Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Alaza
Alaza
Explorer
Member since:
12-26-2017
08-12-2021
Community Statistics
| Posts | 29 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 12-26-2017 |
Activity Feed
- Posted Re: Role to only upload data file via the GUI on Security. 08-07-2020 08:26 AM
- Posted Role to only upload data file via the GUI on Security. 08-07-2020 01:16 AM
- Got Karma for What is the difference of results between verbose and fast mode?. 06-05-2020 12:50 AM
- Got Karma for Re: After indexing data in Splunk, the field is present in the event, but I can't filter on it. 06-05-2020 12:49 AM
- Posted Re: What is the difference of results between verbose and fast mode? on Splunk Dev. 04-17-2019 03:41 AM
- Posted Re: What is the difference of results between verbose and fast mode? on Splunk Dev. 04-17-2019 01:20 AM
- Posted Re: What is the difference of results between verbose and fast mode? on Splunk Dev. 04-16-2019 06:01 AM
- Posted What is the difference of results between verbose and fast mode? on Splunk Dev. 04-15-2019 01:57 AM
- Posted Re: My searchhead is slow since I update from 6 to 7.2.3 on Deployment Architecture. 01-15-2019 03:33 AM
- Posted My searchhead is slow since I update from 6 to 7.2.3 on Deployment Architecture. 01-14-2019 07:59 AM
- Tagged My searchhead is slow since I update from 6 to 7.2.3 on Deployment Architecture. 01-14-2019 07:59 AM
- Tagged My searchhead is slow since I update from 6 to 7.2.3 on Deployment Architecture. 01-14-2019 07:59 AM
- Tagged My searchhead is slow since I update from 6 to 7.2.3 on Deployment Architecture. 01-14-2019 07:59 AM
- Posted Re: How to input an excel file from an email automatically on Getting Data In. 07-02-2018 03:58 AM
- Posted Re: How to input an excel file from an email automatically on Getting Data In. 06-29-2018 06:22 AM
- Posted How to input an excel file from an email automatically on Getting Data In. 06-29-2018 03:52 AM
- Tagged How to input an excel file from an email automatically on Getting Data In. 06-29-2018 03:52 AM
- Tagged How to input an excel file from an email automatically on Getting Data In. 06-29-2018 03:52 AM
- Tagged How to input an excel file from an email automatically on Getting Data In. 06-29-2018 03:52 AM
- Posted Re: Display the count of a field in a multi value field on Getting Data In. 03-09-2018 09:37 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-07-2020
08:26 AM
You just copy the solution of this subject 🤔 : https://community.splunk.com/t5/Getting-Data-In/Capability-to-upload-data-files-via-the-gui-for-a-user/m-p/190518#M37928 But it dosn't work.
... View more
08-07-2020
01:16 AM
Hello, I need a restrict role for only upload data file. I add this capability : edit_monitor - Required to make the "Add Data" option show up in the settings menu. indexes_edit - Required to make the users index name show up in the Indexes drop down when uploading the file. edit_tcp - Required to get the file to actually upload. Without this capability the file upload would hang. search - Required so the user can preview the uploaded file. But the settings are not visible then. The goal is to create a limited access account with only the rigth to upload data, nothing else. Is it possible ? Thanks for your help. SPlunk version 8.1
... View more
Labels
- Labels:
-
access control
-
permissions
04-16-2019
06:01 AM
Thanks for the return but I know this documentation.
What I don't know is why the search inside the dashboard is in fast mode ?
And how can I run the the search inside the dashboard in verbose mode.
I mentionned the fields needed with the command "fields" but it doesn't change anything.
... View more
04-15-2019
01:57 AM
1 Karma
Hello,
this is my query :
(index="uno") OR (index="secundo" earliest=-36mon)
|fields Closed_Date Incident_Number Description Up Overal IDno
|eval ID=coalesce(Incident_Number, IDno)
When the dashboard is loading, it is in Fast mode and don't show the good result.
The good result appears in Verbose mode.
Some fields of the index secundo are empty when the fast mode is used and filled in verbose mode.
I don't get it : with or without "fields" the result is the same, why ?
Thanks for your help.
... View more
01-15-2019
03:33 AM
It was the 6.6.3.
... View more
01-14-2019
07:59 AM
Hello,
since I update my Splunk search head from 6 to 7.2.3, the display of the dashboards are very slow.
In fact, all the action are slowed than the anterior version.
