- " class="nav-category">Using Splunk
This widget could not be displayed.
This widget could not be displayed.
This widget could not be displayed.
This widget could not be displayed.
- " class="nav-category">Training & Certification Blog
This widget could not be displayed.
This widget could not be displayed.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About asabatini85
asabatini85
Path Finder
Member since:
02-08-2018
03-26-2021
Community Statistics
| Posts | 30 |
| Solutions | 3 |
| Karma Given | 16 |
| Karma Received | 14 |
| Member Since | 02-08-2018 |
Activity Feed
- Got Karma for Re: How come enable boot start doesn't work with Splunk on SUSE Enterprise 15?. 07-24-2023 06:19 AM
- Karma Re: Splunk Fundamental Module 4 Lab for aasabatini. 03-26-2021 03:56 AM
- Karma Re: Does Splunk latest version (8.1.2) supports on Centos 8 for aasabatini. 03-26-2021 03:54 AM
- Karma Re: Help on basic question concerning lookup command for aasabatini. 02-19-2021 01:49 AM
- Karma Re: How to check the total consumption out of the 500MB provided by free splunk? for aasabatini. 02-19-2021 01:47 AM
- Karma Re: Change timestamp after initial configure in props.conf for aasabatini. 02-19-2021 01:46 AM
- Karma Re: Not able to send logs to my syslog-ng server for aasabatini. 02-19-2021 01:45 AM
- Karma Re: Not able to send logs to my syslog-ng server for aasabatini. 02-19-2021 01:44 AM
- Karma ITSI KPI summary_index for asabatini23. 06-05-2020 12:51 AM
- Karma Re: How to count for all columns in table based on condition in Splunk for asabatini23. 06-05-2020 12:51 AM
- Karma Re: Collectd dosent send data to splunk for asabatini23. 06-05-2020 12:51 AM
- Karma Re: Perfmon to metrics in 7.0 for asabatini23. 06-05-2020 12:50 AM
- Karma Re: Splunk ES "Error occurred during investigation" for kchamplin_splun. 06-05-2020 12:50 AM
- Karma Re: How to join two searches? for marco1987. 06-05-2020 12:50 AM
- Karma How to drilldown to local windows share for marco1987. 06-05-2020 12:50 AM
- Got Karma for Re: Will AWS S3 event forwarding to SQS will end up being a different message than S3 to SNS to SQS?. 06-05-2020 12:50 AM
- Got Karma for Re: Will AWS S3 event forwarding to SQS will end up being a different message than S3 to SNS to SQS?. 06-05-2020 12:50 AM
- Got Karma for Re: Can you help me parse the following raw data set using Splunk?. 06-05-2020 12:50 AM
- Got Karma for Re: How come enable boot start doesn't work with Splunk on SUSE Enterprise 15?. 06-05-2020 12:50 AM
- Got Karma for Re: How come enable boot start doesn't work with Splunk on SUSE Enterprise 15?. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
01-13-2020
07:52 AM
Hi All,
I need to run a query after a stored procedure, because the stored procedure is a security check before to run a query.
Example
I need to run this:
"call storeprocedurename(?|?);
select * from table;"
But on the DB connect I can run or the stored procedure or the query, it is not possbile run both
| dbxquery procedure="{call storeprocedurename(?|?) connection="TERADATA" query="select * from table"
... View more
12-10-2019
02:45 PM
Thanks for your answer, but the my ldap is not windows based.
... View more
12-10-2019
07:37 AM
Hi
I'm wondering if it is possible to find a search to extract identities information from open ldap.
Thanks.
... View more
10-30-2019
05:03 AM
Nothing, but is correct because dest filed don't have value for now.
... View more
10-29-2019
06:19 AM
Hi all,
I have a weird error on my splunk instance 7.3.0.
I created a tag called application_web, if I try to use this tag with dedup on dest field I have the value of the source on my field.
Example:
search
tag=application_web app=nmol OR app=cross
| dedup dest
| table dest
results
dest
source::/u01/wlslog/osb_ib_prod/osb_lxosb061/serverlogs/access.log|host::LXOSB061|cross_access
source::/u01/wlslog/osb2_ib_prod/osb_lxosb074/serverlogs/access.log|host::LXOSB074|cross_access
source::/u01/app/oracle/admin/osb2_prod/mserver/osb2_prod/servers/osb_lxosb004_d/logs/access.yyyyMMdd.log|host::lxosb004.gbm.lan|cross_access
but If I remove the dedup splunk work correctly, also with index and sourcetype field on search
someone had my same issue?
Regards
... View more
10-29-2019
04:38 AM
2 Karma
Hi Hxman,
I think is possible receive data from Zenoss if the product offers the possibility of sharing information with the third-party software.
you have to check in the zenoss product if it is possible send data either via syslog or via rest.
