Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About BigCosta
BigCosta
Path Finder
Member since:
05-22-2017
09-21-2020
Community Statistics
| Posts | 13 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 9 |
| Member Since | 05-22-2017 |
Activity Feed
- Got Karma for Re: How to use CSS to increase the width of a drop-down input?. 08-24-2023 11:50 PM
- Got Karma for Re: How to use CSS to increase the width of a drop-down input?. 01-17-2023 12:14 PM
- Got Karma for Re: Splunk Machine Learning Tool kit: Error in 'fit' command: External search command exited unexpectedly.. 12-01-2020 04:49 AM
- Posted Re: Splunk Machine Learning Tool kit: Error in 'fit' command: External search command exited unexpectedly. on All Apps and Add-ons. 09-20-2020 06:46 PM
- Got Karma for Re: How to use ldapfilter with ldapsearch to get group names?. 06-05-2020 12:49 AM
- Got Karma for Re: How to use ldapfilter with ldapsearch to get group names?. 06-05-2020 12:49 AM
- Got Karma for Re: How to use CSS to increase the width of a drop-down input?. 06-05-2020 12:48 AM
- Got Karma for Re: How to use CSS to increase the width of a drop-down input?. 06-05-2020 12:48 AM
- Got Karma for Re: How to use CSS to increase the width of a drop-down input?. 06-05-2020 12:48 AM
- Posted Re: How can I extend the width of my drop down box in my dashboard? on Splunk Search. 12-19-2019 10:50 AM
- Posted Re: How to use CSS to increase the width of a drop-down input? on Dashboards & Visualizations. 12-19-2019 09:44 AM
- Posted Re: Setting host and sourcetype in elasticsearch-data-integrator on All Apps and Add-ons. 11-14-2019 07:15 AM
- Posted Re: Splunk Machine Learning Tool kit: Error in 'fit' command: External search command exited unexpectedly. on All Apps and Add-ons. 10-12-2019 08:41 PM
- Posted Re: Splunk Machine Learning Tool kit: Error in 'fit' command: External search command exited unexpectedly. on All Apps and Add-ons. 10-12-2019 07:27 AM
- Posted Re: How to use ldapfilter with ldapsearch to get group names? on Security. 07-10-2019 09:41 AM
- Posted BUG: ldapfilter ignores basedn and limit options on All Apps and Add-ons. 06-10-2019 03:20 AM
- Tagged BUG: ldapfilter ignores basedn and limit options on All Apps and Add-ons. 06-10-2019 03:20 AM
- Tagged BUG: ldapfilter ignores basedn and limit options on All Apps and Add-ons. 06-10-2019 03:20 AM
- Tagged BUG: ldapfilter ignores basedn and limit options on All Apps and Add-ons. 06-10-2019 03:20 AM
- Posted Re: BUG: ldapfilter does not properly output whenCreated field. on All Apps and Add-ons. 06-10-2019 01:52 AM
Topics I've Started
09-20-2020
06:46 PM
Hi Emiliano! Yes, i solved this problem. Solution in my post in this thread from date 10-12-2019 08:41 PM.
... View more
12-19-2019
10:50 AM
Hi!
Here is my solution to the problem
https://answers.splunk.com/answers/423824/how-to-use-css-to-increase-the-width-of-a-drop-dow.html
... View more
12-19-2019
09:44 AM
5 Karma
Hi!
This work in Splunk versions 7 and 8
<input type="dropdown" token="tps_logger_method" searchWhenChanged="true" id="resized_input">
<label>Select a logger name</label>
<search>
<query>eventtype=mlc2 sourcetype=tps host=$host_token$ | table name | dedup name | sort name</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
</search>
<fieldForLabel>name</fieldForLabel>
<fieldForValue>name</fieldForValue>
<default>murex.limits.engine.stream.histo.TPSHistoCounter</default>
</input>
<row depends="noshow">
<panel>
<html>
<style>
#resized_input { width: 500px; }
#resized_input [data-component] { width: auto !important; }
</style>
</html>
</panel>
</row>
This work on all inputs: radio, dropdown, checkbox, multiselect, link, time.
