Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About aferone
aferone
Builder
Member since:
05-19-2011
03-03-2023
Community Statistics
| Posts | 250 |
| Solutions | 7 |
| Karma Given | 36 |
| Karma Received | 39 |
| Member Since | 05-19-2011 |
Activity Feed
- Posted Re: Can't Extract CEF Fields in Distributed Environment on Getting Data In. 02-15-2023 06:50 AM
- Posted Re: Can't Extract CEF Fields in Distributed Environment on Getting Data In. 02-15-2023 05:58 AM
- Posted Re: Can't Extract CEF Fields in Distributed Environment on Getting Data In. 02-15-2023 05:51 AM
- Posted Re: Can't Extract CEF Fields in Distributed Environment on Getting Data In. 02-15-2023 05:41 AM
- Posted Re: Can't Extract CEF Fields in Distributed Environment on Getting Data In. 02-15-2023 05:38 AM
- Posted Can't Extract CEF Fields in Distributed Environment on Getting Data In. 02-15-2023 05:34 AM
- Posted Re: Forwarder Management troubleshooting client errors on Deployment Architecture. 08-25-2021 06:31 AM
- Karma Re: Forwarder Management troubleshooting client errors for akocak. 08-25-2021 06:31 AM
- Posted Re: How can I find out what the deployment errors are? on Deployment Architecture. 08-25-2021 06:30 AM
- Posted Re: How can I find out what the deployment errors are? on Deployment Architecture. 08-25-2021 06:28 AM
- Karma Re: How can I find out what the deployment errors are? for whrg. 08-25-2021 06:27 AM
- Karma Re: Software versioning format for _d_. 02-11-2021 03:57 PM
- Posted Re: Software versioning format on Dashboards & Visualizations. 02-11-2021 03:56 PM
- Posted Re: Yes / No Column if EventCode Found in Lookup on Splunk Search. 11-05-2020 01:14 PM
- Posted Yes / No Column if EventCode Found in Lookup on Splunk Search. 11-05-2020 09:31 AM
- Got Karma for Why is the Splunk App for Unix and Linux generating multiple "yum" source types?. 06-05-2020 12:50 AM
- Karma Re: Still lost - Where do props and transforms go?? for FrankVl. 06-05-2020 12:49 AM
- Karma Re: Appendcols Search Doesn't Work if No Event in Main Search? for DalJeanis. 06-05-2020 12:49 AM
- Karma Re: Using a field within a log for the true timestamp for sundareshr. 06-05-2020 12:48 AM
- Karma Re: Why is fill_summary_index failing to get list of scheduled times? for jsilverbears. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-15-2014
01:21 PM
2 Karma
Can timewrap be utilized to only use weekdays?
Specifically, if I am searching from a Monday for a daily report, can I skip Saturday and Sunday and use the timewrap utility to chart Friday? We want to be able to skip Saturdays and Sundays when we use the daily comparison of timewrap.
Thanks!
... View more
- Tags:
- Timewrap
06-03-2014
07:47 AM
1 Karma
I added this to my limits.conf on the INDEXER, and it is now working.
[searchresults]
maxresultrows = 100000
[stats]
maxresultrows = 100000
[top]
maxresultrows = 100000
... View more
06-03-2014
07:27 AM
Thank you, but there is no reference to whether this should be on the indexer or search head.
... View more
06-03-2014
07:11 AM
1 Karma
In my local limits.conf file, on my Search Head, I have the following:
[searchresults]
maxresultrows = 100000
[stats]
maxresultrows = 100000
However, I still get this error message:
"Error in 'top' command: The limit must be <= 50000."
Am I making the correct changes, and should they be on the Search Head or my Indexer?
Thanks!
... View more
- Tags:
- limits
- limits.conf
- top
04-14-2014
08:31 AM
I thought I knew how this behaved, but now I am not so sure.
