Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jstockamp
jstockamp
Communicator
Member since:
05-02-2011
06-05-2020
Community Statistics
| Posts | 54 |
| Solutions | 8 |
| Karma Given | 0 |
| Karma Received | 19 |
| Member Since | 05-02-2011 |
Activity Feed
- Got Karma for Re: Extracting the User-Agent HTTP header from an Apache log. 06-05-2020 12:46 AM
- Got Karma for Re: How can I monitor the same file on different drives in windows?. 06-05-2020 12:46 AM
- Got Karma for Re: stats count by value, grouped by time. 06-05-2020 12:46 AM
- Got Karma for Re: Search in the earliest source. 06-05-2020 12:46 AM
- Got Karma for Re: Search for Multiples Values and extract them into a single field?. 06-05-2020 12:46 AM
- Got Karma for Re: Urgent!!: Unable to create a dashboard panel. 06-05-2020 12:46 AM
- Got Karma for Universal forwarder not using updated index property in inputs.conf. 06-05-2020 12:45 AM
- Got Karma for Re: Filter windows events on indexer from a universal forwarder. 06-05-2020 12:45 AM
- Got Karma for Filter windows events on indexer from a universal forwarder. 06-05-2020 12:45 AM
- Got Karma for Setting Host field value based on a file inside a tar archive. 06-05-2020 12:45 AM
- Got Karma for Extracting a field at search time - rex question. 06-05-2020 12:45 AM
- Got Karma for Re: Using saved search results on a dashboard not working. 06-05-2020 12:45 AM
- Got Karma for Re: Using saved search results on a dashboard not working. 06-05-2020 12:45 AM
- Got Karma for Using saved search results on a dashboard not working. 06-05-2020 12:45 AM
- Got Karma for Re: Combining values across multiple fields in an event. 06-05-2020 12:45 AM
- Got Karma for Combining values across multiple fields in an event. 06-05-2020 12:45 AM
- Got Karma for Combining values across multiple fields in an event. 06-05-2020 12:45 AM
- Got Karma for Combining values across multiple fields in an event. 06-05-2020 12:45 AM
- Got Karma for Re: Using a google map on a form. 06-05-2020 12:45 AM
- Posted Re: Why Splunk App for Windows Infrastructure shows only 1 counter from the perfmon index? on All Apps and Add-ons. 11-04-2014 03:34 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 3 | |||
| 0 | |||
| 1 | |||
| 1 |
11-04-2014
03:34 PM
Any updates from support on this?
... View more
10-29-2014
04:18 PM
Interested to find out what you hear. I've got a similar issue where all other performance counters are working, except "Network Interface". It's interesting that I'm using the same app for Windows 2003/2008 clients and it works there, the only hosts that it doesn't work with are Windows 2012 R2. I've checked and the object names have stayed the same in 2012 R2.
... View more
01-09-2014
09:17 AM
Thanks, I was able to get a regex extract for my sourcetype to work. Not the optimal solution, but it will work. I completely agree the hyphen was a poor choice.
... View more
01-06-2014
03:59 PM
Nope, same behavior, delimits on the first "-" and not " - "
... View more
01-06-2014
03:42 PM
I've got some logs that are in a format like this
2013-12-29 08:23:21,151 - INFO - 1.1.1.1 - None - None - SERVER1 - User keynote@test.com logged in... - Mozilla/4.0 (compatible; MSIE 8.0; Webmetrics; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
as you can see the field delimiter here is " - " (including the spaces). When I setup my custom sourcetype and field extractions using
DELIMS=" - "
it seems to be ignoring the spaces and breaking the fields at the first "-" rather than " - ". I'm getting "2013" as my first field rather than "2013-12-29 08:23:21,151"
I've tried using DELIMS="\s-\s" and that doesn't seem to work either.
Anyone have any ideas?
... View more
- Tags:
- extraction
12-03-2013
02:25 PM
I'm trying to create a chart that has the time of day on the y axis. I have a results table that looks like this:
Database Time_of_Day
db_1 10:00
db_2 10:05
db_3 13:30
If I do a "chart max(Time_of_Day) by Database" I see results in the results table but nothing in any of the chart types. What am I missing here? How do I tell splunk to use a time scale for the Y axis?
