Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sandyIscream
sandyIscream
Communicator
Member since:
05-16-2017
06-05-2020
Community Statistics
| Posts | 46 |
| Solutions | 0 |
| Karma Given | 9 |
| Karma Received | 16 |
| Member Since | 05-16-2017 |
Activity Feed
- Karma Re: using bin command and span for mayurr98. 06-05-2020 12:49 AM
- Karma Re: Splunk says it has "received event for unconfigured/disabled/deleted index=", except it does exist and ends up working. What gives? for mayurr98. 06-05-2020 12:49 AM
- Karma What is the best way to calculate resource usage of splunkd process on AIX servers? for MousumiChowdhur. 06-05-2020 12:49 AM
- Karma What is best approach to implement kv store to replace using lookups? for MousumiChowdhur. 06-05-2020 12:49 AM
- Karma What's the best way to get the list of forwarders where splunkd service has stopped running? for MousumiChowdhur. 06-05-2020 12:49 AM
- Got Karma for Is there a way set CPU and Memory consumption for splunkd process to a particular limit?. 06-05-2020 12:49 AM
- Got Karma for Re: joining multiple select statements in dbxquery. 06-05-2020 12:49 AM
- Got Karma for Re: joining multiple select statements in dbxquery. 06-05-2020 12:49 AM
- Got Karma for Re: joining multiple select statements in dbxquery. 06-05-2020 12:49 AM
- Got Karma for Re: joining multiple select statements in dbxquery. 06-05-2020 12:49 AM
- Got Karma for Re: joining multiple select statements in dbxquery. 06-05-2020 12:49 AM
- Got Karma for Re: joining multiple select statements in dbxquery. 06-05-2020 12:49 AM
- Got Karma for Re: What is the best way to calculate resource usage of splunkd process on AIX servers?. 06-05-2020 12:49 AM
- Got Karma for Alert Manager functionality not working in search head clsuter environment. 06-05-2020 12:49 AM
- Got Karma for Alert Manager functionality not working in search head clsuter environment. 06-05-2020 12:49 AM
- Got Karma for Alert Manager functionality not working in search head clsuter environment. 06-05-2020 12:49 AM
- Got Karma for Alert Manager functionality not working in search head clsuter environment. 06-05-2020 12:49 AM
- Got Karma for Alert Manager functionality not working in search head clsuter environment. 06-05-2020 12:49 AM
- Got Karma for Alert Manager functionality not working in search head clsuter environment. 06-05-2020 12:49 AM
- Got Karma for Can we create a button added in each row of a table ? I want to achieve this without the use of Sideview Utils. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 6 | |||
| 0 | |||
| 1 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-02-2019
09:00 PM
First you need to set a ID for your multiselect.
for example -
then you need to define the js like the following.
require([
'underscore',
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/utils',
'splunkjs/mvc/tokenutils',
'splunkjs/mvc/simplexml/ready!'], function(_, $, mvc, utils, TokenUtils){
var tokens = mvc.Components.get('default');
var abcvalue = splunkjs.mvc.Components.getInstance("abcselect"); // default value is getting captured here
if (abcvalue != undefined) {
abcvalue.on("change", function(e){
console.log("abc changed to "+tokens.get("abc")); //on token change the value gets captured into through tokens.get("abc")
define your function here
});
}
});
Also please remember to put the JS file in $SPLUNK_APP$/appserver/static folder
... View more
09-02-2019
09:00 PM
First you need to set a ID for your multiselect.
for example -
then you need to define the js like the following.
require([
'underscore',
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/utils',
'splunkjs/mvc/tokenutils',
'splunkjs/mvc/simplexml/ready!'], function(_, $, mvc, utils, TokenUtils){
var tokens = mvc.Components.get('default');
var abcvalue = splunkjs.mvc.Components.getInstance("abcselect"); // default value is getting captured here
if (abcvalue != undefined) {
abcvalue.on("change", function(e){
console.log("abc changed to "+tokens.get("abc")); //on token change the value gets captured into through tokens.get("abc")
define your function here
});
}
});
Also please remember to put the JS file in $SPLUNK_APP$/appserver/static folder
... View more
09-02-2019
07:17 PM
@nareshinsvu did it help solve your problem ?
... View more
09-02-2019
07:16 PM
@stevenbutterworth Did you try the regex that people have posted here ? If that helps then could you please accept the answer.
... View more
09-02-2019
07:13 PM
Did your data started coming to your splunk instance ? @chaga
If not then let me know where exactly your are facing the issue.
... View more
08-30-2019
03:55 AM
The above stanza I pasted will create a new tab from your dashboard once you click on the link. However this below one will create new navigation tab in the SplunkAppbar.
<collection label="Custom Dashboards">
<view name="your view name />
</collection>
This stanza you have to add in your app SPLUNK_HOME/etc/apps/YOUR_APP/local/data/ui/nav/default.xml
... View more
08-30-2019
03:44 AM
@chaga You should write your inputs.conf and outputs.conf
sample inputs.conf
[monitor:///filepath to monitor]
index =
sourcetype =
host = yourhostname
sample outputs.conf
Run this command to create outputs.conf /opt/splunkforwarder/bin/splunk add forward-server :port
then restart - /opt/splunkforwarder/bin/splunk restart
... View more
08-30-2019
03:27 AM
Could you please try to add blacklist and add your archived file type, In addition to that also keep your initCrcLength a multiple of 256.
