Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About jowenssi
jowenssi
Path Finder
Member since:
08-04-2017
05-23-2025
Community Statistics
| Posts | 22 |
| Solutions | 6 |
| Karma Given | 12 |
| Karma Received | 7 |
| Member Since | 08-04-2017 |
Activity Feed
- Got Karma for Re: In dashboard studio, how do I change time format?. 02-07-2025 09:07 AM
- Karma Developer Spotlight with Paul Stout for vvalverde. 01-22-2025 03:01 PM
- Posted Re: In dashboard studio, how do I change time format? on Splunk Search. 06-20-2024 11:20 AM
- Karma Re: KV Store initialization failed. Please contact your system administrator for anilchaithu. 04-18-2022 05:25 PM
- Got Karma for Re: Suggestions on how we can upgrade the jquery version in this minified js file?. 03-04-2022 09:52 PM
- Karma Re: How do I address "check_for_vulnerable_javascript_library_usage" errors in AppInspect? for sloshburch. 03-04-2022 11:35 AM
- Karma Re: Suggestions on how we can upgrade the jquery version in this minified js file? for sloshburch. 03-04-2022 11:35 AM
- Karma Re: How to update a Splunk® Add-on Builder built app or add-on? for sloshburch. 03-04-2022 11:34 AM
- Got Karma for Re: Suggestions on how we can upgrade the jquery version in this minified js file?. 03-04-2022 11:34 AM
- Posted Re: Suggestions on how we can upgrade the jquery version in this minified js file? on Splunk Dev. 03-04-2022 08:42 AM
- Posted Re: How do I address "check_for_vulnerable_javascript_library_usage" errors in AppInspect? on Splunk Dev. 03-04-2022 08:41 AM
- Posted Re: Suggestions on how we can upgrade the jquery version in this minified js file? on Splunk Dev. 03-04-2022 08:39 AM
- Karma Re: Enterprise Security in Splunk 7.1 for smoir_splunk. 06-05-2020 12:49 AM
- Karma Re: How to create an alert if any one log file is missing from long list of files from same location? for cpetterborg. 06-05-2020 12:49 AM
- Karma Re: Can I install a "no-enforcement" key on an older version of Splunk? for mdsnmss. 06-05-2020 12:49 AM
- Karma Re: How to host a Splunk dashboard somewhere so that the users can see the dashboard upon clicking a link? for jluo_splunk. 06-05-2020 12:49 AM
- Karma Re: How to hide or not to make visible the tokens in the splunk url for martin_mueller. 06-05-2020 12:49 AM
- Karma Re: Can you combine fields from multiple search in one table? for PowerPacked. 06-05-2020 12:49 AM
- Karma Re: How to do the equivalent of a debug/refresh on cluster master master-apps? for dxu_splunk. 06-05-2020 12:49 AM
- Got Karma for Re: Enterprise Security in Splunk 7.1. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
06-20-2024
11:20 AM
1 Karma
Using YYYY-MM-DD HH:MM:SS will yield incorrect results with the current dashboard studio version due to the overlap of Month and Minute. The correct way would be to use: YYYY-MM-DD HH:mm:ss @sbarnes_nj was correct in stating the format reference here: https://momentjs.com/docs/#/displaying/
... View more
03-04-2022
08:42 AM
One thing I forgot to note. This appears to be fixed in Add-on Builder version 4.1.0 but you will need to perform the export/import process if you upgrade the app in-place.
... View more
03-04-2022
08:41 AM
This is sometimes caused by the behavior of AppInspect versions prior to 4.1.0. See this post for more info: https://community.splunk.com/t5/Developing-for-Splunk-Enterprise/Suggestions-on-how-we-can-upgrade-the-jquery-version-in-this/m-p/587680#M9798
... View more
03-04-2022
08:39 AM
2 Karma
Sometimes this is a false-positive from Add-on Builder because it does not prune legacy files on Export. We found that by following this procedure, the Add-on Builder will essentially fix itself by pruning unrequired JS files: - Export the app from Add-on Builder - Delete the app from Add-on Builder - Import the app to Add-on Builder - Package and download the app from the "Validate & Package" dashboard This should remove the common.js from the package if it is not relevant.
... View more
06-12-2018
12:51 PM
This is true, but only if the environment is configured correctly. The rest call below will display the same role information.
... View more
06-12-2018
12:49 PM
The easiest/quickest way would be to identify the instances running a Job Scheduler. Depending on the configuration of the distributed environment, this could return Indexers or instances with other Splunk roles that run jobs. This query also assumes that all of your logs are being forwarded to the Indexers.
index=_internal sourcetype=scheduler
You could then run this REST search on the instances to identify if the Splunk role is set as a Search Head:
| rest splunk_server=local /services/server/info | table serverName server_roles
... View more
06-12-2018
12:33 PM
Sure, just use | appendcols
search foo | fields date,open,close | appendcols [ search bar | fields incident,type1,result]
http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Appendcols
... View more
06-12-2018
12:31 PM
To use the REST API, you must have a paid subscription to Splunk Cloud. The reason is because there are specific credentials necessary.
http://docs.splunk.com/Documentation/SplunkCloud/7.0.3/User/WelcometoSplunkCloud
... View more
06-12-2018
06:47 AM
NOT and dedup are really expensive. Try something like this:
search index=auto_prod_cm_comparisions source=*cert_details.log earliest=-1m | stats count by host,source | fields host,source | append [inputlookup source.csv | stats count by host,source | fields host,source] | stats count by host, source | search count = 1
That will give you the delta between the two and allow you to identify which sources are either extra or missing.
