Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About dkrichards16
dkrichards16
Path Finder
Member since:
06-09-2017
07-16-2020
Community Statistics
| Posts | 22 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 4 |
| Member Since | 06-09-2017 |
Activity Feed
- Got Karma for Re: Which is faster: SHOULD_LINEMERGE vs LINE_BREAKER. 10-20-2020 11:52 PM
- Posted Splunk Search Heads in infinite loop of refreshing on Splunk Search. 07-16-2020 10:40 AM
- Got Karma for Splunk Add-on for Mobile Access with Splunk Enterprise 7.0.1. 06-05-2020 12:49 AM
- Got Karma for Splunk Add-on for Mobile Access with Splunk Enterprise 7.0.1. 06-05-2020 12:49 AM
- Got Karma for Splunk Add-on for Mobile Access with Splunk Enterprise 7.0.1. 06-05-2020 12:49 AM
- Karma Re: How can I install a splunk 4.2+ license from the command line? for jrodman. 06-05-2020 12:46 AM
- Posted Re: How do I remove a search head that is appearing under the Indexer Clustering page? on Deployment Architecture. 08-01-2019 12:24 PM
- Posted | tunefs not working when searching in the Alerts Timing Optimization Scheduler App on All Apps and Add-ons. 07-10-2019 07:00 AM
- Tagged | tunefs not working when searching in the Alerts Timing Optimization Scheduler App on All Apps and Add-ons. 07-10-2019 07:00 AM
- Posted Cisco Teams on All Apps and Add-ons. 04-04-2019 02:14 PM
- Tagged Cisco Teams on All Apps and Add-ons. 04-04-2019 02:14 PM
- Tagged Cisco Teams on All Apps and Add-ons. 04-04-2019 02:14 PM
- Tagged Cisco Teams on All Apps and Add-ons. 04-04-2019 02:14 PM
- Posted Re: Add a help panel to a dashboard? on Dashboards & Visualizations. 02-18-2019 11:40 AM
- Posted Re: Which is faster: SHOULD_LINEMERGE vs LINE_BREAKER on Splunk Search. 09-05-2018 02:20 PM
- Posted Re: Which is faster: SHOULD_LINEMERGE vs LINE_BREAKER on Splunk Search. 09-05-2018 02:04 PM
- Posted Which is faster: SHOULD_LINEMERGE vs LINE_BREAKER on Splunk Search. 09-05-2018 12:08 PM
- Tagged Which is faster: SHOULD_LINEMERGE vs LINE_BREAKER on Splunk Search. 09-05-2018 12:08 PM
- Tagged Which is faster: SHOULD_LINEMERGE vs LINE_BREAKER on Splunk Search. 09-05-2018 12:08 PM
- Tagged Which is faster: SHOULD_LINEMERGE vs LINE_BREAKER on Splunk Search. 09-05-2018 12:08 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 3 | |||
| 0 | |||
| 0 |
07-16-2020
10:40 AM
We had one search head have to be rebuilt because of JAVA issues. We had another search head, due to a network switch outage, loose connection to the search head cluster. When we re-adding those servers to the search head cluster we not have a strange issue with where custom apps can't search. They either provided a "error fetching saved searches" in the panel then get stuck in a infinite loop of refreshing the browser tab or they load an error 255 where they can't search indexes even though they can search indexes fine in the default search and reporting app. We use custom authorization.conf and authorize.conf configs in /opt/splunk/etc/system/local and affected servers have the latest configs copied from a healthy server. I'm working with splunk support but they are requesting har browser files and the issues seem to be permissions related. Has anyone else seen this issue and able to resolve it?
... View more
- Tags:
- shc
Labels
- Labels:
-
search job inspector
08-01-2019
12:24 PM
I had the same issue and a restart of Splunk on the index master cleared it up.
... View more
07-10-2019
07:00 AM
When I run | tunefs I'm getting "Unknown search command 'tunefs'." Is there something I need to install or enable for that command to run?
... View more
04-04-2019
02:14 PM
Is the Cisco Spark Add-On compatible with the rebranding to Cisco Teams? Also, is it compatible with Splunk 7.2.5?
... View more
02-18-2019
11:40 AM
This great. Very simple to use. A lot eaiser than all the js versions out there!
... View more
09-05-2018
02:20 PM
Thanks. I guess my question is could I put the regex in the line_break and not even need anything in the transforms. But, I'm going to use TRANSFORM-### to link to the transforms to ensure our data gets parsed at index time instead of search time. Thanks for letting me ponder.
... View more
09-05-2018
02:04 PM
1 Karma
NOTE: You get a significant boost to processing speed when you use
LINE_BREAKER to delimit multi-line events (as opposed to using
SHOULD_LINEMERGE to reassemble individual lines into multi-line events).
