About mthierbel

mthierbel · ‎07-22-2015

I'm having the exact same problem with 6.1.3. and Windows 7. Did you ever find a solution? I have yet to.

mthierbel · ‎12-05-2014

Where do you see it documented that the logging to both jbridge.log and web_access.log was fixed? I don't see anything about this in the DBX 1.1.5 Fixed Issues page. http://docs.splunk.com/Documentation/DBX/1.1.5/ReleaseNotes/Releasenotes

mthierbel · ‎12-01-2014

@stefanlasiewski -- I'm surprised applying the setting under [default] is not working for you. Which directory is your ui-prefs.conf in? Are its settings taking effect for the [search] app screen?

mthierbel · ‎11-16-2014

According to Splunk's documentation for props.conf, the ANNOTATE_PUNCT setting "Determines whether to index a special token starting with "punct::" ". Does this setting get applied at input-time or index-time?

mthierbel · ‎07-10-2014

I was able to get this working by using three double-quotes. If my field looks like this: "foo" Then my .csv lookup matches it if I set it as """foo""" So, overall, my lookup table would look like this (with the top line being the header): field1,field2 """foo""",bar

mthierbel · ‎04-22-2014

Keep in mind that the default homepage in Splunk 6.0.2 is actually the launcher app and not the search app, so configuring just the [search] stanza will not change the setting for the homepage. I was able to get it working in both the search app and the homepage by creating a $SPLUNK_HOME/etc/system/local/ui-prefs.conf containing these settings: [search] dispatch.earliest_time = -24h dispatch.latest_time = now [default] dispatch.earliest_time = -24h dispatch.latest_time = now

mthierbel · ‎03-13-2014

Can you elaborate on this?

mthierbel · ‎01-02-2014

That's what I figured, but I was hoping there was another way. My environment has so many subfolders, that it would be difficult to maintain separate inputs.conf entries for each of them, which is why I have the recursive parent input.

mthierbel · ‎12-31-2013

In case I was not clear, my input is already recursive and that is intended. Basically, I want my inputs to be recursive, but crcSalt to not be recursive. For example: \var\log\data\* NO crcSalt \var\log\data\program1 YES crcSalt \var\log\data\program2 NO crcSalt

mthierbel · ‎12-31-2013

My inputs.conf is configured to monitor a directory with may different subfolders, and each contains different types of log files. Is there a way I can make crcSalt only apply to a certain subfolder or file type? For example, here is my inputs.conf entry: [monitor://c:\var\log\data\] disabled = false index = logdata If I add crcSalt = <SOURCE> here, it will apply to all input files within the c:\var\log\data folder. But what if I only want it to apply to files in the the c:\var\log\data\program subfolder? (I have too many subfolders to define inputs.conf entries for each one). Is there a way I can make crcSalt only apply to a specific folder or file within my input directory?

Posts	10
Solutions	1
Karma Given	17
Karma Received	28
Member Since	‎12-31-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

When does the ANNOTATE_PUNCT props.conf setting ap...

Can crcSalt be applied to a specific subdirectory ...

Re: Splunk services are running well but the webpa...

Re: Splunk DB Connect: Why Web Access data is bein...

Re: How to set the default search time in Splunk 6...

When does the ANNOTATE_PUNCT props.conf setting ap...

Re: CSV Lookup not matching double quotes

Re: How to set the default search time in Splunk 6...

Re: LDAP authentication with AD always returns: ...

Re: Can crcSalt be applied to a specific subdirect...

Re: Can crcSalt be applied to a specific subdirect...

Can crcSalt be applied to a specific subdirectory ...

Are you a member of the Splunk Community?