About nate015

nate015 · ‎01-08-2012

I think this might require subsearching, but I would be intrigued to see if someone can come up with a more elegant solution than subsearching.

nate015 · ‎08-10-2011

Has anyone used ammap without a lookup? The necessary fields exist in my results and I'd like to bypass creating a lookup. See the link below. http://splunk-base.splunk.com/answers/28740/use-ammap-without-a-lookup

nate015 · ‎08-09-2011

amMap works fine using a lookup, but what if the data already has the client_city, client_region, client_country, client_lon, and client_lat in the events as fields? I would like to map these events without generating a lookup table.

nate015 · ‎01-24-2011

In our case we see the issue when we go from one Solaris (running a ZFS filesystem) to another Solaris box (running a ZFS filesystem). It is mostly a x86 Solaris (deployment server) to SPARC Solaris (deployment clients), but I don't think that would matter.

nate015 · ‎01-07-2011

Enabling the apps isn't this issue we are seeing, it's granting execute permissions on the scripts. Just a side note, our deployment server(s) are Solaris servers.

nate015 · ‎09-27-2010

I'm also interested. I would like to remove the message "Subsearches of a real-time search run over all-time unless explicit time bounds are specified within the subsearch."

nate015 · ‎09-22-2010

Make sure you don't have an outputs.conf in your app directory ($SPLUNK_HOME/etc/apps/...) that has a tcpoutput to itself.

nate015 · ‎08-30-2010

Thanks for the links Lowell, unfortunately I don't think they will work for me since I'm using the "transaction" operator (which will have multiple _cd values). What I'm doing is running a search that looks at all the commands logged by a user on a networking device and puts them into a single transaction. The user then needs to put an explanation and a ticket number to go along with the transaction. I'll open an enhancement request.

nate015 · ‎08-29-2010

A user would like to click on the down arrow to the left of an event and leave a comment. I think I have seen this demoed in ESS. Is there a simple way to implement it?

nate015 · ‎08-11-2010

Deploy server updates the apps just fine, but they aren't runnable after being deployed by the deployment server.

nate015 · ‎07-08-2010

I'm having the same issue documented here http://www.splunk.com/support/forum:SplunkGeneral/3130 "An example is the Unix app. When this app is pushed to a Splunk instance using the deployment server the scripts under unix/bin lose their execute permissions." The permissions on the deployment server are -r-xr-xr-x but on the client they become -rw------

Posts	11
Solutions	0
Karma Given	8
Karma Received	7
Member Since	‎07-08-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

use amMap without a lookup?

Add a comment field to an event

Application scripts not executable when deployed v...

Re: Comparing two fields from different sources, e...

Re: How do I use the Splunk for amMap app posted o...

use amMap without a lookup?

Re: Application scripts not executable when deploy...

Re: Application scripts not executable when deploy...

Re: Message module filter values?

Re: Forwarders fail to make connection to server

Re: Add a comment field to an event

Add a comment field to an event

Re: Application scripts not executable when deploy...

Application scripts not executable when deployed v...