But my index are the same and the upgrade has been done with no error.
Any clues about that ?
Regards,
Alaza
... View more
07-02-2018
03:58 AM
I do not have the knowledge to do this script, that's why I need some help.
... View more
06-29-2018
06:22 AM
That's the script I need, that's why I asked my question 🙂
... View more
06-29-2018
03:52 AM
Hello,
everyday I have an email with an Excell file attached.
To input the data in Splunk, I have to save the file, convert the file in csv then add it to Splunk.
Is it possible to do this action automatically ?
... View more
03-09-2018
09:37 AM
I see, but yes I need time.
... View more
03-09-2018
08:33 AM
I understand but I want to display the count of event matching for each value of the field ABLA.
If the match result is null I want to display it too.
... View more
03-09-2018
08:19 AM
Thanks but to be more precise, I want to display on a dashboard the count of events with the ALIAS matching ABLA by time.
Example :
Date ALIAS1 ALIAS2 ALIAS3 ALIAS4 ALIAS5 ALIAS6 ALIAS7 ... ALIAS10
09/03/2018 1 4 0 7 2 1 0 3
... View more
03-09-2018
04:39 AM
I have a CSV with 10 values for the field ABLA.
In my events I have a field ALIAS and I want to display on a dashboard the count of events with the ALIAS matching ABLA by time.
index="events_index"
| append [| inputlookup CSV.csv |stats values(ABLA) as liste]
| where alias IN liste
How can I do that ?
... View more
- Tags:
- csv
- multivalue
03-08-2018
08:09 AM
Type_Group is a field and I can't display the value like the picture, weekend or not.
... View more
03-08-2018
07:46 AM
Hello,
How can I have a table like the picture with the time a the top, the type on the right side and a count by date on the row ?
With timechart It doesn't work :
index="Ico_number" Type_Group
| timechart count by Type_Group
... View more
02-28-2018
09:52 AM
The use of the time picker was the goal, without it, my search not modulabe.
... View more
02-28-2018
08:22 AM
Hi, as I said I already use |eval _time=strptime(field1, "%d/%m/%Y").
Can you be more precise ?
... View more
02-28-2018
12:53 AM
Hello,
I have importing a CSV file with the field2 for the timestamp. It's working.
After that I need to create a timechart using the filed1 for the timestamp.
I use this :
|eval _time=strptime(field1, "%d/%m/%Y")
| timechart span=year count(field3)
If I put "all the time" on the timepicker, it works.
But if put "year 2013" on the timepicker the year 2013, the result is the events of the year 2013 based on the index time ( equal to field2) and not the field1.
I don't understand why the timechart is based on the events link to the field1 inside the event link to the field2.
[Version Splunk 6.6.3]
... View more
01-23-2018
03:38 AM
To be more clear on my demand.
My index contains row with differents fields : field_1 is the primary key (person) and field_2 is the function of this person.
A person can have 4 functions, or 3, or 2 or 1 or not (null).
For example a person with 4 fonctions will be represent by 4 rows. Each row with the field_2 fill differently.
For example a person with 3 fonctions will be represent by 3 rows. Each row with the field_2 fill differently.
A person with no function will be represent by 1 row with the field_2 null.
I want to have one row by person with the differents commun fields, and 4 fields representing each function possible fill if the person have this function.
... View more
01-22-2018
09:26 AM
I'm sorry but it doesn't work, I try to be more clear on my demand.
My index contains row with differents fields : field_1 is the primary key (person) and field_2 is the function of this person.
A person can have 4 functions, or 3, or 2 or 1 or not (null).
For example a person with 4 fonctions will be represent by 4 rows. Each row with the field_2 fill differently.
For example a person with 3 fonctions will be represent by 3 rows. Each row with the field_2 fill differently.
A person with no function will be represent by 1 row with the field_2 null.
I want to have one row by person with the differents commun fields, and 4 fields representing each function possible fill if the person have this function.
... View more
01-22-2018
07:55 AM
Hello,
in my index I have values like below :
field _1 | field _2
null |1
6000 |2
3000 |2
6000 |3
3000 |3
null |4
How can I put the value on one row like this result ?
field_1 |field_2 |field_3
1 | null |null
2 |6000 |3000
3 |6000 |3000
4 |null |null
Thanks for you help.
... View more
- Tags:
- splunk-enterprise
01-03-2018
01:35 AM
Thanks a lot, yes it's answer to my question.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-12-2021
11:10 AM
|
