Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About splunkreal
splunkreal
Motivator
Member since:
05-26-2016
a week ago
Community Statistics
| Posts | 489 |
| Solutions | 20 |
| Karma Given | 692 |
| Karma Received | 38 |
| Member Since | 05-26-2016 |
Activity Feed
- Karma Re: Can we use wildcard characters in a lookup table? for tmcmaster. a week ago
- Karma Re: consequence of lookup command with or without OUTPUT parameter for s2_splunk. a week ago
- Karma Re: consequence of lookup command with or without OUTPUT parameter for somesoni2. a week ago
- Posted Re: How can I avoid overwriting the local folder when reloading from my deployment server? on Splunk Enterprise. a week ago
- Posted Re: How can I avoid overwriting the local folder when reloading from my deployment server? on Splunk Enterprise. a week ago
- Tagged Re: How can I avoid overwriting the local folder when reloading from my deployment server? on Splunk Enterprise. a week ago
- Karma Re: How can I avoid overwriting the local folder when reloading from my deployment server? for andrewtrobec. a week ago
- Karma How can I avoid overwriting the local folder when reloading from my deployment server? for andrewtrobec. a week ago
- Karma Announcing Our Splunk MVPs for jhupka_splunk. 2 weeks ago
- Karma Introducing the 2024 Splunk MVPs! for SplunkCommunity. 2 weeks ago
- Karma Re: Search a lookup with wildcard in values for tscroggins. 2 weeks ago
- Posted Re: Deployment Server and HeavyForwarder app local folder on Deployment Architecture. 3 weeks ago
- Karma Re: Deployment Server and HeavyForwarder app local folder for kiran_panchavat. 3 weeks ago
- Posted Deployment Server and HeavyForwarder app local folder on Deployment Architecture. 3 weeks ago
- Karma Re: Question about "run as" (Owner or User ) for saved searches. Missing in version 7. for the_wolverine. 4 weeks ago
- Karma Re: How to change server roles in the Distributed Management Console using the CLI or conf files? for MuS. 4 weeks ago
- Posted Re: tstats via REST API on Splunk Search. 4 weeks ago
- Karma Re: tstats via REST API for isoutamo. 4 weeks ago
- Karma Re: How to delete a correlation search for DavidHourani. 4 weeks ago
- Karma Re: Splunk Enterprise Security: Why am I receiving "Search could not be updated: [HTTP 500]" error when trying to save correlation search as ess_admin? for smoir_splunk. a month ago
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
a week ago
Hi @edoardo_vicendo the weird thing is the local folder with app.conf inside have been created on the deployment-apps folder when restarting/reloading deploy-server.
... View more
a week ago
Hello @somesoni2 @andrewtrobec @edoardo_vicendo we saw same issue and it can wipe your changes on client's local folder. So is that normal that even if we don't have local folder in deployment-apps/app, reloading deployment server creates deployment-apps/app/local + deployment-apps/app/local/app.conf ? We had to leave it, resync correctly then at the end add our specific conf files on the heavyforwarder etc/apps/app/local Thanks.
... View more
- Tags:
- app
- Deployment Server
3 weeks ago
Hi @kiran_panchavat renaming DS "app/local" to "app/local.OLD" is enough? Thanks.
... View more
3 weeks ago
Hello, if we have on DS "app/local" with conf files, is that possible restarting it that it pushes DS "app/local" to HF "app/local" and deletes custom local conf files on HF (created from HF GUI)? Thanks.
... View more
Labels
4 weeks ago
Hello @isoutamo does this | tstats command requires to have data access or just internal logs? Thanks.
... View more
a month ago
1 Karma
Hi @gcusello did you get answer from @woodcock regarding applying on all etc/system/local/authorize.conf search head nodes (preferably from GUI if possible) ? Thanks.
... View more
04-10-2024
06:21 AM
Hello @meetmshah how do you add custom ES roles on Permissions page? In data/inputs/app_permissions_manager "Action is not available" "Current instance is running SHC" There is only ess_analyst and ess_user Thanks.
