Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About Starlette
Starlette
Contributor
Member since:
02-26-2010
06-05-2020
Community Statistics
| Posts | 95 |
| Solutions | 3 |
| Karma Given | 31 |
| Karma Received | 47 |
| Member Since | 02-26-2010 |
Activity Feed
- Got Karma for 2 different timestamps in single log. 06-23-2021 01:48 PM
- Karma How to rename field names using lookups and regex? for shikhanshu. 06-05-2020 12:47 AM
- Got Karma for Is the data from accelerated data models and reports replicated in a cluster as well?. 06-05-2020 12:47 AM
- Got Karma for Is the data from accelerated data models and reports replicated in a cluster as well?. 06-05-2020 12:47 AM
- Got Karma for Is the data from accelerated data models and reports replicated in a cluster as well?. 06-05-2020 12:47 AM
- Karma Re: Why is FSChange (file system change monitor) a deprecated feature in Splunk 5.0? for cervelli. 06-05-2020 12:46 AM
- Karma Re: Deployment clients logging for sowings. 06-05-2020 12:46 AM
- Karma Re: Single Value change font size for Drainy. 06-05-2020 12:46 AM
- Karma Re: Override source key in inputs.conf for gekoner. 06-05-2020 12:46 AM
- Karma Re: security threats for Ayn. 06-05-2020 12:46 AM
- Karma Re: timechart count against si gives different max results for 2 intervals for Drainy. 06-05-2020 12:46 AM
- Karma List of saved/in-line searches within a view for SarahBOA. 06-05-2020 12:46 AM
- Karma Re: Eval limitations on si index with sistats count by field1, field2 etc for dwaddle. 06-05-2020 12:46 AM
- Karma Re: Eval limitations on si index with sistats count by field1, field2 etc for sideview. 06-05-2020 12:46 AM
- Karma Re: System requirements for Universal Forwarder for Drainy. 06-05-2020 12:46 AM
- Karma Deployment monitor and intermediary forwarder for echalex. 06-05-2020 12:46 AM
- Karma Re: report acceleration besides existing job server for hexx. 06-05-2020 12:46 AM
- Got Karma for Re: space and tab as Delimiter. 06-05-2020 12:46 AM
- Got Karma for list deploy-clients remotely. 06-05-2020 12:46 AM
- Got Karma for Re: how to really delete, NOT HIDE, data from splunk. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 3 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
07-14-2015
01:38 AM
same on macos / chrome
... View more
Is the data from accelerated datamodels and reports replicated as well? I cant find it in the docs...
... View more
12-31-2012
01:56 AM
1 Karma
Just found out that this is now possible in v5....test till 7 levels!
... View more
12-19-2012
01:11 PM
its an ER now, and a docbug, docs are presuming that side by side is possible, (native | ldap), but radius is out of scope for this.....so besides native its ldap or radius...so its not possible to config radius as a resort....
... View more
hi there
Should accelerated reports configed with sh1 be visible and picked up with sh2?
Thats the basic question, the idea behind this is that i configed the searches from a jobserver but the main indexer isnt use them.
So this is not a set for sh pooling. Iam also curious whats best pratice if I using report accelation against si cube indexes. any tips for this as well?
chrz
... View more
10-25-2012
01:01 PM
yeah, or is ariving at the deploymentbox, i can control them now but was focus on the component deploymentserver which is gone in splunk.d log
... View more
10-25-2012
05:25 AM
This is a returning question but I wonder whats the best way to handle this in sideview.
So i want to achive an overview of clickable links (saved searches) which render the flashtimeline...(same as rendering them from the menu)
... View more
10-25-2012
04:42 AM
cool, indeed it looks like the components are gone,,,,guess time for a deployment config monitor?
... View more
10-24-2012
06:17 AM
Is the component in _internal dropped for the deployment clients connects ( component DeploymenServer) ?
I believe that to get the client you could use :
index=_internal source=splunkd.log component="DeploymentServer" | dedup hostname | table hostname
... View more
- Tags:
- deployment
09-06-2012
03:55 AM
1 Karma
Is it possible someway to run splunk deploy cmds remotely with the cli -uri?
I have to deal with a windows box and it should be nice to deal with this but a get no results.
... View more
- Tags:
- deployment
06-06-2012
11:39 AM
right, but you dont have the fieldextractions like Idletreads=21 etc?
... View more
06-06-2012
11:30 AM
did you already indexed this data? cause Splunks default behaviour is that it will extract the key=values pairs (due the = seperator)
... View more
12-21-2011
07:00 AM
I am indeed checking this but thats a bit difficult :
/mydir/message_1234.trc
it would be handy if
/mydir/message_\d+\.trc
was supported but that becomes a whitelist and that will exclude the *.log so it looks like I am in a lock
... View more
12-21-2011
06:59 AM
I am indeed checking this but thats a bit difficult :
/mydir/message_1234.trc
it would be handy if
/mydir/message_\d+.trc
was supported but that becomes a whitelist and that will exclude the *.log so it looks like I am in a lock
... View more
12-21-2011
05:52 AM
Hi Kristian,...
