×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
hschuhkn
Engager
Member since: ‎02-06-2018
‎11-26-2024
Community Statistics
Posts 4
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎02-06-2018
View All

Re: Deployment Server Upgrade 9.2.1 and Server Cla...

by in Deployment Architecture
‎06-10-2024 08:23 AM
‎06-10-2024 08:23 AM
This seems to fix the rest endpoint issue (esp. changes to outputs.conf). https://docs.splunk.com/Documentation/Splunk/latest/Updating/Upgradepre-9.2deploymentservers ... View more

Re: SAML response from ADFS

by in Security
‎01-11-2024 05:12 AM
‎01-11-2024 05:12 AM
Had the same error message to an adfs server with encryption and in my case this worked, dont know if it is correct. I added the encrypted private key to signAuthnRequest certificate, which  is this authentication.conf parameter: [saml] clientCert = cert_and_encrypted_private_key.pem The password of the encypted private key was configured to the parameter sslPassword of the same stanza  sslPasswort =  No this parameter could be set to true: signAuthnRequest = true and reloaded authentication to let the sslPasswort be hashed. Worked for me. ... View more

Re: Dynamic saved search - How do I initialize sea...

by in Splunk Search
‎10-10-2022 12:21 AM
‎10-10-2022 12:21 AM
Thanks for reply and the question is understood perfectly. When I open the query in the dashboard with the magnifying glass, I also get a new search window with a "| savedsearch field=$token1$" query. So currently I have to temporary edit the savedsearch replace the token with values, test the query and replace the values with token back before saving the search. So i still hope for a nicer solution, to just add one initializing line in the spl like  | eval field = if (isnull($token$) , value, $token$) which does not work. It would make editing and developing dynamic saved search much easier. ... View more

Dynamic saved search - How do I initialize search ...

by in Splunk Search
‎10-04-2022 05:16 AM
‎10-04-2022 05:16 AM
I like to use savedsearches with token inside  a classic xml dashboards e.g.  <form> ... <search> <query>| savedsearch "my_savedsearch " tok_token1="$form.tok_token1$" tok_token2="$form.tok_token2$" ..." </query> </search> ... </form> But when I want to edit the savedsearch later in the search app/dashboard, the tokens are not set, e.g. > index=xyz field1=$tok_token1$  AND field2=$tok_token2$ The only way to run and edit the query  I know is to replace temporary the token to constant values, because something like  > | eval tok_token1=value  before does not work. Is there a better way to temporary set the tokens in a  dynamic search for enhancing a query afterwards ? ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎11-26-2024 01:17 PM
Karma given to
View All