... View more
03-29-2024
03:46 PM
Hello, does editing ES roles on Permissions page is same as editing ES roles in Splunk's native edit role page? I guess they both point to ES authorize.conf but native's one can work with custom roles? Thanks.
... View more
Labels
03-27-2024
07:04 AM
Hi @power12 you could try using the API : https://community.splunk.com/t5/Splunk-Search/How-to-change-sharing-and-permissions-for-a-lookup-table-using/m-p/163257
... View more
03-27-2024
07:02 AM
Hello @asimsk84 welcome! depending on your retention policy on indexes.conf old buckets won't be frozen and will be deleted : https://community.splunk.com/t5/Getting-Data-In/Do-I-need-to-define-coldToFrozenDir-in-indexes-conf-to-move-old/m-p/247162 Doc : https://docs.splunk.com/Documentation/Splunk/9.2.0/Admin/Indexesconf%20%22coldToFrozenDir%22 You should not delete any file yourself, leave Splunk manage.
... View more
03-08-2024
06:08 AM
Hi @DanAlexander , looks like this is not supported at the moment : https://docs.splunk.com/Documentation/AddonBuilder/4.1.4/UserGuide/Installation "Add-on Builder is not supported in a search head cluster or index cluster environment." You can upvote this idea : https://ideas.splunk.com/ideas/APPSID-I-843
... View more
03-02-2024
06:19 AM
Hello, thanks for solution, so "enhanced" view removes those useful filters, strange...
... View more
03-02-2024
01:44 AM
Hello, I would like to know the aim of this default constraint : (`cim_Authentication_indexes`) tag=authentication NOT (action=success user=*$) action="success" Especially what does it try to match with user=*$ ? User accounts ending with $ symbol like in Windows? Thanks.
... View more
Labels
- Labels:
-
field extraction
-
fields
-
other
02-07-2024
04:35 AM
Hello, is it possible to install SA-cim_vladiator on clustered search heads? Thanks.
... View more
- Tags:
- SA-cim_vladiator
Labels
- Labels:
-
data model
-
field extraction
-
other
02-02-2024
04:52 AM
Hello @elizabethl_splu any news? Is it available in V9.2? Thanks.
... View more
01-26-2024
05:19 AM
Hi @PickleRick we use base url api already for curl commands and would like to use in python.
... View more
01-26-2024
05:19 AM
Hi @VatsalJagani no, we need to use base url api. Thanks.
... View more
01-22-2024
06:01 AM
Hello, thanks so how would you connect from Python using base url? We have HA/FO servers in front of Splunk servers.
... View more
01-22-2024
03:25 AM
We are using /api base url, is that correct for .splunkrc as it asks for host and in our environment we use url?
thanks for your help!
.splunkrc
# Splunk host (default: localhost)
host=splunkurl/api
# Splunk admin port (default: 8089)
port=443
# Splunk username
username=
# Splunk password
password=
# Access scheme (default: https)
scheme=https
# Your version of Splunk (default: 6.3)
version=9.0.4
... View more
Labels
- Labels:
-
other
12-18-2023
03:05 AM
Hello @Sambaing how to index these logs? Maybe your "source" field is not correctly defined.
... View more
12-18-2023
03:00 AM
Hello @uagraw01 what is `indextime`for you, is that macro? If yes try replacing by the content of the macro directly.
... View more
12-18-2023
02:57 AM
Hello @WanLohnston you can try something like this : | timechart span=1d count(myfield) as nb_myfield | eventstats min(myfield) as min_fields max(myfield) as max_fields avg(myfield) as moy_fields
... View more
12-15-2023
08:32 AM
Great 🙂 Hopefully this is solved then.
... View more
12-15-2023
06:49 AM
1 Karma
yes, sounds logic 😉 You can add idea to document these fields at https://ideas.splunk.com/ideas/new
... View more
12-15-2023
06:41 AM
Seems tcp_kprocessed is total transferred data and kb the volume indexed for that particular event. You may submit support ticket for further information as this doesn't look documented.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
a week ago
|
Karma given to
