About altink

PrewinThomas · ‎09-22-2025

@warden0 Solution here mention that, In your app.conf file you only need to mention your custom .conf file name only (don't put .conf stanza) [triggers] reload.inputs_templates = simple Additionally, if you are developing via add-on builder, then addon_builder.conf might be adding to your default .conf list. So add below in your app.conf, [triggers] reload.addon_builder = simple Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

PickleRick · ‎08-07-2025

You can edit your message and insert the ansible part in either a preformatted paragraph or a code box. Then it will not get butchered (most importantly - the indents will be preserved).

rvany · ‎04-15-2025

Short documentation reminder: https://docs.splunk.com/Documentation/DBX/3.18.2/DeployDBX/Prerequisites "KV store must also be active and working properly as of DB Connect version 3.10.0 and higher"

altink · ‎10-16-2024

Question for Omega Core Audit Will I (as app developer) get notified ?

gcusello · ‎08-26-2024

Hi @altink , if you are the customer, you can indicate some reference people to open cases, usually they are contractual reference ,but it's better to indicate one contractual reference and two or three operational people. To do this, one of the already active contractual reference people must open a case to Splunk Support to indicate the other reference people to open cases. Ciao. Giuseppe

altink · ‎04-22-2024

Thank You very much @VatsalJagani I had to click on the version number (link), and there did open what I needed best regards Altin

isoutamo · ‎02-29-2024

This seems to be a bug on that dashboard. There shouldn’t be any fixed days, instead it should offer time picker for you to select needed time span and then use it. Probably the easiest way is just create your own dashboard with time picker and fix it that way? Please create also an support case for it as Splunk should have a dashboard which shows that statistics based n their current license policy/model.

rob_gibson · ‎02-28-2024

Thanks so much!

woodcock · ‎02-04-2024

WARNING! The new website is broken and cannot display newlines inside of double-quotes, even as a "code snippet" which is also moronic and inexcusable. So while my correct answer looked fine and worked in the old answers site, the new one cannot be made to display a correct answer so I am going to DESSCRIBE IT. The space that you see in the double-quotes is actually supposed to be a newline as in <"></n><">. If you do that, it works. The stupid site is also forcing me to add an app, even this this Q/A has nothing to do with any app.

isoutamo · ‎01-05-2024

As always when you know old url you could try way back machine https://web.archive.org/web/20181020030244/http://docs.splunk.com:80/Documentation/Splunkbase/splunkbase/Splunkbase/Monetizeyourcontent

altink · ‎01-05-2024

Hi @kmorris_splunk I have the same issue. The link provided leads to an empty page: "Hi! This page does not exist, or has been removed from the documentation. ....." best regards Altin

unionub · ‎10-18-2023

Hi @_JP There are two automatic lookups (for the two csv-s) under Splunk Add-on for Sysmon. Both are enabled. The one I am interested in looks like this:

altink · ‎09-21-2023

Thank You very much @richgalloway As You suggested, the following worked: index = os_sysmon NOT Image="*Sysmon*" EventCode=1 | rex field=Image "(?P<Executable>[^\\\]+)$" | table Image Executable

altink · ‎04-25-2023

Cannot view my closed cases in official support page All I can see is as in the image attached regards Altin

asgharalikhan · ‎04-20-2023

Hello Niketn, In my case, I am using timechart where i need to drilldown IP and Port to display Values on the new dashbaord as below sample. " timechart span=5m avg(In) as In avg(Out) as Out latest(host) as IP latest(snmp_index) as Port" I tried to hide Port and IP using the below CSS it does hide both IP and Host on from the graph but still values appears when you move mouse curser, values still there. it does not fully removed. Any suggestion please. <html depends="$alwaysHideCSSStyle$"> <style> g.highcharts-legend-item:nth-child(3) { visibility: hidden !important; } g.highcharts-legend-item:nth-child(4) { visibility: hidden !important; } g.highcharts-series-3 { visibility: hidden !important; } </style> </html>

altink · ‎01-18-2023

Thank you very much for the solution regards Altin ps. upvote is "accept as solution"?

altink · ‎09-21-2022

Thank You for this but it would not be acceptable to have this thing applied to all Inputs. best regards Altin

