About whitecat001

whitecat001

I made my configuration for inputs.conf to ingest data into splunk but not getting data, during my investigation to check if there is any issue i realize the configured source is not showing any data and i cant see the source path in the index in splunk. Is there a reason why am not seeing the source after configuring the inputs.conf

whitecat001

Hello Can i get a regex that matches with this; permission=Permission12345. I have tried to bring up one but its not working. Thanks in advance

whitecat001

Thanks for the reply, thats what i thought but am not seeing any configuration in the app.conf file under the app folder. Do i need to add those config myself or find another way to go about it

whitecat001

Hello I tried to change a Custom App name (e.g BRB_App to CAA_App) on the Deployer through the Cli but i realize that the name change only affects the Folder name not the name of the App when i checked the UI. Is there a way to effect that change to affect the Name of the custom App and not just the folder name

whitecat001 · ‎03-25-2024

How do you copy a knowledge object from one app to another in Splunk

whitecat001 · ‎03-23-2024

I want a sample query that will guide in creating one for both TA and Kvstore

whitecat001 · ‎03-22-2024

What i mean is i want to create a query to output kvstore error and splunk Ta errors

whitecat001 · ‎03-21-2024

Is there a way to create a Splunk query to show the errors from splunk TA and kv store.

whitecat001 · ‎03-20-2024

Is there a way to create a query to show the errors from splunk TA and kv store

whitecat001 · ‎03-20-2024

Thanks for the reply but will prefer checking through the cli, maybe like a command to achieve that

whitecat001 · ‎03-19-2024

1. Pls whats the best way to monitor kvstore? 2. What is the best way to monitor errors from kvstore migration

whitecat001 · ‎03-15-2024

Hello, There was a user name that was changed and want to transfer ownership of splunk knowledge Object (Alerts) to her new account name . I will like to achieve this through the cli and also the user changed her name and will want the new name to be applied to the knowledge object Pls how will i go about effecting this change.

whitecat001 · ‎03-15-2024

Thanks for the quick response but i will like to achieve this through the cli and also the user changed her name and will want the new name to be applied to the knowledge object

whitecat001 · ‎03-15-2024

Hello, There was a user name that was changed and want to transfer ownership of splunk knowledge Object (Alerts) to her new account name . Pls how will i go about effecting this change

whitecat001 · ‎03-02-2024

Is there anything i can do to make the error go away?

whitecat001 · ‎03-01-2024

Hello I am getting this warning and the sample data looks like this 02-22-2012 17:01:12.280 +0000 WARN DateParserVerbose - A possible timestamp match (Wed Feb 22 17:01:12 2012) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context="source::/var/opt/jira/log/atlassian-jira-security.log|host::syn|atlassian_jira|remoteport::47375"

whitecat001 · ‎02-29-2024

The first event that came in doesnt have a timestamp which is the reason for the error but the other events are extracted properly

whitecat001 · ‎02-29-2024

Am getting a warning of DateParserVerbose - Accepted time (Wed Feb 14 17:01:12 2024) is suspiciously far away from previous event (Thu jan 18 17:01:12 2024) is still acceptable because it was extracted by the same pattern Is there any configuration that can help take this error away in splunk

whitecat001 · ‎02-25-2024

Thank you for your response. I will check it out

whitecat001 · ‎02-22-2024

What i mean by backend is through the CLI

whitecat001 · ‎02-22-2024

Am trying to provide limited access to a dashboard and am trying to do that through the backend

whitecat001 · ‎02-22-2024

Hello, How do i provide access to a limited email address on a dashboard through the backend

Posts	22
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎02-14-2024

Online Status	Offline
Date Last Visited	Thursday

Indexed Data

REGEX

Apps

Copy a Knowledge Object

Errors

Query

KVstore

Knowledge Object

Knowledge Object

Troubleshooting

Indexed Data

REGEX

Re: Apps

Apps

Copy a Knowledge Object

Re: Errors

Re: Errors

Errors

Query

Re: KVstore

KVstore

Knowledge Object

Re: Knowledge Object

Knowledge Object

Re: Troubleshooting

Troubleshooting

Re: Troubleshooting.

troubleshooting.

Re: Limited Dashboard Access

Re: Limited Dashboard Access

Re: Limited Dashboard Access

Limited Dashboard Access