Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About dougmartin
dougmartin
Path Finder
Member since:
06-19-2015
06-05-2020
Community Statistics
| Posts | 23 |
| Solutions | 0 |
| Karma Given | 14 |
| Karma Received | 4 |
| Member Since | 06-19-2015 |
Activity Feed
- Got Karma for Re: Can I reload savedsearches.conf without restarting?. 09-10-2024 01:55 AM
- Got Karma for Re: Can I reload savedsearches.conf without restarting?. 10-14-2020 06:06 AM
- Karma Re: How to share and manage searches across Splunk instances? for woodcock. 06-05-2020 12:48 AM
- Karma Re: Sometime my dbconnect is to disabled. for richgalloway. 06-05-2020 12:48 AM
- Karma Updating server.conf with Chef, how can I generate pass4SymmKey and sslKeysfilePassword using splunk.secret? for kdoonan. 06-05-2020 12:47 AM
- Karma Re: DB connect 2 Problem for goelli. 06-05-2020 12:47 AM
- Karma Splunk DB Connect 2: Why am I getting error "Cannot get a connection, pool error Timeout waiting for idle object"? for guimilare. 06-05-2020 12:47 AM
- Karma Re: Is the current version of S.o.S - Splunk on Splunk compatible with Splunk 6.3? for hexx. 06-05-2020 12:47 AM
- Karma Creating an HTTP Event Collector input generates "invalid key in stanza" error when running btool on the description field for NaraSplunk. 06-05-2020 12:47 AM
- Karma Can I set force_change_pass on a user from the command line? for NaraSplunk. 06-05-2020 12:47 AM
- Karma How to filter events with exporttool? for sam. 06-05-2020 12:46 AM
- Karma Re: How to filter events with exporttool? for jt_splunk. 06-05-2020 12:46 AM
- Karma Re: Can't log in to splunk for piebob. 06-05-2020 12:46 AM
- Karma Is it possible to parse an extracted field as json if the whole log line isn't json? for stevennoble. 06-05-2020 12:46 AM
- Karma using the API to get graphs for wsw70. 06-05-2020 12:46 AM
- Got Karma for Re: Can I reload savedsearches.conf without restarting?. 06-05-2020 12:46 AM
- Got Karma for Re: Can I reload savedsearches.conf without restarting?. 06-05-2020 12:46 AM
- Karma Re: Manually Trigger Scheduled Saved Search for matthieu_araman. 06-05-2020 12:45 AM
- Posted Re: How to share and manage searches across Splunk instances? on Splunk Search. 07-19-2016 12:22 PM
- Posted Re: Can I reload savedsearches.conf without restarting? on Deployment Architecture. 06-23-2016 06:51 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-19-2016
12:22 PM
Yup, the 1-way sync would be a start.
A little worried about overwriting saved searches but something has to give since there is no great way to do this otherwise.
... View more
06-23-2016
06:51 AM
4 Karma
You can access specific reloads like this:
https://spliunk:8080/en-US/debug/refresh?entity=admin/savedsearch
... View more
05-24-2016
11:38 AM
We have multiple Splunk instances (webui & indexer) that we manage. They're currently kept isolated by design. However, we're trying to figure out the best way to share searches and distribute searches between the instances with minimal effort.
Basically, we want to create a search/report on SplunkB and see it on SplunkA & SplunkC within a short time frame (0-15minutes would suffice). We'd also like the searches from SplunkA to show up on B&C.
Hopefully that makes sense.
... View more
05-23-2016
06:24 AM
How can I set up several sourcetypes to inherit the values from one place so I don't have to edit 10 different ones that all have the same basic framework?
... View more
04-12-2016
07:26 AM
What is the "xor 'DEFAULTSADEFAULTSA....'" string we xor with?
