Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About ktn01
ktn01
Path Finder
Member since:
02-03-2017
12-18-2024
Community Statistics
| Posts | 46 |
| Solutions | 3 |
| Karma Given | 5 |
| Karma Received | 4 |
| Member Since | 02-03-2017 |
Activity Feed
- Posted Re: Script to filter events at index time on Getting Data In. 12-18-2024 02:10 AM
- Posted Script to filter events at index time on Getting Data In. 12-18-2024 01:48 AM
- Posted Re: How to (un)sort an input dropdown in dashboard studio on Dashboards & Visualizations. 11-08-2023 09:53 AM
- Posted Re: How to (un)sort an input dropdown in dashboard studio on Dashboards & Visualizations. 11-08-2023 05:37 AM
- Posted How to (un)sort an input dropdown in dashboard studio on Dashboards & Visualizations. 11-08-2023 05:06 AM
- Posted props.conf: stanza "host::...." using regex on Knowledge Management. 10-20-2021 05:50 AM
- Got Karma for Re: splunklib: how to get metric indexes with "service.indexes". 08-18-2021 06:29 PM
- Posted Re: splunklib: how to get metric indexes with "service.indexes" on Splunk Dev. 08-18-2021 02:16 PM
- Karma Re: splunklib: how to get metric indexes with "service.indexes" for tpavlik_splunk. 08-18-2021 02:16 PM
- Posted splunklib: how to get metric indexes with "service.indexes" on Splunk Dev. 08-16-2021 04:31 PM
- Posted Re: procedure to replace a deployer on a shcluster on Splunk Enterprise. 07-02-2021 08:10 AM
- Posted procedure to replace a deployer on a shcluster on Splunk Enterprise. 07-02-2021 06:13 AM
- Posted Wrong volume usage reported on monitoring console and "_introspection" index on Splunk Enterprise. 06-24-2021 05:49 AM
- Karma Re: List searches searching old events for javiergn. 05-14-2021 03:27 AM
- Posted Re: List searches searching old events on Monitoring Splunk. 05-14-2021 03:26 AM
- Posted List searches searching old events on Monitoring Splunk. 05-12-2021 02:30 AM
- Posted Re: "tsidxWritingLevel" of existing tsidx file on Monitoring Splunk. 01-11-2021 06:14 AM
- Posted "tsidxWritingLevel" of existing tsidx file on Monitoring Splunk. 01-11-2021 02:59 AM
- Posted Re: Splunk_TA_jmx: server configuration on All Apps and Add-ons. 12-03-2020 09:07 AM
- Posted How to set java_home on Splunk_TA_jmx on All Apps and Add-ons. 12-03-2020 09:04 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-18-2024
02:10 AM
Thank you for your reply. I can't pre-process the events before ingestion in Splunk because they are directly sent by an appliance to a hec input. Christian
... View more
12-18-2024
01:48 AM
Is it possible to use a python script to perform transforms during event indexing? My aim is to remove keys from json files to reduce volume. I'm thinking of using a python script that decodes the json, modifies the resulting dict and then encodes the result in a new json that will be indexed.
... View more
Labels
- Labels:
-
heavy forwarder
11-08-2023
09:53 AM
{
"visualizations": {},
"dataSources": {
"ds_6STCWAXt": {
"type": "ds.search",
"options": {
"query": "index=dsi_splunk host=dev_splunkmanager script=backup \n| sort _time \n| stats earliest(_time) as debut by pid\n| convert timeformat=\"%d/%m/%Y %H:%M\" ctime(debut)"
},
"name": "backupId"
}
},
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"latest": "$global_time.latest$",
"earliest": "$global_time.earliest$"
}
}
}
}
},
"inputs": {
"input_global_trp": {
"type": "input.timerange",
"options": {
"token": "global_time",
"defaultValue": "-24h@h,now"
},
"title": "Période globale"
},
"input_backup": {
"options": {
"items": ">frame(label, value) | prepend(formattedStatics) | objects()",
"token": "backupId",
"selectFirstSearchResult": true
},
"title": "Backup",
"type": "input.dropdown",
"dataSources": {
"primary": "ds_6STCWAXt"
},
"context": {
"formattedConfig": {
"number": {
"prefix": ""
}
},
"formattedStatics": ">statics | formatByType(formattedConfig)",
"statics": [],
"label": ">primary | seriesByName(\"debut\") | renameSeries(\"label\") | formatByType(formattedConfig)",
"value": ">primary | seriesByName(\"pid\") | renameSeries(\"value\") | formatByType(formattedConfig)"
},
"hideWhenNoData": true
}
},
"layout": {
"type": "grid",
"options": {
"width": 1440,
"height": 960
},
"structure": [],
"globalInputs": [
"input_global_trp",
"input_backup"
]
},
"description": "",
"title": "Backups Cloner"
}
... View more
11-08-2023
05:37 AM
I am using Splunk 9.1.1
... View more
11-08-2023
05:06 AM
I have the following search index=dsi_splunk host=dev_splunkmanager script=backup
| stats earliest(_time) as debut by pid
| convert timeformat="%d/%m/%Y %H:%M" ctime(debut) The result is sorted as I need: I use this search as input for a dropdown on dashboard studio but de result is sorted differently: It seems the list is sorted by "value". How may I have an unsorted dropdown to conserve the result order? Thanks
... View more
Labels
- Labels:
-
Dashboard Studio
10-20-2021
05:50 AM
Hello, The documentation says that a stanza [host::<host>] in "props.conf" must be used with a host-pattern Is it a way to use a regexp? I have to match host names like "[vp][mnas][pdtiv].*"
... View more
Labels
- Labels:
-
field extraction
08-18-2021
02:16 PM
1 Karma
It works fine. This is exactly what I needed. Thanks a lot
... View more
08-16-2021
04:31 PM
"service.indexes" in splunklib for Python return by default a collection with only event indexes (no metric indexe). Is it a way to get a collection from all metric and event indexes giving the filter parameter "datatype=all" ? Thanks
... View more
07-02-2021
08:10 AM
Thanks a lote Next time, I will have to search better 🙄
... View more
07-02-2021
06:13 AM
Hello, I need to replace the deployer on a shcluster but I can't find any procedure on the documentation to do it. Does anyone know where I can find some documentation to make this replacement? Thanks in advance
... View more
Labels
- Labels:
-
administration
-
configuration
-
installation
06-24-2021
05:49 AM
Hello I have a volume with a filesystem mountpoint as VolumePath. The page "volume Detail: Instance" on monitoring console say me that the "volume usage" on this volume is ~26'400GB but the "df" command on operating system say me that the usage is ~21'416GB I have enabled "tsidxreduction" recently. Any Idee why do I have a about 5TB more by Splunk usage as by Filesystem usage?
