Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About carmackd
carmackd
Communicator
Member since:
04-26-2010
06-05-2020
Community Statistics
| Posts | 78 |
| Solutions | 5 |
| Karma Given | 34 |
| Karma Received | 58 |
| Member Since | 04-26-2010 |
Activity Feed
- Karma Re: An instance of fill_summary_index is already running for app=search for MarioM. 06-05-2020 12:46 AM
- Karma Re: role creation with very specific capabilities for gkanapathy. 06-05-2020 12:46 AM
- Karma Re: Anyone else seeing clients not restarting after a deployment server push? for yannK. 06-05-2020 12:46 AM
- Karma Anyone else seeing clients not restarting after a deployment server push? for imacdonald2. 06-05-2020 12:46 AM
- Karma Re: UDP Syslog input, current timestamp changes to a year in the past. for cbdick. 06-05-2020 12:46 AM
- Karma Re: Export limit in 5.x for Ron_Naken. 06-05-2020 12:46 AM
- Karma SyntaxError: JSON.parse: unexpected character with Sampledata.zip from tutorial for marcogallotta. 06-05-2020 12:46 AM
- Karma Re: Missing Windows Event Logs? for jsb22. 06-05-2020 12:46 AM
- Karma Re: Splunk 6 dropdown menu - decrease width for kensternberg. 06-05-2020 12:46 AM
- Got Karma for Re: Splunk 6 dropdown menu - decrease width. 06-05-2020 12:46 AM
- Got Karma for Re: Cannot delete, move, or clone Saved Searches after upgrade to 5.0. 06-05-2020 12:46 AM
- Got Karma for Re: Cannot delete, move, or clone Saved Searches after upgrade to 5.0. 06-05-2020 12:46 AM
- Got Karma for Re: Cannot delete, move, or clone Saved Searches after upgrade to 5.0. 06-05-2020 12:46 AM
- Got Karma for summarize directories in dispatch?. 06-05-2020 12:46 AM
- Got Karma for summarize directories in dispatch?. 06-05-2020 12:46 AM
- Got Karma for role creation with very specific capabilities. 06-05-2020 12:46 AM
- Got Karma for summarize directories in dispatch?. 06-05-2020 12:46 AM
- Got Karma for multivalued OUTPUT field for my automatic lookup. 06-05-2020 12:46 AM
- Got Karma for multivalued OUTPUT field for my automatic lookup. 06-05-2020 12:46 AM
- Got Karma for Re: time difference issues. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 2 | |||
| 0 | |||
| 3 | |||
| 1 | |||
| 4 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 1 |
11-25-2015
03:08 PM
If I understand correctly, this should work.
| inputlookup awback.csv | rename "LAN MAC Address" AS Mac | append [|inputlookup actback.csv | rename "MAC Adress" AS Mac ] | stats values(*) AS ** by Mac
Supposed to be a single astrik
... View more
11-25-2015
02:08 PM
... | eval is_notible_event=if(condition,"t",NULL) | transaction some_field | where isnull(is_notable_event)
... View more
10-13-2014
02:35 PM
Can access control be applied to the ldap connections? We have multiple AD teams, each with the need for segregated access.
... View more
12-06-2013
11:47 AM
1 Karma
excellent! this worked. thx!!
... View more
12-06-2013
06:55 AM
2 Karma
I'm trying to decrease the width of my drop down menus on a form I'm creating. According to the web framework documentation, I can adjust this using the width property for the DropdownInput object after converting my dashboard to HTML.
http://docs.splunk.com/Documentation/WebFramework
However, after doing so it seems I can only increase the width, not decrease below default of 200. Is this expected behavior? Is there another way I can decrease the size of width?
CSS works for text boxes:
#field1 input {width:150px;}
but not for the select HTML tag
#field2 select {width:150px;}
... View more
12-04-2013
10:33 AM
I'm creating a form and need to change the text displayed in the search button from "search" to "update", is this possible?
thanks!
... View more
11-04-2013
07:52 AM
3 Karma
another option is to simply go into the savedsearches.conf for the search in question and delete the vsid attribute.
... View more
07-03-2013
05:19 AM
3 Karma
This morning I woke up to a "too many jobs in dispatch directory" message across my screen. After checking dispatch, I noticed over half were these summarize directories. We recently upgraded to Splunk5.0.3, are these something new in that release, and if so, what are they?
... View more
- Tags:
- dispatch
- summarized
06-10-2013
12:14 PM
You could set 0 limit on series for timechart
limit
Syntax: limit=
Description: Specify a limit for series filtering; limit=0 means no filtering. By default, setting limit=N would filter the top N values based on the sum of each series.
but if you're aggregating over many, horizontal scrolling becomes an issue 🙂
... View more
06-05-2013
04:54 PM
Do the same user role exist on the VM search head that exist on your indexer/search head? Check your splunkd log on the VM search head for unknown role errors.
... View more
06-05-2013
04:44 PM
I'm sure you can optimize your regex to match multiple criteria. Can you provide examples of the events you're trying to filter?
... View more
02-22-2013
01:42 PM
2 Karma
| convert timeformat="%m/%e/%Y %I:%M:%S %p" mktime(StartTime) AS StartTime_epoch mktime(ResolvedTime) AS ResolvedTime_epoch | eval age=round((ResolvedTime_epoch-StartTime_epoch)/60/60/24)
... View more
09-06-2012
07:42 AM
1 Karma
Is it possible to create a role that will allow a user to execute saved searches only through the REST API? The user should not be able to log into the GUI and should not be able to run ad hoc queries, only execute saved searches.
