Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About Andre_
Andre_
Path Finder
Member since:
02-02-2025
3 weeks ago
Community Statistics
| Posts | 42 |
| Solutions | 1 |
| Karma Given | 5 |
| Karma Received | 4 |
| Member Since | 02-02-2025 |
Activity Feed
- Posted Re: UF 10.0 — splunk-winevtlog.exe crashes in VCRUNTIME140.dll / KERNELBASE.dll (EventCode=1000) on Getting Data In. 3 weeks ago
- Posted Re: UF 10.0 — splunk-winevtlog.exe crashes in VCRUNTIME140.dll / KERNELBASE.dll (EventCode=1000) on Getting Data In. 3 weeks ago
- Posted Re: how to setup Veeam app in distributed environment on Deployment Architecture. 3 weeks ago
- Posted how to setup Veeam app in distributed environment on Deployment Architecture. 3 weeks ago
- Got Karma for Re: Bug? Logical Disk Performance counter ingest NULL instead of Zero (0). a month ago
- Posted Re: Bug? Logical Disk Performance counter ingest NULL instead of Zero (0) on Getting Data In. a month ago
- Posted Bug? Logical Disk Performance counter ingest NULL instead of Zero (0) on Getting Data In. 11-25-2025 08:17 PM
- Tagged Bug? Logical Disk Performance counter ingest NULL instead of Zero (0) on Getting Data In. 11-25-2025 08:17 PM
- Tagged Bug? Logical Disk Performance counter ingest NULL instead of Zero (0) on Getting Data In. 11-25-2025 08:17 PM
- Posted Re: Clock panels (Dashboard Studio) on Dashboards & Visualizations. 11-13-2025 02:56 PM
- Posted Re: Clock panels (Dashboard Studio) on Dashboards & Visualizations. 11-13-2025 12:12 AM
- Karma Re: Dashboard studio tables - Microsoft Excel like table headers/filters for PrewinThomas. 10-18-2025 04:09 PM
- Posted Re: how to change font colour in single value trellis? on Dashboards & Visualizations. 09-12-2025 07:41 PM
- Posted how to change font colour in single value trellis? on Dashboards & Visualizations. 09-11-2025 09:27 PM
- Posted Re: Dashboard studio tables - Microsoft Excel like table headers/filters on Dashboards & Visualizations. 09-09-2025 04:37 AM
- Posted Dashboard studio tables - Microsoft Excel like table headers/filters on Dashboards & Visualizations. 09-09-2025 01:53 AM
- Tagged Dashboard studio tables - Microsoft Excel like table headers/filters on Dashboards & Visualizations. 09-09-2025 01:53 AM
- Tagged Dashboard studio tables - Microsoft Excel like table headers/filters on Dashboards & Visualizations. 09-09-2025 01:53 AM
- Got Karma for Re: How do you use the Database Connect Alert Action?. 08-29-2025 01:04 AM
- Posted Re: How do you use the Database Connect Alert Action? on Splunk Search. 07-17-2025 03:40 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
3 weeks ago
in our case that solved the issue, interesting side note - only UFs where high level of cross AD domain resolution happens were impacted.
... View more
3 weeks ago
I’ve read the doco and that’s what I am wondering about where do I need the app and do I have to enable/disable certain parts. it also has a “config” as part of the app, so that can only be done on the search head but it looks like the settings will be needed on the HF and indexer. Also no mention how to configure the index. regards syslog behind a load balancer, it’s a pain in the B with Splunk but how else do you ensure you are not missing data when you patch/restart your HF? syslog source -> single HF tcp/udp => every restart of Splunk on the HF = data loss syslog source-> LB -> multiple HF tcp/udp => no data loss when restarting Splunk on one HF
... View more
3 weeks ago
Hello, Veeam App for Splunk how do you install/configure the Veeam App in a distributed environment? Search Head Cluster, Index Cluster and Heavy Forwarders behind Load balancer for Syslog. Do I have to install the App on Search Head / Heavy Forwarder and Indexers? What about Syslog going through a load balancer, will that impact the props/transforms I need? Kind Regards Andre
... View more
Veeam App for Splunk
![Thumbnail of Veeam App for Splunk]()
Veeam App for Splunk
Labels
a month ago
1 Karma
Not a bug. opened a support case and there is a showZeroValue = 1 option for the inputs.conf stanza. Default is 0, once set to 1, Zero Values are being recorded as 0.
... View more
11-25-2025
08:17 PM
Hello, we encountered a situation today where a monitored Windows Drive disappeared from Spunk. The drive had become completely full, 0 bytes free and 0% free space. |mstats -> drive does show up in results anymore We've reproduced the issue in a lab and every time the disk goes to 0 it disappears. We've compared the performance counters in the metric index with what powershell shows locally using get-counter. Powershell returns 0 (not NULL) Looking at available perfmon counters for logical disk, we found one counter that has a not 0 value "% Idle Time" - we've added that to the inputs.conf and mstats SPL Once this was complete we could see that all other fields for the disk with 0 bytes free were NULL instead of 0 (Zero) "% Free Space" and ""Free Megabytes" should be 0 (zero) not NULL when they are 0 Anyone else had this issue before? Kind Regards Andre
... View more
Labels
- Labels:
-
universal forwarder
11-13-2025
12:12 AM
So, if I have 50 users that have a dashboard with time/clock display open, does that mean splunk is running 50 searches per second? is there no way to utilise the local browser? Some js or so?
