Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About splunkreal
splunkreal
Motivator
Member since:
05-26-2016
8 hours ago
Community Statistics
| Posts | 494 |
| Solutions | 20 |
| Karma Given | 697 |
| Karma Received | 38 |
| Member Since | 05-26-2016 |
Activity Feed
- Posted Re: Exporting data and importing into another Splunk instance on Other Usage. yesterday
- Posted Re: Data used by searches? on Splunk Search. yesterday
- Karma Re: How can I determine how much an index is being searched? for skillfulobj. yesterday
- Karma Re: Question about "run as" (Owner or User ) for saved searches. Missing in version 7. for the_wolverine. yesterday
- Posted Re: List deployment client showing "no clients contacted the server" on Deployment Architecture. yesterday
- Karma Re: cannot get all clients via 'list deploy-clients' after upgrading splunk 6.2.0 for nicolas_perreau. yesterday
- Karma Re: Splunk Enterprise Security: is there a way to notify someone via email that they have been assigned a notable event? for AndySplunks. Monday
- Posted Re: Help creating a table that shows Incident Review Mean Time to Triage for each type of notable per notable owner on Splunk Enterprise Security. Monday
- Posted Re: How to write a search to display a Notable Event Timeline Review showing various phases of a ticket? on Splunk Search. Monday
- Karma Re: How to write a search to display a Notable Event Timeline Review showing various phases of a ticket? for jstoner_splunk. Monday
- Karma Re: Can we use wildcard characters in a lookup table? for tmcmaster. 2 weeks ago
- Karma Re: consequence of lookup command with or without OUTPUT parameter for s2_splunk. 2 weeks ago
- Karma Re: consequence of lookup command with or without OUTPUT parameter for somesoni2. 2 weeks ago
- Posted Re: How can I avoid overwriting the local folder when reloading from my deployment server? on Splunk Enterprise. 2 weeks ago
- Posted Re: How can I avoid overwriting the local folder when reloading from my deployment server? on Splunk Enterprise. 2 weeks ago
- Tagged Re: How can I avoid overwriting the local folder when reloading from my deployment server? on Splunk Enterprise. 2 weeks ago
- Karma Re: How can I avoid overwriting the local folder when reloading from my deployment server? for andrewtrobec. 2 weeks ago
- Karma How can I avoid overwriting the local folder when reloading from my deployment server? for andrewtrobec. 2 weeks ago
- Karma Announcing Our Splunk MVPs for jhupka_splunk. 2 weeks ago
- Karma Introducing the 2024 Splunk MVPs! for SplunkCommunity. 2 weeks ago
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
yesterday
Hello @CSReviews you can export as csv file it's then easy to import. https://hurricanelabs.com/splunk-tutorials/ingesting-a-csv-file-into-splunk/ "Upload with Splunk Web"
... View more
yesterday
Hello @whitecat001 try this :
index=_audit action="search" search="*" NOT user="splunk-system-user" savedsearch_name="" NOT search="\'|history*" NOT search="\'typeahead*"
| rex "index=(?P<myIndex>\w+)\s+\w+="
| stats count by myIndex
... View more
yesterday
Hello @Poojitha you can try splunk list deploy-clients -count -1 Also you should use Settings/Forwarder management (GUI interface of your DMC server).
... View more
Monday
Hi @ITWhisperer you should filter with _time otherwise you will find unaccurate results probably?
... View more
Monday
Hello @jstoner_splunk @fwijnholds_splu I'm finding different results filtering in Incident Review, is that normal? Thanks.
... View more
2 weeks ago
Hi @edoardo_vicendo the weird thing is the local folder with app.conf inside have been created on the deployment-apps folder when restarting/reloading deploy-server.
... View more
2 weeks ago
Hello @somesoni2 @andrewtrobec @edoardo_vicendo we saw same issue and it can wipe your changes on client's local folder. So is that normal that even if we don't have local folder in deployment-apps/app, reloading deployment server creates deployment-apps/app/local + deployment-apps/app/local/app.conf ? We had to leave it, resync correctly then at the end add our specific conf files on the heavyforwarder etc/apps/app/local Thanks.
... View more
- Tags:
- app
- Deployment Server
4 weeks ago
Hi @kiran_panchavat renaming DS "app/local" to "app/local.OLD" is enough? Thanks.
