About kmorris_splunk

jhuysing · ‎06-19-2024

This is how I added a wildcard to a dropdown list Query for the dynamic options | makeresults | eval type="*"| append [ search index=blah rest of search ]

carbdb · ‎06-11-2024

thanks, saved me loads of redundant coding! i.e. elegant new solution setting dashboard tokens: | sort 0 area -error_rate | dedup area | eval x=area+"_service_id" | eval {x} = service_id | fields - x service_id | eval x=area+"_service" | eval {x} = service | fields - x service | eval x=area+"_value" | eval {x} = error_rate | fields - x error_rate | eval x=area+"_color" | eval {x} = color | fields - x color | fields - area _time | stats values(*) as *

Kathir · ‎01-09-2024

|rest /services/apps/local |fields author configured disbled eai:aci.owner eai:acl.sharing label title visible check_for_updates update.version version |dedup title |table title label author eai:aci.owner eai:acl.sharing configured disabled visible check_for_updates update.version version

altink · ‎01-05-2024

Hi @kmorris_splunk I have the same issue. The link provided leads to an empty page: "Hi! This page does not exist, or has been removed from the documentation. ....." best regards Altin

dudhatjanhavi · ‎09-14-2023

Did you ever find out how to do this? I'm in a similar situation and was hoping you were able to find a workaround?

smcmaster · ‎04-26-2023

As a refresh of the information in this thread... * For the 10gb developer license, you can reach out to devinfo@splunk.com for a reset key. You should expected a response within 2-3 business days. * For the 50gb dev/test license, you'll need to reach out to Splunk Support or to your account team for a reset key. These licenses are only available for customers.

b_chris21 · ‎04-07-2022

Grazie mille Giuseppe

HiwaKarimi · ‎02-11-2022

I did like this in path: $SPLUNK_HOME/etc/system/default/indexes.conf for an Index (wallix) [wallix] repFactor = auto homePath = volume:hotwarm/wallix/db coldPath = volume:cold/wallix/colddb thawedPath = $SPLUNK_DB/wallix/thaweddb tstatsHomePath = volume:hotwarm/wallix/datamodel_summary homePath.maxDataSizeMB = 5120 coldPath.maxDataSizeMB = 10240 maxHotBuckets = 10 maxDataSize = auto_high_volume maxTotalDataSizeMB = 15360 maxWarmDBCount = 4294967295 frozenTimePeriodInSecs = 31104000

shumel · ‎02-01-2022

how can i find who are the designated support contacts in my splunk cloud instance?

terminaloutcome · ‎09-05-2021

There's another option that works if you're looking to do some simple sorting. | makeresults | eval name="Alice,Bob,Frank,Steve" | makemv delim="," name | mvexpand name | eval fakenumber=len(name) | eval sorted_name=if(name=="Frank"," Frank",name) | eval sorted_name=if(sorted_name=="Steve"," Steve",sorted_name) | stats max(fakenumber) as namelen by sorted_name It'll put the trellis in the order of Steve, Frank, Alice, Bob. There's two spaces before "Steve" and one before "Frank"

kmorris_splunk · ‎02-24-2021

Take a look at my response on this post. https://community.splunk.com/t5/Splunk-Search/To-Rex-or-not-to-rex/m-p/459516#M129688 I used this on a source where the Key Value pairs was not consistent. This should allow you to dynamically extract the Key Values from whatever gets

gjanders · ‎11-07-2020

When using ldap this shows cached users which has a limit...you can increase the limit in splunk config if you have a large user base. Furthermore enable paging is required if you cannot obtain all users from a single query, available in 7.3 and above With the right settings I can see over 3000 users after restart

jorodrigues · ‎10-27-2020

managed to solve? what are you using today to monitor cpu, Firewpower memory?

