Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Starlette
Starlette
Contributor
Member since:
02-26-2010
06-05-2020
Community Statistics
| Posts | 95 |
| Solutions | 3 |
| Karma Given | 31 |
| Karma Received | 47 |
| Member Since | 02-26-2010 |
Activity Feed
- Got Karma for 2 different timestamps in single log. 06-23-2021 01:48 PM
- Karma How to rename field names using lookups and regex? for shikhanshu. 06-05-2020 12:47 AM
- Got Karma for Is the data from accelerated data models and reports replicated in a cluster as well?. 06-05-2020 12:47 AM
- Got Karma for Is the data from accelerated data models and reports replicated in a cluster as well?. 06-05-2020 12:47 AM
- Got Karma for Is the data from accelerated data models and reports replicated in a cluster as well?. 06-05-2020 12:47 AM
- Karma Re: Why is FSChange (file system change monitor) a deprecated feature in Splunk 5.0? for cervelli. 06-05-2020 12:46 AM
- Karma Re: Deployment clients logging for sowings. 06-05-2020 12:46 AM
- Karma Re: Single Value change font size for Drainy. 06-05-2020 12:46 AM
- Karma Re: Override source key in inputs.conf for gekoner. 06-05-2020 12:46 AM
- Karma Re: security threats for Ayn. 06-05-2020 12:46 AM
- Karma Re: timechart count against si gives different max results for 2 intervals for Drainy. 06-05-2020 12:46 AM
- Karma List of saved/in-line searches within a view for SarahBOA. 06-05-2020 12:46 AM
- Karma Re: Eval limitations on si index with sistats count by field1, field2 etc for dwaddle. 06-05-2020 12:46 AM
- Karma Re: Eval limitations on si index with sistats count by field1, field2 etc for sideview. 06-05-2020 12:46 AM
- Karma Re: System requirements for Universal Forwarder for Drainy. 06-05-2020 12:46 AM
- Karma Deployment monitor and intermediary forwarder for echalex. 06-05-2020 12:46 AM
- Karma Re: report acceleration besides existing job server for hexx. 06-05-2020 12:46 AM
- Got Karma for Re: space and tab as Delimiter. 06-05-2020 12:46 AM
- Got Karma for list deploy-clients remotely. 06-05-2020 12:46 AM
- Got Karma for Re: how to really delete, NOT HIDE, data from splunk. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 3 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
07-14-2015
01:38 AM
same on macos / chrome
... View more
Is the data from accelerated datamodels and reports replicated as well? I cant find it in the docs...
... View more
12-31-2012
01:56 AM
1 Karma
Just found out that this is now possible in v5....test till 7 levels!
... View more
12-27-2012
02:19 AM
2 Karma
Hello,
You can find tracks on http://www.splunk.com/view/education/SP-CAAAAH9
... View more
12-19-2012
01:11 PM
its an ER now, and a docbug, docs are presuming that side by side is possible, (native | ldap), but radius is out of scope for this.....so besides native its ldap or radius...so its not possible to config radius as a resort....
... View more
hi there
Should accelerated reports configed with sh1 be visible and picked up with sh2?
Thats the basic question, the idea behind this is that i configed the searches from a jobserver but the main indexer isnt use them.
So this is not a set for sh pooling. Iam also curious whats best pratice if I using report accelation against si cube indexes. any tips for this as well?
chrz
... View more
10-25-2012
01:01 PM
yeah, or is ariving at the deploymentbox, i can control them now but was focus on the component deploymentserver which is gone in splunk.d log
... View more
10-25-2012
05:25 AM
This is a returning question but I wonder whats the best way to handle this in sideview.
So i want to achive an overview of clickable links (saved searches) which render the flashtimeline...(same as rendering them from the menu)
... View more
10-25-2012
04:42 AM
cool, indeed it looks like the components are gone,,,,guess time for a deployment config monitor?
... View more
10-24-2012
06:17 AM
Is the component in _internal dropped for the deployment clients connects ( component DeploymenServer) ?
I believe that to get the client you could use :
index=_internal source=splunkd.log component="DeploymentServer" | dedup hostname | table hostname
... View more
- Tags:
- deployment
09-06-2012
03:55 AM
1 Karma
Is it possible someway to run splunk deploy cmds remotely with the cli -uri?
I have to deal with a windows box and it should be nice to deal with this but a get no results.
... View more
- Tags:
- deployment
06-06-2012
11:39 AM
right, but you dont have the fieldextractions like Idletreads=21 etc?
... View more
06-06-2012
11:30 AM
did you already indexed this data? cause Splunks default behaviour is that it will extract the key=values pairs (due the = seperator)
... View more
12-21-2011
07:00 AM
I am indeed checking this but thats a bit difficult :
/mydir/message_1234.trc
it would be handy if
/mydir/message_\d+\.trc
was supported but that becomes a whitelist and that will exclude the *.log so it looks like I am in a lock
... View more
12-21-2011
06:59 AM
I am indeed checking this but thats a bit difficult :
/mydir/message_1234.trc
it would be handy if
/mydir/message_\d+.trc
was supported but that becomes a whitelist and that will exclude the *.log so it looks like I am in a lock
... View more
12-21-2011
05:52 AM
Hi Kristian,...
Then i ended up with 1 sourcetype, ( for more *.trc's)
So thats not ideal as well...thanks
... View more
12-21-2011
03:48 AM
yes, thats what was thinking as well, then it might be not possible to handle this...
... View more
12-21-2011
02:31 AM
Consider i have a directory like :
/mydir/file1.log
/mydir/file.2.log
/mydir/message_1234.trc
Now i want to end up with choosen sourcetypes and souce overrriding for getting rid of the 1234.
When I configured this according the docs it doenst work, the source is not overridden.
I am not sure if this is the best approach and if this will work due the loop in destkey :
inputs.conf
[monitor:///mydir]
props.conf
[source::.../file1.log]
sourcetype = mysourcetype1
[source::.../file2.log]
sourcetype = mysourcetype2
[source::.../*.trc]
sourcetype = temp_sourcetype
[temp_sourcetype]
TRANSFORMS-source_fix = sourceoverride
[mysourcetype3]
TRANSFORMS-fix_source = source_clean_roll_1
tranforms.conf
[temp_sourcetype]
DEST_KEY = MetaData:Sourcetype
SOURCE_KEY = MetaData:Source
REGEX = \d+\.trc
FORMAT = sourcetype::mysourcetype3
[source_clean_roll_1]
DEST_KEY = MetaData:Source
SOURCE_KEY = MetaData:Source
REGEX = (.*)(message_)(\d+)(\.trc)
FORMAT = source::$1$2$4
... View more
- Tags:
- override
- sourcetype
11-14-2011
03:29 AM
The default is not picked anymore so you have to put them in local or under your app...
Arent those Field exactions not very high level btw?, and you want to add you own stuff as well?
So you better add those entries under you custom configs
system\local
props.conf
[sendmail]
MAX_TIMESTAMP_LOOKAHEAD = 32
SHOULD_LINEMERGE = False
TIME_FORMAT = %b %d %H:%M:%S
TRANSFORMS = syslog-host
REPORT-syslog = sendmail-extractions
transforms.conf
[sendmail-extractions]
REGEX = sendmail[(\d+)]: (\w+):
FORMAT = process::sendmail pid::$1 qid::$2
and your own extracts as well,,
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:02 AM
|
Karma from