... View more
4 weeks ago
Hello, if we have on DS "app/local" with conf files, is that possible restarting it that it pushes DS "app/local" to HF "app/local" and deletes custom local conf files on HF (created from HF GUI)? Thanks.
... View more
Labels
04-15-2024
09:10 AM
Hello @isoutamo does this | tstats command requires to have data access or just internal logs? Thanks.
... View more
04-12-2024
03:45 AM
1 Karma
Hi @gcusello did you get answer from @woodcock regarding applying on all etc/system/local/authorize.conf search head nodes (preferably from GUI if possible) ? Thanks.
... View more
04-10-2024
06:21 AM
Hello @meetmshah how do you add custom ES roles on Permissions page? In data/inputs/app_permissions_manager "Action is not available" "Current instance is running SHC" There is only ess_analyst and ess_user Thanks.
... View more
03-29-2024
03:46 PM
Hello, does editing ES roles on Permissions page is same as editing ES roles in Splunk's native edit role page? I guess they both point to ES authorize.conf but native's one can work with custom roles? Thanks.
... View more
Labels
03-27-2024
07:04 AM
Hi @power12 you could try using the API : https://community.splunk.com/t5/Splunk-Search/How-to-change-sharing-and-permissions-for-a-lookup-table-using/m-p/163257
... View more
03-27-2024
07:02 AM
Hello @asimsk84 welcome! depending on your retention policy on indexes.conf old buckets won't be frozen and will be deleted : https://community.splunk.com/t5/Getting-Data-In/Do-I-need-to-define-coldToFrozenDir-in-indexes-conf-to-move-old/m-p/247162 Doc : https://docs.splunk.com/Documentation/Splunk/9.2.0/Admin/Indexesconf%20%22coldToFrozenDir%22 You should not delete any file yourself, leave Splunk manage.
... View more
03-08-2024
06:08 AM
Hi @DanAlexander , looks like this is not supported at the moment : https://docs.splunk.com/Documentation/AddonBuilder/4.1.4/UserGuide/Installation "Add-on Builder is not supported in a search head cluster or index cluster environment." You can upvote this idea : https://ideas.splunk.com/ideas/APPSID-I-843
... View more
03-02-2024
06:19 AM
Hello, thanks for solution, so "enhanced" view removes those useful filters, strange...
... View more
03-02-2024
01:44 AM
Hello, I would like to know the aim of this default constraint : (`cim_Authentication_indexes`) tag=authentication NOT (action=success user=*$) action="success" Especially what does it try to match with user=*$ ? User accounts ending with $ symbol like in Windows? Thanks.
... View more
Labels
- Labels:
-
field extraction
-
fields
-
other
02-07-2024
04:35 AM
Hello, is it possible to install SA-cim_vladiator on clustered search heads? Thanks.
... View more
- Tags:
- SA-cim_vladiator
Labels
- Labels:
-
data model
-
field extraction
-
other
02-02-2024
04:52 AM
Hello @elizabethl_splu any news? Is it available in V9.2? Thanks.
... View more
01-26-2024
05:19 AM
Hi @PickleRick we use base url api already for curl commands and would like to use in python.
... View more
01-26-2024
05:19 AM
Hi @VatsalJagani no, we need to use base url api. Thanks.
... View more
01-22-2024
06:01 AM
Hello, thanks so how would you connect from Python using base url? We have HA/FO servers in front of Splunk servers.
... View more
01-22-2024
03:25 AM
We are using /api base url, is that correct for .splunkrc as it asks for host and in our environment we use url?
thanks for your help!
.splunkrc
# Splunk host (default: localhost)
host=splunkurl/api
# Splunk admin port (default: 8089)
port=443
# Splunk username
username=
# Splunk password
password=
# Access scheme (default: https)
scheme=https
# Your version of Splunk (default: 6.3)
version=9.0.4
... View more
Labels
- Labels:
-
other
12-18-2023
03:05 AM
Hello @Sambaing how to index these logs? Maybe your "source" field is not correctly defined.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
8 hours ago
|
Karma given to
| User | Karma Count |
|---|---|
| 1 | |
| 2 | |
| 1 | |
| 1 | |
| 1 |
