About iainsmart

iainsmart · ‎05-19-2020

You could create a dashboard with HTML panels for the instruction text. Then using depends/rejects in the SimpleXML for the dashboard and set/unset tokens to show/hide panels depending on what is required by the workflow. See: https://docs.splunk.com/Documentation/Splunk/latest/Viz/ContextualDrilldown

iainsmart · ‎05-18-2020

The COALESCE command might be your friend here: https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/ConditionalFunctions#coalesce.28X.2C....29

iainsmart · ‎03-25-2020

I am in Verbose mode and the TA is installed on the search head

iainsmart · ‎03-25-2020

Hi, When I search for Windows Event Logs using : index=oswin sourcetype=XmlWinEventLog I'm not getting any parsing/syntax highlighting or field extractions happening. The results are simply the raw XML. I have checked that I am in List format! If I search for other indexes and sourcetypes I am getting correct parsing/syntax highlighting and extractions. How can I go about finding out why this is happening and fix it? Thanks, Iain

Posts	4
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎03-25-2020

Online Status	Offline
Date Last Visited	‎08-11-2020 06:33 AM

Windows TA field extractions are not working

Re: Work Instructions in SPLUNK

Re: How to get specified events from 2 indices.

Re: Windows TA field extractions are not working

Windows TA field extractions are not working