Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About JensT
JensT
Communicator
Member since:
07-01-2010
08-27-2024
Community Statistics
| Posts | 73 |
| Solutions | 2 |
| Karma Given | 19 |
| Karma Received | 21 |
| Member Since | 07-01-2010 |
Activity Feed
- Karma Re: Renewing server.pem certificate for harsmarvania57. 06-05-2020 12:49 AM
- Karma Re: Where to get Splunk icons for architecture and deployment diagrams? for javiergn. 06-05-2020 12:48 AM
- Karma Re: How do I use requireHeader to override indexing settings for a TCP input? for jkat54. 06-05-2020 12:48 AM
- Karma Re: KVStore error although not using kvstore for rbal_splunk. 06-05-2020 12:48 AM
- Karma Re: How to match an IP address from a lookup table of cidr ranges? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: How can I get a list of all saved searches from all apps using the REST command? for harsmarvania57. 06-05-2020 12:47 AM
- Karma Re: Splunk - List of Dashboards for tom_frotscher. 06-05-2020 12:47 AM
- Karma Re: How do I change the owner of a saved search? for dglinder. 06-05-2020 12:46 AM
- Karma Re: Loading lookup file... for bfernandez. 06-05-2020 12:46 AM
- Karma Re: Search for hosts in a lookup, but not in Splunk. for MuS. 06-05-2020 12:46 AM
- Karma Re: Show timerange of a search in a dashboard@ for sideview. 06-05-2020 12:46 AM
- Karma Re: How to reindex data from a forwarder for yannK. 06-05-2020 12:46 AM
- Karma Re: search a subnet for adrianathome. 06-05-2020 12:46 AM
- Karma Re: Single value return N/A instead of 0 for sideview. 06-05-2020 12:46 AM
- Karma Re: inputcsv stopped working after upgrade 4.2.2->4.3.4 for sthomas. 06-05-2020 12:46 AM
- Karma Re: Use "Splunk" relative times for custom fields?@ for martin_mueller. 06-05-2020 12:46 AM
- Karma Re: transaction: keeporphans error after 4.3 upgrade? for Drainy. 06-05-2020 12:46 AM
- Karma Re: Splunks date_* fields not in all records for Ayn. 06-05-2020 12:46 AM
- Got Karma for Re: Cannot login - already tried the admin/changeme thing!. 06-05-2020 12:46 AM
- Got Karma for Re: Cannot login - already tried the admin/changeme thing!. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-06-2018
01:30 PM
Hi,
not sure what you mean. I used exactly your dataset.
The table output does not make sense. As it indicates that one event is start and end at the same time.
The trick is the stats ! It will not work with a table.
... View more
12-06-2018
10:49 AM
index=foo
| rex "^(?<datetime>\d+\s\d+)\s\((?<job_id>\d+)\)"
| eval timestamp = strptime(datetime,"%m%d %H%M%S")
| eval job_start_time = if(match(_raw, "Log initialized"), timestamp, null())
| eval job_end_time = if(match(_raw, "EMail Sent Successfully"), timestamp, null())
| stats values(job_start_time) AS Start, values(job_end_time) AS End by job_id
| eval durationInSec = End-Start
| eval Start = strftime(Start, "%D %T"), End = strftime(End, "%D %T")
... View more
06-24-2018
12:18 PM
Hello Adonio,
thanks for you passion into this.
But if you think a minute about this, I am sure you will agree that this is not a good approach.
And the overhead is just one bad aspect.
... View more
06-18-2018
12:57 AM
Hello Adonio,
thanks for your speedy reply, that would indeed work, but its not feasible for us.
1.) Ownership for Index 1 might be different. So the Owner of Role 4 might not be allowed to grant access to index 1, which he/she would give implicit.
2.) We do not want to modify the Splunk config for every possible combination. So the access to different indexes should still be controlled by different roles. Not my modifying Role 4 all the times.
... View more
06-15-2018
12:53 PM
Situation:
Index 1, Role 1
Index 2, Role 2
Index 3, Role 3
.... Etc.
