Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About Andre_
Andre_
Path Finder
Member since:
02-02-2025
yesterday
Community Statistics
| Posts | 36 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 3 |
| Member Since | 02-02-2025 |
Activity Feed
- Posted Re: Clock panels (Dashboard Studio) on Dashboards & Visualizations. yesterday
- Posted Re: Clock panels (Dashboard Studio) on Dashboards & Visualizations. yesterday
- Karma Re: Dashboard studio tables - Microsoft Excel like table headers/filters for PrewinThomas. 4 weeks ago
- Posted Re: how to change font colour in single value trellis? on Dashboards & Visualizations. 09-12-2025 07:41 PM
- Posted how to change font colour in single value trellis? on Dashboards & Visualizations. 09-11-2025 09:27 PM
- Posted Re: Dashboard studio tables - Microsoft Excel like table headers/filters on Dashboards & Visualizations. 09-09-2025 04:37 AM
- Posted Dashboard studio tables - Microsoft Excel like table headers/filters on Dashboards & Visualizations. 09-09-2025 01:53 AM
- Tagged Dashboard studio tables - Microsoft Excel like table headers/filters on Dashboards & Visualizations. 09-09-2025 01:53 AM
- Tagged Dashboard studio tables - Microsoft Excel like table headers/filters on Dashboards & Visualizations. 09-09-2025 01:53 AM
- Got Karma for Re: How do you use the Database Connect Alert Action?. 08-29-2025 01:04 AM
- Posted Re: How do you use the Database Connect Alert Action? on Splunk Search. 07-17-2025 03:40 PM
- Posted Re: How do you use the Database Connect Alert Action? on Splunk Search. 07-08-2025 05:23 AM
- Posted Re: How do you use the Database Connect Alert Action? on Splunk Search. 07-08-2025 01:43 AM
- Posted Re: How do you use the Database Connect Alert Action? on Splunk Search. 07-08-2025 01:31 AM
- Posted Re: How do you use the Database Connect Alert Action? on Splunk Search. 07-08-2025 01:27 AM
- Posted How do you use the Database Connect Alert Action? on Splunk Search. 07-07-2025 02:54 PM
- Karma Re: exclude winevent older than 7 days from ingest for isoutamo. 07-07-2025 02:44 PM
- Posted Re: exclude winevent older than 7 days from ingest on Getting Data In. 06-19-2025 10:09 PM
- Posted Re: exclude winevent older than 7 days from ingest on Getting Data In. 06-17-2025 07:49 PM
- Posted Re: exclude winevent older than 7 days from ingest on Getting Data In. 06-17-2025 07:08 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
yesterday
So, if I have 50 users that have a dashboard with time/clock display open, does that mean splunk is running 50 searches per second? is there no way to utilise the local browser? Some js or so?
... View more
09-12-2025
07:41 PM
Not even in version 10?
... View more
09-11-2025
09:27 PM
Hello, I have a single value panel in dashboard studio and would like to set all text to a specific colour (#212121) Not all text is taking the colour. Any idea what I am missing? the "Days", "Hours", "Minutes" should be dark grey too.... { "containerOptions": { "visibility": { "hideWhenNoData": true } }, "dataSources": { "primary": "ds_YtjP8WZh" }, "options": { "align": "left", "sparklineDisplay": "off", "splitByLayout": "trellis", "trellisBackgroundColor": "transparent", "trellisColumns": 3, "trellisMinColumnWidth": 10, "trellisPageCount": 3, "trellisSplitBy": "aggregations", "trendDisplay": "off", "majorColor": "#212121", "backgroundColor": "transparent" }, "title": "", "type": "splunk.singlevalue", "context": {}, "showProgressBar": false, "showLastUpdated": false } Any help appreciated Thanks Andre
... View more
Labels
- Labels:
-
single value
09-09-2025
04:37 AM
How would you do a multi select?
... View more
09-09-2025
01:53 AM
Hello, is there a way in Dashboard Studio to have filters per column? Similar to Microsoft Excel? like if I have a table with host, location and organisation headers, to easily filter on each column? Including multi select of column values? kind regards Andre
... View more
Labels
- Labels:
-
Dashboard Studio
07-17-2025
03:40 PM
1 Karma
I found some more information, when I go: Apps -> DBX -> search -> save as alert -> I get the Output Name field but if I go: Apps -> other app (like Search & Reporting) -> search -> save as alert -> I don't get the Output Name field Any ideas what that could be? Kind Regards, Andre
... View more
07-08-2025
05:23 AM
When you set up the alert - what app are you using? Wondering if it’s a permission issue? My alert is defined in the search app.
... View more
07-08-2025
01:43 AM
Latest 3.x, haven’t updated to 4.0.0 yet (not a fan of 0s)
... View more
07-08-2025
01:31 AM
The document you linked states in step 5 for creating and alert: “Enter the Output Name. The output name must exist in DB Connect.” I have no option to enter the output name. Says no parameters required.
