About cyue_splunk

cyue_splunk · ‎10-19-2023

I met the same error during the DB Connect set up. The solution that works in my situation is to check $SPLUNK_HOME/etc/apps/splunk_app_db_connect/metadata/local.meta There are definitions for identities and db_connections. Make sure the "export = system" instead of "export = none". It should look like this: [identities/xxxxxx] access = read : [ * ], write : [ admin, db_connect_admin ] export = system owner = xxxxxx ...... [db_connections/xxxxxx] access = read : [ * ], write : [ admin, db_connect_admin ] export = system owner = xxxxxx ......

Azeemering · ‎04-21-2022

Update on this. In current versions (6.x and higher) you are now able to Clone a Correlation Search under Content Management in Enterprise Security. To delete a correlation search you can go to Settings > Searches, reports, and alerts

centrafraserk · ‎03-25-2020

Did you ever have luck solving this? I am on that version as well and having the same issue.

chanst2 · ‎07-10-2014

You can create a dashboard.css under etc/apps/ /appserver/static put the following codes in dashboard.css which will create a new range highCustom .single-value.highCustom{ color: #FFFFFF; } Then you can use rangemap in a search and define a range for highCustom, then if the value falls into this highCustom range, the color of the value will become white.

syusjk6 · ‎01-16-2013

Thanks. It helped.

vistasyslog · ‎12-24-2012

Great. Thanks for your help.

yannK · ‎12-24-2012

Not really, splunk indexers already go full speed by default. Check your indexing queues queues with the sos app to find any bottleneck. One remark about universal and lighweight forwarders : they have a limit of 256 kbps for the network speed. You can remove this limit.

syusjk6 · ‎01-16-2013

Thanks. This helped.

cyue_splunk · ‎12-23-2012

This is the correct one. Thanks, Damien! TIME_FORMAT = %b %d %H:%M:%S CST %Y

hartfoml · ‎02-03-2012

Sure anything I can do to help. Post a queston if you have something specifice you need help with.

cyue_splunk · ‎06-21-2011

You can try this way to force the Splunk Web to display Chinese: http:// :8000/zh-CN for Simplified Chinese or "zh-TW" for Traditional Chinese

northben · ‎05-19-2016

and in a strange irony, the CASE command is case-sensitive

Posts	20
Solutions	1
Karma Given	1
Karma Received	38
Member Since	‎04-18-2011

Online Status	Offline
Date Last Visited	‎10-19-2023 03:43 AM

how to change the color code and font size for sin...

how to speed the files input process

how do I skip the timezone inside the timestamps

Re: com.splunk.dbx.exception.NotFoundException: Ca...

Re: Enterprise Search: Can we delete or clone corr...

Re: First Login Phantom returns 500: Server Error

Re: how to change the color code and font size for...

Re: The minimum free disk space (2000MB) reached r...

Re: No URL field in the Search base

Re: how to speed the files input process

Re: How do I cut the designated decimal place base...

Re: how do I skip the timezone inside the timestam...

Re: Universal forwarder and WMI

Re: Chinese Characters in Splunk Web

Re: How to make a search case-sensitive?

Join the Conversation