Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About bfernandez
bfernandez
Communicator
Member since:
05-27-2011
06-05-2020
Community Statistics
| Posts | 43 |
| Solutions | 3 |
| Karma Given | 33 |
| Karma Received | 37 |
| Member Since | 05-27-2011 |
Activity Feed
- Karma Re: How could i filter network firewall data using a filed value ? for jmallorquin. 06-05-2020 12:47 AM
- Karma Re: Setting the text color in an apps navigation bar? for LukeMurphey. 06-05-2020 12:47 AM
- Karma Re: Are Key/Value Store data counted as Splunk license ? for gfuente. 06-05-2020 12:47 AM
- Karma Re: Why were my triggered alerts cleared after restart? for gfuente. 06-05-2020 12:47 AM
- Karma Re: Splunk DB Connect: Why am I getting error "Invalid column index" trying to create a database input with a rising column SQL query? for richgalloway. 06-05-2020 12:47 AM
- Karma Re: How to display my image in an XML dashboard without reverting it to HTML? for gfuente. 06-05-2020 12:47 AM
- Karma Re: How to make column timechart that can drill down to the clicked column time value? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Why am I getting error "DispatchManager: The user 'admin" does not have sufficient search privileges" after copying custom app from Splunk 4.3 to 6.2? for teunlaan. 06-05-2020 12:47 AM
- Karma Why do scheduled searches randomly stop running in a Splunk 6.3.0 Search Head Cluster? for emiller42. 06-05-2020 12:47 AM
- Karma Re: search results sum count by date? for jmallorquin. 06-05-2020 12:47 AM
- Got Karma for Re: Search Head Clustering: Distributed search status is up, but why is replication status always initial for all search heads except the captain?. 06-05-2020 12:47 AM
- Got Karma for Re: Search Head Clustering: Distributed search status is up, but why is replication status always initial for all search heads except the captain?. 06-05-2020 12:47 AM
- Got Karma for Re: Search Head Clustering: Distributed search status is up, but why is replication status always initial for all search heads except the captain?. 06-05-2020 12:47 AM
- Got Karma for Re: Search Head Clustering: Distributed search status is up, but why is replication status always initial for all search heads except the captain?. 06-05-2020 12:47 AM
- Got Karma for Re: Search Head Clustering: Distributed search status is up, but why is replication status always initial for all search heads except the captain?. 06-05-2020 12:47 AM
- Got Karma for Re: Search Head Clustering: Distributed search status is up, but why is replication status always initial for all search heads except the captain?. 06-05-2020 12:47 AM
- Got Karma for Re: Search Head Clustering: Distributed search status is up, but why is replication status always initial for all search heads except the captain?. 06-05-2020 12:47 AM
- Got Karma for Re: Search Head Clustering: Distributed search status is up, but why is replication status always initial for all search heads except the captain?. 06-05-2020 12:47 AM
- Got Karma for Re: Search Head Clustering: Distributed search status is up, but why is replication status always initial for all search heads except the captain?. 06-05-2020 12:47 AM
- Got Karma for Re: Search Head Clustering: Distributed search status is up, but why is replication status always initial for all search heads except the captain?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 2 | |||
| 1 | |||
| 2 | |||
| 0 | |||
| 1 | |||
| 0 |
09-16-2015
08:01 AM
I have found a workaround for this issue configuring JAVA_HOME variable in $SPLUNK_HOME/etc/splunk-launch.conf.
... View more
07-24-2015
05:54 AM
Did you run SplunkIT3.2 successfully on Splunk6.2 ? According to this case is not working.
... View more
07-24-2015
05:42 AM
Any news about the release of the new version?
... View more
07-22-2015
01:06 AM
As you explain an alert can run in any SH member but the problem is each one have their own RSS feed. You can`t have a unique URL with all fired alerts in every SHC member.
... View more
07-21-2015
09:01 AM
Anyone know if the alerts triggered per each node are consolidated in only one feed?
... View more
06-03-2015
04:11 AM
10 Karma
Support has confirmed that our concert about Replication status Initial is the expected behavior since the Search head captain is the one which always sends bundles to peers so its status is the only one shown as successful.
This behavior has changed from previous versions so they are going to request a Splunk doc change.
... View more
05-28-2015
08:47 AM
I am researching the same problem. Have you made some progress?
... View more
04-17-2015
03:14 AM
I am trying to join two sourcetypes with a common field (ID). The problem occurs when I tried to limit one source to today's indexed data. If I execute the search in “fast mode” it applies index-time filter to both sources, but if I execute it in “verbose” it applies correctly to only one source. It works in both modes without index-time filter.
