About carmackd

AnilPujar · ‎02-03-2022

does this works for splunk 8.2.0 version?

woodcock · ‎11-27-2015

That was my point: for the purposes of your question, DLQ is irrelevant. My answer should suffice as-is.

woodcock · ‎12-02-2015

I mocked up your sample data with my original solution and it works perfectly: |noop|stats count AS "LAN MAC Address" | eval "LAN MAC Address" = "AB:34:dd:56:78:GF,CB:34:ds:45:gd:45,DR:45:ds:FR:56:G7" | makemv delim="," "LAN MAC Address" | mvexpand "LAN MAC Address" | eval source="awback.csv" | appendpipe [ |noop|stats count AS "MAC Address" | eval "MAC Address" = "AB:34:dd:56:78:GF,CB:34:ds:45:gd:45,DR:45:ds:FR:56:G7,GT:45:33:eE:45:eD" | makemv delim="," "MAC Address" | mvexpand "MAC Address" | rename "MAC Address" as "LAN MAC Address" | eval source = "actback.csv"] | stats dc(source) AS numSources values(*) AS * BY "LAN MAC Address" | where numSources=2 Which results in this output: LAN MAC Address numSources source AB:34:dd:56:78:GF 2 actback.csv awback.csv CB:34:ds:45:gd:45 2 actback.csv awback.csv DR:45:ds:FR:56:G7 2 actback.csv awback.csv

jcoates_splunk · ‎03-28-2015

Hi, you can use permissions to control access to each of the commands, but I don't think that you can use different permissions on each connection.

sibbsnb · ‎09-16-2014

This didn't work

richgalloway · ‎06-28-2017

This thread is almost four years old so it's unlikely anyone will respond. I suggest you post a new question.

gkanapathy · ‎09-06-2012

I don't think this is possible, but it is a good enhancement request.

cburr2012 · ‎07-25-2012

aniketb, 1) Create the list of verified hostnames as a CSV file. It is easy if the column containing the hostname values is the same name as Splunk's hostname. (i.e. if Splunk calls it "host=bob" your header should be "host" without the quotes.) 2) Open Splunk. 3) Navigate to Manager --> Lookups --> Add New --> Lookup Table File 4) Upload your file and name it hostname_lookup.csv (or whatever you want, have the filename end in .csv) 5) Under Manager --> Lookups --> Add New --> Lookup Definition 6) Name: hostname_lookup , lookup-file: hostname_lookup.csv 7) Now define your search query: index=this_index query_terms_here NOT [|inputlookup hostname_lookup | fields host] 😎 Set your time and click Create --> Alert 9) Schedule your alert and have it trigger when your results are great than 0. Hope this helps.

smileyge · ‎09-27-2013

I'm having this issue as well but only on certain searches. Anyone got any ideas?

carmackd · ‎04-18-2012

Sanity check -- Have you configured any log monitors in inputs.conf on the forwarder? However, by default the forwarder will send its internal logs (splunkd etc.) so you should be able to search those on the indexer if you have properly configured the necessary. From the indexer query the following: index=_internal sourcetype=fwdinfo If you return results then you know the connection between the two instances are good.

jsb22 · ‎04-03-2012

This does not directly address your question, but if this does become an issue, you may be able to switch from archiving events, to 'overwrite events older than X days' and increasing the log size so it has time to pull. Although, I don't think you'll have that issue, I just don't have any proof to support it. Just a suggestion though.

dvb · ‎10-26-2016

If you want to get multi-value outputs then make sure you select "Overwrite field values" for the automatic lookup. In other words, make sure you see OUTPUT and not OUTPUTNEW . By default, the UI sets automatic lookup to use OUTPUTNEW , but that will only write to the output field if it does not exist already (which will result in only the first value of an mv-field to being looked up).

kmattern · ‎08-30-2012

Actually we're looking to put as much output into outputlookup tables CSV) as we possibly can. Then we'll write our own asp or java scripts to generate output from those lookups so we can embed specific tables into our portal pages and bypass the Splunk interface whenever possible. Then we'll schedule the searches to run and gather the results. I don't think we have begun to make a dent in the customization we need to do. Mostly because of security concerns.

