Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About erick_costa
erick_costa
Path Finder
Member since:
08-07-2012
06-05-2020
Community Statistics
| Posts | 17 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 4 |
| Member Since | 08-07-2012 |
Activity Feed
- Karma Re: 2 Indexer and Summary for Ayn. 06-05-2020 12:46 AM
- Got Karma for results Ids not in list. 06-05-2020 12:46 AM
- Got Karma for Re: Character format conversion. 06-05-2020 12:46 AM
- Got Karma for Re: Character format conversion. 06-05-2020 12:46 AM
- Got Karma for Re: Move indexed file!. 06-05-2020 12:46 AM
- Posted How to correct Splunk SDK Python syntax error? on Splunk Dev. 07-21-2014 03:10 PM
- Tagged How to correct Splunk SDK Python syntax error? on Splunk Dev. 07-21-2014 03:10 PM
- Tagged How to correct Splunk SDK Python syntax error? on Splunk Dev. 07-21-2014 03:10 PM
- Tagged How to correct Splunk SDK Python syntax error? on Splunk Dev. 07-21-2014 03:10 PM
- Posted Re: 2 Indexer and Summary on Getting Data In. 05-29-2014 11:04 AM
- Posted 2 Indexer and Summary on Getting Data In. 05-29-2014 10:36 AM
- Tagged 2 Indexer and Summary on Getting Data In. 05-29-2014 10:36 AM
- Tagged 2 Indexer and Summary on Getting Data In. 05-29-2014 10:36 AM
- Tagged 2 Indexer and Summary on Getting Data In. 05-29-2014 10:36 AM
- Posted Re: Move indexed file! on Getting Data In. 01-09-2014 06:26 AM
- Posted Re: Move indexed file! on Getting Data In. 01-09-2014 06:26 AM
- Posted Move indexed file! on Getting Data In. 01-08-2014 01:26 PM
- Tagged Move indexed file! on Getting Data In. 01-08-2014 01:26 PM
- Tagged Move indexed file! on Getting Data In. 01-08-2014 01:26 PM
- Tagged Move indexed file! on Getting Data In. 01-08-2014 01:26 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
07-21-2014
03:10 PM
Python 2.4.3
Splunk 6
Error:
/splunklib/client.py", line 196
return entries if isinstance(entries, list) else [entries]
^
SyntaxError: invalid syntax
What should I do?
... View more
05-29-2014
11:04 AM
If I send my summary to the indexers, improve the performance of search?
... View more
05-29-2014
10:36 AM
Hi,
I have 2 Indexer and 1 SearchHead. Where should the data from my summary of the SH or the Indexer?
I checked and in my case they are in HS. Is this correct? I do not think anything in the documentation about this.
Regards,
Erick Eduardo
... View more
01-08-2014
01:26 PM
How to do to move files indexed by splunk?
[monitor:///var/log/teste/teste.log]
... View more
05-23-2013
08:00 AM
How to calculate datediff?
... View more
05-22-2013
12:26 PM
sourcetype=teste1
============================
code, datahora
_________________
1, 2013-05-07 15:51:13.772
sourcetype=teste2
============================
code, datahora
_________________
1, 2013-05-07 15:55:13.060
... View more
04-26-2013
05:21 AM
How to do rex to extract field URL eg.: http://www.gnookcooki.com.br
1366974288.183 102 178.19.3.199 TCP_REFRESH_HIT/200 174 GET http://www.gnookcooki.com.br/images/hat_orange_big.gif teste@teste.com DIRECT/www.gnookcooki.com.br/image/gif
1366974288.184 102 178.19.3.199 TCP_REFRESH_HIT/200 174 GET http://www.gnookcooki.com.br/images-files/hat_orange.jpg teste@teste.com DIRECT/www.gnookcooki.com.br/image/gif
... View more
04-08-2013
10:24 AM
The graphs in tutorial don't have values in bar or pie chart. I want to put the value above each bar graph!!
... View more
04-08-2013
09:04 AM
How to plot values in graphs? Searchs or Xml Dashboard!!!!
... View more
- Tags:
- chart
01-22-2013
07:06 AM
2 Karma
Hi,
This should help:
| eval y = tostring( Source ) | eval x="00000" | strcat x "0" y z | eval w=substr(z, -6) | table w
... View more
01-22-2013
06:26 AM
to Source Name use
| eval src_name=mvindex(Account_Name, 0)
To Target Name use
| eval src_name=mvindex(Account_Name, 1)
Example:
index=main source="WinEventLog:Security" (EventCode=4720 OR EventCode=4722) Account_Name!="*$" | eval src_name=mvindex(Account_Name,0) | eval tgt_name=mvindex(Account_Name,1) | table src_name, tgt_name
... View more
01-04-2013
11:18 AM
1 Karma
Hi,
Have a query that results are several Ids (09, 10, 11, 12, 13, ..., 99). I wonder how can I do to know which ids (0 to MaxID = 100) that is not in the result, without using the lookup because Id increasing as it is added to an item.
... View more
- Tags:
- results-formatting
11-27-2012
05:07 AM
problem solved!
I had to install a license for resetting errors, reset license (available for Enterprise only). And presto everything working!
... View more
11-26-2012
01:30 PM
The 2 licenses are valid and error continue:
Splunk Enterprise Sales Trial stackLearn more * auto_generated_pool_enterprise is currently a default license pool. Slave indexers can be automatically added to this pool by pointing them to the splunkd port on this machine.
Licenses Volume Expiration Status
Splunk Enterprise Sales Trial 51,200 MB Nov 28, 2012 12:28:46 PM valid Delete
Splunk Enterprise Sales Trial 30,720 MB Dec 11, 2012 6:56:03 PM valid Delete
Effective daily volume 81,920 MB
Pools Indexers Volume used today
auto_generated_pool_enterprise * 457 MB / 81,920 MB Edit | Delete
localhost.localdomain 457 MB (>0%)
error message on App [Search]: Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times. Renew your Splunk license by visiting www.splunk.com/store or calling 866.GET.SPLUNK.
... View more
08-07-2012
08:00 AM
I want to do the SQL in Splunk:
SELECT TB1.*
FROM TB1
JOIN TB2
ON TB2.ID = TB1.ID
WHERE TB2.OPTION = "OPTION 1"
How do I do this?
... View more
- Tags:
- join
- search-language
