Unable to use case with stats
Hi Everyone, I am not able to use eval command with stats. I am using the following search in a form, I want to find the sum of a field depending on the action selected from drop down. I am using the...
View ArticleCheck if value is null for a period of time
Hi Guys,I need help to set-up an email alert for Splunk that will trigger if a value is null for a specific amount of time. The value in question is derived from multiple values and added by eval...
View Articleports used between splunk instances
I have two splunk instances on either side of a firewall. I use the deployment server and a shared license. Each instance is an indexer and I use distributed search if that matters.I'm seeing inbound...
View ArticleHow to include a python script in views.
hi all,i have developed a simple python script to get the current external ip of machine. Script is working fine in standalone.i hav created a commands.conf file and make a corresponding entry for it...
View ArticleDB Connect not inputting MS SQL from data source
Have the latest install of DB Connect that I have been able to on board two data sources that are MS SQL, I am doing the same for a 3rd MS SQL with no success. I have check the following files on DBX...
View ArticleHow to change a search into a marco filter?
This is a follow up to Background exclusion The question I have now is no longer on topic with the original posted hence the following. The title is fairly descriptive I have a search that gives logs...
View Articledb connect timestamp issues
Hi,I want to do a tail on an Oracle table, using db connect. The table contains a column that appears to be in epoch time, so it should be good for the rising column value. However, whenever I get the...
View ArticleUsing tokens in splunklib?
Hi,I'm writing a custom command that is supposed to do some actions on Splunk through its REST interface so I wanted to use the SDK. However, I'm having problems authenticating with the session token....
View ArticleHeavy Forwarder and Splunkstorm
Can I use a heavy forwarder together with SplunkStorm?Is it supported in general? From a license point of view etc.Are the credential applications compatible?Any other potential issues?
View ArticleWhat do you want to see in a Splunk Mobile app?
Here's a very early version of a Splunk App I wrote that generates HTML friendly to small screens and fat fingers.Use it on your phone or ipad, for...
View ArticleIn a Distributed Search environment, how do I restrict what indexes (or...
I have a main centralized splunk index server with logs for 50+ hosts. I have a secondary Splunk instance for a smaller application where it logs its own data. I would like to set the smaller instance...
View Articleapp not deploying to client
1 Serverclass.conf in ~splunk/etc/system/local using clientName attributeplaceholder app in ~splunk/etc/deployment-apps/placeholder [global] whitelist.0=* stateOnClient = enabled [serverClass:base-xyz]...
View Articleperformance considerations for eventtypes?
I've been looking at the "Search Job Inspector" recently and noticing that command.search.typer is often showing up at the top of the list. It's not uncommon for it to be using nearly 50% (sometimes...
View ArticleProper REX command
What would the proper REX command be to extract the following:SPACE:SPACE then a numeric stringso ends up being ' : 949495'
View ArticleHow to escape double quotes in SideView Utils Textfield Module
I have a dashboard that uses two SideView Utils TextField modules. The set up is as follows:view textfield checkboxes checkboxes textfield button search table view The problem I'm having is in the...
View Articleprocess control chart e.g. upper/lower control limit.
I have been asked to help a co-worker create a process control chart to understand an applications response time.The following three events are generated for each test. INFO=Signon_Screen...
View ArticleClik here to view.
SavedSearch module doesn't use results from scheduled search
I'm trying to use the Sideview SavedSearch module to load results from a previous scheduled search in order to quickly populate dropdowns on my page.<module name="SavedSearch" autoRun="True">...
View ArticleIs there a way to control layoutPanel in Tabs/Switcher ?
I was wondering, is there a way to control the layoutPanel for Tabs/Switcher? I couldn't seem to make the layout contain within the Switcher itself.
View ArticleBuild a Splunk app
Hi,I'm new to Splunk and I'm trying to build a dashboard app. I have installed Splunk and Java sdk and managed to perform search and get the results to my console. What is the next step? How do I...
View ArticleAn error occurred while rendering the page template. See web_service.log for...
Hi there,When i did splunk start, everything goes well. There was no error. but when i try to go to the url in my browser, i see this message==>"An error occurred while rendering the page template....
View Article