Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sogeniusio
sogeniusio
Path Finder
Member since:
07-17-2017
06-05-2020
Community Statistics
| Posts | 21 |
| Solutions | 1 |
| Karma Given | 3 |
| Karma Received | 2 |
| Member Since | 07-17-2017 |
Activity Feed
- Got Karma for Re: Is there a way to get a list of Splunk Apps that are installed on a deployment client running a universal forwarder?. 03-31-2023 10:09 AM
- Got Karma for Re: Can deployment server upgrade universal forwarders yet?. 03-22-2023 04:25 AM
- Karma Re: LineBreakingProcessor - Truncating line because limit of 1000000 bytes has been exceeded with a line length >= 1003520 - data_source="lsof", data_host="gbrdcr10328n02", data_sourcetype="lsof" for rphillips_splk. 06-05-2020 12:47 AM
- Karma Re: What are the ports that I need to open? for bandit. 06-05-2020 12:46 AM
- Karma Re: Strip control/color codes for Ayn. 06-05-2020 12:45 AM
- Posted Re: Why did forwarding stopped then ended with ApplicationLicense info entry in the logs on Installation. 10-08-2018 06:56 AM
- Posted How do you set up Slack alerts with Linux Hostname Environment Variable placeholder in alert_actions.conf? on Alerting. 08-22-2018 10:05 AM
- Tagged How do you set up Slack alerts with Linux Hostname Environment Variable placeholder in alert_actions.conf? on Alerting. 08-22-2018 10:05 AM
- Tagged How do you set up Slack alerts with Linux Hostname Environment Variable placeholder in alert_actions.conf? on Alerting. 08-22-2018 10:05 AM
- Tagged How do you set up Slack alerts with Linux Hostname Environment Variable placeholder in alert_actions.conf? on Alerting. 08-22-2018 10:05 AM
- Tagged How do you set up Slack alerts with Linux Hostname Environment Variable placeholder in alert_actions.conf? on Alerting. 08-22-2018 10:05 AM
- Posted Re: How can I backup and maintain a version of dashboard XML files before updating anything in production? on Dashboards & Visualizations. 06-25-2018 09:30 AM
- Posted Re: Can deployment server upgrade universal forwarders yet? on Getting Data In. 06-18-2018 10:54 AM
- Posted Re: Microsoft DNS Debug and monitorNoHandle on All Apps and Add-ons. 02-19-2018 01:53 PM
- Posted Re: Is there a way to get a list of Splunk Apps that are installed on a deployment client running a universal forwarder? on Getting Data In. 02-15-2018 09:02 AM
- Posted Why did our VMWare Collection Nodes suddenly stopped? on All Apps and Add-ons. 01-25-2018 01:48 PM
- Tagged Why did our VMWare Collection Nodes suddenly stopped? on All Apps and Add-ons. 01-25-2018 01:48 PM
- Tagged Why did our VMWare Collection Nodes suddenly stopped? on All Apps and Add-ons. 01-25-2018 01:48 PM
- Posted Re: Create dropdown of two-week range (gentimes) on Dashboards & Visualizations. 01-18-2018 01:51 PM
- Posted Re: Create dropdown of two-week range (gentimes) on Dashboards & Visualizations. 01-18-2018 01:43 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-08-2018
06:56 AM
Did you find a resolution for this?
... View more
08-22-2018
10:05 AM
I'm setting up Slack alerts and would like to deploy uniformly to our heavy forwarders. To do so, I'd have to add a placeholder to their alert_actions.conf
[slack]
disabled = 0
param.from_user = XXXXXXXXXXXXXXXXXXX #$HOSTNAME or $HOST
param.webhook_url = https://hooks.slack.com/services/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
I was wondering if something like the linux hostname variable can be used within this file like above.
... View more
06-25-2018
09:30 AM
All this back and forth and we still don't have a tool/app
... View more
06-18-2018
10:54 AM
1 Karma
I got this to work using python. For some reason this didn't work using shell. Check it out here: https://git.sogenius.io/pub/upgrade_splunk_uf-python - Use at your own risk!