... View more
07-08-2025
01:27 AM
Hi, yes, all is setup and works well when used manually. I can use SPL to update the database table. i am unable to use the db connect alert action. i have 3 outputs configured in DBX. Now I am setting up an alert and choose the db connect alert action. It’s not working. And in my mind it can’t because I have no way to tell it what output to use? if someone has an dbx alert configured and could share the config that might clear up my confusion. Kind regards, Andre
... View more
07-07-2025
02:54 PM
Hello, I have Database Connect setup and it's working all fine. But I can't wrap my head around how the Alert Action works. The Alert action "Output results to databases" has no parameters - what am I missing? I have a DB table "test_table" with columns col1, col2 and want to setup | makeresults
| eval col1 = "test", col2 = "result" as an alert that pushes the results into the "test_table". I would expect the Alert action to at least need to know what DB Output to use? Any help appreciated, Kind Regards Andre
... View more
Labels
- Labels:
-
other
06-19-2025
10:09 PM
support confirmed - no way to exclude old windows event logs from being imported. "The Splunk Universal Forwarder's Windows Event Log input doesn't offer a built-in way to filter events based on age during initial data collection. This means you can't directly configure the forwarder to only send events newer than 7 days when it first starts monitoring. You'll need to use other methods, like filtering at the indexer level or leveraging props/transforms.conf after the data is indexed, to remove older events. Or else take the backup of the event viewer logs which are older than 7 days in the source machine and remove them before onboarding to splunk." Kind Regards Andre
... View more
06-17-2025
07:49 PM
/opt/splunk/bin/splunk btool props list XmlWinEventLog:Security --debug | grep MAX_DAYS_AGO /opt/splunk/etc/system/local/props.conf MAX_DAYS_AGO = 7 that should work, right? Present on all indexers. All indexers restarted. (Splunk Enterprise 9.4.2) TIme to log a support call?
... View more
06-17-2025
07:08 PM
that does not work, once you remove the blacklist, it ingests the old events.....
... View more
06-17-2025
06:09 PM
I've done a rolling restart of the cluster and checked. Looks like it "should" work but doesn't. Since then, I tried this approach: put a "blacklist_all_WinEvent" app on the UF during initial start. Just an inputs.conf that has "blacklist1 = ." for all winevent sources. let the UF do it's initial thing and an hour later I remove that app from the UF and restart the UF whilst not optimal, that would do the trick for onboarding existing servers and automating that is easy enough. Kind Regards Andre
... View more
06-17-2025
02:28 PM
Hello, so I've created a props.conf on the indexer under the Windows_TA local folder and put his in: [WinEventLog] MAX_DAYS_AGO = 7 [XmlWinEventLog] MAX_DAYS_AGO = 7 onboarded another Windows Server - still ingested windows event logs going back a few years. Any ideas why that's not working? Kind Regards Andre
... View more
06-16-2025
10:56 PM
trying that now, does it require a restart?
... View more
06-16-2025
02:30 PM
MAX_DAYS_AGO - I would set this on the indexer? (our setup is UF -> Indexer) Will that be a global setting for all incoming data? Kind Regards Andre
... View more
06-16-2025
01:27 AM
It's not in the spec file, I tried and it does not work.
... View more
06-16-2025
12:13 AM
I think the opposite is the case: current_only = <boolean>
* Whether or not to acquire only events that arrive while the instance is
running.
* A value of "true" means the input only acquires events that arrive
while the instance runs and the input is on. The input does not read
data which was stored in the Windows Event Log while the instance was not
running. This means that there will be gaps in the data if you restart the
instance or experiences downtime.
... View more
06-16-2025
12:09 AM
Hi Giuseppe, "ignoreOlderThan" only applies to log files, not windows event logs (like security events, application events, etc) Kind Regards Andre
... View more
06-15-2025
10:45 PM
I've seen the "current_only" option but discarded that as it will not ingest any historical data. If I set "current_only=1" during initial deployment it will not ingest old data - so far so good. If the UF goes down for a period of time, after a restart it will not process the events that occurred whilst the UF was down - bad What happens if I deploy the UF with "current_only =1" and after a week I remove the setting? will it start ingesting all historical? Or could I use that as a temporary setting during the onboarding phase and remove for production phase? Kind Regards Andre
... View more
06-15-2025
09:59 PM
Hello, I am about to onboard 1000+ Windows UF. Those have windows event logs going back many years. Is there a way to exclude any windows eventlog older than 7 days from being ingested during the initial onboarding? For log files there's an option for inputs.conf on the UF, but nothing similar for eventlog? Kind Regards Andre
... View more
Labels
- Labels:
-
universal forwarder
-
Windows
04-22-2025
08:33 PM
Hello, We have a few hundred hosts and a handful of customers. I have a csv file with serverName,customerID. I've been able to add the customerID to incoming events using props.conf/transforms.conf on the HF but I have no luck with metric data. Background - I like to use the customerID later for search restriction in roles. any suggestions where to start troubleshooting? Kind Regards Andre
... View more
Labels
- Labels:
-
data
-
heavy forwarder
