About LintuMathews

jcoates · ‎04-05-2018

More than one level is assumed, no one really has a flat organization. It doesn't make any difference to my advice. Missing data is also normal, but not your problem. In fact your dashboard might even inspire people to start fixing the source data.

the_wolverine · ‎01-04-2016

The Overview is using real-time searches so you should be seeing data as long as data as flowing into Splunk. https://answers.splunk.com/answers/215077/any-performance-issues-with-all-the-real-time-sear.html Everything else is based on data model acceleration. We have seen tstats delayed significantly. This may or may not be based on your volume of PAN data. You might want to ping PAN about tuning although we have given up and worked around it using summary indexing although Palo Alto will tell you that the latest version of the app is better tuned for data model acceleration -- it was many months of frustration. https://answers.splunk.com/answers/326382/palo-alto-networks-app-for-splunk-data-model-frequ.html https://answers.splunk.com/answers/318950/can-you-disable-the-acceleration-of-all-data-model.html

LintuMathews · ‎04-10-2015

I was hoping something like this would work, this was generated through the erex , but needs some adjustments i guess rex "(?i)windows\(?P[^\]+)"

LintuMathews · ‎07-30-2014

Thanks, I used this query and it works: index=msad lastLogonTimestamp | stats latest(lastLogonTimestamp) by employeeID

LintuMathews · ‎08-27-2014

I tried the options suggested on MY SEARCH HEADS, it is returning results with errors for my linux indexers-"Streamed search execute failed because: Error in 'geoip' command: command="geoip", Error: GeoIP database file '/Program Files/Splunk/etc/apps/maps/bin/GeoLiteCity.dat' does not exist!". My architecture has 2 Search Heads in Windows and 4 indexers- (2 Indexers windows and 2 indexers- Linux). Each of these indexers have its own sets of data. ie..no mirroring configured. hence I will have to availability of all indexers for a search operation. So here is what i did: 1. modify the Search heads & Indexers running on Windows- geoip.conf with following entry: database_file = /Program Files/Splunk/etc/apps/maps/bin/GeoLiteCity.dat Modify the indexer running Linux - geoip.conf with following entry: database_file = /opt/splunk/etc/apps/maps/bin/GeoLiteCity.dat However on my Search head, when I try to run syntax, for example: "index=vpn session disconnected | geoip IP " does return with events for my indexers running windows, but fails to provide events from indexers running on Linux. But if I run the syntax individually on the Indexer running with Linux, it does return events. Can someone help propose a solution for this ?

jdunlea · ‎08-19-2015

Does this still stand for the current version of the SA-ldapsearch?

Posts	11
Solutions	1
Karma Given	0
Karma Received	2
Member Since	‎04-11-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How to find employee manager up to levels above un...

Palo Alto Networks App for Splunk: Why are tstats ...

Advise a rex for domain\username example windows\...

Query to find the latest time entry for lastlogonT...

Re: How to find employee manager up to levels abov...

Re: Palo Alto Networks App for Splunk: Why are tst...

Re: Advise a rex for domain\username example wind...

Re: Query to find the latest time entry for lastlo...

Re: geoip command stops working after upgrade to 6...

Re: Group policy changes error code 1 in Splunk Ap...