... View more
02-13-2019
06:11 AM
2 Karma
Hi Tiago,
it depends on the type of input you are configuring
for example the cloudtrail inputs needs only the SQS and the S3.
for the config-legacy inputs you needs the SNS.
also you can configure the custom data in your S3 bucket.
For any doubts I suggest you to check these videos
https://www.youtube.com/channel/UCn7X9CAe0ZAHOzVb_OpRWkQ
Regards
Alessandro
... View more
02-08-2019
01:50 AM
Thanks for your answer yes I'm using the aws add-on
... View more
02-06-2019
07:32 AM
Hi Guys,
I have my aws account with different regions and one splunk HF created with aws but present in only region , my question is:
Can I configure the different Role for each Regions in my Splunk HF?
Or is better create different HF for each regions?
Best Regards
... View more
11-28-2018
07:32 AM
thanks, but I fixed the issue by myself
... View more
11-28-2018
07:31 AM
5 Karma
I fixed the issue
Suse Enterprise 15 need this package to run service at boot time.
insserv-compat
STEP 1 install the package
zypper install insserv-compat
STEP 2 run enable comand
./splunk enable boot-start
STEP 3 set the run level
chkconfig --set splunk on
... View more
11-28-2018
06:34 AM
Hi guys,
I installed Splunk on Enterprise SUSE enterprise 15.
When I run the command splunk enable boot-start , I received this error:
/sbin/insserv: No such file or directory
someone can help me?
... View more
- Tags:
- splunk-enterprise
11-26-2018
04:09 AM
Hi
can I ask which file you pushed?
BR
... View more
11-07-2018
07:26 AM
Hi guys,
I have this xml format Data, I need to transforms these events in index time
67195595 67195596 67195597 67195598 67204206
0 0 0 0 8
to CSV
measTypes . measResults
67195595 . 0
67195596 . 0
67195597 . 0
67195598 . 0
67204206 . 8
any suggestions?
Thanks
... View more
- Tags:
- splunk-enterprise
10-17-2018
01:58 AM
In that case it's better use the transaction comand for the self join.
... View more
10-15-2018
05:23 AM
I don't have an Idea from which version the client upgraded, I need to acquire this information, I know the splunk version is 7.0.3
... View more
10-12-2018
06:20 AM
Hi Folks,
my client recived this error after updated Splunk ES to 5.1.0 Version
the error is:
Error occurred during investigation migration
anyone have some idea?
Thanks
... View more
10-04-2018
07:21 AM
1 Karma
What is for you, the relevant values?
you can use the : with separator, but you need modify the file log.
... View more
06-12-2018
02:50 AM
1 Karma
Why I receive this error message in my splunk enviroment?
Splunk_SA_CIM version 4.11.0 is lower than required 4.9.1
... View more
- Tags:
- splunk-enterprise
06-08-2018
06:47 AM
the app is: AI_LAN_FR0_R_1V73_A350_idx
the output is:
opt/splunk/etc/apps/TA_AI_R_1V73_serverclass_gateway/default/serverclass.conf [global]
/opt/splunk/etc/apps/TA_AI_R_1V73_serverclass_gateway/default/serverclass.conf continueMatching = true
/opt/splunk/etc/system/default/serverclass.conf crossServerChecksum = false
/opt/splunk/etc/system/default/serverclass.conf endpoint = $deploymentServerUri$/services/streams/deployment?name=$tenantName$:$serverClassName$:$appName$
/opt/splunk/etc/apps/TA_AI_R_1V73_serverclass_gateway/default/serverclass.conf excludeFromUpdate = $app_root$/local
/opt/splunk/etc/system/default/serverclass.conf filterType = whitelist
/opt/splunk/etc/system/default/serverclass.conf issueReload = false
/opt/splunk/etc/system/default/serverclass.conf repositoryLocation = $SPLUNK_HOME/etc/deployment-apps
/opt/splunk/etc/system/default/serverclass.conf restartSplunkWeb = False
/opt/splunk/etc/system/default/serverclass.conf restartSplunkd = False
/opt/splunk/etc/apps/TA_AI_R_1V73_serverclass_gateway/default/serverclass.conf stateOnClient = enabled
/opt/splunk/etc/system/default/serverclass.conf targetRepositoryLocation = $SPLUNK_HOME/etc/apps
/opt/splunk/etc/system/default/serverclass.conf tmpFolder = $SPLUNK_HOME/var/run/tmp
/opt/splunk/etc/system/local/serverclass.conf [serverClass:AI_R_1V73_CLUSTER-MASTER]
/opt/splunk/etc/system/local/serverclass.conf repositoryLocation = /opt/splunk/etc/deployment-apps
/opt/splunk/etc/system/local/serverclass.conf whitelist.0 = CLUSTER_MASTER
/opt/splunk/etc/system/local/serverclass.conf [serverClass:AI_R_1V73_CLUSTER-MASTER:app:SA-IndexCreation]
/opt/splunk/etc/system/local/serverclass.conf restartSplunkWeb = 0
/opt/splunk/etc/system/local/serverclass.conf restartSplunkd = 0
/opt/splunk/etc/system/local/serverclass.conf stateOnClient = noop
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf [serverClass:AI_R_1V73_CLUSTER-MASTER:app:TA_AI_NR_1V73_A350_idx]
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkWeb = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkd = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf stateOnClient = noop
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf [serverClass:AI_R_1V73_CLUSTER-MASTER:app:TA_AI_NR_1V73_Hypervisor_idx]
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkWeb = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkd = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf stateOnClient = noop
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf [serverClass:AI_R_1V73_CLUSTER-MASTER:app:TA_AI_NR_1V73_application-header_idx]
