Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About teddyidc1101
teddyidc1101
Communicator
Member since:
04-03-2017
06-05-2020
Community Statistics
| Posts | 74 |
| Solutions | 0 |
| Karma Given | 11 |
| Karma Received | 12 |
| Member Since | 04-03-2017 |
Activity Feed
- Got Karma for How to resolve Unable to initialize modular input "server" defined inside the app "splunk_app_db_connect". 01-17-2022 01:44 AM
- Karma Re: Can SNMP Modular Input be installed in the Universal Forwarder? for Damien_Dallimor. 06-05-2020 12:49 AM
- Karma Re: Splunk SSH access for Damien_Dallimor. 06-05-2020 12:49 AM
- Karma Re: Can 1 indexer in a distributed deployment be SNMP manager? for Damien_Dallimor. 06-05-2020 12:49 AM
- Karma Re: where to validate if the SNMP_Ta was successfully getting data from SNMP agent for koshyk. 06-05-2020 12:49 AM
- Karma Re: where to validate if the SNMP_Ta was successfully getting data from SNMP agent for koshyk. 06-05-2020 12:49 AM
- Karma Re: Splunk maintenance for HiroshiSatoh. 06-05-2020 12:49 AM
- Karma Re: When is it necessary to upgrade universal forwarders? for renjith_nair. 06-05-2020 12:49 AM
- Karma Re: Splunk search head suddenly crashed for acharlieh. 06-05-2020 12:49 AM
- Karma Re: Python Error in restarting Splunk for xpac. 06-05-2020 12:49 AM
- Karma Re: Splunk Alert: how to retrieve search query and results from previous trigger for adonio. 06-05-2020 12:49 AM
- Karma Re: Search ID or sid for niketn. 06-05-2020 12:49 AM
- Got Karma for Re: How to make headers as field-values?. 06-05-2020 12:49 AM
- Got Karma for GCP Add-on : where does data in google:gcp:monitoring came from?. 06-05-2020 12:49 AM
- Got Karma for SNMP_TA: is it possible to install in indexer?. 06-05-2020 12:49 AM
- Got Karma for How to resolve Unable to initialize modular input "server" defined inside the app "splunk_app_db_connect". 06-05-2020 12:48 AM
- Got Karma for How to resolve Unable to initialize modular input "server" defined inside the app "splunk_app_db_connect". 06-05-2020 12:48 AM
- Got Karma for How to resolve Unable to initialize modular input "server" defined inside the app "splunk_app_db_connect". 06-05-2020 12:48 AM
- Got Karma for How to resolve Unable to initialize modular input "server" defined inside the app "splunk_app_db_connect". 06-05-2020 12:48 AM
- Got Karma for How to resolve Unable to initialize modular input "server" defined inside the app "splunk_app_db_connect". 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-13-2020
05:17 AM
I have 2 sites that has more than 10 peers each site, each peer have different hardware specs. what is the best practice in identifying the site_replication_factor and site_search_factor ?
... View more
Labels
04-23-2019
10:31 PM
Hi - We will be running script that was coded in python 3.7 (*.ipynb) in our splunk version 7.x, will the script run/work ? If not, what is the best way to run it?
Thanks!
... View more
Labels
- Labels:
-
python
-
scripted input
04-21-2019
11:41 PM
The requirement is to do forecasting on indexed data. A python script will be developed and use in Splunk to use the indexed data for forecasting. Is this possible? if yes, how?
Thanks!
... View more
10-15-2018
09:25 PM
During the initial load of the dropdown values, there's a duplicate error since there are multiple branch# (Owner=* and branch#=*). when a specific Owner is chosen, then the error disappears as it already has value for branches.
... View more
10-14-2018
07:33 PM
Here is the sample code for the dropdown:
> <input type="dropdown"
> token="report"
> searchWhenChanged="true">
> <label>Report Type</label>
> <fieldForValue>foo</fieldForValue>
> <search>
> <query>| inputlookup foo.csv | sort foo foo_label | where
> report_label="foo"
> </search>
> <change>
> <set token="foolabel">$label$</set>
> </change>
> <fieldForLabel>foo_label</fieldForLabel>
> <default>foo</default>
> <initialValue>foo</initialValue>
> </input>
> <input type="dropdown" token="foo2_id"
> searchWhenChanged="true">
> <label>Foo2</label>
> <fieldForLabel>foo_NM</fieldForLabel>
> <fieldForValue>foo2_ID</fieldForValue>
> <search base="foo2_metadata">
> <query>| dedup foo2_ID | fields foo_NM foo2_ID | sort
> foo_NM</query>
> </search>
> <change>
> <set token="foo2_label">$label$</set>
> </change>
> <choice value="*">ALL</choice>
> <default>*</default>
> <initialValue>*</initialValue>
> </input>
> <input type="dropdown" token="foo3" searchWhenChanged="true">
> <label>Branch</label>
> <choice value="*">ALL</choice>
> <fieldForLabel>foo3_NM</fieldForLabel>
> <fieldForValue>foo3_NO</fieldForValue>
> <search base="foo3_metadata">
> <query>| dedup foo3_NO | search foo3_ID="$foo2_id$" | fields
> foo3_NM foo3_NO | sort foo3_NM
> </search>
> <default>*</default>
> </input>
... View more
10-12-2018
06:09 AM
I have this data
Owner Branch# Bname
O1 B1 Bname1
O1 B2 Bname2
O2 B1 Bname3
O2 B3 Bname4
O2 B4 Bname5
O3 B3 Bname6
O3 B5 Bname7
I need to put the Bname in a dropdown where depending on the Owner (token) but the query is getting error Duplicate values causing conflict because of the multiple Branch#. I cannot dedup Branch# as this will be passed on as token to other panels when owner is chosen. If I do dedup, it will only pass the 1st occurence and other owner will not have any Branch# to chose from.