... View more
06-11-2018
09:25 AM
Splunk Enterprise Security 5.1 is compatible with Splunk 7.1.
Per the docs: Splunk Web for Splunk 7.1.0 and Splunk Enterprise Security 5.1.0 provides an updated look and feel. As a result, these two releases of the Splunk platform and Splunk Enterprise Security are only supported with each other.
http://docs.splunk.com/Documentation/ES/5.1.0/RN/Enhancements
... View more
06-11-2018
08:41 AM
1 Karma
The new query would be:
/opt/splunk/bin/splunk search "index =main sourcetype=employee_data_hcprd earliest=-24h@h latest=now |search HR_STATUS=\"I\" | table EMPLID" -maxout 0 > /opt/jobdata.txt
... View more
06-11-2018
08:28 AM
Can you be more specific?
It sounds like you need a regular expression. The only binary characters are "0" and "1".
This regex would match binary characters: "[01]+"
... View more
06-11-2018
08:18 AM
There are a couple ways to do this. You could keep a "master list" of log files as a CSV lookup, then have a scheduled search compare your search against the lookup and send an alert if there are less records.
The other way would be to index (or append to a KVstore) the number/list of log files for each host and do the same scheduled search comparison.
Basically, you'll need to decide if you want to compare against a master list, or compare against a previous ("normal") list of log files.
... View more
06-11-2018
08:14 AM
Sadly, that's the way that tokens are passed. If you want to obfuscate the tokens, consider doing some hashing yourself.
Why are you trying to hide the tokens? They'll be visible on the dashboard anyways.
... View more
06-11-2018
08:12 AM
Is this Windows or *Nix?
Depending on your Splunk version, you could try an fschange input. The docs are here: http://docs.splunk.com/Documentation/Splunk/7.1.1/Data/Monitorchangestoyourfilesystem
Here's some more info on how to do it on Windows: https://docs.splunk.com/Documentation/Splunk/7.1.1/Data/MonitorfilesystemchangesonWindows
As an alternative to FSChange, there are some Open Source (and not) solutions (i.e. TripWire).
... View more
06-11-2018
08:03 AM
The new query would be:
/opt/splunk/bin/splunk search "index =main sourcetype=employee_data_hcprd earliest=-24h@h latest=now |search HR_STATUS="I" | table EMPLID" -maxout 0 > /opt/jobdata.txt
... View more
06-07-2018
10:40 AM
Unless there is a misconfigured input feeding the audit index, the easiest answer is that there seem to be a large amount of changes in your environment. The DIY solution would be to search the audit index to identify what changes are occurring. These could be a script making changes to the Splunk files on disk, or a large/excess amount of activity. Here's a list of all of the activities that would cause an entry in the audit index: https://docs.splunk.com/Documentation/Splunk/7.1.1/Security/AuditSplunkactivity
... View more
06-07-2018
10:32 AM
It looks like it was removed. It's supposed to be here https://play.google.com/store/apps/details?id=com.splunk.mobile.access&hl=en. I don't know why this was prior to it's EOL on August 13, 2018.
Mobile App Release Notes - http://docs.splunk.com/Documentation/MobileApp/2.4.4/AndroidAppReleaseNotes/Features
Splunk Mobile Access Information - https://www.splunk.com/en_us/products/splunk-mobile-access.html
... View more
06-06-2018
12:31 PM
You can put a server.conf file (or better yet an app containing a server.conf file) that sets the license server with:
[license]
master_uri = [self|<uri>]
* An example of <uri>: <scheme>://<hostname>:<port>
Referenced from: https://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Serverconf
You can use python to check the hostname or another variable to check if the Splunk role would require a License Master.
... View more
05-14-2018
01:54 PM
2 Karma
Splunk ES 5.1 was released and supports Splunk 7.1
"Splunk Web enhancements and version compatibility Splunk Web for Splunk 7.1.0 and Splunk Enterprise Security 5.1.0 provides an updated look and feel. As a result, these two releases of the Splunk platform and Splunk Enterprise Security are only supported with each other." - http://docs.splunk.com/Documentation/ES/5.1.0/RN/Enhancements
... View more
04-26-2018
10:54 AM
From the information I've been able to gather, we're waiting for the next ES release to include the updated UI components necessary for compatibility with 7.1.
... View more
04-25-2018
02:51 PM
There appears to be issues with Splunk Enterprise on Splunk 7.1
Is there a reason that the Incident Review "Urgency" selection panel is not showing? [See Image Below]
I have tested this with clean installs of ES 4.7.4 and 5.0.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-23-2025
09:33 AM
|
Karma from
Karma given to