I thought that if a browser were to crash in the middle of a search (or even close the browser windows), your search job would continue to run, and you'd be able to jump back into it via the Jobs page. However, this doesn't seem to be working anymore for us. When this occurs, we go into Jobs, and the searches are either finalized or finished. I even tested this by pausing a search. I went into Jobs, and it showed up as finished instead of paused.
Anything we should be looking at? Thanks!
... View more
03-06-2014
07:45 AM
Yeah, I checked that link out. But it keep referring to the files in the app. I can't find any of my searches in my app directory to remove those vsid entries.
... View more
03-06-2014
05:19 AM
I did both views and searches, yes. Now, I am getting the "Unable to get viewstate information; formatting may not be correct" error.
The problem is again that I can't find the searches in the app directory structure to remove the vsid entries. Shouldn't they be in the app directory structure of my app?
... View more
03-05-2014
11:41 AM
Will they end up in the app at some point? Even when I shared them out to the app, I don't see any instances of the searches within the directory structure of the app in the CLI ($SPLUNKHOME$/etc/apps/myapp
... View more
03-05-2014
08:34 AM
OK, I have cloned my reports to the dashboard, and that seems to work. However, in looking through the CLI, I can't seem to find where the new cloned files are placed. Where would they be?
... View more
03-05-2014
06:44 AM
I know I can control permissions through roles, but I was unclear with how to do it for apps?
... View more
03-05-2014
06:44 AM
No, I haven't been restarting my search head. Do I need to?
And for cloning, how do I control which app they go to?
... View more
03-04-2014
01:12 PM
1 Karma
I have a collection of dashboards, powered by saved scheduled searches, that I would like to organize into a new app. I've read over the documentation of creating a new app. However, I can't seem to get things running as they should.
Whenever I copy the views into the proper directory of the new app, and place the saved searches into "savedsearches.conf", I get all kinds of errors saying the searches can't be found.
Then, when I create a new dashboard and reports from scratch, they show up through the GUI for views and searches, but I can't find the through the CLI!
This is getting frustrating. Help!!
... View more
03-03-2014
10:47 AM
I'd like to be able to change the size and colors of all of the panel titles in a dashboard.
I am assuming I can control this through a CSS file for particular views, but how exactly?
Thank you!
... View more
02-26-2014
09:47 AM
1 Karma
Nailed it! Thank you!
... View more
02-26-2014
08:31 AM
Here is an example of a VPN log with an error. I want to create a field for "Reason", which includes everything found after "Reason:", until the end of the line:
2014-02-26 11:26:05 -05:00 @vpn1 id=firewall time="2014-02-26 11:26:05" pri=6 fw=X.X.X.X vpn=vpn1 user=XXX realm="XXXX" roles="XXXXX" proto=auth src=X.X.X.X dst= dstname= type=vpn op= arg="" result= sent= rcvd= agent="" duration= msg="AUT22925: Host Checker policy 'Comp Configuration Check' failed on host X.X.X.X for user 'XXX'. Reason: 'Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\XXX\not found; Registry key: HKEY_LOCAL_MACHINE\XXX\Plan not found; Registry key: HKEY_LOCAL_MACHINE\Wow6432Node\XXX\Plan not found; Registry key: HKEY_LOCAL_MACHINE\XXX\Plan not found; Registry key: HKEY_LOCAL_MACHINE\Wow6432Node\XXX\Plan not found; Registry key: HKEY_LOCAL_MACHINE\XXX\Plan not found'."
Thanks!
... View more
01-31-2014
08:34 AM
To all, for clarification, the answer to this question is in the comments of this answer. The first comment from richgalloway, to be exact.
... View more
01-31-2014
08:33 AM
Rich,
I used the StaticContentSample option. Even though I have SideviewUtils installed, I was still running into an issue. However, the StaticContentSample works like a charm.
Thank you for your time and help!!