... View more
02-19-2018
01:53 PM
What was the verdict on this? Did it work in your environment?
... View more
02-15-2018
09:02 AM
1 Karma
Your regex should read
"applications\.(\w+)\.stateOnClient","\1"
Missing an "s"
... View more
01-25-2018
01:48 PM
Two days ago our VMWare collector setup stopped logging data. I don't see anything within the logs that would explain why it stopped and I'm totally stumped on where to even begin (aside from logs of course).
I do know that around the time our networking team was doing maintenance that would explain the drop but doesn't explain why it didn't come back up. Some insight would definitely be useful.
... View more
01-18-2018
01:51 PM
Yes I'd like it to be calculated based on the current date. Since today is 1/18 the range should be 1/3 - 1/18
... View more
01-18-2018
01:43 PM
Your solution required some edits
| gentimes start=-240 increment=14d
| eval starthuman=strftime(starttime,"%m/%d/%Y")
| eval endhuman=strftime(endtime,"%m/%d/%Y")
| bin span=14d endtime
| eval date=starthuman." - ".endhuman
| table date
| reverse
How would I go about using these values in my search?
... View more
01-18-2018
01:21 PM
Seems to work in a regular search but when I place it within the search for the dropdown it says it has conflicts due to duplicates.
... View more
01-18-2018
10:08 AM
I'd like to create a dropdown that has two week spans. It should be formatted as follows:
01/01/2017 - 01/14/2017
01/15/2017 - 01/29/2017
...
I'd like to use this dropdown to group the data. I believe this could be accomplished with gentimes. I just don't know how to format the search.
... View more
01-02-2018
02:57 PM
Trying to setup a catchall for all our Sun Solaris servers but can't find the proper way to match by machineTypesFilter
serverclass.conf
# =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
# SOLARIS SERVERS
# =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
[serverClass:sc_flowers_SOLARIS]
filterType = whitelist
whitelist.0 = *
machineTypesFilter = sunos-*
restartSplunkd=true
[serverClass:sc_flowers_SOLARIS:app:flowers_SOLARIS]
... View more
12-08-2017
02:05 PM
I'm interested in knowing why it's frowned upon not to search index=*. I was asked by one of our employees and remembered it being mentioned at this .conf.
... View more
11-22-2017
09:57 AM
Any idea if this can be fixed for vmstat.sh. We're getting broken pipe errors.
... View more
11-17-2017
02:38 PM
Did you find a fix for this issue? We're facing the same thing. We setup an alert to run every 15 minutes to check that the HFs are up:
| inputlookup splunk_critical_systems.csv
| JOIN type=outer host
[ search *
| stats count AS currentcount by host ]
| eval status=if(ignore="true", "ignored", if(isnull(currentcount), "missing", "present"))
| table host status
| search status=missing
LOOKUP TABLE
host || ignore
HF1 || false
HF2 || false
HF_LINUX || true
... View more
10-26-2017
07:01 AM
This is exactly what we looking for. A dynamic way to apply the hostname of our syslog servers to a custom indexed field. We're reduced to applying the following
_meta = field_name::host.name
... View more
10-12-2017
09:14 AM
Trying to extract a string into a new field. A sample of log is as follows:
productName = Special Day Argyle Socks for Men (Special Day Argyle Socks Size 10-13)
| rex "productName\s=\s(?<ProductName>\s[\w\W]+)"
Not sure where to go from here. When I test within regex101, it works just fine. But when I move to Splunk i get nothing.
Update
Added this but now it doesn't stop at a new line
| rex "productName\s=\s(?<ProductName>[\w\W]+\n)"
... View more
07-17-2017
07:24 AM
I would like to display the actual image rather than the image URL within a splunk table.
Is this possible?
... View more
- Tags:
- image
- splunk-cloud
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
