Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About splunkreal
splunkreal
Motivator
Member since:
05-26-2016
Thursday
Community Statistics
| Posts | 487 |
| Solutions | 20 |
| Karma Given | 685 |
| Karma Received | 38 |
| Member Since | 05-26-2016 |
Activity Feed
- Karma Re: Search a lookup with wildcard in values for tscroggins. Thursday
- Posted Re: Deployment Server and HeavyForwarder app local folder on Deployment Architecture. Monday
- Karma Re: Deployment Server and HeavyForwarder app local folder for kiran_panchavat. Monday
- Posted Deployment Server and HeavyForwarder app local folder on Deployment Architecture. Monday
- Karma Re: Question about "run as" (Owner or User ) for saved searches. Missing in version 7. for the_wolverine. 2 weeks ago
- Karma Re: How to change server roles in the Distributed Management Console using the CLI or conf files? for MuS. 2 weeks ago
- Posted Re: tstats via REST API on Splunk Search. 2 weeks ago
- Karma Re: tstats via REST API for isoutamo. 2 weeks ago
- Karma Re: How to delete a correlation search for DavidHourani. 2 weeks ago
- Karma Re: Splunk Enterprise Security: Why am I receiving "Search could not be updated: [HTTP 500]" error when trying to save correlation search as ess_admin? for smoir_splunk. 2 weeks ago
- Got Karma for Re: New "role" cannot be added to any users due to "is not grantable"; how to make roles "grant. 2 weeks ago
- Posted Re: New "role" cannot be added to any users due to "is not grantable"; how to make roles "grant on Security. 2 weeks ago
- Karma Re: New "role" cannot be added to any users due to "is not grantable"; how to make roles "grant for gcusello. 2 weeks ago
- Karma Re: What populates the list of "Owners" in the ES App? for smoir_splunk. 2 weeks ago
- Karma Re: Enterprise Security Suite Incident Review - How Do You Edit the Owners List? for aakwah. 2 weeks ago
- Posted Re: Difference between ES Permissions page and Splunk native edit role page on Splunk Enterprise Security. 3 weeks ago
- Karma Re: license manager results differ from metrics.log indexed volume for yannK. 3 weeks ago
- Karma Re: Difference between ES Permissions page and Splunk native edit role page for meetmshah. 4 weeks ago
- Karma Re: Announcing Our Splunk MVPs for jkat54. 4 weeks ago
- Karma Re: Announcing Our Splunk MVPs for gcusello. 4 weeks ago
Monday
Hi @kiran_panchavat renaming DS "app/local" to "app/local.OLD" is enough? Thanks.
... View more
Monday
Hello, if we have on DS "app/local" with conf files, is that possible restarting it that it pushes DS "app/local" to HF "app/local" and deletes custom local conf files on HF (created from HF GUI)? Thanks.
... View more
Labels
2 weeks ago
Hello @isoutamo does this | tstats command requires to have data access or just internal logs? Thanks.
... View more
2 weeks ago
1 Karma
Hi @gcusello did you get answer from @woodcock regarding applying on all etc/system/local/authorize.conf search head nodes (preferably from GUI if possible) ? Thanks.
... View more
3 weeks ago
Hello @meetmshah how do you add custom ES roles on Permissions page? In data/inputs/app_permissions_manager "Action is not available" "Current instance is running SHC" There is only ess_analyst and ess_user Thanks.
... View more
a month ago
Hello, does editing ES roles on Permissions page is same as editing ES roles in Splunk's native edit role page? I guess they both point to ES authorize.conf but native's one can work with custom roles? Thanks.
... View more
Labels
03-27-2024
07:04 AM
Hi @power12 you could try using the API : https://community.splunk.com/t5/Splunk-Search/How-to-change-sharing-and-permissions-for-a-lookup-table-using/m-p/163257
... View more
03-27-2024
07:02 AM
Hello @asimsk84 welcome! depending on your retention policy on indexes.conf old buckets won't be frozen and will be deleted : https://community.splunk.com/t5/Getting-Data-In/Do-I-need-to-define-coldToFrozenDir-in-indexes-conf-to-move-old/m-p/247162 Doc : https://docs.splunk.com/Documentation/Splunk/9.2.0/Admin/Indexesconf%20%22coldToFrozenDir%22 You should not delete any file yourself, leave Splunk manage.
... View more
03-08-2024
06:08 AM
Hi @DanAlexander , looks like this is not supported at the moment : https://docs.splunk.com/Documentation/AddonBuilder/4.1.4/UserGuide/Installation "Add-on Builder is not supported in a search head cluster or index cluster environment." You can upvote this idea : https://ideas.splunk.com/ideas/APPSID-I-843
... View more
03-02-2024
06:19 AM
Hello, thanks for solution, so "enhanced" view removes those useful filters, strange...
... View more
03-02-2024
01:44 AM
Hello, I would like to know the aim of this default constraint : (`cim_Authentication_indexes`) tag=authentication NOT (action=success user=*$) action="success" Especially what does it try to match with user=*$ ? User accounts ending with $ symbol like in Windows? Thanks.
... View more
Labels
- Labels:
-
field extraction
-
fields
-
other
02-07-2024
04:35 AM
Hello, is it possible to install SA-cim_vladiator on clustered search heads? Thanks.
... View more
- Tags:
- SA-cim_vladiator
Labels
- Labels:
-
data model
-
field extraction
-
other
02-02-2024
04:52 AM
Hello @elizabethl_splu any news? Is it available in V9.2? Thanks.
... View more
01-26-2024
05:19 AM
Hi @PickleRick we use base url api already for curl commands and would like to use in python.
... View more
01-26-2024
05:19 AM
Hi @VatsalJagani no, we need to use base url api. Thanks.
... View more
01-22-2024
06:01 AM
Hello, thanks so how would you connect from Python using base url? We have HA/FO servers in front of Splunk servers.
... View more
01-22-2024
03:25 AM
We are using /api base url, is that correct for .splunkrc as it asks for host and in our environment we use url?
thanks for your help!
.splunkrc
# Splunk host (default: localhost)
host=splunkurl/api
# Splunk admin port (default: 8089)
port=443
# Splunk username
username=
# Splunk password
password=
# Access scheme (default: https)
scheme=https
# Your version of Splunk (default: 6.3)
version=9.0.4
... View more
Labels
- Labels:
-
other
12-18-2023
03:05 AM
Hello @Sambaing how to index these logs? Maybe your "source" field is not correctly defined.
... View more
12-18-2023
03:00 AM
Hello @uagraw01 what is `indextime`for you, is that macro? If yes try replacing by the content of the macro directly.
... View more
12-18-2023
02:57 AM
Hello @WanLohnston you can try something like this : | timechart span=1d count(myfield) as nb_myfield | eventstats min(myfield) as min_fields max(myfield) as max_fields avg(myfield) as moy_fields
... View more
12-15-2023
08:32 AM
Great 🙂 Hopefully this is solved then.
... View more
12-15-2023
06:49 AM
1 Karma
yes, sounds logic 😉 You can add idea to document these fields at https://ideas.splunk.com/ideas/new
... View more
12-15-2023
06:41 AM
Seems tcp_kprocessed is total transferred data and kb the volume indexed for that particular event. You may submit support ticket for further information as this doesn't look documented.
... View more
12-15-2023
06:20 AM
Hello @Snorre you should migrate Windows first. Personally I prefer using Linux like RHEL for Splunk servers if you can switch.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Thursday
|
Karma given to