Any idea on how to manage the SPL?
Thanks!
... View more
10-02-2018
01:28 AM
The search head we use searches events from test and prod indexer. In prod, we only need to capture the one from prod indexer. Can we filter events coming from specific a splunk_server? Or how do we point a search head to only get data from prod indexer?
... View more
09-13-2018
07:22 AM
What is the difference between the System Center Operations Manager integration App: https://splunkbase.splunk.com/app/327/
and
the Splunk Add-on for Microsoft System Center Operations Manager: https://splunkbase.splunk.com/app/2729/
We are planning to get SCOM data into Splunk. What is the best way to do it?
... View more
09-06-2018
02:08 AM
Do you have solution for Skype?
... View more
08-26-2018
05:54 PM
Thank you for you response!
We already checked the deploymentclient.conf and its pointing to the correct DS where the server is a client but with the old server name. Will check the server.conf as well.
Does it mean that we have to reinstall Splunk to get the correct hostname for the server and deleting and redefining as client will no be enough?
... View more
08-26-2018
05:46 PM
Thank you for your responses..
We checked the inputs.conf but we do not see reference to the old name. Is it correct to override the host name? We wanted it to be dynamic where it gathers the actual name and not assigning it....
... View more
08-24-2018
08:39 AM
We have a server that was cloned to that have a different hostname. The old server was shutdown and the team is now using the new server with a different hostname. Looking at DS, the name of the host is still the same as the old one. Looking at the events from the new cloned server, its still showing the old server name before it was cloned.
We wanted to reflect the new hostname. should we delete the server as client and make it as client again by restarting the forwarder? it should reflect the new hostname, right?
... View more
08-24-2018
08:32 AM
Thanks for this...will make it as guide for implementation.
... View more
08-23-2018
05:18 AM
We are planning to upgrade the VM server to RHEL 7.5 with splunk distributed deployment installed in them.
Do we have any documentation or best practices regarding steps? thanks!
... View more
08-21-2018
09:22 PM
What is the system requirement for Virtual Machines for installing Splunk Enterprise Security?
... View more
08-21-2018
08:00 PM
We upgraded our Splunk enterprise to 7.1.2 from 7.0 version in a SH that has Splunk ES version 4.7.2.
After the upgrade, we notice that Incident Review dashboard doesn't work as expected.
If we upgrade the Splunk ES, will this be fixed?
Also, if we plan on upgrading, should we do Splunk ES first them Splunk Enterprise? What will be the sequence for these upgrades?
Thanks!
... View more
08-15-2018
09:07 PM
Hi - we have a requirement to get the data from DB Connect.
In pulling data, we also need to take the value of a field (data field) and append that value to the splunk Source field (source=filename_).
We know that formatting can be done in props and transforms but getting the field value from DB Connect pull is the one we are not familiar of.
Any help can be greatly appreciated.
... View more
08-14-2018
11:14 PM
Just curious, if we are upgrading distributed splunk enterprise from 7.0 to 7.1.2, we will download the current version in this link ,https://www.splunk.com/en_us/download/splunk-enterprise.html and will use it for the upgrade process, right? I just want to confirm if, is it even possible that when we upgrade, it will convert the splunk with license to free version of the splunk if we use the downloaded version from the link above?
Just confirming my understanding.
... View more
Labels
- Labels:
-
upgrade
08-09-2018
02:23 AM
We are planning to upgrade our splunk instances and we are wondering if its necessary for the forwarders as well? if not, then when?
both are running in Splunk 7.0 and environment is distributed, clustered indexers.
... View more
07-12-2018
12:20 AM
Hi - we are trying to setup REST API call with the google backend services, get health. we have the account and the API key but dont know how to map them with the authentication available. If we have these credentials, what authentication should be used for the REST API setup.
... View more
07-06-2018
01:40 AM
thanks for your response...but I'm looking for the version 1.1.x...
... View more
07-06-2018
12:50 AM
looking for the previous Google Cloud Platform version 1.1.x, to be used in testing. thanks!
... View more
06-11-2018
06:48 PM
Hello, i have data that came in as of yesterday but over a period of time (24hrs after), CASE object data are not coming into splunk and looking at my index=_internal,
2018-06-12 01:42:15,903 +0000 log_level=ERROR, pid=32750, tid=MainThread, file=task.py, func_name=_send_request, code_line_no=465 | **[stanza_name=SF_Case] The response status=400** for request which url=https://xxx.com/services/data/v39.0/query?q=SELECT%20CaseNumber%2CParent%2CPriority%2CStatus%2CSubject%2CType%2CLastModifiedDate%20FROM%20Case%20WHERE%20LastModifiedDate%3E2018-03-13T00%3A00%3A00.000z%20ORDER%20BY%20LastModifiedDate%20LIMIT%201000 and method=GET.
What seems to be the problem with the intermittent issue.
... View more
06-07-2018
08:10 PM
like a normal restart, it will load on its own. just need patience while the client lists completes.
... View more
06-07-2018
08:08 PM
thanks for sharing...jobs were expired which probably the reason i'm having a hard time finding it...
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma from
Karma given to
