Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About nabeel652
nabeel652
Builder
Member since:
04-15-2015
12-11-2022
Community Statistics
| Posts | 180 |
| Solutions | 16 |
| Karma Given | 38 |
| Karma Received | 38 |
| Member Since | 04-15-2015 |
Activity Feed
- Got Karma for Re: How to hide or grey out Clone option under Edit on Splunk dashboard?. 08-16-2023 02:04 AM
- Got Karma for Re: How to hide a column in a table if every value in that column is null?. 04-11-2022 02:28 PM
- Got Karma for Re: How to monitor Microsoft CA logs on Server 2008 R2?. 10-05-2021 11:31 AM
- Posted What's the difference between nomv and mvcombine? on Splunk Search. 12-27-2020 05:34 PM
- Got Karma for Re: How to hide a column in a table if every value in that column is null?. 12-07-2020 05:45 PM
- Got Karma for Re: How to hide or grey out Clone option under Edit on Splunk dashboard?. 08-01-2020 12:46 AM
- Posted Re: Source Override on Getting Data In. 07-06-2020 07:54 PM
- Posted Re: Source Override on Getting Data In. 07-06-2020 04:19 AM
- Posted Re: Source Override on Getting Data In. 07-06-2020 03:37 AM
- Posted Re: Source Override on Getting Data In. 07-06-2020 03:26 AM
- Posted Re: Source Override on Getting Data In. 07-06-2020 12:47 AM
- Posted Re: Source Override on Getting Data In. 07-05-2020 11:46 PM
- Posted Re: Source Override on Getting Data In. 07-05-2020 11:26 PM
- Posted Re: Source Override on Getting Data In. 07-05-2020 11:21 PM
- Posted Re: Source Override on Getting Data In. 07-05-2020 11:18 PM
- Posted Re: Source Override on Getting Data In. 07-05-2020 11:15 PM
- Posted Sourcetype Override on Getting Data In. 07-05-2020 11:04 PM
- Karma Re: How can I fix Symantec Endpoint Protection (SEP) field extractions (again)? for gf13579. 06-05-2020 12:50 AM
- Karma Re: searchWhenChanged=false not honored? for niketn. 06-05-2020 12:50 AM
- Karma Re: Can I execute several functions with a single (perhaps custom) command? for dmarling. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
12-27-2020
05:34 PM
Could someone please show the difference between nomv and mvcombine with some examples? What I have seen is that both work exactly the same way and delim parameter in mvcombine doesn't work as expected. Thanks
... View more
07-06-2020
07:54 PM
@gcusello Well, what a silly mistake that I've made It is MetaData:Sourcetype NOT MetaData::Sourcetype Fixed it and all good! Thanks anyway for your time and sorry once again for the small typo that caused big hassle 😄
... View more
07-06-2020
03:37 AM
Yep, All three files inputs.conf, props.conf and transforms.conf is in /opt/splunk/etc/apps/mycustomapp/local/
... View more
07-06-2020
03:26 AM
props.conf [performance]
TRANSFORMS-changesourcetype = sourcetype_override transforms.conf [sourcetype_override]
REGEX = .
FORMAT = sourcetype::new_srctype
DEST_KEY = MetaData::Sourcetype
... View more
07-06-2020
12:47 AM
Thanks @gcusello Sourcetype has no other use. I'm in fact trying to create an example to demonstrate sourcetype override. Works fine with monitored inputs but scripted inputs giving problems. Still no luck. I've used the original sourcetype i. e "performance" but no change at all.
... View more
07-05-2020
11:46 PM
Tried that but still not working. Yes, I'm restarting Splunk everytime I make changes
... View more
07-05-2020
11:26 PM
@gcusello Some more details: I've deployed the scripted input on one of my heavy forwarders. I've tried this transform on the same heavy forwarder as well as the indexer but fails to change the sourcetype to new one.
