About Shtark

Shtark · ‎08-19-2019

Could it be permissions related? We got the same error message (although not in a clustered environment). Per https://answers.splunk.com/answers/602346/opsgenie-app-trigging-alert-doesnt-work-unless-use.html you need the "list_storage_passwords" capability for the alert to work.,Could it be permissions related? We got the same error message (although not in a clustered environment). Per https://answers.splunk.com/answers/602346/opsgenie-app-trigging-alert-doesnt-work-unless-use.html you need the assign the "list_storage_passwords" capability to the desired user.

Shtark · ‎03-08-2017

Since updating to DB Connect v3 columns are being returned in lexicographical order rather than the order specified in the SELECT statement. E.g. SELECT Plan, ISP, count() now returns ISP, Plan, count(). The order per the SELECT command was correct in v2. Anyone else experiencing this? Fields and Table Splunk commands are obviously workarounds for now but we'd prefer not to have to select the order twice.

Shtark · ‎08-09-2016

I haven't seen a release date or notes for 6.4.3 yet sorry.

Shtark · ‎08-09-2016

Looks like it's fixed in 6.4.3: https://answers.splunk.com/answers/401873/why-is-an-embedded-report-on-a-webpage-not-getting.html

Shtark · ‎03-05-2014

Using SOS I've confirmed that the only non-default attributes in the [syslog] stanza of props.conf are EVALs, LOOKUPs and a couple of EXTRACTs that shouldn't impact the missing fields. Further, when I append | extract pairdelim=" ", kvdelim="=" to my searches, the fields that weren't extracted are now extracted. Aren't those settings the same as auto extraction though?

Shtark · ‎01-27-2014

Every event in this search has an application field. I have application saved as a selected field so based on what I've seen with other searches and fields, it should show as a selected field regardless of how many events it appears in. An example search that returns events like this but doesn't extract the application field is: event=application* serial="660589501000016" Thanks very much for your help.

Shtark · ‎01-08-2014

Sourcetype is syslog. From inputs.conf: [monitor:///var/log/rsyslog/sv121-mw4] disabled = false followTail = 0 host = sv121-mw4 sourcetype = syslog blacklist = blacklist = .(gz|bz2|z|zip)$ I'm pretty sure we haven't done any local defining of the sourcetype definition so it's all as per default.

Shtark · ‎01-08-2014

Splunk is intermittently not automatically extracting fields in the regular foo=bar format. E.g. in this event Jan 9 11:33:37 sv121-mw4 [mw2] INFO auth_id="000767E10050" eventTime="1389227425697" household_id="5c8977b2-7f49-11df-a4df-001321c9413d" partner="partner1" pid="13353" uri="/v2/events" event="applicationOpened" mac="00:07:67:E1:00:50" application="YouTube" request_id="adc211e2-78c5-11e3-b292-3c4a92ebea90" version="2.767.cf97ae4" https="true" billing_partner="partner1" duration="16.88" serial="660589501000016" debugEvent="True" remote_ip="100.64.10.309" all the fields were extracted except 'application'. I don't think it's a limits thing because in limits.conf in the kv stanza we have limit = 250 and maxcols = 512 and there definitely aren't that many fields in the results of the search. I haven't been able to find any pattern as to which fields don't get extracted or when. There isn't a field that never gets extracted but if I run the same search it is always the same field that doesn't get extracted. Any ideas?

Shtark · ‎09-26-2012

Thanks Ayn. One tweak required though. I needed to add a count to the return function, e.g. | return 100000 $search | otherwise it only returns the search field for one result.

Shtark · ‎09-24-2012

I used this method and the subsearch returned ( "_time<=1348231831 AND serial=660500011226000000000023" ) OR ... which doesn't work because the '<=' is in the middle of a string. Eval'ing only the _time comparison as search results in ( "_time<=1348231831" AND serial="660500011226000000000023" ) OR ... which still doesn't work. What I really need is ( _time<=1348231831 AND serial="660500011226000000000023" ) OR ... Any ideas?

Shtark · ‎03-28-2012

I need to apply a lookup only to events before a certain point in time (the data added by the lookup is now included in the events). I haven't seen anything to indicate that this could be done to a whole lookup, only per item in the lookup table (temporal lookup). My only thought on how it might be possible was if a timestamp was added to each item in the lookup, max_offset_secs was set to 0 and min_offset_secs was negative but I don't know if that would be valid. The documentation for those settings only refers to the event being later than the timestamp in the lookup, not earlier. Any ideas/answers gladly welcomed.

Posts	11
Solutions	2
Karma Given	4
Karma Received	5
Member Since	‎08-10-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

DB Connect 3 ignoring column order in SELECT state...

Fields not automatically extracting

Apply a lookup only to events before a certain tim...

Re: OpsGenie for Splunk app on a Search Head Clust...

DB Connect 3 ignoring column order in SELECT state...

Re: Embed reports show older jobs and not most rec...

Re: Embed reports show older jobs and not most rec...

Re: Fields not automatically extracting

Re: Fields not automatically extracting

Re: Fields not automatically extracting

Fields not automatically extracting

Re: To use subsearch result in outersearch for > a...

Re: To use subsearch result in outersearch for > a...

Apply a lookup only to events before a certain tim...