carmackd · ‎12-01-2011

i= the guid of the corresponding indexer, but I would still like to know why I am seeing blank values in the h field.

carmackd · ‎04-17-2012

Check the login.html file in $SPLUNK_HOME/share/splunk/search_mrsparkle/templates/account/ and make sure it is current with the Splunk version you're running. I had the same problem and saw differences between the login.html page that was in that directory and the one that was supposed to install during my upgrade to 4.3.1. Old login.html page contain the following, while the latest did not: #some code here# var s = $.cookie('${cherrypy.config['tools.sessions.name']}'); #some code here# else if (!s) { $('.error').hide(); $('#jserror').text(_('Login will fail due to a significant clock differences between the server and this machine')).show(); } After updating the file with the latest, the error message went away.

carmackd · ‎05-20-2011

thanks! good catch, that worked, but i removed the "^". If i remove the "source::" the new host name appears as "host=source::myapphost"

vbumgarner · ‎04-20-2011

That's what Splunk does with characters that are outside of the charset. The default charset is utf-8. I'm guessing the files are not utf-8 and sometimes it's okay, and sometimes it isn't? You can try other charsets in props.conf. The most common I've seen outside utf-8 is UTF-16LE. http://www.splunk.com/base/Documentation/4.2.1/Data/Configurecharactersetencoding

yannK · ‎06-20-2018

since Splunk 5.* this was greatly improved A single DS can now handle more than 1000+ to 10000 clients, and the phonehome interval strategy is better. however this is still a single threaded process.

jrodman · ‎03-01-2011

Docs scrubbed. Sorry, old error. Passes smell test but was incorrect.

David · ‎02-24-2011

Absolutely. I'd try the instructions provided here: http://answers.splunk.com/questions/397/how-to-configure-ssl-for-forwarding-and-receiving-data

Lowell · ‎04-17-2014

Starting in Splunk 6, it's now possible to specify the timezone on a Universal Forwarder. As long as both sender and receiver are using the new forwarding protocol, the timezone information provided by the sender should be honored. Links to related docs: Specify time zones of timestamps props.conf - Look at the " TZ " attribute. outputs.conf. The new protocol can be enabled/disabled with negotiateNewProtocol .

carmackd · ‎02-04-2011

Perfect! thanks

araitz · ‎01-28-2011

Nope, capabilities are scoped system-wide. It seems like it would be quite a jumbled administrative mess if they were scoped per-app, and beyond that, I'm not sure I understand the utility of allowing users to schedule searches in one app but not in another.

the_wolverine · ‎09-12-2014

outputcsv also work just fine after removing the sort command -- export from UI is no longer capped at 10k.

supersleepwalke · ‎11-19-2012

Awesome! I didn't realize that the default indexes could be overridden by a normal app. That should solve it for me. Thanks!

Posts	78
Solutions	5
Karma Given	34
Karma Received	58
Member Since	‎04-26-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Splunk Support for Active Directory: Can access co...

Splunk 6 dropdown menu - decrease width

Building Forms - can i change the text in the "sea...

summarize directories in dispatch?

role creation with very specific capabilities

User cannot export csv

Missing Windows Event Logs?

multivalued OUTPUT field for my automatic lookup

license_usage.log abnormality & ?

Host Override

Re: Splunk 6 dropdown menu - decrease width

Re: How do I create an alert when Splunk sees a tr...

Re: How to create one table by combining a common ...

Re: Splunk Support for Active Directory: Can acces...

Re: Building Forms - can i change the text in the ...

Re: summarize directories in dispatch?

Re: role creation with very specific capabilities

Re: comparing a field and external file

Re: User cannot export csv

Re: Not able to see the Forwarder host name in the...

Re: Missing Windows Event Logs?

Re: multivalued OUTPUT field for my automatic look...

Re: Restricting or not restricting users from crea...

Re: license_usage.log abnormality & ?

Re: significant clock differences

Re: Host Override

Re: Receiving x's & 0's.............sometimes

Re: Hardware requirements for deployment server in...

Re: Using index time as time stamp

Re: LWF and SSL outputs

Re: Timezone Offset

Re: Thruput search help

Re: limit a role's capability according to app?

Re: Exporting CSV over 10,000 No OS access

Re: deployment server - systems/local