... View more
09-12-2025
07:41 PM
Not even in version 10?
... View more
09-11-2025
09:27 PM
Hello, I have a single value panel in dashboard studio and would like to set all text to a specific colour (#212121) Not all text is taking the colour. Any idea what I am missing? the "Days", "Hours", "Minutes" should be dark grey too.... { "containerOptions": { "visibility": { "hideWhenNoData": true } }, "dataSources": { "primary": "ds_YtjP8WZh" }, "options": { "align": "left", "sparklineDisplay": "off", "splitByLayout": "trellis", "trellisBackgroundColor": "transparent", "trellisColumns": 3, "trellisMinColumnWidth": 10, "trellisPageCount": 3, "trellisSplitBy": "aggregations", "trendDisplay": "off", "majorColor": "#212121", "backgroundColor": "transparent" }, "title": "", "type": "splunk.singlevalue", "context": {}, "showProgressBar": false, "showLastUpdated": false } Any help appreciated Thanks Andre
... View more
Labels
- Labels:
-
single value
09-09-2025
04:37 AM
How would you do a multi select?
... View more
09-09-2025
01:53 AM
Hello, is there a way in Dashboard Studio to have filters per column? Similar to Microsoft Excel? like if I have a table with host, location and organisation headers, to easily filter on each column? Including multi select of column values? kind regards Andre
... View more
Labels
- Labels:
-
Dashboard Studio
07-17-2025
03:40 PM
1 Karma
I found some more information, when I go: Apps -> DBX -> search -> save as alert -> I get the Output Name field but if I go: Apps -> other app (like Search & Reporting) -> search -> save as alert -> I don't get the Output Name field Any ideas what that could be? Kind Regards, Andre
... View more
07-08-2025
05:23 AM
When you set up the alert - what app are you using? Wondering if it’s a permission issue? My alert is defined in the search app.
... View more
07-08-2025
01:43 AM
Latest 3.x, haven’t updated to 4.0.0 yet (not a fan of 0s)
... View more
07-08-2025
01:31 AM
The document you linked states in step 5 for creating and alert: “Enter the Output Name. The output name must exist in DB Connect.” I have no option to enter the output name. Says no parameters required.
... View more
07-08-2025
01:27 AM
Hi, yes, all is setup and works well when used manually. I can use SPL to update the database table. i am unable to use the db connect alert action. i have 3 outputs configured in DBX. Now I am setting up an alert and choose the db connect alert action. It’s not working. And in my mind it can’t because I have no way to tell it what output to use? if someone has an dbx alert configured and could share the config that might clear up my confusion. Kind regards, Andre
... View more
07-07-2025
02:54 PM
Hello, I have Database Connect setup and it's working all fine. But I can't wrap my head around how the Alert Action works. The Alert action "Output results to databases" has no parameters - what am I missing? I have a DB table "test_table" with columns col1, col2 and want to setup | makeresults
| eval col1 = "test", col2 = "result" as an alert that pushes the results into the "test_table". I would expect the Alert action to at least need to know what DB Output to use? Any help appreciated, Kind Regards Andre
... View more
Labels
- Labels:
-
other
06-19-2025
10:09 PM
support confirmed - no way to exclude old windows event logs from being imported. "The Splunk Universal Forwarder's Windows Event Log input doesn't offer a built-in way to filter events based on age during initial data collection. This means you can't directly configure the forwarder to only send events newer than 7 days when it first starts monitoring. You'll need to use other methods, like filtering at the indexer level or leveraging props/transforms.conf after the data is indexed, to remove older events. Or else take the backup of the event viewer logs which are older than 7 days in the source machine and remove them before onboarding to splunk." Kind Regards Andre
... View more
06-17-2025
07:49 PM
/opt/splunk/bin/splunk btool props list XmlWinEventLog:Security --debug | grep MAX_DAYS_AGO /opt/splunk/etc/system/local/props.conf MAX_DAYS_AGO = 7 that should work, right? Present on all indexers. All indexers restarted. (Splunk Enterprise 9.4.2) TIme to log a support call?
... View more
06-17-2025
07:08 PM
that does not work, once you remove the blacklist, it ingests the old events.....
... View more
06-17-2025
06:09 PM
I've done a rolling restart of the cluster and checked. Looks like it "should" work but doesn't. Since then, I tried this approach: put a "blacklist_all_WinEvent" app on the UF during initial start. Just an inputs.conf that has "blacklist1 = ." for all winevent sources. let the UF do it's initial thing and an hour later I remove that app from the UF and restart the UF whilst not optimal, that would do the trick for onboarding existing servers and automating that is easy enough. Kind Regards Andre
... View more
06-17-2025
02:28 PM
Hello, so I've created a props.conf on the indexer under the Windows_TA local folder and put his in: [WinEventLog] MAX_DAYS_AGO = 7 [XmlWinEventLog] MAX_DAYS_AGO = 7 onboarded another Windows Server - still ingested windows event logs going back a few years. Any ideas why that's not working? Kind Regards Andre
... View more
06-16-2025
10:56 PM
trying that now, does it require a restart?
... View more
06-16-2025
02:30 PM
MAX_DAYS_AGO - I would set this on the indexer? (our setup is UF -> Indexer) Will that be a global setting for all incoming data? Kind Regards Andre
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
3 weeks ago
|
