About spl_stu

spl_stu · ‎08-17-2023

A file directory needs to be collected, but there is a large amount of historical data in the file directory. If I currently point to collecting data from the last three days, is there a parameter to control the collection of files after the specified time?

spl_stu · ‎05-04-2023

Okay, thank you for your suggestion. This issue has been resolved so far.

spl_stu · ‎04-25-2023

How to view the currently running search of Splunk and display the amount of memory consumed during the execution of this search command? Based on this information, I would like to pause some searches with high memory usage.

spl_stu · ‎08-18-2022

Please help answer this question, thank you： All the host values of the data I access now are the host names. I want to change all the host names to IP. How can I do this? For example, host = Splunk is changed to host = 192.168.3.1 There are many hosts to be modified, so is there any configuration to be pushed uniformly by the deployment server?

spl_stu · ‎07-22-2022

Thank you very much for your answer. My problem has been solved

spl_stu · ‎07-21-2022

OK, thank you very much for your answer. I'll test it now

spl_stu · ‎07-21-2022

These two values are the log content automatically extracted by "add on". The corresponding value of "Recipient" is a field, and the corresponding value is the recipient connected by multiple space characters. The complete value of "status" is this content

spl_stu · ‎07-21-2022

Please help answer this question, thank you： For these two multivalued fields, you want the value in the "Recipient" field to correspond to the value in the "recipient_status". If the receipt is successful, it corresponds to ";", If it fails, it corresponds to "'550 5.1.1 resolver.adr.recipnotfound, not found'". Is there a way to segment the values of these two fields and make one-to-one correspondence? The following are the values corresponding to these two fields Recipient="@000.com @123.com @456.com @789.com", recipient_status=";;'550 5.1.1 RESOLVER.ADR.RecipNotFound; not found';"

Posts	9
Solutions	0
Karma Given	4
Karma Received	0
Member Since	‎01-23-2022

Online Status	Offline
Date Last Visited	‎11-23-2023 08:40 AM

How Splunk collects data after a specific time

How to view the currently running search of Splunk...

How to change host = hostname to host = IP in sear...

How to Split correspondence of multi value fields

How Splunk collects data after a specific time

Re: How to view the currently running search of Sp...

How to view the currently running search of Splunk...

How to change host = hostname to host = IP in sear...

Re: Split correspondence of multi value fields

Re: Split correspondence of multi value fields

Re: Split correspondence of multi value fields

How to Split correspondence of multi value fields