Search example over the last month:
(sourcetype=source1 _index_earliest=-d@d _index_latest=now) OR (sourcetype= source2) | stats first(fieldsource1), first(field source2) by ID
Using Splunk 6.2.2 – 255606 over Centos x64
... View more
11-13-2014
04:20 AM
3 Karma
I understand that another key benefit is the acceleration. Has anyone done any comparative performance test?
... View more
07-24-2014
06:15 AM
Other option.
After making the transaction you can extract a multivarible field that contains all the matches to finally sum the number of items in it.
index=webnavigation
| transaction maxspan=24h maxpause=30m cs_username
| rex max_match=0 "pageview(? .)" <-- just to extract every match on individual events
| eval countPV = mvcount(PV) <- count the mv items
| stats sum(countPV) as PageViews. <- sum of pageviews on transactions
You can try both to see which is more efficient
... View more
06-30-2014
04:29 AM
5 Karma
I solved this problem deleting the ownership assigned to the lookup file set in:
$SPLUNK_HOME/etc/apps/myapp/metadata/local.meta
[lookups/xxxt.csv]
version = 5.0.3
export = system
owner = name <-- delete
I hope this help
... View more
06-24-2014
02:28 AM
1 Karma
You are missing underscores in the field names. That’s the problem.
info_min_time
info_max_time
http://docs.splunk.com/Documentation/Splunk/6.1.1/SearchReference/Addinfo
... View more
05-06-2014
03:33 AM
Alright, I don’t know if there are any xml option (simple or advance) to do it but you can bucket your data in the time interval that you want and use it in the xseries of your chart in spite of using the default timechart capabilities.
I mean, | bucket span=6m _time | eval mytime = strftime(_time, "%H:%M:%S") | stats xxx by mytime
This should force the chart to mark your frequency.
... View more
05-06-2014
01:56 AM
If you are using timechart you can use span option to do it.
http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/Timechart
span
Syntax: span= | span=
Description: Sets the size of each bucket, using a span length based on time or log-based span.
... View more
03-21-2014
03:54 AM
It is not taking the maxout configuration that is 100 events in a search query by defafult.
Try this CLI example:
Without maxout:
./splunk search "| savedsearch name" -output csv > /data/test/export.csv
(in jobs view) | savedsearch Datos_Grupo_9 | head 100 | export add_timestamp=f add_offset=t format=csv segmentation=raw
With maxout:
./splunk search "| savedsearch name" -output csv -maxout 0 > /data/test/export.csv
(in jobs view) | savedsearch Datos_Grupo_9 | export add_timestamp=f add_offset=t format=csv segmentation=raw
... View more
07-10-2013
12:46 AM
1 Karma
After taking some time looking for information in answers I finally found the solution.
| addinfo | eval selection_duration=strftime(info_min_time,"%+") . " - " . strftime(info_max_time,"%+")
... View more
07-10-2013
12:40 AM
2 Karma
Anyone know if it is possible to use the time picker selection in a query?
I would like to use this value to calculate availability of a server in base of the time range selected.
time picker 24 so time_interval = 24 hours
server time_offline time_interval availability
server1 3 hours 24 hours 87,5%
server2 20 hours 24 hours 26,7%
I mean, I have the number of time downtime but I can’t calculate this metric dynamically.
Thanks!
... View more
03-25-2013
09:09 AM
1 Karma
If it is a configuration option, disabled by default. Why it warns the administrator? Are there any workaround to avoid just only this alerts?
... View more
03-25-2013
07:30 AM
I am having the same problems. This distribution method don't keep original permisions like Deployment Server does.
... View more
12-20-2012
07:10 AM
You may have changed the search mode which manage the data extraction If you are on Splunk 5
http://docs.splunk.com/Documentation/Splunk/5.0/Search/Changethesearchmode
... View more
12-20-2012
06:54 AM
1 Karma
You can handle the volume of internal indices defining a specified retention policy for them.
Retention policies.
http://wiki.splunk.com/Deploy:BucketRotationAndRetention
... View more
12-20-2012
06:54 AM
1 Karma
In the other hand you can see and change the default system loggings at Manager > System settings > System logging.
What Splunk logs about itself
http://docs.splunk.com/Documentation/Splunk/5.0/Troubleshooting/WhatSplunklogsaboutitself
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma from
Karma given to
