Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About atemourt
atemourt
Engager
Member since:
01-31-2018
06-05-2020
Community Statistics
| Posts | 13 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 01-31-2018 |
Activity Feed
- Karma Re: How to dynamically change the dropdown menu of a dashboard as a result of selecting another dropdown? for gokadroid. 06-05-2020 12:48 AM
- Posted Can you change/develop/tune/test indexing time transformations (props.conf) without restarting a Splunk instance? on Getting Data In. 09-14-2018 05:16 AM
- Tagged Can you change/develop/tune/test indexing time transformations (props.conf) without restarting a Splunk instance? on Getting Data In. 09-14-2018 05:16 AM
- Tagged Can you change/develop/tune/test indexing time transformations (props.conf) without restarting a Splunk instance? on Getting Data In. 09-14-2018 05:16 AM
- Posted Re: Is it possible to edit a sourcetype after its creation? on Getting Data In. 09-13-2018 04:12 AM
- Posted Re: Is it possible to edit a sourcetype after its creation? on Getting Data In. 09-13-2018 04:11 AM
- Posted Re: Why do I see duplicate fields in sourcetype configuration? on Getting Data In. 09-13-2018 03:19 AM
- Posted Is it possible to edit a sourcetype after its creation? on Getting Data In. 09-13-2018 03:15 AM
- Tagged Is it possible to edit a sourcetype after its creation? on Getting Data In. 09-13-2018 03:15 AM
- Tagged Is it possible to edit a sourcetype after its creation? on Getting Data In. 09-13-2018 03:15 AM
- Posted Why do I see duplicate fields in sourcetype configuration? on Getting Data In. 09-13-2018 01:46 AM
- Tagged Why do I see duplicate fields in sourcetype configuration? on Getting Data In. 09-13-2018 01:46 AM
- Tagged Why do I see duplicate fields in sourcetype configuration? on Getting Data In. 09-13-2018 01:46 AM
- Tagged Why do I see duplicate fields in sourcetype configuration? on Getting Data In. 09-13-2018 01:46 AM
- Tagged Why do I see duplicate fields in sourcetype configuration? on Getting Data In. 09-13-2018 01:46 AM
- Posted What's causing the error message in the extraction of new fields? on Splunk Search. 04-19-2018 01:15 AM
- Tagged What's causing the error message in the extraction of new fields? on Splunk Search. 04-19-2018 01:15 AM
- Tagged What's causing the error message in the extraction of new fields? on Splunk Search. 04-19-2018 01:15 AM
- Tagged What's causing the error message in the extraction of new fields? on Splunk Search. 04-19-2018 01:15 AM
- Tagged What's causing the error message in the extraction of new fields? on Splunk Search. 04-19-2018 01:15 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-14-2018
05:16 AM
Hello Splunkers,
Is there any way how to change/develop/tune/test indexing time transformations (props configurations) without need of restart of a Splunk instance?
Thanks in advance!
Afroditi
... View more
09-13-2018
04:12 AM
Thank you @mayurr98!
... View more
09-13-2018
04:11 AM
Thank you @florianduhme!
... View more
09-13-2018
03:19 AM
Hello mayurr98,
Thank you very much for your reply!
... View more
09-13-2018
03:15 AM
Hello Splunkers,
Is it possible to edit a sourcetype after its creation?
Thank you in advance!
Afroditi
... View more
09-13-2018
01:46 AM
Hello Splunkers,
I am trying to configure a sourcetype in Advanced section.
For example, I create a field alias by creating the key/value:
When I perform search on the data, I see both MD5 and md5 fields to be extracted and containing the same values.
However, I want to see only md5 in Interesting fields.
Why do I see both fields?
Thank you in advance!
Afroditi
... View more
04-19-2018
01:15 AM
Why do I get the following error message when I try to extract new fields?
The events associated with this job have no sourcetype information: 1524125445.48
... View more
03-22-2018
08:38 AM
Hello,
Is it possible to get data into Splunk from a website with HTML file?
Example: https://name/report.php
Thank you in advance!
Afroditi
... View more
03-20-2018
02:19 AM
Yes, I restarted Splunk.
Every time I do a change in the conf files, I restart Splunk.
... View more
03-19-2018
02:04 AM
Hello skoelpin,
Thank you for the answer.
I have tried what you suggested, but Splunk cannot read the timestamp.
I still see the message: Could not use timestamp to parse the data from "".
Is there anything else that I can try?
... View more
03-18-2018
02:10 PM
Thanks for the advise.
I have set the MAX_DAYS_AGO to 5000 in props.conf.
Actually, my props.conf is:
[data]
DATETIME_CONFIG =
MAX_DAYS_AGO = 5000
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TIMESTAMP_FIELDS = Date
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = true
However, it doesn't work. Splunk still doesn't recognize dates from 2010, 2011 and 2012. 😞
... View more
03-16-2018
06:08 AM
I uploaded the csv file from my computer.
... View more
03-16-2018
03:29 AM
Hello,
I have a csv file with data from 2010 until 2017.
Splunk seems to parse the timestamp correctly for most of the data but when the date is from 2010 or 2011 or 2012, I see the message: Could not use timestamp to parse the data from "".
i.e. Could not use timestamp to parse the data from "1/21/2010".
The format of date in the csv file is month/day/year.
Why does Splunk recognize the timestamp when the date is 1/20/2017 23:00:00 PM but it doesn't recognizes the timestamp when the date is 1/21/2010 11:00:00 AM?
Sample of data:
Date Type Latitude Longitude Id
1/21/2010 11:00 Dry Cargo 39.3869634 22.9385489 29
1/22/2010 8:00 Dry Cargo 39.3675609 22.9491659 30
1/23/2010 13:30 Dry Cargo 39.367539 22.9229295 31
1/24/2010 9:00 Refrigerated Cargo 39.3686508 22.9414365 32
1/26/2010 18:00 Dry Cargo 39.3766097 22.9603403 33
1/26/2010 17:00 Dry Cargo 39.3557886 22.9581058 34
1/27/2010 10:00 Refrigerated Cargo 39.3799523 22.9232278 35
1/27/2010 12:00 Dry Cargo 39.3647131 22.9517557 36
Thank you in advance!
... View more
- Tags:
- splunk-enterprise
