About R15

R15 · ‎02-06-2025

This worked great. For anyone else, I verified the totals between the new and old searches just in case with | addtotals row=f col=t Thank you!

R15 · ‎02-06-2025

Refer to the tables in my original post. I'm doing a count of events per each span using tstats. So just how many events were there from 00:00-04:00, 04:00-08:00 etc. But splunk chooses that starting point of 00:00 and sometimes it's a very poor choice so I would like to be able to adjust it. So instead it would be 01:00-05:00, 05:00-09:00 etc. The methods I've found in the forum do not seem to work with tstats. As shown in my second table, the _time labels are adjusted but the values are not recalculated.

R15 · ‎02-06-2025

Does it work with tstats?

R15 · ‎02-05-2025

I'm searching for a method for general use that I can apply as needed. Currently for testing I'm using a simple tstats search counting events by ip, in spans of 4 hours. I need a way to adjust the starting point of the spans but as shown above, it's not actually shifting where it's searching the data. It's just changing the time labels in the table.

R15 · ‎02-04-2025

I've tried a few methods shared here to adjust the start/end times of span. Mainly: 1 - | eval _time=_time-3600 | bin _time span=4h | eval _time=_time+3600 2 - | timechart span=4h aligntime=@h-120m However after testing, neither of these is actually offsetting the span. It only changes the times shown in the resulting table. The values (in my case counts) in each box do not change, just the _time values. Am I doing something wrong? For example: _time A B C 1/28 00:00 2 1 2 1/28 04:00 4 2 4 1/28 08:00 6 3 6 1/28 12:00 8 4 8 1/28 16:00 10 5 10 _time A B C 1/27 22:00 2 1 2 1/28 02:00 4 2 4 1/28 06:00 6 3 6 1/28 10:00 8 4 8 1/28 14:00 10 5 10

R15 · ‎10-01-2024

This list has aged quite a bit, is it still accurate? @yannK

R15 · ‎09-17-2024

Thank you for letting me know! Unfortunately the workaround didn't fix it, hopefully the next update will.

R15 · ‎09-04-2024

Careful, the linked documentation page says not to modify that app in any way.

R15 · ‎07-30-2024

Recently upgraded to 9.2.2 and Historic License Usage panels in the Monitoring Console are now broken. The panels in License Usage - Today still work. Most answers I found had to do with the license manager not indexing or reading the usage data. But on the license manager the panels all work in Settings » Licensing » License Usage Reporting. The suggestion in this post did not apply either: https://community.splunk.com/t5/Splunk-Enterprise/Why-is-Historical-license-usage-page-showing-blank/m-p/635412

R15 · ‎07-11-2024

In case anyone else stumbles upon this thread, this solution worked for me.

R15 · ‎06-26-2024

I haven't messed with that at all, I simply have the box checked for Link to Results.

R15 · ‎06-26-2024

The search is very basic. The system is isolated so I can't copy/paste but it's just searching for one event code, action, and signature and tabling the results. There is nothing unique or unusual from other alert searches. I don't understand how anything in the search string would cause a 404 error.

R15 · ‎06-26-2024

Can you elaborate on that? The search works fine on its own, and if the search was bad why would that cause the web page to not load?

R15 · ‎06-25-2024

One of my alerts is having an issue with the email link to the results not working. I'm the admin, so I don't think it's a permissions issue. Other alerts from the same app are working fine. Any ideas?

R15 · ‎06-25-2024

I would consult the Nessus forums.

R15 · ‎06-06-2024

I posted a workaround if you're still having this issue.