Many Thanks,
... View more
- Tags:
- roles
08-30-2012
12:13 PM
I know this is a bit late, but I found this post interesting and felt I could add something to the topic by sharing how we do things.
We removed the search scheduling capability from the default user role and created a new role called "schedule_search". If needed, a user can request the schedule_search role, but is only granted if the user has previously taken our in-house Splunk training course. Like the posters method, we also allow users to submit their searches for review and we (admin's) schedule if deemed efficient enough, or will tweak until so. We also have a few daily scheduled searches to monitor any user schedule search that runs too often or for too long. If they should show up on this report, we investigate and make the appropriate changes, if needed.
This method works pretty well for us.
Thx
... View more
07-25-2012
10:34 AM
2 Karma
upload the host list as a lookup file (save as .csv) host column header named hostname
run this search
sourcetype=<my_sourcetype_name_here> NOT [|inputlookup <lookup_name_here>.csv | fields hostname]
... View more
07-25-2012
06:31 AM
4 Karma
I have a user who cannot export a csv from the GUI after running an ad-hoc query. Results are only around 600 rows. In chrome the page returns an error loading (and dies), in IE it attemps to download a file name with a very long/URL-ish looking name - file fails to download.
I'm seeing the following error message in splunkd.
07-24-2012 12:56:39.110 +0000 ERROR DispatchSearch - blockingWrite() failed while exporting csv output
Anyone have any clue to what could be going on, or what the blockingWrite() method is doing?
thanks,
... View more
- Tags:
- csv
04-20-2012
12:41 PM
You can simply ignore the binary check as well using the following props attribute.
#******************************************************************************
# Binary file configuration
#******************************************************************************
NO_BINARY_CHECK = [true|false]
* When set to true, Splunk processes binary files.
* Can only be used on the basis of [<sourcetype>], or [source::<source>], not [host::<host>].
* Defaults to false (binary files are ignored).
... View more
04-18-2012
06:37 AM
Sanity check -- Have you configured any log monitors in inputs.conf on the forwarder?
However, by default the forwarder will send its internal logs (splunkd etc.) so you should be able to search those on the indexer if you have properly configured the necessary. From the indexer query the following:
index=_internal sourcetype=fwdinfo
If you return results then you know the connection between the two instances are good.
... View more
04-18-2012
05:32 AM
6 Karma
you can use the convert command to turn your fldTimeStamp field into epoch time then subtract it from your now() eval. example
| convert timeformat="%Y %D" mktime(fldTimeStamp) AS epoch_fldTimeStamp | eval fldNow=now() | eval age=fldNow-epoch_fldTimeStamp | where age < 1800
NOTE: use this link to get the correct time directives for your timeformat
http://www.tutorialspoint.com/python/time_strptime.htm
... View more
04-17-2012
10:10 AM
When the behavior you're seeing occurs, can you return results by searching?
sourcetype=
I know you said you could by searching the sourcetype alone, but if you include the IP you're looking for, can you return results?
Do you ever experience problems with your search peers dropping off?
In your query are you searching the IP using a key valued pair i.e. field= , or simply searching for the IP as a string in the raw event data?
... View more
04-17-2012
09:08 AM
By broad search do you mean over "All time"?
If you're searching 6 hours later, its very possible there simply are no cisco asa events for the "new" time period you are searching over. For example, searching over the last 24 hours and doing it again 6 hours later will exclude 6 hours of results on the back end of your original search results, while adding 6 new hours of results on the front end.
... View more
04-17-2012
08:49 AM
1 Karma
Sanity check --- I know you said you created a reporting app, but did you create a reporting index as as well?
Also, what are the splunkd logs from the forwarder saying about the file monitors? If you can search, run the following, if not, look in the raw splunkd file for the two components in the query below.
host=<forwarder host> sourcetype=splunkd (component="TailingProcessor" OR component="WatchedFile")
... View more
04-17-2012
08:37 AM
1 Karma
Check the login.html file in $SPLUNK_HOME/share/splunk/search_mrsparkle/templates/account/ and make sure it is current with the Splunk version you're running. I had the same problem and saw differences between the login.html page that was in that directory and the one that was supposed to install during my upgrade to 4.3.1.
Old login.html page contain the following, while the latest did not:
#some code here#
var s = $.cookie('${cherrypy.config['tools.sessions.name']}');
#some code here#
else if (!s) {
$('.error').hide();
$('#jserror').text(_('Login will fail due to a significant clock differences between the server and this machine')).show();
}
After updating the file with the latest, the error message went away.
... View more
04-03-2012
08:18 AM
Since the Windows Event Viewer archives and generates a new log at 20MB (its maximum capacity), is there a risk that the Windows monitor would fail to consume an event if the events are being generated at a very quick pace? In other words, the creation of windows event logs is outpacing the Splunk monitor. For example, say your Windows server is generated X kb of Windows Security Events per second, but the splunk monitor can only consume X - 1 kb events per second, by the time the log hits 20MB and is archived, the splunk monitor has failed to consume all 20MB, so in theory I am missing some events. Is this a possibility?
... View more
03-15-2012
07:02 AM
Not exactly. My problem is I have a multivalued matching field (key in ex above) and I need to return all matching output, which will also make the output field multivalued. The behavior I'm seeing with the multivalued matching field is that it applies the first multivalued matching field to the lookup and skips the remaining.
Example: I have two keys (key=1 & key=2 example above) in an event that retrieves resultX using an automatic lookup. However the automatic lookup only returns the first match (aaa) when I need it to return (aaa & ccc) in a multivalued output field.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:02 AM
|
