunk 6+
I just tested creating all the dependencies on a Linux system using the same Python versions and copying the stuff over, also tried placing them in different folders as things look like they've been moved around somewhere between Splunk 5 and 6, but could not get it to work. The lookup script returns error code 1.
It would be great if someone would update the GeoASN app or create a new Splunk 6+ compatible version.
... View more
03-25-2013
02:25 PM
I am having the same problem trying to load this as a Network Admin account: "Splunk Installer was unable to start Splunk Services - Please make sure you have provided the correct username and/or password...... Exitcode='4'
I have had success loading as a local user, but that doesn't help for my test.
... View more
06-30-2015
07:45 AM
I assume that you are talking about the app found here: https://splunkbase.splunk.com/app/314/ . According to the developer, the app is deprecated because the capability to email PDF reports is now baked into Splunk. I am running Splunk v6.2.3 on a Windows Search Head and I can select "PDF" as an email option for scheduled searches and alerts. So I guess the answer is "now"!
... View more
06-16-2011
12:24 AM
1 Karma
I've figured out what went wrong. "l3win7clone" is used in the master clone copy. After cloning, the machine name is changed but not the server name used in the splunk config file. hence, for splunk, it still uses "l3win7clone" as the host name. The huge amount of data are actually generated by many different machines that share the same server name.
... View more
04-04-2011
09:55 AM
Thanks Ayn! the timestamp can now be recognised correctly after applying the datetime format patch.
... View more