But on multiselect input you need to set the width exactly to size.
Example:
#multiselect_input { width: 500px; }
#multiselect_input [data-component] { width: 500px !important; }
... View more
11-14-2019
07:15 AM
Hi!
I think the inability to set your own sourcetype is a bug. But there is workaround. Use source for set sourcetype and host . Insert TRANSFORMS in your props.conf and add the transformation to transforms.conf
props.conf
[source::metric-*]
SHOULD_LINEMERGE = 0
KV_MODE = json
TIME_PREFIX = "@timestamp":
MAX_TIMESTAMP_LOOKAHEAD = 40
TRANSFORMS-host_sourcetype_override = elk_host_override, elk_sourcetype_override
transforms.conf
[elk_host_override]
REGEX = "beat":\s*{[^}]*?"hostname":\s*"([^"]+)
DEST_KEY = MetaData:Host
FORMAT = host::$1
[elk_sourcetype_override]
REGEX = .
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::Metric_Elastic
... View more
10-12-2019
08:41 PM
1 Karma
Hi!
I found a solution to this problem. You need to update three Python packages that come as part of Splunk_SA_Scientific_Python_linux_x86_64 -- NumPy, SciPy and scikit_learn
To do this You need to do the following:
Download from Python software repository https://pypi.org/ latest numpy, scipy and scikit_learn packages (yum won't help because it downloads older versions)
numpy-1.16.5-cp27-cp27mu-manylinux1_x86_64.whl
scipy-1.2.2-cp27-cp27mu-manylinux1_x86_64.whl
scikit_learn-0.20.4-cp27-cp27mu-manylinux1_x86_64.whl
Install packages in system python
pip install numpy-1.16.5-cp27-cp27mu-manylinux1_x86_64.whl
pip install scipy-1.2.2-cp27-cp27mu-manylinux1_x86_64.whl
pip install scikit_learn-0.20.4-cp27-cp27mu-manylinux1_x86_64.whl
Make a backup of the original numpy, scipy and scikit_learn packages located in Splunk_SA_Scientific_Python_linux_x86_64
mv $SPLUNK_HOME/etc/apps/Splunk_SA_Scientific_Python_linux_x86_64/bin/linux_x86_64/lib/python2.7/site-packages/numpy $SPLUNK_HOME/etc/apps/Splunk_SA_Scientific_Python_linux_x86_64/bin/linux_x86_64/lib/python2.7/site-packages/numpy.orig
mv $SPLUNK_HOME/etc/apps/Splunk_SA_Scientific_Python_linux_x86_64/bin/linux_x86_64/lib/python2.7/site-packages/scipy $SPLUNK_HOME/etc/apps/Splunk_SA_Scientific_Python_linux_x86_64/bin/linux_x86_64/lib/python2.7/site-packages/scipy.orig
mv $SPLUNK_HOME/etc/apps/Splunk_SA_Scientific_Python_linux_x86_64/bin/linux_x86_64/lib/python2.7/site-packages/sklearn $SPLUNK_HOME/etc/apps/Splunk_SA_Scientific_Python_linux_x86_64/bin/linux_x86_64/lib/python2.7/site-packages/sklearn.orig
Copy installed packages from system python to Splunk_SA_Scientific_Python_linux_x86_64
cp -r /usr/lib64/python2.7/site-packages/numpy* -t $SPLUNK_HOME/etc/apps/Splunk_SA_Scientific_Python_linux_x86_64/bin/linux_x86_64/lib/python2.7/site-packages
cp -r /usr/lib64/python2.7/site-packages/scipy* -t $SPLUNK_HOME/etc/apps/Splunk_SA_Scientific_Python_linux_x86_64/bin/linux_x86_64/lib/python2.7/site-packages
cp -r /usr/lib64/python2.7/site-packages/sklearn -t $SPLUNK_HOME/etc/apps/Splunk_SA_Scientific_Python_linux_x86_64/bin/linux_x86_64/lib/python2.7/site-packages
All done, you can now run the search with the fit command (Splunk reboot is not required)
The numpy, scipy and scikit_learn packages in system python are no longer needed and you can remove them with the pip uninstall <package> command
... View more
10-12-2019
07:27 AM
Hello!