* When using LINE_BREAKER to delimit events, SHOULD_LINEMERGE should be set
to false, to ensure no further combination of delimited events occurs.
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf
... View more
09-05-2018
12:08 PM
Hi, I'm doing some research for our new architecture and am currently doing some house keeping on our props and transforms.
If we have a regex for a sourcetype, is it faster to put the regex in the transforms or in the props and use line_breaker? Traditionally, we just set should_linemerge to false in the props and then put the regex in the transforms and link it via report in the props. However, I just read something that said doing regular expressions in line_breaker causes a performance increase.
Could someone provide a clear explanation on this for me?
... View more
05-10-2018
06:22 AM
Okay thanks. The MC doesn't have an option for heavy forwarder as a server role. Should I leave it blank? Also, we are using the heavy forwarder to bridge between two splunk instances on different networks and the heavy forwarder is on a dmz. Is it better to send the internal logs to the receiving Splunk location's MC or the MC on the forwarding side's Splunk?
... View more
05-09-2018
09:52 AM
Also, to turn on internal logs. Is it better to add the heavy forwarder to the monitoring console on the receiving side or the sending side. I'm currently working in the sending side and not sure if I can force the internal logs to go to an internal source and not be forwarded with everything else?
... View more
05-09-2018
09:38 AM
In the monitoring console what is the best practice of server role for heavy forwarders? I used Indexer but not sure if there is a better suit for those? Our heavy forwarder will be the only indexer in the overview page because according to the docs for index clusters only add the search head master as a search peer? Could someone please confirm these are both accurate?
... View more
Labels
- Labels:
-
heavy forwarder
-
indexer
02-06-2018
09:28 AM
Hi, I installed the latest version of the custom cluster map visualization app in our testing environment and even after a reboot the app icon isn't coming up. Is there something I need to do to change this from an add-on, that's just available in the background, & a visible app in the side panel?
... View more
01-23-2018
05:59 AM
Thanks Clearing the Web Cache fixed the login screen logo for the two servers I had with broken links.
... View more
01-22-2018
03:03 PM
I'm running into an issue where I accidentally didn't drop the png file into the /opt/splunk/etc/app/search/appserver/static/logincustomlogo/ folder and got a broken image link. I dropped the file and restarted splunk but still getting the broken link. Has anyone else ran into this issue?
Thanks,
... View more
01-22-2018
02:58 PM
Hi, has anyone ran into an issue. I accidentally didn't have the .png or .jpg in the /opt/splunk/etc/apps/search/appserver/static/logincustomlogo/ folder after modifying /opt/splunk/etc/system/local/web.conf file when I restarted and got a broken image link. I then dropped the file in the correct folder and restart splunk again but still getting the broken link. I tried setting the custombackground to default so I could remove the web.conf then started the process over but still no luck. Is there something in the static folder that changes and needs to be manually edited?
... View more
- Tags:
- png
01-09-2018
06:14 AM
We are starting to have additional issues with other apps like DB_Connect and may downgrade to 6.6.5 which has support for Mobile. I'd hate to loose Metric and other cool features of 7.X that was shown in the conf but if I gain speed for features we use daily it might be worth it. I'll keep you posted what we decide on.
... View more
12-11-2017
08:12 AM
3 Karma
Hi, has anyone tested and be able to use Splunk Add-on for Mobile Access with Splunk Enterprise 7.X? It is saying its only supported up to Splunk Enterprise 6.6. Also, we will be using it thru a DMZ for the public IP to be visible in the app.
Thanks,
... View more
08-31-2017
01:32 PM
We found the issue. When I escaped less than in the searchbase I accidentally used greater than so the search brought back no results.
... View more
08-30-2017
02:12 PM
I have two Splunk DB Connect SQL queries that I appended into a search and it worked. However, when I append it in the search for a dashboard, which is then used for an inline panel search to provide a total it doesn't add the appended information to the total. Are we allowed to use append in search bases?
... View more
06-09-2017
11:22 AM
I'm not super familiar with macros in Splunk yet but I'll keep this in mind. Thanks
... View more
06-09-2017
11:21 AM
The replace didn't created some null values but the foreach worked and shaved .668 sec off of my query. lol
... View more
06-09-2017
10:45 AM
Hi,
I'm switching from dbquery to dbxquery and I noticed that it brings in booleans as 0/1 instead of true/false. For my reports/dashboards I'd like them to read as true/false. I got the following to work, but was wondering if there was a way to do it for all booleans in a report without setting an if statement for each field:
|eval LogA=if(LogA=1,"True","False")
|eval LogB=if(LogB=1,"True","False")
I've been doing some research on isbool, but not seeing a ton of documentation on it yet. Does anyone out there have a more efficient way to do that?
... View more
