The venerable old-skool Splunk forums are now closed. Feel free to search for old content here, but new posts are no longer supported.
Instead, please visit the thriving community at answers.splunk.com to ask and answer questions about your Splunk deployment and how to get the most out of it.
Forums: Posted by arturo
| Topic | Author | Replies | Latest Post |
|---|---|---|---|
|
Search documentation : where is it (really) ?
In: SplunkGeneral
(Not tagged)
Thanks CerielTjuh :
I'd love to help ... however, I do not have the answers to this questions, ...
Guys : Why the documentation on A LOT of search commands is so poor ? Example : SELFJOIN (there ... |
2
|
30 months ago... | |
|
Subsearch problem / How subsearches work ?
In: SplunkSearchAndAlert
(Not tagged)
Guys :
The mistery is about to end ?
From Will Hayes, I have this feedback :
- theres a ...
Update : After contacting some guys at Splunk on the subject, there seems to be 2 cases : - Some ... Gracias Marcelo ! No offense taken ... sometimes the obvious is not so ! I used as source : source="./apps1.csv", ... Thx gkanapathy ! I didn't touch directly props or transforms (neither ... actually I used the "Extract ... Thx gkanapathy ! Did it (both installations), same result : source=./app1.csv [ search source=./app1.csv ... Btw ... sharing some collateral help (from Maveric, somewhere inside Splunk :-) It does not do exactly ... Btw ... sharing some collateral help (from Maveric, somewhere inside Splunk :-) It does not do exactly ... Thanks gkanapathy : I did as you suggest : 1.- The simplified search : source="./app2.csv" ... Thanks SplunkSE ... Did that already ... same results !!!! A |
24
|
30 months ago... | |
|
Comparison of Splunk vs. Zenoss for a small IT shop??
In: SplunkGeneral
(Not tagged)
tlyczko :
I think that both obviously can do it ... to certain extend. The differences are based ...
|
3
|
34 months ago... |