About Andre_

Andre_ · ‎02-24-2026

Does anyone know if there’s somewhere a complete list of keyboard shortcuts cuts for the search SPL editor available? the once I came across so far are: CTRL + F CTRL + E CTRL + /

Andre_ · ‎02-09-2026

Thank you, time to log a ticket with Pure.

Andre_ · ‎02-05-2026

Hello, I've installed the PureStorage Add-On and it requires to add your CA cert to the cacert.pem. But the location for the cacert.pem is $SPLUNK_HOME/etc/apps/TA-purestorage-unified/bin/ta_purestorage_unified/aob_py3/certifi/cacert.pem. That file gets overwritten when updating the Add-on. Is there a way to configure a different location or use the cacert.pem in $SPLUNK_HOME/etc/auth ? link to doco: PureStorage Unified Add-on Configuration Thanks Andre

Andre_ · ‎12-10-2025

is that fixed in 9.4.7?

Andre_ · ‎12-10-2025

in our case that solved the issue, interesting side note - only UFs where high level of cross AD domain resolution happens were impacted.

Andre_ · ‎12-07-2025

I’ve read the doco and that’s what I am wondering about where do I need the app and do I have to enable/disable certain parts. it also has a “config” as part of the app, so that can only be done on the search head but it looks like the settings will be needed on the HF and indexer. Also no mention how to configure the index. regards syslog behind a load balancer, it’s a pain in the B with Splunk but how else do you ensure you are not missing data when you patch/restart your HF? syslog source -> single HF tcp/udp => every restart of Splunk on the HF = data loss syslog source-> LB -> multiple HF tcp/udp => no data loss when restarting Splunk on one HF

Andre_ · ‎12-06-2025

Hello, Veeam App for Splunk how do you install/configure the Veeam App in a distributed environment? Search Head Cluster, Index Cluster and Heavy Forwarders behind Load balancer for Syslog. Do I have to install the App on Search Head / Heavy Forwarder and Indexers? What about Syslog going through a load balancer, will that impact the props/transforms I need? Kind Regards Andre

Andre_ · ‎12-02-2025

Not a bug. opened a support case and there is a showZeroValue = 1 option for the inputs.conf stanza. Default is 0, once set to 1, Zero Values are being recorded as 0.

Andre_ · ‎11-25-2025

Hello, we encountered a situation today where a monitored Windows Drive disappeared from Spunk. The drive had become completely full, 0 bytes free and 0% free space. |mstats -> drive does show up in results anymore We've reproduced the issue in a lab and every time the disk goes to 0 it disappears. We've compared the performance counters in the metric index with what powershell shows locally using get-counter. Powershell returns 0 (not NULL) Looking at available perfmon counters for logical disk, we found one counter that has a not 0 value "% Idle Time" - we've added that to the inputs.conf and mstats SPL Once this was complete we could see that all other fields for the disk with 0 bytes free were NULL instead of 0 (Zero) "% Free Space" and ""Free Megabytes" should be 0 (zero) not NULL when they are 0 Anyone else had this issue before? Kind Regards Andre

Andre_ · ‎11-13-2025

So, I can’t have a clock display in dashboard studio?

Andre_ · ‎11-13-2025

So, if I have 50 users that have a dashboard with time/clock display open, does that mean splunk is running 50 searches per second? is there no way to utilise the local browser? Some js or so?

Andre_ · ‎09-12-2025

Not even in version 10?

Andre_ · ‎09-11-2025

Hello, I have a single value panel in dashboard studio and would like to set all text to a specific colour (#212121) Not all text is taking the colour. Any idea what I am missing? the "Days", "Hours", "Minutes" should be dark grey too.... { "containerOptions": { "visibility": { "hideWhenNoData": true } }, "dataSources": { "primary": "ds_YtjP8WZh" }, "options": { "align": "left", "sparklineDisplay": "off", "splitByLayout": "trellis", "trellisBackgroundColor": "transparent", "trellisColumns": 3, "trellisMinColumnWidth": 10, "trellisPageCount": 3, "trellisSplitBy": "aggregations", "trendDisplay": "off", "majorColor": "#212121", "backgroundColor": "transparent" }, "title": "", "type": "splunk.singlevalue", "context": {}, "showProgressBar": false, "showLastUpdated": false } Any help appreciated Thanks Andre

Andre_ · ‎09-09-2025

How would you do a multi select?

Andre_ · ‎09-09-2025

Hello, is there a way in Dashboard Studio to have filters per column? Similar to Microsoft Excel? like if I have a table with host, location and organisation headers, to easily filter on each column? Including multi select of column values? kind regards Andre

Andre_ · ‎07-17-2025

I found some more information, when I go: Apps -> DBX -> search -> save as alert -> I get the Output Name field but if I go: Apps -> other app (like Search & Reporting) -> search -> save as alert -> I don't get the Output Name field Any ideas what that could be? Kind Regards, Andre

Andre_ · ‎07-08-2025

When you set up the alert - what app are you using? Wondering if it’s a permission issue? My alert is defined in the search app.