I have the same problem. I researched the problem and found that the problem is in the numpy module.
The code of Python " import numpy as np " causes "Illegal instruction (core dumped)"
You can check this by running the command:
/opt/splunk/etc/apps/Splunk_SA_Scientific_Python_linux_x86_64/bin/linux_x86_64/bin/python -c "import numpy as np"
You will see a lot of errors like "ERROR:root:code for hash xxxxx was not found." - that's okay.
If you have no problems with the "fit" command, then the last lines of the output will be:
ValueError: unsupported hash type sha512
If you have problems with the "fit" command, then the last lines of the output will be:
ValueError: unsupported hash type sha512
Illegal instruction (core dumped)
I have not yet found why the numpy module does not start...
I have Splunk 7.3.2, Splunk_SA_Scientific_Python_linux_x86_64 1.4 and Splunk_ML_Toolkit 4.4.1
... View more
Hi!
This code leave only group objects, excluding the user objects.
| ldapsearch search="(&(objectClass=group)(cn=tt_users))" attrs="cn,distinguishedName"
| ldapgroup
| table cn member_name
| mvexpand member_name
| ldapfilter search="(&(objectClass=group)(cn=$member_name$))" attrs="objectSid"
... View more
06-10-2019
03:20 AM
App: SA-ldapsearch (Version 2.2.0 and Version 2.2.1)
This search will give more than 3 results, and the objects in results will be not only from "CN=Users,DC=corp,DC=domain,DC=com", but also, for example, from "CN=Builtin,DC=corp,DC=domain,DC=com."
For test, change the value of "DC=corp,DC=domain,DC=com" in basedn to the value of your domain.
| makeresults
| ldapfilter search="(sAMAccountName=*)" attrs="distinguishedName,sAMAccountName" basedn="CN=Users,DC=corp,DC=domain,DC=com" limit=3
... View more
06-10-2019
01:52 AM
The same problem with the whenChanged attribute
... View more
06-05-2017
03:32 AM
I found a workaround for the problem.
I changed the SQL query
round((cast(CREATED as date)-to_date('01011970','MMDDYYYY'))*86400)||'.'||to_char(CREATED, 'FF') as CREATED_EPOCH
... View more
05-23-2017
09:26 PM
After adding, I get an error:
SQLSyntaxErrorException: ORA-00932: inconsistent datatypes: expected NUMBER got INTERVAL DAY TO SECOND
Here it works without error:
(trunc(CREATED) - TO_DATE('01-01-1970', 'MM-DD-YYYY')) * 86400 as indexTime
BUT time is rounded to one day. This is unacceptable to me. I need original accuracy.
In fact, DB Connect v3 converts a TIMESTAMP type to a DATATIME type.
Can I make DB Connect v3 not do this with TIMESTAMP types, but just keep it in the form in which it is shown in oracle (1495450599.159)?
... View more
05-22-2017
07:37 PM
Thanks for the quick response!
I need to be in the index TIMESTAMP was in epoch.
I already have an old index in which TIMESTAMP is in epoch and there are complex searches and applications that use epoch. In my situation, the use of this workaround is very difficult.
... View more
05-22-2017
07:21 AM
Hello!
I used Splunk DB Connect v1 and now I updated it to Splunk DB Connect v3. I get data from oracle sql.
I have several TIMESTAMP type columns that in version 1 were saved in the epoch format, but in version 3 they are stored in human readable format.
Example (CREATED is TIMESTAMP type):
Version 1: CREATED = 1495450599.159
Version 3: CREATED = 2017-05-22 13:56:39.159
How to make so that in version 3 TIMESTAMP type was in epoch format?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-21-2020
02:30 AM
|
Karma from