... View more
08-30-2019
03:10 AM
Could you please send the sample log file. Then I might be able to help you write the regex query
... View more
08-30-2019
02:58 AM
@stevenbutterworth You have to setup two files. props.conf and transforms.conf
Please have a loot at the example below.
props.conf
[srctype1]
TRANSFORMS-set = setnull, logstoCapture
transforms.conf
[logstoCapture]
REGEX =
DEST_KEY = queue
FORMAT = indexQueue
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
... View more
08-30-2019
01:19 AM
@vishaltaneja07011993 Please try the below code.
<html>
<div>
<a href="/app/$env:app$/your_viewname">Admin</a>
</div>
</html>
... View more
08-29-2019
10:16 PM
@satyajitjem Please go through the the answer below - https://answers.splunk.com/answers/582405/how-to-migrate-a-clustered-indexer-peer-to-a-new-h.html
https://answers.splunk.com/answers/582405/how-to-migrate-a-clustered-indexer-peer-to-a-new-h.html
... View more
08-29-2019
10:01 PM
Please go through the URL that @mayurr98 has pasted.
And if you want to refresh the page or panels of your dashboard from a click of a button in your dashboard then i would suggest you to create a button first then write the functionality of this button using javascript.
If you require help in writing a script to refresh the panels let me know
... View more
08-29-2019
09:50 PM
Could you please elaborate issue ? For example what property you have used in your inputs.conf stanza and outputs.conf.
... View more
08-29-2019
09:45 PM
@naregayam Please have a look at these apps below.
https://splunkbase.splunk.com/app/3720/
https://splunkbase.splunk.com/app/1739/
Also go through the link to save the mails into a file and then have it monitored via Splunk.
https://www.techhit.com/messagesave/help/saving-outlook-messages.html
... View more
08-29-2019
09:36 PM
@wailoont I understand your requirement and for a workaround you can use summary index to collect the data that you are getting in the default index. It will not count for license usage as summary indexing doesn't increase the daily ingestion volume.
To send the data to summary index.
Create a index first.
use the below query. index= | table * | collect index= source="your custom source"
Run this query as a scheduled search and set the schedule as per your need.
... View more
08-29-2019
09:27 PM
@nareshinsvu Please go through the following document and let me know if it helps!
https://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Advancedsourcetypeoverrides
... View more
08-29-2019
09:14 PM
sample monitor stanza in your case would be something like this
[monitor:///your filepath to be monitor]
index =
sourcetype =
initCrcLength =
blacklist = .(?:txt|gz)$ //It will exclude the .txt file format and .gz
... View more
08-29-2019
09:08 PM
@nareshinsvu Can send a sample of your logFile here. As Splunk reads the first and last 256 characters of the monitored file and keep a track of that in a file called fishbucket.
case 1 : If your logfile has a long header and has more than 256 characters. Then I would suggest you to increase the initCrcLength of the monitor stanza. Also please remove the crcSalt in your case.
case 2 : You can add a blacklist property. Which will exclude the file types as .tar.gz or .gz.
You can go through the documentation for input monitor stanza and see which one fits best for your case - https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Inputsconf
Please let me know if it helps!
... View more
04-10-2019
10:40 AM
@robettinger If you want to highlight text or string values in table cell, Then you need to add the following code.
// Update the cell content
$td.text(value).addClass('string');
I have tried it in my case and it works.
Please let me know if you encounter any other problems.
... View more
07-07-2018
02:22 AM
I have tried this trick. But my fields are generated dynamically. So hard-coding the values in charting.fieldColors will not work.
... View more
07-06-2018
05:50 AM
Hi Splunkers!
We need to show the number of dots for each zip code in Splunk cluster map. On hover on each dot, we should show the zip code and mark the dots with a specific color.
I have a table like below.
zipcode latitude longitude Avg(percent1) avg(percent2) avg(percent3)
currently we are doing like this-
geostats latifield=latitude longfield=longitude count by zipcode.
Which is showing the number of count in the map but we are not able to restrict the color codes based on (avg%percent).
Could you please help me out here!
... View more
12-13-2017
02:49 AM
I am guessing you want the formula to conver Maidenhead Grid square to latitude and longitude. if yes then you can go to the below link and check for it.
https://ham.stackexchange.com/questions/221/how-can-one-convert-from-lat-long-to-grid-square
I believe this will help you convert them to latitude and longitude. Then save this formula as macro in your search head, so you don't need to write it again n again for future purpose. You just have to call the macro.
... View more
12-13-2017
02:37 AM
You need to write props.conf and transforms.conf when you want to filter any data.
In your case you need construct your props.conf like below.
[sourcetype]
TRANSFORMS-set =setnull, Error
transforms.conf
[setnull] --------------------------------------this is direct all the unwanted data to null queue. (Same as dev/null for linux)
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
[Error] ---------------------- It will filter all the events which have ERROR keyword in them and redirect them to your index
REGEX = ERROR
DEST_KEY = queue
FORMAT = indexQueue
... View more
12-13-2017
02:26 AM
First run the script from the folder and check whether it is giving you output or not.
Probably you have given wrong "\" ...replace this with "/"
[script://$SPLUNK_HOME/etc/apps/search/bin/test.py]
disabled = false
index = main
interval = 60.0
sourcetype = csv
Also check the user with which you have installed Splunk have permission to run the script.
... View more