Andre_ · ‎07-08-2025

Latest 3.x, haven’t updated to 4.0.0 yet (not a fan of 0s)

Andre_ · ‎07-08-2025

The document you linked states in step 5 for creating and alert: “Enter the Output Name. The output name must exist in DB Connect.” I have no option to enter the output name. Says no parameters required.

Andre_ · ‎07-08-2025

Hi, yes, all is setup and works well when used manually. I can use SPL to update the database table. i am unable to use the db connect alert action. i have 3 outputs configured in DBX. Now I am setting up an alert and choose the db connect alert action. It’s not working. And in my mind it can’t because I have no way to tell it what output to use? if someone has an dbx alert configured and could share the config that might clear up my confusion. Kind regards, Andre

Andre_ · ‎07-07-2025

Hello, I have Database Connect setup and it's working all fine. But I can't wrap my head around how the Alert Action works. The Alert action "Output results to databases" has no parameters - what am I missing? I have a DB table "test_table" with columns col1, col2 and want to setup | makeresults | eval col1 = "test", col2 = "result" as an alert that pushes the results into the "test_table". I would expect the Alert action to at least need to know what DB Output to use? Any help appreciated, Kind Regards Andre

Andre_ · ‎06-19-2025

support confirmed - no way to exclude old windows event logs from being imported. "The Splunk Universal Forwarder's Windows Event Log input doesn't offer a built-in way to filter events based on age during initial data collection. This means you can't directly configure the forwarder to only send events newer than 7 days when it first starts monitoring. You'll need to use other methods, like filtering at the indexer level or leveraging props/transforms.conf after the data is indexed, to remove older events. Or else take the backup of the event viewer logs which are older than 7 days in the source machine and remove them before onboarding to splunk." Kind Regards Andre

Andre_ · ‎06-17-2025

/opt/splunk/bin/splunk btool props list XmlWinEventLog:Security --debug | grep MAX_DAYS_AGO /opt/splunk/etc/system/local/props.conf MAX_DAYS_AGO = 7 that should work, right? Present on all indexers. All indexers restarted. (Splunk Enterprise 9.4.2) TIme to log a support call?

Andre_ · ‎06-17-2025

that does not work, once you remove the blacklist, it ingests the old events.....

Andre_ · ‎06-17-2025

I've done a rolling restart of the cluster and checked. Looks like it "should" work but doesn't. Since then, I tried this approach: put a "blacklist_all_WinEvent" app on the UF during initial start. Just an inputs.conf that has "blacklist1 = ." for all winevent sources. let the UF do it's initial thing and an hour later I remove that app from the UF and restart the UF whilst not optimal, that would do the trick for onboarding existing servers and automating that is easy enough. Kind Regards Andre

Posts	45
Solutions	1
Karma Given	6
Karma Received	4
Member Since	‎02-02-2025

Online Status	Offline
Date Last Visited	‎02-24-2026 12:13 AM

Keyboard short cuts for search

cacert.pem in PureStorage Unified Add-on overwritt...

how to setup Veeam app in distributed environment

Bug? Logical Disk Performance counter ingest NULL ...

how to change font colour in single value trellis?

Dashboard studio tables - Microsoft Excel like tab...

How do you use the Database Connect Alert Action?

exclude winevent older than 7 days from ingest

add customerID to incoming data (event & metric)

import vendor security advisories for comparison w...

Keyboard short cuts for search

Re: cacert.pem in PureStorage Unified Add-on overw...

cacert.pem in PureStorage Unified Add-on overwritt...

Re: UF 10.0 — splunk-winevtlog.exe crashes in VCRU...

Re: UF 10.0 — splunk-winevtlog.exe crashes in VCRU...

Re: how to setup Veeam app in distributed environm...

how to setup Veeam app in distributed environment

Re: Bug? Logical Disk Performance counter ingest N...

Bug? Logical Disk Performance counter ingest NULL ...

Re: Clock panels (Dashboard Studio)

Re: Clock panels (Dashboard Studio)

Re: how to change font colour in single value trel...

how to change font colour in single value trellis?

Re: Dashboard studio tables - Microsoft Excel like...

Dashboard studio tables - Microsoft Excel like tab...

Re: How do you use the Database Connect Alert Acti...

Re: How do you use the Database Connect Alert Acti...

Re: How do you use the Database Connect Alert Acti...

Re: How do you use the Database Connect Alert Acti...

Re: How do you use the Database Connect Alert Acti...

How do you use the Database Connect Alert Action?

Re: exclude winevent older than 7 days from ingest

Re: exclude winevent older than 7 days from ingest

Re: exclude winevent older than 7 days from ingest

Re: exclude winevent older than 7 days from ingest

Join the Conversation