About tchen_splunk

tchen_splunk · ‎10-21-2016

You'll need to customize datetime.xml to parse out the date from filename https://answers.splunk.com/answers/172535/extract-date-time-from-source-path-with-custom-dat.html

tchen_splunk · ‎01-03-2016

I believe the geo-ip data is baked into the data model acceleration. http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/AddageoIPattribute Note: Geo IP attributes are added to your object as required attributes, and their Type values are predetermined. You cannot change these values.

tchen_splunk · ‎10-15-2015

Turned out there is indeed a way to do this within Splunk, with the Transaction command: | eval ParentId=coalesce(ParentId,ChildId) | eval pc=ParentId.":".ChildId | makemv delim=":" pc | transaction pc Thanks to d for providing the solution!

tchen_splunk · ‎10-15-2015

Let's say I have something like this: time,ParentId,ChildId 12:05:10 PM, ,A1 12:05:11 PM, ,B1 12:05:12 PM,A1 ,A2 12:05:13 PM, ,C1 12:05:14 PM,B1 ,B2 12:05:15 PM,B2 ,B3 12:05:16 PM,A2 ,A3 12:05:17 PM,B3 ,B4 12:05:18 PM,C1 ,C2 As we can see above, we have this parent-child chain going from B1<--B2<--B3<--B4 is there a way to chain up these events without recursion?

tchen_splunk · ‎02-11-2015

Another thing to look into is whether there's a proxy in the middle. Once we allowed SSLV3 to pass through the proxy server, it works as promised.

tchen_splunk · ‎04-10-2014

tonumber() call works now in 6.x ... | eval sci_no="7.6e+02" | eval result=tonumber(sci_no) yields result of 760

tchen_splunk · ‎04-08-2014

Nikolai, It can be automated. 1. Have scheduled search to generate the report 2. then have another scheduled job to trigger a script to download the generated pdf for storage on NFS For an example, try referencing this post http://answers.splunk.com/answers/111602/trigger-a-pdf-via-the-command-line Tian

Posts	7
Solutions	2
Karma Given	6
Karma Received	6
Member Since	‎04-30-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How do we chain up events based on parent-child ev...

Re: How to combine year, month, day from a filenam...

Re: When does the accelerated Data model's values ...

Re: How do we chain up events based on parent-chil...

How do we chain up events based on parent-child ev...

Re: How to debug connection errors on Windows 7 64...

Re: How to convert scientific notation to decimal?

Re: Sending pdf report into shared storage