About dart

dart · ‎10-08-2012

Are you trying to use the fields in a different app, e.g. search? They are probably set to App level sharing, instead of Global, if so. Check via Manager -> Fields -> Field Extractions, then the permissions link next to the extractions.

dart · ‎10-08-2012

A cheating way to do this would be to run it through sed, like so | rex field=_raw mode=sed "s/a\d=//g"

dart · ‎10-08-2012

Try piping to | sort date_hour

dart · ‎10-08-2012

You'd have to specify a custom datetime.xml for parsing this. Can you provide a complete sample?

dart · ‎10-08-2012

Widen the groupBaseDN - it shouldn't be a problem. If you're worried, add to the groupBaseFilter to just look at those in the right OUs.

dart · ‎10-08-2012

Duplicate up your config, so you have another monitor stanza in inputs.conf, with a different sourcetype, then another stanza in props.conf for the new sourcetype, with new transforms for the appropriate behaviour.

dart · ‎10-08-2012

Can you notify the other system with an API or similar? Is the only possible way to create a file on the endpoint?

dart · ‎09-11-2012

Grep through the $FWDIR/conf/objects_5_0.C file and find the log server object, then find the sic_name field within the object definition. You'll most likely have an open SSH session to the Security Management Server already, so just take advantage of that.

dart · ‎09-06-2012

It's the script that backfills the Deployment Monitor Index. If you're deployment monitor is already populated, you can disable it. AFAIK the only way to launch it is to hit the button in the Deployment Monitor app.

dart · ‎09-05-2012

Can you use the same credentials to connect from the Splunk system via the commandline mysql tools to the remote mysql server?

dart · ‎09-05-2012

So what I mean is schedule Splunk to build the lookup for you. Does that work? You can use the results of a search as a lookup. You can also use |inputlookup append=t name_of_your_lookup to merge in any previous results

dart · ‎09-05-2012

I see the question as how do I find exceptions that have not happened before? There are a number of ways of doing this kind of task. I would build a lookup of all previously seen exception types and then only alert on those that we have not previously seen. In this case, I'd possibly even keep other data about the source of the exception, such as the component or time that it occurred.

dart · ‎09-05-2012

Can you draw the final product for that example data, I'm afraid I still can't see what you're trying to do.

dart · ‎09-05-2012

I'm not sure I understand your desired final product. Can you draw a table illustrating this?

dart · ‎09-05-2012

Sounds like a great use case for a MySQL lookup

dart · ‎09-05-2012

Does the delta command do what you need?

dart · ‎09-05-2012

Either don't store it or you will need to either modify timerangepicker (as MarioM suggests) or write a custom module to filter the timerange. Or don't store the data.

dart · ‎09-05-2012

I'd suggest filing a support case for an enhancement request for this.

dart · ‎09-05-2012

I think you want to convert your lookup to be an automatic time based lookup, and then use the search filter in the role for each customer on the owner_src and owner_dst fields. That way you do not need the convert, evals and 2nd search.

dart · ‎09-05-2012

Do you have any examples on how to add a ticket to your system automatically?

dart · ‎09-05-2012

A workaround is to go grab the file from splunkbase.com, and the upload the app via Manager.

dart · ‎09-05-2012

We have applications for both AD and Exchange that have all the data collection set up for you and should have everything you'll need to get started with troubleshooting it.

dart · ‎09-05-2012

Does this reference of SCCM log files help?

dart · ‎09-05-2012

The technical answer is that you can filter using regular expressions. Examples are in the documentation on page Route and Filter data In practise in your scenario I'd configure multiple filters with the different types of data you are interested in.

dart · ‎09-05-2012

Do you have any overriding settings in $SPLUNK_HOME/etc/system/local or another app? splunk btool is useful for listing the details, in this case ./splunk btool web list --debug and ./splunk btool server list --debug

Posts	306
Solutions	63
Karma Given	41
Karma Received	248
Member Since	‎08-19-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

What's the earliest date I can have in Splunk?

Get-WmiObject : Invalid class error in Citrix XenA...

Do I need to restart a license slave if I change l...

How does RAID 10 affect IOPS?

How many IOPS can I expect from a disk?

How to clean a clustered index?

Can I get the length of a replacement or SEDCMD re...

How can I monitor a Splunk Cluster with Nagios?

Specifying a TTL when creating a job via the API?

Re: Simple field extractions not working in props

Re: Best way to combine a variable number of field...

Re: The chart does not put the hour part in correc...

Re: CSV TImestamp Problem

Re: Active Directory nested groups

Re: 2 Sourcetype, Parsing done on each sourcetype

Re: Execute a script on the node itself

Re: How do I find the DN of the Checkpoint log man...

Re: What would cause the dm_backfill_factory.py to...

Re: MySQLConnector : "Can't connect to MySQL serve...

Re: Unusual Exceptions

Re: Unusual Exceptions

Re: Splunk Query Help ??

Re: Splunk Query Help ??

Re: How to Join a SourceType in Splunk With data f...

Re: Splunk Query Help ??

Re: Timerangepicker earliest problem

Re: How does splunk prune block signatures?

Re: Need Help Restricting Results

Re: Splunk Alerts -> Custom Scripts -> Sharepoint ...

Re: Trouble updating Windows app

Re: what logs for active directory and exchange

Re: Monitor SCCM Log & correlate to file system ch...

Re: Trimming Event Logs from a Domain Controller

Re: Deployment Server Questions: SSLv3 settings in...

Join the Conversation