... View more
01-31-2014
06:35 AM
<view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
<label>Index Gauges - Space Used - (GB)</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="Message" layoutPanel="messaging">
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
<param name="filter">*</param>
</module>
<module name="DashboardTitleBar" layoutPanel="viewHeader"/>
<module name="Message" layoutPanel="navigationHeader">
<param name="level">warn</param>
<param name="clearOnJobDispatch">True</param>
<param name="maxSize">1</param>
<param name="filter">splunk.search.job</param>
</module>
<module name="HiddenSearch" layoutPanel="panel_row1_col1_grp1" group="NA1" autoRun="True">
<param name="groupLabel">Perimeter</param>
<param name="search">| eventcount summarize=false report_size=true index=perimeter | eval MB = size_bytes / 1000 / 1000 / 1000 | gauge MB 0 2000 4000 6500</param>
<module name="ViewstateAdapter">
<param name="suppressionList">
<item>count</item>
<item>displayRowNumbers</item>
<item>charting.chart.height</item>
<item>charting.chart</item>
</param>
<module name="HiddenFieldPicker">
<param name="strictMode">True</param>
<module name="JobProgressIndicator">
<module name="EnablePreview">
<param name="enable">True</param>
<param name="display">False</param>
<module name="HiddenChartFormatter">
<param name="charting.chart">radialGauge</param>
<param name="charting.chart.height">150</param>
<module name="FlashChart">
<param name="width">100%</param>
<module name="Gimp"/>
<module name="ConvertToDrilldownSearch">
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
<module name="ViewRedirectorLink">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
</module>
</module>
<module name="HTML" layoutPanel="panel_row1_col1_grp1"> <param name="html"><![CDATA[ <h2><center>Total1</center></h2> ]]></param>
</module>
</module>
<module name="HiddenSearch" layoutPanel="panel_row1_col1_grp2" group="NA1" autoRun="True">
<param name="groupLabel">Perimeter</param>
<param name="search">| eventcount summarize=false report_size=true index=oa-022-m-grc-2202 | eval MB = size_bytes / 1000 / 1000 / 1000 | gauge MB 0 2000 4000 6500</param>
<module name="ViewstateAdapter">
<param name="suppressionList">
<item>count</item>
<item>displayRowNumbers</item>
<item>charting.chart.height</item>
<item>charting.chart</item>
</param>
<module name="HiddenFieldPicker">
<param name="strictMode">True</param>
<module name="JobProgressIndicator">
<module name="EnablePreview">
<param name="enable">True</param>
<param name="display">False</param>
<module name="HiddenChartFormatter">
<param name="charting.chart">radialGauge</param>
<param name="charting.chart.height">150</param>
<module name="FlashChart">
<param name="width">100%</param>
<module name="Gimp"/>
<module name="ConvertToDrilldownSearch">
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
<module name="ViewRedirectorLink">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
</module>
</module>
<module name="HTML" layoutPanel="panel_row1_col1_grp2"> <param name="html"><![CDATA[ <h2><center>Total2</center></h2> ]]></param>
</module>
</module>
</view>
... View more
01-31-2014
06:18 AM
Right. That's what I did. I just used the 2nd PostProcess module. I'll try simplifying my code. If it still doesn't work, I'll post.
Thanks!
... View more
01-31-2014
06:06 AM
Thank you for the reply!
When I try to add this to my dashboard, the panels load, but with no charts or gauges in them. I also get a green "Loading..." box at the top center of the dashboard. But no data.
... View more
01-30-2014
12:58 PM
I have figured out how to put 4 and 5 gauges in one panel on my dashboard. However, without any type of title or label near each gauge, it is impossible to know which gauge does what.
How would I put a label or a title for each gauge, within one panel?
Thanks!
... View more
11-27-2013
05:58 AM
Is the way I'm trying to do it a common approach?
... View more
11-27-2013
05:42 AM
The 4th one is just basically a continuation:
[Stan4]
SOURCE_KEY = MetaData:Host
REGEX = (host10|host11|host12).domain.here.com
DEST_KEY = _MetaData:Index
FORMAT = index4
... View more