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkWeb = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkd = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf stateOnClient = noop
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf [serverClass:AI_R_1V73_CLUSTER-MASTER:app:TA_AI_NR_1V73_bmcpatrol_idx]
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkWeb = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkd = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf stateOnClient = noop
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf [serverClass:AI_R_1V73_CLUSTER-MASTER:app:TA_AI_NR_1V73_bsm_idx]
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkWeb = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkd = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf stateOnClient = noop
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf [serverClass:AI_R_1V73_CLUSTER-MASTER:app:TA_AI_NR_1V73_cab-change_idx]
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkWeb = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkd = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf stateOnClient = noop
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf [serverClass:AI_R_1V73_CLUSTER-MASTER:app:TA_AI_NR_1V73_caravelle_idx]
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkWeb = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkd = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf stateOnClient = noop
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf [serverClass:AI_R_1V73_CLUSTER-MASTER:app:TA_AI_NR_1V73_controlm_idx]
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkWeb = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkd = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf stateOnClient = noop
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf [serverClass:AI_R_1V73_CLUSTER-MASTER:app:TA_AI_NR_1V73_dictionary_idx]
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkWeb = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkd = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf stateOnClient = noop
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf [serverClass:AI_R_1V73_CLUSTER-MASTER:app:TA_AI_NR_1V73_inesto_idx]
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkWeb = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkd = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf stateOnClient = noop
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf [serverClass:AI_R_1V73_CLUSTER-MASTER:app:TA_AI_NR_1V73_metric-vip_idx]
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkWeb = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkd = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf stateOnClient = noop
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf [serverClass:AI_R_1V73_CLUSTER-MASTER:app:TA_AI_NR_1V73_monitoring_idx]
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkWeb = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkd = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf stateOnClient = noop
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf [serverClass:AI_R_1V73_CLUSTER-MASTER:app:TA_AI_NR_1V73_semaphore-changes_idx]
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkWeb = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkd = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf stateOnClient = noop
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf [serverClass:AI_R_1V73_CLUSTER-MASTER:app:TA_AI_NR_1V73_semaphore-incidents_idx]
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkWeb = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkd = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf stateOnClient = noop
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf [serverClass:AI_R_1V73_CLUSTER-MASTER:app:TA_AI_NR_1V73_solman_idx]
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkWeb = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf restartSplunkd = 0
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf stateOnClient = noop
/opt/splunk/etc/apps/AI_R_1V73_serverclass_apps/local/serverclass.conf
... View more
06-08-2018
03:02 AM
yes I did but I haven't found any entries on my serverclass.conf
... View more
06-08-2018
02:29 AM
Hi All,
I found this error on on my internal log:
"Caught exception='Application does not exist: app name' while reloading: version="1.0" encoding="UTF-8"?deployResponse restartSplunkd="false" restartSplunkWeb="false" stateOnClient="enabled" issueReload="false" excludeFromUpdate="local" repositoryLocation="$SPLUNK_HOME/etc/apps" endpoint="$deploymentServerUri$/services/streams/deployment?name=$tenantName$:$serverClassName$:$appName$ serverClass name="AI_R_1V73_CLUSTER-MASTER"
it's really weird because this app isn't present to the deployment server etc/apps and on serverclass.conf.
Any suggestions?
Thanks
... View more
- Tags:
- splunk-enterprise
04-11-2018
06:07 AM
Yes, I know the autoLBVolume parameter, I want to know if exist a metric search to calculate how much volume my architecture hold.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-26-2021
07:16 AM
|
Karma given to