Now I need a new role which give full access to Index 2, and partial access to Index 1, e.g. just to a certain sourcetype.
How do I achieve this? I tried a srchFilters, but its applied to the complete search.
+ If tomorrow someone orders Role 3 in addition it should give full access to Index 1, 3 and the partial access to 2...
Regards,
Jens
... View more
03-28-2018
12:52 AM
Hi,
of course I do not want to give admin rights to one who just needs to configure the Addon.
So I wonder why permission and capabilities are required?
Regards,
Jens
... View more
10-03-2017
11:58 PM
Hi,
Option #2 is smarter, as you work on the events.
But first I would check if transaction can be replaced by the much faster "stats" command, as its a streaming command.
In combination with #2 you can pre-filter the data and then add the stats.
Kind regards,
Jens
... View more
02-13-2017
07:58 AM
Hi,
sorry, seems my wording was bad.
I have a timepicker, but want to use the label in a different panel.
Example: 500 Events 'Yesterday'
Regards,
Jens
... View more
02-13-2017
07:50 AM
Hi,
earliest and latest are in the "relative time" notation of Splunk.
So I would like to use the label in a panel. E.g. "Yesterday" Or "Last 7 Days".
Is that possible? If yes, how?
Kind regards,
Jens
... View more
02-02-2017
05:44 AM
Hi Lisa,
great thing.
Can this be done without transforms.conf?
I.E. just upload the csv and then do the lookup inline?
(Our users are 'of course' not allowed to modify Splunk configs)
Rgds,
Jens
... View more
05-20-2016
06:10 AM
I downvoted this post because "guessing" is not really an appropriate type help.
... View more
02-22-2016
07:59 AM
Hello,
I do not want all Application Eventlogs. I want only logs from a VIEW.
And no, I do not want to use blacklist/whitelist.
Regards,
Jens
... View more
02-22-2016
07:14 AM
Hi,
In our environment, many applications are logging into the Windows Application Event log.
We would like to transport it separately.
Is it possible to transport data from a Windows Event log View?
-Jens
... View more
07-21-2015
05:47 AM
Hi,
seems like you want a forced install.
There are several options. Check:
https://technet.microsoft.com/en-us/library/cc759262(v=ws.10).aspx
https://support.microsoft.com/en-us/kb/227091
Regards,
Jens
... View more
03-24-2014
01:52 AM
Hi!
i retested and you are absolutely right!
1.) \ in any lookup is not a problem.
2.) Its MSSQL not MSSSQL
Thanks,
Jens
... View more
03-22-2014
05:16 AM
Hi,
We're analazing database logs. From SyBase, Oracle and MSSQL.
MSSQL full db instances contain a \
e.g. MSNG123\MyInstance
We want to use a lookup to enrich the data.
It works fine with the lookup command. But not using the automatic lookup.
Any suggestions?
Using Splunk 4.3.6
Regards,
Jens
... View more
01-21-2014
08:14 AM
Hello,
we're using Splunk 4.3.6 with summary indexes. Sometimes the search that is filling the summary indexes, fails.
We can then backfill the summary index, but we would like to monitor if a saved searches fails.
Any smart ideas?
Kind regards,
Jens
... View more
Hi,
following MuS' suggestion is a valid workaround - if your're using username/password 😉
If you have multiple users, you can actually copy them from your old passwd file, into the new.
kind regards,
Jens
... View more
10-29-2013
10:08 AM
Hi,
I also need an auto-refresh, but a chooseable.
Means, I want a dropdown with "15s", "1m", "15m", "1h" and according to this the autorefresh is set.
Yes, I read: how-can-i-auto-refresh-my-dashboard
Splunk Version: 6, Using advanced XML.
Regards,
Jens
... View more
08-26-2013
10:38 AM
1 Karma
Hi,
thanks for the speedy answer. So i consider this as a design flaw.
We have billions of records with these fields (Linux, Unix, Solaris) and millions without (Windows Event Logs).
Its confusing to users and will be hard to explain this, but at least we know that we cannot rely on them.
Regards and thanks,
Jens
... View more