kmorris_splunk · ‎08-06-2020

index=YOURINDEX sourcetype=YOURSOURCETYPE | stats sum(Value) as TotalValue by Month | append [ searchindex=YOURINDEX sourcetype=YOURSOURCETYPE Status="Done" Accepted="Done" | stats sum(Value) as TotalVal_Done by Month] | stats values(TotalValue) as TotalValue values(TotalVal_Done) as TotalVal_Done by Month

kmorris_splunk · ‎04-08-2020

Yes, the installations are the same, just the configurations would be different.

woodcock · ‎10-25-2019

Like this: | rex field=_raw "\\{3}(?<API>\w+)" I took you literally and I am quite sure that what you said you need is not actually what you need.

kmorris_splunk · ‎09-27-2019

Here is an example from some different data: sourcetype=access_combined earliest=-60m | bin _time span=10s | timechart count by action You might consider using Trellis visualization as well, which automatically creates a different line graph for each.

sloshburch · ‎09-25-2019

Some supporting documentation at SplunkCloud service description for Splunkbase and private apps and Manage private apps in your Splunk Cloud deployment

danielbb · ‎08-15-2019

And now it shows in _audit...

Jarohnimo · ‎08-13-2019

I added the 2nd pipeline to one of the servers yesterday. Making these adjustment (the ones mentioned above) has definitely improved the issue with delays. I found out today that increasing the maxkbps to 8192 doesn't have a negative effect on the network as 144 MB/s transfers can't compare to some of the network traffic we see coming from SQL. I feel comfortable making these changes now.

mayurr98 · ‎08-07-2019

Try this run anywhere search | makeresults | eval data="Aplicación restringida detectada: MS Windows Games (Game)" | rex field=data ":\s+(?P<NewField>[^\(]+)\s+"

audunn · ‎08-08-2019

One follow up to this. If i want to send the syslog traffic over UDP how do i force that? don't see it in the docs (if even possible)

kmorris_splunk · ‎08-06-2019

Burch, good point on the sourcetype definitions. So it should still allow for upload and installation.

agentsofshield · ‎07-30-2019

This is a cool answer that helps a little, BUT the results are still in the URL. This means that if I refresh the page, it repeats the action again and I don't want it to.

kmorris_splunk · ‎07-23-2019

Check out this documentation on setting up an intermediate forwarder. An intermediate forwarder can be either a Universal or Heavy forwarder and is used a lot in Splunk Cloud architectures to limit the number of egress points. https://docs.splunk.com/Documentation/Splunk/7.3.0/Forwarding/Configureanintermediateforwarder

Posts	324
Solutions	49
Karma Given	27
Karma Received	113
Member Since	‎07-29-2014

Online Status	Offline
Date Last Visited	‎02-24-2021 02:01 PM

Re: How can I create a wildcard for a dropdown men...

Re: how do I create a variable(or new field name) ...

Re: How to check app updates availability in Splun...

Re: Where can I find more info on app licensing?

Re: Which capability should I use for editing the ...

Re: How to reset a license violation for a Dev lic...

Re: How to install SA_LDAPSearch on Splunk Cloud

Re: Setting indexes on windows universal forwarder

Re: Can you help me raise a case to Splunk Cloud s...

Re: How can I change the sort order of data in a T...

How to translate mv field extraction from SPL to c...

Re: Query to find out users belong to a particular...

Re: CISCO ASA Health Monitoring through Splunk

Re: Count and sum fourth column if second and thir...

Re: Is the installation file same for setting up s...

Re: Help in writing regex

Re: Count the number of api occurrence in 10 secon...

Re: I need entire process for the submission of a ...

Re: What does the Add to Triggered Alerts action d...

Re: maxkbps on 10gb network

Re: Can I ignore some words form a field?

Re: Send one source to multiple outputs

Re: Uploaded App getting rejected by SplunkCloud

Re: How to reset dashboard when I press submit? (o...

Re: Forward Universal Forwarder through Heavy forw...

Are you a member of the Splunk Community?