R15 · ‎06-06-2024

After setting this aside until we finally upgraded splunk, a solution has been found. Working with splunk support for weeks, we were not able to fix it directly and concluded that the errors are due to splunk trying to read the files before they are done being written by our diode software. The files are transferred once every 24 hours, so I created a script run by a scheduled task that copies the files to a different set of folders and set up batch inputs to read then delete the copies. All logs come through without any extra junk. Thanks for your help! @yeahnah @isoutamo

R15 · ‎03-26-2024

Neither are working for me. Their search gives an unwieldy table with 100+ columns, yours has only blanks for avg and max. Splunk 9.1.2

R15 · ‎02-22-2024

We upgraded splunk then the app to 1.4.6, but kept getting the same errors. The solution was rather silly. It couldn't run python3.exe because the python installer named it python312.exe... renamed and the app started working.

R15 · ‎11-29-2023

No, I don't believe so.

R15 · ‎11-28-2023

What version of splunk are you running? We're still on 8, but upgrading to 9 soon™.

R15 · ‎11-15-2023

@LukeMurphey I'm trying to run the File/Directory Information Input app (v1.4.5) on a universal forwarder. It's a windows server and I've installed the latest version of python 3 (and set the app to use 3). I keep getting the same 3 errors in splunkd (copied from another post as my system is isolated): "09-18-2019 10:47:10.099 +0200 ERROR ModularInputs - Introspecting scheme=file_meta_data: Unable to run "python "C:\Program Files\SplunkUniversalForwarder\etc\apps\file_meta_data\bin\file_meta_data.py" --scheme": child failed to start: The system cannot find the file specified. 09-18-2019 10:47:10.356 +0200 WARN UserManagerPro - Can't find [distributedSearch] stanza in distsearch.conf, using default authtoken HTTP timeouts 09-18-2019 10:47:10.356 +0200 ERROR ModularInputs - Unable to initialize modular input "file_meta_data" defined in the app "file_meta_data": Introspecting scheme=file_meta_data: Unable to run "python "C:\Program Files\SplunkUniversalForwarder\etc\apps\file_meta_data\bin\file_meta_data.py" --scheme": child failed to start: The system cannot find the file specified.." (Except it says Python3.exe instead of python). Other posts with these errors did not have python installed, or one said their path environment variable was incorrect but didn't elaborate. My path is set with the 2 default values from the installer if that matters.

R15 · ‎11-01-2023

@isoutamo @inventsekar We'll be upgrading soon but until then I'm stuck.

R15 · ‎10-31-2023

@inventsekar apparently avg is not an eval function in my version of splunk. It's available with other things like chart and stats, but not eval. Something like this works however: ... | chart eval(avg(bytes) ...

R15 · ‎10-31-2023

There is no other portion, running the same search as in your screenshot I get the error.

Posts	38
Solutions	3
Karma Given	280
Karma Received	1
Member Since	‎12-14-2022

Online Status	Offline
Date Last Visited	‎04-09-2025 12:49 PM

How to change span alignment

MC Historic License Usage Broken

View results email link leads to 404 Not Found

File/Directory Information Input app help

The avg function is unsupported or undefined

How to get events for .csv headers?

Splunk Upgrade Requirement Clarification

Upgrade Requirement Clarification

Re: How to change span alignment

Re: How to change span alignment

Re: How to change span alignment

Re: How to change span alignment

How to change span alignment

Re: How to reindex data from a forwarder

Re: MC Historic License Usage Broken

Re: The Client forwarder management not showing th...

MC Historic License Usage Broken

Re: Indexer Discovery Error (IndexerDiscoveryHeart...

Re: View results email link leads to 404 Not Found

Re: View results email link leads to 404 Not Found

Re: View results email link leads to 404 Not Found

View results email link leads to 404 Not Found

Re: Nessus scan

Re: How to get events for .csv headers?

Re: Getting events for .csv headers

Re: Search lag error

Re: File/Directory Information Input app help

Re: How to get events for .csv headers?

Re: How to get events for .csv headers?

File/Directory Information Input app help

Re: The avg function is unsupported or undefined

Re: The avg function is unsupported or undefined

Re: The avg function is unsupported or undefined

Are you a member of the Splunk Community?