About 493600

493600

Seeing some errors in the internal logs for lookup files. Can someone help me with the reason for these errors? 1) Unable to find filename property for lookup=xyz.csv will attempt to use implicit filename. 2) No valid lookup table file found for this lookup=* 3) The lookup table '*' does not exist or is not available. - This can be due to the definition or reference of the lookup file is there but the file has been deleted.

493600

Looking for a solution that does certain validations check when we upgrade any splunk addon to latest version. This is to make sure when the addon is upgraded to latest version it does not break any of the existing working configs like field parsing, search execution time, etc. in prod. So we need to check if its possible to create a dashboard or something where in we can compare the old state vs upgraded state of the addon before we deploy to prod. Basic two validations can be CIM fields & search execution time and to kick off this we can pick any one sourcetype.

493600 · ‎05-12-2023

We got this resolved. We installed app on SH and added index having data from add-on in the macro shown in below screenshot We started getting data in the index because the app has savedsearches that runs on the basis of macro and outputlookup it to the kv store.

493600 · ‎04-27-2023

Hey All, I am trying to onboard crowdstrike fdr logs using splunk addon Splunk Add-on for CrowdStrike FDR - Splunk Add-on for CrowdStrike FDR | Splunkbase I want to enrich the aidmaster logs. I want to show ComputerName using aid in splunk logs. I have installed addd-on on forwarder and configured input as below: With this input configuration, we can see fdr logs, but the event coverage for ComputerName is very less - 0.36. In short, we are not able to get ComputerName information for aids properly. I have few queries: 1) Do I need some changes on SH as well? 2) Do I need to make any change in savedsearches.conf of the add-on for the ComputerName to be shown? Thanks in advance!

493600 · ‎09-08-2021

Hi All, I want to shift the paginator of my dashboard panel to the upside. The dashboard is a xml dashboard. Is there any way to directly edit the dashboard without adding css ? If not please suggest the css method as well. Thanks in advance!

493600 · ‎08-25-2021

Hello, I have a simple dashboard that has 2 panels: 1)Types of dashboards (single value component defining count of each type) 2)Drilldown for 1st panel to show details I want to convert 1st panel such that, the font size of name of the dashboard type should vary according to the count. color would be the category of dashboard and the count (number of times it has been accessed) would lead to size of the text. I checked for dashboard studio for this purpose but couldn't find out perfect solution. Tried to make one sample dashboard that i want in below screenshot Thanks in advance!

493600 · ‎01-28-2020

I want to check for how long my field TPP_ID is empty. I want to check date and time. Is it possible using splunk query?

493600 · ‎01-14-2020

I happened to get the same error. It was because i have used deployer instance instead of search head instance in the command ./splunk apply shcluster-bundle -target https://"Use search head instance here"

Posts	8
Solutions	1
Karma Given	2
Karma Received	0
Member Since	‎01-14-2020

Online Status	Online
Date Last Visited	5 hours ago

Splunk error for lookup files - Unable to find fil...

How to Compare upgraded app version configurations...

Facing issue while onbaoarding logs in splunk usin...

How to reposition pagination bar to the upside of ...

I need to create a Dashboard that has a text compo...

How to check since how long the field is having nu...