... View more
- Tags:
- chart
07-30-2013
03:36 PM
1 Karma
You need to either build a lookup table or use a custom command to parse the user agent string. Looks like this might do the trick:
http://splunk-base.splunk.com/apps/48017/ta-uas_parser
... View more
07-30-2013
03:32 PM
if you want to know all the hosts you have index data for do a search
index = "*" | stats count by host
Depending on the size of your indexes this query may take a long time to run.
... View more
07-30-2013
01:49 PM
You just need to add the appropriate perfmon counters.
http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/Real-timeWindowsperformancemonitoring
You should be adding stanzas like this to your perfmon configuration:
[PERFMON:Web Service]
counters = Get Requests/sec;Current Connections
disabled = 0
instances = *
interval = 10
object = Web Service
index = windows_perfmon
... View more
07-30-2013
01:34 PM
1 Karma
You could try a regex in the path:
[monitor://[A-Z]:\Program Files\folderfile.txt]
http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/Specifyinputpathswithwildcards
... View more
04-19-2013
07:08 AM
1 Karma
I would think you could just use the "earliest" function of stats - i.e.
sourcetype="mysourcetype" | stats earliest(source) as firstsource | search source=firstsource
... View more
04-19-2013
06:59 AM
1 Karma
timechart seems like a better solution here
timechart span=1m count(domain) by domain
should work.
... View more
04-19-2013
06:45 AM
Just to be clear these modifications to props.conf and transforms.conf will go on the indexer, not the forwarder.
... View more
04-18-2013
07:43 AM
It sounds like you were already configured the forwarder to push ADFS logs (which means you configured an inputs.conf file to monitor a directory). In that inputs.conf add index=myIndex and you should be good. there can be multiple inputs.conf files on a forwarder, so you could have configured it in a number of places.
... View more
04-18-2013
07:33 AM
To specify the index you want an input to go to just add:
index=myIndex
to the monitor stanza in your inputs.conf (on the forwarder).
I don't believe Splunk for AD supports ADFS logs specifically.
... View more
04-18-2013
07:04 AM
A little more information would be helpful .... what app, what index, what specifically do you need help with? You might want to take a look at the Splunk App for Active Directory (http://splunk-base.splunk.com/apps/51338/splunk-app-for-active-directory) as it will do most of the configuration for you.
... View more
03-26-2013
10:31 AM
1 Karma
I'm having a hard time understanding what you're trying to do. Maybe posting some sample data would be useful. You can easily extract multiple fields in a single rex command.
... View more
03-26-2013
08:19 AM
To combine two fields you can use "eval combined_field = field1 ."-". field2" - that will combine them with a hyphen between.
... View more
03-26-2013
08:15 AM
First place to look for problems would be splunkd.log in $SPLUNK_HOME/var/log/splunk on both the forwarder and the indexer.
Can you post outputs.conf from the forwarder?
Have you installed the splunk Deployment Monitor app on the indexer? If so do you see the forwarder listed under "All Forwarders"?
... View more
03-22-2013
11:12 AM
Are you seeing messages in splunkd.log that you are connected to the indexer? Do you have any other inputs on the forwader that are making it to the indexer?
... View more
03-22-2013
10:41 AM
You might want to add a whiltelist to your input:
whitelist=*.log
... View more
03-19-2013
08:31 PM
Okay. The error message you quoted earlier saved the saved search (not the DB) already existed. I'm guessing if you go into "Searches" in manager you'll see your previously saved search.
... View more
03-19-2013
08:29 PM
Universal forwarder might work for this, but it would be useful to know what types of inputs you want to use. If the forwarder doesn't work you could always push the data to your splunk server using scp or something similiar (or mount your log directory from the splunk server).
... View more
03-18-2013
10:45 PM
1 Karma
Have you tried using a different name. Have you gone into Manager and looked at your saved searches?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:02 AM
|
Karma from
