Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jcorcoran508
jcorcoran508
Loves-to-Learn
Member since:
03-17-2020
yesterday
Community Statistics
| Posts | 9 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 03-17-2020 |
Activity Feed
- Posted Re: Error when pushing bundle to shcluster. Error = "No target specified" on Archive. yesterday
- Posted Re: isBad TRUE can someone explain this isBad key / value on All Apps and Add-ons. 12-25-2020 06:51 PM
- Posted isBad TRUE can someone explain this isBad key / value on All Apps and Add-ons. 12-24-2020 10:19 AM
- Posted What is the best way to create an alert that opens a ticket in Salesforce? on Getting Data In. 10-01-2020 09:32 AM
- Tagged What is the best way to create an alert that opens a ticket in Salesforce? on Getting Data In. 10-01-2020 09:32 AM
- Posted Re: Error while deploying apps to first member: Error while fetching apps baseline on target=https://1.1.1.1:8089: Non-2 on Deployment Architecture. 09-28-2020 04:13 PM
- Posted Re: Why is the save button greyed out when attempting to modify a report/search? on Splunk Search. 07-13-2020 12:58 PM
- Posted Re: Anyway to make tags.conf case insensitive? on Splunk Search. 06-20-2020 05:00 AM
- Posted Re: sort not working as expected on Splunk Search. 05-14-2020 02:16 PM
- Posted Re: What is the best way to get list of index in my splunk on Splunk Search. 04-14-2020 06:58 AM
Topics I've Started
12-25-2020
06:51 PM
https://www.splunk.com/en_us/blog/security/sunburst-backdoor-detections-in-splunk.html index=main sourcetype=stream:* | lookup sunburstDOMAIN_lookup Domain AS query | search isBad=TRUE | stats VALUES(query) AS "Sunburst" by src_ip
... View more
12-24-2020
10:19 AM
I have been searching for a couple of hours for an explanation and what purpose this k/v isBad TRUE can you please elaborate on this question .
... View more
Labels
- Labels:
-
administration
-
troubleshooting
10-01-2020
09:32 AM
Hi all,
I'm researching the best way to have Splunk send an alert event to open a ticket in Salesforce.
Looked around the internet not really specific to Salesforce ticketing from Splunk.
We already have the Salesforce add-on installed to collect data, and as far as I know, it's not sending an alert to open a Salesforce ticket.
Any assistance would be appreciated.
... View more
Labels
- Labels:
-
other
09-28-2020
04:13 PM
I had the same issue, this is how I reserved my issue: On searchhead(s) in /opt/splunk/etc/system/local/server.conf [shclustering] disabled = 0 mgmt_uri = https://10.0.0.202:8089 replication_factor = 2 shcluster_label = InCorpShcluster01 id = 33DA70FF-FC57-497A-B405-CA85C61EFACE adhoc_searchhead = true current_member_uri = https://10.0.0.135:8089 I had the DEPLOYER = xxxxx under the[shcluster]stanza , but read that the KEYc ould be located under the [general] stanza - so I removed the pass4SymmKey = and restarted splunk. Deployer /opt/splunk/etc/system/local/server.conf [general]serverName = searchhead2site1 pass4SymmKey = $7$v9H1PDth+5OR0zCD4fnfJOJ8JQ7/sdJd6+vc/jSDRX0v4suiha+Srg== ## bunch of other line configs [shclustering] shcluster_label = InCorpShcluster01 Deployer server ------------------------------------------ [splunk@deployer]lunk/bin/splunk apply shcluster-bundle -target https://10.0.0.202:8089 -auth admin:pssword Warning: Depending on the configuration changes being pushed, this command might initiate a rolling restart of the cluster members. Please refer to the documentation for the details. Do you wish to continue? [y/n]: y Bundle has been pushed successfully to all the cluster members.
... View more
07-13-2020
12:58 PM
I know its a dated string. On splunk 8, when you edit a Report via open search in the report window. you will see the "SAVE" button greyed out. Modify the search string (if that is you intent) , click the search button. So post change run you see the "SAVE" button be normal , then save the report as the same name. Or Save as for a new named report using the updated search string.
... View more
06-20-2020
05:00 AM
just updating the where command now supports the " like %" wild card.
... View more
05-14-2020
02:16 PM
can you explain what those files listed actually are for ? What value do they have ?
product.screen
cart.do
category.screen
oldlink
success.do
passwords.pdf
error.do
userlist
account
api
... View more
04-14-2020
06:58 AM
This spl strings worked on instance. Thank you for sharing
index=* | stats count by index
| rest /services/data/indexes
| eventcount summarize=false index=* index=_* | dedup index | fields index
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
yesterday
|
