The venerable old-skool Splunk forums are now closed. Feel free to search for old content here, but new posts are no longer supported.
Instead, please visit the thriving community at answers.splunk.com to ask and answer questions about your Splunk deployment and how to get the most out of it.
Forums: Posted by l33t
| Topic | Author | Replies | Latest Post |
|---|---|---|---|
|
Autorefresh in Simple Dashboard
In: SplunkGeneral
(Not tagged)
Any idea??
Hi, Is it possible to include 'autorefresh' feature in Simple dashboards like Advanced dashboards ... |
2
|
32 months ago... | |
|
Combine two Searches
In: SplunkSearchAndAlert
(Not tagged)
Thanks gkanapathy
But the problem is not solved yet.
When I run the that search, i got the following ...
Thanks for the suggession araitz. I went through commands like join, append etc. but not able to find ... I want to combine two searches - 1st Search : eventtype=A | stats count by fieldA,fieldB,fieldC 2nd ... |
4
|
33 months ago... | |
|
Simple Correlation rule
In: SplunkGeneral
(Not tagged)
Pls respond...
I am trying to create a correlation rule: Two eventtypes - eventtype-A and eventtype-B. I want to ... |
2
|
34 months ago... | |
|
Tranactions, fields +, and excluding search responses that contain NULL values.
In: SplunkAdministration
(Not tagged)
Anyone....plzz...
Please suggest a transaction search, which should start with "primary authentication successful for" ... |
7
|
36 months ago... | |
|
Filter logs from OPSEC-LEA server
In: SplunkApplications
(Not tagged)
I have configured OPSEC-LEA as given in
http://www.splunk.com/base/Apps:Configure_OPSEC_LEA_input
and ...
|
–
|
37 months ago... | |
|
Not able to see logs when clicking on time chart
In: SplunkReporting
(Not tagged)
I want to filter logs by clicking on a time range in the graph report. But it is only working for those ...
Hi all, I am not able to filter logs when clicking on a time chart graph. But it works fine in normal ... |
–
|
37 months ago... | |
|
Alert before indexing exceeds the license limit
In: SplunkSearchAndAlert
(Not tagged)
Please find the solution to alert if daily indexing size exceeds a particular value, say 512MB, 800MB, ...
|
1
|
37 months ago... | |
|
Configure Timestamp extraction
In: SplunkGeneral
(Not tagged)
Hi,
Here is a sample log,
Apr 29 23:52:59 abcd.efg.hij.net Apr 29 18:32:47 abcd.efg.hij.net GenericLog
By ...
|
–
|
37 months ago... | |
|
Identify events per second
In: SplunkGeneral
(Not tagged)
Thanks. That fixed it!
Hi, How can I identify the total no. of events per second in Splunk server. |
2
|
37 months ago... | |
|
Splunk Replay Application always respond "ERROR: Authentication failed"
In: SplunkDev
(Not tagged)
Me also have the same problem...Please help us
|
2
|
38 months ago... | |
|
List of hosts which have not sent a message
In: SplunkSearchAndAlert
(Not tagged)
I agreed this and tried to shedule the search and alert on every 30min, 60min etc... but unfortunately ...
I want to search and make alert a list of all hosts which have not sent a message in last 24 hours. ... |
3
|
38 months ago... | |
|
Include reports in Alerts
In: SplunkSearchAndAlert
(Not tagged)
Hi,
Is it possible to include graphed reports in alerts through mails
|
1
|
38 months ago... | |
|
Problems in "Splunk replay" application
In: SplunkApplications
(Not tagged)
I tried to install an application called "Splunk-Replay" from Splunbase
http://www.splunkbase.com/apps/All/Technologies/Splunk/app:Splunk+Replay
But ...
|
–
|
39 months ago... | |
|
Extracting Firewall logs
In: SplunkGeneral
(Not tagged)
Thanks for ur great advice...Its works fine..
But a small problem, the timestamp is exactly different ...
"121086" "1Mar2009" "8:28:43" "eth1c0" "MEDDCFW01" "Log" "Monitor Only" "http-proxy" "46541" "AE-DDC-Proxy01" ... |
–
|
39 months ago... | |
|
CheckPoint OPSEC LEA
In: SplunkApplications
(Not tagged)
I have a problem with this Opsec-lea configuration.
I tried this Opsec-lea configuration in our co-operate ...
|
11
|
40 months ago... | |
|
Automatic export
In: SplunkGeneral
(Not tagged)
I want to export searched logs to a text file during alerting. But i didnt find any option to export ...
|
1
|
40 months ago... | |
|
Filtering and Scheduling
In: SplunkGeneral
(Not tagged)
Thks for the information araitz, but i want to forward it based on the search results. If it is critical, ...
I want to filter certain logs and forward only these logs from one Splunk forwarder to another Splunk ... |
2
|
40 months ago... | |
|
Regular expression
In: SplunkGeneral
(Not tagged)
Thks for ur great help, rataide...It works fine..
I wanna study to write regular exp. Can u pls suggest ...
i want to extract "User Name" field from some logs. What is the regular expression for that? Given ... |
2
|
40 months ago... | |
|
Extract each fields from Windows Snare syslog
In: SplunkApplications
(Not tagged)
Hi rataide,
thanks for your suggession. Some fields are extracted, but not all..
Hi gkanapathy,
We ...
Feb 17 17:46:27 10.120.9.144 Feb 17 17:46:27 metechitest.abc.de.fgh MSWinEventLog 1 Security 116 Tue ... Hi I installed a snare agent in windows machine and forward these logs to my Splunk server. I want ... |
2
|
40 months ago... |