... View more
07-05-2020
11:18 PM
Thanks @gcusello Yes, that's correct. However, my transform is not working at all
... View more
07-05-2020
11:04 PM
I have a deployed a scripted input with source=perfmon_script that gets server and workstation data. in props.conf I have: [source::perfmon_script]
TRANSFORMS-changesourcetype = sourcetype_new in transforms.conf [sourcetype_new]
REGEX = .
FORMAT = sourcetype::somesrctype
DEST_KEY = MetaData::Sourcetype Sourcetype not changing. What am I doing wrong?
... View more
Labels
- Labels:
-
props.conf
-
sourcetype
-
transforms.conf
05-21-2020
04:08 PM
Thanks
Yep, tried that as well but no matter what App I select it gets written to "search" app's local directory
... View more
05-21-2020
03:33 AM
I'm creating an remote performance monitor input through Settings => Data Input => Remote performance monitoring on a Windows system. Even though I select my custom app in "App Context" while setting up the input but every time the wmi.conf file gets written to the search app's local folder. I've tried it on Splunk 8.03 and 7.3.1 and the behaviour is consistent.
I know we can manually port the stanza to app of our choice but the actual concern here is that why the option for selecting "App Context" while creating input through Splunk Web is not working.
Can somebody please verify if this is the case or I'm doing something silly?
... View more
01-04-2020
06:09 PM
Hi @skalliger
It's not about any specific managed lookup. You can pick up any lookup from the content management dashboard and try to export it. It will not be exported with the .csv file.
... View more
01-03-2020
09:57 PM
I have a custom lookup on my ES search-head. I have added it to manged lookups and it shows up fine in the Content Management Dashboard. However When I try to export it as an app i. e. I select it and then in "Edit Selection" dropdown at the top I select Export. It exports it the app fine. But when I download the app and open it it has only two folders "default" and "meta" and in default it has transforms.conf as expected. But what I'm missing is the .csv file. The documentation says that when you export a managed lookup the csv file will be exported but it is NOT. (I'm onES 6.0).
The like to docs where it says the csv will be exported with managed lookups:
https://docs.splunk.com/Documentation/ES/6.0.0/Admin/Export
... View more
12-27-2019
10:06 PM
Thanks a lot gcusello
Sorry for being dumb, when I run a realtime search in the dashboard it is continuous. But what confuses me here is that it is scheduled for running every five minutes. So what does it mean? It executes on say 00 past the hour and it is real time I believe it will keep running perpetually scanning the newly received events continuously. However, what'd happen at 05 past the hour. Or it'll run once on real time data and then stop and run again on realtime data once after five minutes? If this is the case we are already looking five minutes back in the time range i. e rt-5m@m
... View more
12-27-2019
01:15 AM
thanks @gcusello
I know the rest of the stuff, just confused about rt part. Can you elaborate it a bit what does continuously update means?
Yest it was */5 * * * * that was missed due to formatting.
... View more
12-27-2019
12:40 AM
Hi Guys
In Splunk ES there is correlation search "Excessive Failed Logins" which has time range set to latest=rt-5m@m earliest=rt-65m@m. It is scheduled */5 * * * *
Can't understand what rt means in the time ranges
... View more
12-10-2019
06:24 PM
I am running a search like this:
| makeresults | fields - _time | eval data = "Susan|Developer|Software,Chris|Admin|Server,Bob|Developer|Software,Tina|Admin|Server,Chris|Developer|Software" | table data | makemv delim="," data | mvexpand data | rex field=data "^(?<Employee>[^\|]*)\|(?<Role>[^\|]*)\|(?<Department>.*$)" | fields - data | xyseries Department, Employee, Role
What I need is to be able to color cells in the final table based on user roles - like green for Developer, blue for Admin etc.
The problem is the field names are dynamic and I cannot find a way to set coloring options for such fields. I know it's tricky any thoughts? I'd prefer a non-HTML, non-Javascript solution as I am hosted in SplunkCloud.
I've tried field="*" in the format tag but it doesn't work.
<format type="color" field="*">
<colorPalette type="map">{"Developer":#2ECC71,"Admin":#5DADE2,"Project Manager":#AED6F1}</colorPalette>
</format>
... View more