... View more
02-01-2016
01:10 PM
Splunk DB Connect 2 is proving very difficult to get up and running:
2016-02-01 21:05:45 ERROR DBX2Proxy:52 - Exception encountered for entity-name = mylookup and type = lookup
java.lang.OutOfMemoryError: Java heap space
at com.sun.crypto.provider.CipherCore.update(CipherCore.java:750)
at com.sun.crypto.provider.AESCipher.engineUpdate(AESCipher.java:400)
at javax.crypto.Cipher.update(Cipher.java:1945)
at sun.security.ssl.CipherBox.decrypt(CipherBox.java:469)
at sun.security.ssl.InputRecord.decrypt(InputRecord.java:172)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1015)
at sun.security.ssl.SSLSocketImpl.readDataRecord(SSLSocketImpl.java:930)
at sun.security.ssl.AppInputStream.read(AppInputStream.java:105)
at com.mysql.jdbc.MysqlIO.readFully(MysqlIO.java:2954)
at com.mysql.jdbc.MysqlIO.nextRowFast(MysqlIO.java:2159)
at com.mysql.jdbc.MysqlIO.nextRow(MysqlIO.java:1964)
at com.mysql.jdbc.MysqlIO.readSingleRowSet(MysqlIO.java:3316)
at com.mysql.jdbc.MysqlIO.getResultSet(MysqlIO.java:463)
at com.mysql.jdbc.MysqlIO.readResultsForQueryOrUpdate(MysqlIO.java:3040)
at com.mysql.jdbc.MysqlIO.readAllResults(MysqlIO.java:2288)
at com.mysql.jdbc.MysqlIO.sqlQueryDirect(MysqlIO.java:2681)
at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2551)
at com.mysql.jdbc.PreparedStatement.executeInternal(PreparedStatement.java:1861)
at com.mysql.jdbc.PreparedStatement.executeQuery(PreparedStatement.java:1962)
at org.apache.commons.dbcp2.DelegatingPreparedStatement.executeQuery(DelegatingPreparedStatement.java:83)
at org.apache.commons.dbcp2.DelegatingPreparedStatement.executeQuery(DelegatingPreparedStatement.java:83)
at com.splunk.dbx2.DBX2LookupJDBC.load(DBX2LookupJDBC.java:300)
at com.splunk.dbx2.DBX2Proxy.loadLookups(DBX2Proxy.java:330)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:497)
at com.splunk.dbx2.ServiceResponder.respond(ServiceResponder.java:422)
at org.apache.avro.ipc.Responder.respond(Responder.java:151)
at org.apache.avro.ipc.Responder.respond(Responder.java:99)
at org.apache.avro.ipc.ResponderServlet.doPost(ResponderServlet.java:48)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)
... View more
02-01-2016
08:20 AM
I downvoted this post because this isn't a solution, it's a workaround.
... View more
01-29-2016
10:08 AM
Right. The problem is the web UI sticks the description in there.
... View more
01-29-2016
08:53 AM
It's xyz. Nothing special.
... View more
01-29-2016
08:13 AM
Yes du refers to the *nix du command.
... View more
01-28-2016
11:53 AM
false errors, is never NOT a problem 🙂
... View more
01-28-2016
11:52 AM
[http://splunk_machine_du_output]
disabled = 0 index = disk_space_index
indexes = disk_space_index source =
splunk_box sourcetype = our_sourcetype
token =
20202020-4242-4343-4343-434334343434
description = xyz
... View more
01-28-2016
10:40 AM
To get rid of the "first time logging in?" messsage on the web app just touch $SPLUNK_HOME/etc/.ui_login
source: https://answers.splunk.com/answers/5543/how-can-i-remove-the-first-time-logging-in-hint-in-the-login-form.html,I've used "splunk edit user admin" but when the web app next comes up it does the whole "first time signing in" and change password which is annoying.
... View more
12-11-2015
05:37 AM
Thanks for confirming. We've already decided to move forward with DB connect2 but was hoping I could still add mysqlconnector to our new instance to support migrated reports.
... View more
12-10-2015
12:04 PM
It's no longer listed on the apps page: https://apps.splunk.com/apps/id/MySQL
I'm creating a new Splunk machine (6.3) and the older machine (6.1) had this app installed.
... View more
09-09-2015
02:04 PM
We need a better solution here to answer this question. Such as how to limit the number of inline searches but still display the charts/data near up to date.
... View more
08-18-2015
10:58 AM
What is the max value for maxsearches? Is there a way to NOT have a max (set to 0 or -1)?
... View more
07-17-2015
02:11 PM
I used the map. The key for me was both endtimeu and the fact the map search command fails quietly if you try somelike eval="$myvar$" and you don't escape the quotes: eval=\"$myvar$\" within that map search.
... View more
07-15-2015
08:46 AM
Can you add an explanation of the parts.
... View more
07-15-2015
08:26 AM
I have a log table and I need to match up the user_id with potential PRE log-in user_ids
user_id | page_referer | event_time
1199 | blah.com/sign_in | 01/02/2015 1:01:33 am
2244 | blah.com/sign_in | 01/22/2015 7:55:33 am
user_id | page_referer | event_time
2200 | blah.com/before_sign_in | 01/02/2015 1:01:25 am
4488 | blah.com/before_sign_in | 01/22/2015 7:55:12 am
4499 | blah.com/before_sign_in | 01/22/2015 7:55:15 am
so 1199 should matchup with 2200 and 2244 match up with 4488 & 4499 in a result like this:
user_id | other user_id (MV field ok)
1199 | 2200
2244 | 4488, 4499
Part of the problem I'm having is how to construct a subsearch, or join (or appendcols, etc) where I need to use the event_timestamp as a search ( event_timestamp-90 as the lower range and event_timestamp as the upper range).
I could end up with the final result table, or some other join/transaction that can group these pre/post login user_ids.
... View more