TheGearx · ‎03-14-2022

What you must do is -Download the app and delete the alert/search -upload the Custom app and the scheduled alert/search must disappear

altink · ‎01-21-2022

In Oracle you have the unified audit trail, and there are some pre-deployed policies which you can activate and start immediately. https://docs.oracle.com/en/database/oracle/oracle-database/19/sqlrf/CREATE-AUDIT-POLICY-Unified-Auditing.html to retrieve and visualize the trail, you can use the following Oracle Unified Audit App for Splunk https://splunkbase.splunk.com/app/6172/ best regards Altin

altink · ‎01-21-2022

For Oracle Unified Audit (starting with Oracle 12c R1), you can use the following Oracle Unified Audit App for Splunk https://splunkbase.splunk.com/app/6172/ best regards Altin

altink · ‎01-21-2022

If you are using Oracle Unified Audit (starting with Oracle 12c R1), you can use the following Oracle Unified Audit App for Splunk https://splunkbase.splunk.com/app/6172/ best regards Altin

altink · ‎01-21-2022

If you are using Oracle Unified Audit (starting with Oracle 12c R1), you can use the following Oracle Unified Audit App for Splunk: https://splunkbase.splunk.com/app/6172/ best regards Altin

altink · ‎01-21-2022

If you are using Oracle Unified Audit, please check this: Oracle Unified Audit App for Splunk best regards Altin

altink · ‎01-21-2022

For the Oracle Unified * Audit Trail you can use the following: Oracle Unified Audit App for Splunk * the unified audit starts in Oracle 12c R1

altink · ‎01-21-2022

I do not think that Splunk will update the LAST_ARCHIVE_TIMESTAMP - not by itself. However, in the doc Splunk says that it does support calling a procedure of an Oracle Database https://docs.splunk.com/Documentation/DBX/3.7.0/DeployDBX/Commands But I do not know if its only the case of procedures returning events as cursor to be pulled by DB Connect, or even the (your) case of a procedure just doing some actions and returning no rows. If the second is true, I guess that calling DBMS_AUDIT_MGMT.SET_LAST_ARCHIVE_TIMESTAMP( audit_trail_type IN PLS_INTEGER, last_archive_time IN TIMESTAMP, rac_instance_number IN PLS_INTEGER DEFAULT NULL, container IN PLS_INTEGER DEFAULT CONTAINER_CURRENT, database_id IN NUMBER DEFAULT NULL, container_guid IN VARCHAR2 DEFAULT NULL); https://docs.oracle.com/en/database/oracle/oracle-database/19/arpls/DBMS_AUDIT_MGMT.html#GUID-75EE6B31-98A1-4353-9000-A293E4752380 ... will set the right timestamp

Posts	254
Solutions	1
Karma Given	55
Karma Received	14
Member Since	‎07-02-2015

Online Status	Offline
Date Last Visited	‎10-20-2025 02:37 PM

omega core audit test notify

Select Entitlement combo empty when trying to crea...

Change App's Release Notes

Storage for DB Connect Checkpoint values

Splunk License Report - Previous 60 days - Charts ...

Splunk App with trial time and expiration

Field EventDescription and Splunk Add-on for Sysmo...

Get filename from path with rex

Why can't I view closed cases in official support?

How to extract field with rex?

Re: check_reload_trigger_for_all_custom_confs - ap...

Re: Storage for DB Connect Checkpoint values

Re: Splunk DB Connect: How to resolve "Can not com...

omega core audit test notify

Re: Select Entitlement combo empty when trying to ...

Re: Change App's Release Notes

Re: Splunk License Report - Previous 60 days - Cha...

Re: Can not communicate with task server, please c...

Re: fix loss of text formatting in dashboard table...

Re: Splunk App with trial time and expiration

Re: Where can I find more info on app licensing?

Re: Field EventDescription and Splunk Add-on for S...

Re: Get filename from path with rex

Why can't I view closed cases in official support?

Re: Hide unused chart legend item

Re: Extract field with rex

Re: How do I tell Splunk (or DB Connect) that the ...

Re: Splunk Alert - No Delete option on Edit/Menu

Re: How to enable audit logs in these databases an...

Re: How should we handle DB audit trails?

Re: How can Oracle database activities be monitore...

Re: Oracle Database integration with Splunk

Re: Are there any dashboards for databases audit d...

Re: Splunk Application Installation

Re: Pulling Oracle Fine-Grained Audit logs from Or...

Join the Conversation