... View more
Labels
- Labels:
-
administration
-
metrics
05-12-2021
02:30 AM
Hello Is it a way to find how much searches are searching events older than 2 years? I need this information to evaluate the impact if I set the "tsidx retention policy" to two years. Thanks
... View more
- Tags:
- admin
Labels
- Labels:
-
audit
-
search performance
01-11-2021
06:14 AM
Hello, Yes, I know it. My question is how to check if an existing tsidxfile was created before or after the modification of "tsidxWritingLevel". Best Regards Christian
... View more
01-11-2021
02:59 AM
Hello, I would like to know witch tsidx files was created before I increase the parameter "tsidxWritingLevel" form 1 to 3. is there any way to know the "tsidxWritingLevel" of the tsxidx files in a bucket? Thanks Christian
... View more
Labels
- Labels:
-
indexer
12-03-2020
09:07 AM
Hello, The proble was the JAVA version installed on the server. was 11 and Splunk_TA_jmx work with java 8. Thanks for your responses Christian
... View more
12-03-2020
09:04 AM
Hello, I need to set the java version to be used by "Splunk_TA_jmx" without changing the configuration for other apps which use another Java version. The documentation (https://docs.splunk.com/Documentation/AddOns/released/JMX/Installationsteps) indicates that the variable $ JAVA_HOME should be modified but where should I do it without disturbing other apps? Thanks Christian
... View more
Labels
- Labels:
-
configuration
11-10-2020
06:22 AM
This is base64url encoding...
... View more
11-06-2020
02:24 AM
Hello Editing a template on splunk_TA_jmx web interface is practically impossible because the input field is only 30 characters wide. I would prefer to directly edit the contents of the jmx_templates.conf file but the "content" parameter is encoded there. Do you know how to decode then encode this parameter? Thanks Christian
... View more
- Tags:
- splunk_TA_jmx
Labels
- Labels:
-
configuration
11-06-2020
02:10 AM
Hello, The issue seems to be on REST API. You can edit directly the file "local_servers.conf" as a workarround. A case is open on Splunk support. Regards
... View more
10-12-2020
03:14 AM
1 Karma
Hello, I have some difficulties to configure my first connection in "Splunk_TA_jmx": Our WEB administrator says he can use the URL "service:jmx:rmi:///jndi/rmi://<host>:<port>/jmxrmi" in "jconsole" to connect to a java machine. So I am trying to configure a server in "Splunk_TA_jmx" with the following parameters: Destination App : Splunk_TA_jmx Name : test JVM Description : my_test Connection Type : rmi Stub Source : jndi Host : <host> Port : <port> Lookup Path : /jmxrmi Username : <user> Password : <password> Server Interval : 30 But I get the message "Invalid parameter found in connection URL. Verify the provided connection configurations." when I try to add it. Any idea what I'm doing wrong ? Thanks Christian
... View more
- Tags:
- jmx
Labels
- Labels:
-
configuration
09-22-2020
01:46 PM
Hello, Is it a way to know the actual checkpoint value for a rising column in a db_inputs? I would like to obtain this value through a REST API and with a shell command even working when splunk is down. I am using db_connect 3.4.0 Thank Christian
... View more
Labels
- Labels:
-
development
-
using Splunk Enterprise
09-03-2020
11:21 AM
Hello, I have a script to index enddate from certificats #!/bin/sh
echo debug enddate
date=`date "+%d/%m/%Y %H:%M:%S"`
for file in `/usr/bin/ls /opt/splunk/etc/auth/mycerts/*.pem`
do
echo debug befor $file
/opt/splunk/bin/openssl x509 -in $file -enddate -noout
echo debug after $file
done This script is started from this stanza in inputs.conf: [script://./bin/certificats]
interval = * * * * *
index=my_index
sourcetype = splunk:certificats
start_by_shell = false The script is wriking well when I start it from shell with the splunk account (which is also runnig Splunk) and I enddate is printed for both .pem files thar are in mycerts directory. But when it is started from Splunk, only the lines "debug endate" and "debug befor $file" are indexed (debug befor only for the first file). I also try with the command "/opt/splunk/bin/splunk cmd openssl x509 -in $file -enddate -noout". This don't change anything. Do you have an idee why the command openssl give no result and exit the script when started from Splunk? Thanks
... View more
Labels
- Labels:
-
scripted input
04-17-2020
03:09 AM
Thanks for your answer but I have to still using splunk in french
I only want to avoid the translation for the dropdown input element's.
Best Regards
Christian
... View more
04-17-2020
12:13 AM
Hello,
I have a dashboard with a dropdown input filled by a search. One result from this search in "Valid" witch is translated as "Valide" in french.
How may I avoid this translation to display "Valid" even in french?
Thanks
Christian
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-18-2024
12:35 PM
|