Then i ended up with 1 sourcetype, ( for more *.trc's)
So thats not ideal as well...thanks
... View more
12-21-2011
03:48 AM
yes, thats what was thinking as well, then it might be not possible to handle this...
... View more
12-21-2011
02:31 AM
Consider i have a directory like :
/mydir/file1.log
/mydir/file.2.log
/mydir/message_1234.trc
Now i want to end up with choosen sourcetypes and souce overrriding for getting rid of the 1234.
When I configured this according the docs it doenst work, the source is not overridden.
I am not sure if this is the best approach and if this will work due the loop in destkey :
inputs.conf
[monitor:///mydir]
props.conf
[source::.../file1.log]
sourcetype = mysourcetype1
[source::.../file2.log]
sourcetype = mysourcetype2
[source::.../*.trc]
sourcetype = temp_sourcetype
[temp_sourcetype]
TRANSFORMS-source_fix = sourceoverride
[mysourcetype3]
TRANSFORMS-fix_source = source_clean_roll_1
tranforms.conf
[temp_sourcetype]
DEST_KEY = MetaData:Sourcetype
SOURCE_KEY = MetaData:Source
REGEX = \d+\.trc
FORMAT = sourcetype::mysourcetype3
[source_clean_roll_1]
DEST_KEY = MetaData:Source
SOURCE_KEY = MetaData:Source
REGEX = (.*)(message_)(\d+)(\.trc)
FORMAT = source::$1$2$4
... View more
- Tags:
- override
- sourcetype
11-14-2011
03:29 AM
The default is not picked anymore so you have to put them in local or under your app...
Arent those Field exactions not very high level btw?, and you want to add you own stuff as well?
So you better add those entries under you custom configs
system\local
props.conf
[sendmail]
MAX_TIMESTAMP_LOOKAHEAD = 32
SHOULD_LINEMERGE = False
TIME_FORMAT = %b %d %H:%M:%S
TRANSFORMS = syslog-host
REPORT-syslog = sendmail-extractions
transforms.conf
[sendmail-extractions]
REGEX = sendmail[(\d+)]: (\w+):
FORMAT = process::sendmail pid::$1 qid::$2
and your own extracts as well,,
... View more
11-13-2011
11:12 AM
But is the data after this config picked up (split) correctly?
If this was already sourcetyped data then you could use a sourcetype alias ( http://docs.splunk.com/Documentation/Splunk/latest/Data/Renamesourcetypes ), but thats not the case here.
I assume the data you mean already indexed is just a part of the syslogdata...the only way is to re-index is after clean your index. ( so from the source,,,syslog files maybee)
I played with indexed data forwarded as cloned data to a VM an reroute that back,,,but thats hard to explain here....
... View more
11-13-2011
08:01 AM
2 options :
1)
Save a NOT search as macro to catch the lines and prefix this in your main search
2)
Get rid of them before indexing ( best option)
Check this , and scroll for the sedcmd
The regex should be pretty easy,,just the first range of characters, let me know if you succeed, otherwise paste a sample and the header...
... View more
11-13-2011
07:51 AM
4 Karma
Sure that is possible and i do it all the time,,
Take a look at this, we call this sourcetype overriding
You should end up with something like this : ( replace syslog with your stanza for the syslog input)
props.conf
[syslog]
TRANSFORMS-sourcetype_and_host_override = sendmail
SHOULD_LINEMERGE = false
transforms.conf
[sendmail]
DEST_KEY = MetaData:Sourcetype
REGEX = (YOURREGEXTOCATCHSENDMAIL)
FORMAT = sourcetype::sendmail
Let me know if you succeed, otherwise paste a sample of your log to get the regex right...
... View more
11-12-2011
10:50 AM
Well this IS rendering events,,,,fyi if you have 300.000 events per minute then this is slow for shooting it in the pulldown module...
I am testing now with | metadata type=hosts and subsearch for the sourcetype...( and index)
But no luck,,,i think i have to schedule it with summary indexing,,,
... View more
11-12-2011
08:41 AM
1 Karma
Is there a smart way to list field values as input without rendering the events?
Example :
I want to list the hosts for a sourcetype=named
so instead of doing a
sourcetype=named | fields host ( and have to use a earliest time)
cause this takes time to render the pulldown module....maybee |metadata ?
... View more
10-19-2011
06:57 AM
1 Karma
multiple_delims] DELIMS = "|;", "=:"
The above example extracts key-value pairs which are separated by '|' or ';'.
while the key is delimited from value by '=' or ':'.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:02 AM
|
