Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ReachDataScient
ReachDataScient
Explorer
Member since:
12-31-2017
12-21-2020
Community Statistics
| Posts | 18 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 12-31-2017 |
Activity Feed
- Got Karma for How to create multiple dependent dropdowns on a dashboard?. 06-05-2020 12:49 AM
- Got Karma for How to tag events based on the host value that contains a condition?. 06-05-2020 12:49 AM
- Posted How do I send emails to different groups based on search result contents for host field? on Reporting. 08-27-2018 08:23 AM
- Tagged How do I send emails to different groups based on search result contents for host field? on Reporting. 08-27-2018 08:23 AM
- Tagged How do I send emails to different groups based on search result contents for host field? on Reporting. 08-27-2018 08:23 AM
- Posted Re: How to create multiple dependent dropdowns on a dashboard? on Dashboards & Visualizations. 08-01-2018 09:13 PM
- Posted How to create multiple dependent dropdowns on a dashboard? on Dashboards & Visualizations. 08-01-2018 07:57 PM
- Tagged How to create multiple dependent dropdowns on a dashboard? on Dashboards & Visualizations. 08-01-2018 07:57 PM
- Tagged How to create multiple dependent dropdowns on a dashboard? on Dashboards & Visualizations. 08-01-2018 07:57 PM
- Posted Re: How to tag events based on the host value that contains a condition? on Getting Data In. 07-06-2018 12:12 PM
- Posted How to tag events based on the host value that contains a condition? on Getting Data In. 07-06-2018 11:38 AM
- Tagged How to tag events based on the host value that contains a condition? on Getting Data In. 07-06-2018 11:38 AM
- Tagged How to tag events based on the host value that contains a condition? on Getting Data In. 07-06-2018 11:38 AM
- Posted Splunk Alert -No Delete Option on Alerting. 07-02-2018 06:22 AM
- Tagged Splunk Alert -No Delete Option on Alerting. 07-02-2018 06:22 AM
- Posted Re: Why am I getting a false DMC Alert that search peer not responding? on Alerting. 04-16-2018 07:01 AM
- Posted Why am I getting a false DMC Alert that search peer not responding? on Alerting. 04-11-2018 07:12 AM
- Tagged Why am I getting a false DMC Alert that search peer not responding? on Alerting. 04-11-2018 07:12 AM
- Posted How to trigger an alert to send an email only when the same hosts fails more than once ? on Alerting. 04-09-2018 01:21 PM
- Tagged How to trigger an alert to send an email only when the same hosts fails more than once ? on Alerting. 04-09-2018 01:21 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-27-2018
08:23 AM
I execute a search and, from the search results, if the host contains hostA, I want to send email to groupA. If it contains hostB then I want to send an email to hostB. Sometimes the search results can contain both hostA and hostB in which case I want to send email to both groupA and groupB.
... View more
08-01-2018
09:13 PM
Instead of creating a lookup, how can i code the values in the xml.
... View more
08-01-2018
07:57 PM
1 Karma
I have a need to create 2 dropdowns on a dashboard. The first dropdown should show Dev, Test, Prod as options and the second dropdown should show the below options based on what is selected in the first dropdown.
Dev -Dev1,Dev2,Dev3
Test -Test1,Test2,Test3
Prod -Prod1,Prod2,Prod3
... View more
07-06-2018
12:12 PM
Can you please list the steps to achieve what you suggested.
... View more
07-06-2018
11:38 AM
1 Karma
Events from our DEV/PROD servers are ingested into the same index. This index already has events since 1 year.
The only way to distinguish the dev and prod events is if the host contains DEV or Prod in this value.
How can I tag the events based on the host value that contains a condition?
Thank you
... View more
07-02-2018
06:22 AM
There is no delete option under the edit menu for a splunk alert. The alert is disabled now but need to delete it. The option is not showing up for the alert owner and splunk admin. Are there any other ways to delete the alert ?
... View more
04-16-2018
07:01 AM
Have you made this change and what would you suggest to set the statusTimeout in seconds. Are there any negative effects due to increasing the statusTimeout.
... View more
04-11-2018
07:12 AM
The DMC Alert - search peer not responding has false positives. Anyone addressed this issue with a better modified search.
... View more
04-09-2018
01:21 PM
I have the splunk alert scheduled to run every 5 min to trigger an email to report if any splunk search peer hosts are down.
| rest splunk_server=local / services/search/distributed/peers/
| where status!="Up" AND disabled=0
| fields peerName, status | rename peerName as Instance, status as Status
I want the alert to trigger to send an email only when the same hosts fails more than once as there seems many false positive.
How to achieve this?
... View more
03-14-2018
12:01 PM
On a dashboard I have an input text field where user can type the IP Address and I pass this as a token to the panel search shown above. The user would never type IP Address in double quotes, so they see the Error in 'eval' command. The number 192.168.1.1 is invalid display in the panel.
... View more
03-14-2018
11:29 AM
| makeresults
| eval ipaddress=192.168.1.1
| lookup AM ipaddress OUTPUT hostname
| table ipaddress,hostname
This works fine if I place the ipaddess between the double quotes other wise it throws Error in 'eval' command. The number 192.168.1.1 is invalid.
Any clue.
... View more
- Tags:
- splunk-enterprise
03-09-2018
07:35 AM
If the event has field names and values both separated by pipe, how to do field extraction.
Field1|Value1|Field2|Value2|Field3|Value3...........
... View more
01-31-2018
12:51 PM
I have the below search which shows 3 columns....the field1, index list and events count. How can I add a trend line or a spark line to show if the event count is increasing or decreasing.
| tstats count by index
| join index type=inner
| inputlookup LookUp1
| eval index=lower(index)
| table field1,index,count
| sort field1 asc]
| stats list(index) as index, sum(count) as count by field1
... View more
- Tags:
- splunk-enterprise
01-30-2018
05:15 AM
I tried this before but for the sparkline it shows a flat line with 0 value all across.
... View more
01-30-2018
04:52 AM
I have the below search which shows 3 columns....the field1, index list and count of events. How can I add a trend line or a spark line to show if the event count is increasing or decreasing.
| tstats count by index
| join index type=inner
| inputlookup LookUp1
| eval index=lower(index)
| table field1,index,count
| sort field1 asc]
| stats list(index) as index, sum(count) as count by field1
... View more
01-29-2018
06:17 PM
How to display the event count per index and distinct host count per index with a trend line.
... View more
- Tags:
- splunk-enterprise
01-02-2018
08:21 AM
In our Splunk environment we have SHC, Indexer Cluster and Heavy Forwarders. We have the HEC port 8088 running only on the Heavy Forwarders.
The Documentation for this App is not very clear. Where do I install this App on i.e., on SHC/Indexer Cluster/Heavy Forwarders. Also this App requires HEC setup on the Splunk system, so where do I setup HEC.
... View more
12-31-2017
05:40 AM
I installed the ForeScout App for Splunk v2.6.0 & ForeScout Technology Add-on for Splunk v2.6.0 on Splunk 6.6.x Search Head Cluster. The setup link is missing from the Apps menu.
... View more
- Tags:
- splunk-enterprise
