Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About pfernandez133
pfernandez133
Explorer
Member since:
07-12-2013
04-10-2021
Community Statistics
| Posts | 12 |
| Solutions | 1 |
| Karma Given | 3 |
| Karma Received | 4 |
| Member Since | 07-12-2013 |
Activity Feed
- Karma Re: How to disable scheduled searches via command line interface? for Ledion_Bitincka. 06-05-2020 12:47 AM
- Got Karma for Can Splunk be configured to use different PagerDuty escalation policies based on the alert?. 06-05-2020 12:47 AM
- Got Karma for Can Splunk be configured to use different PagerDuty escalation policies based on the alert?. 06-05-2020 12:47 AM
- Got Karma for Re: Can Splunk be configured to use different PagerDuty escalation policies based on the alert?. 06-05-2020 12:47 AM
- Karma Re: Unauthorized Forwarders for gkanapathy. 06-05-2020 12:46 AM
- Karma Re: Unauthorized Forwarders for gkanapathy. 06-05-2020 12:46 AM
- Got Karma for Unauthorized Forwarders. 06-05-2020 12:46 AM
- Posted Re: Can Splunk be configured to use different PagerDuty escalation policies based on the alert? on All Apps and Add-ons. 01-13-2015 06:04 PM
- Posted Can Splunk be configured to use different PagerDuty escalation policies based on the alert? on All Apps and Add-ons. 01-13-2015 05:16 PM
- Tagged Can Splunk be configured to use different PagerDuty escalation policies based on the alert? on All Apps and Add-ons. 01-13-2015 05:16 PM
- Posted Re: How to disable scheduled searches via command line interface? on Reporting. 10-22-2014 01:50 PM
- Posted How to disable scheduled searches via command line interface? on Reporting. 10-21-2014 06:28 PM
- Tagged How to disable scheduled searches via command line interface? on Reporting. 10-21-2014 06:28 PM
- Tagged How to disable scheduled searches via command line interface? on Reporting. 10-21-2014 06:28 PM
- Tagged How to disable scheduled searches via command line interface? on Reporting. 10-21-2014 06:28 PM
- Posted Re: splunk db connect - dbquery not accessible on Splunk Search. 08-05-2014 01:56 PM
- Posted Re: Use a Function without Running a Search on Splunk Search. 06-18-2014 02:05 PM
- Posted Re: Use a Function without Running a Search on Splunk Search. 06-18-2014 02:05 PM
- Posted Use a Function without Running a Search on Splunk Search. 06-18-2014 11:42 AM
- Tagged Use a Function without Running a Search on Splunk Search. 06-18-2014 11:42 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 2 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
01-13-2015
06:04 PM
1 Karma
Well, it's not the most elegant solution but...I created an additional Splunk service in PagerDuty, called Splunk-X. Then, on the Splunk server, I copied ~splunk/scripts/pagerduty.py to ~splunk/scripts/pagerduty-x.py. I then changed the following line in def main():
pagerduty_api_key = get_pagerduty_api_key(config_file)
to the following line:
pagerduty_api_key = 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
Where xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx is the service API from Splunk-X in PagerDuty. Then, I followed PagerDuty's steps on creating an alert. Namely, you create an alert, then set it to run a script, and that script is pagerduty-x.py.
Tested. Works. Yay!
... View more
01-13-2015
05:16 PM
2 Karma
Hey everyone, is there's a way to have Splunk assign alerts to different PagerDuty escalation policies based on the triggered alert?
We have different development teams, and I'd like to set it up so that if product X has an error, it alerts to the Splunk-X PagerDuty group, product Y, Splunk-Y PagerDuty group, etc.
I was thinking I could simply set up multiple PagerDuty Splunk services, but I can't think of how to configure Splunk that alert X should go to PagerDuty Splunk service "Splunk-X", while alert Y should go to PagerDuty Splunk service "Splunk-Y".
Thanks in advance!
... View more
10-22-2014
01:50 PM
Thanks for the suggestion!
I had to set "is_scheduled=true" to get it to flip from 0 to 1, but the search's status is still set to disabled under Manager > Searches and Reports. How can I switch that disabled to enabled?
Thx again!
... View more
10-21-2014
06:28 PM
Hey guys, I'm looking for a way to disable multiple scheduled searches via command line.
Once a week, we switch one environment on and the other off, so we want to disable searches/alerts for the environment we've disabled. As you may have guessed, it's quite a few searches/alerts that need to be disabled. A command-line method would allow me to script it.
Thanks in advance!
... View more
08-05-2014
01:56 PM
Not sure that the original poster is still experiencing this problem, but for the benefit of other readers who might be, make sure that the role to which you are attempting to grant DB Connect access also has the dbx_capable capability. That fixed it for me.
... View more
06-18-2014
11:42 AM
Hey guys, is it possible to run an eval function in the search bar without piping a search to it?
In an attempt to test the urldecode function, I'm trying to run the following on the search bar:
| eval x=urldecode("http%3A%2F%2Fwww.blah.com%2Fsomething%2Fsomething-something") | search x!=""
I'm just trying to see what that urldecode function will do with that string, but, I would like to be able to do something like this with other functions in the future.
Any thoughts?
Thanks!
... View more
09-27-2013
07:15 PM
Thank you, sir!
So, if I don't have anything different in my $SPLUNK/etc/system/local/inputs.conf, the [splunktcp] stanza from $SPLUNK/etc/system/default/inputs.conf is in effect?
[splunktcp]
route=has_key:_replicationBucketUUID:replicationQueue;has_key:_dstrx:typingQueue;has_key:_linebreaker:indexQueue;absent_key:_linebreaker:parsingQueue
acceptFrom=*
connection_host=ip
Which means anyone can send my Indexer anything?
Thx!
... View more
09-27-2013
06:47 PM
1 Karma
Hey guys, fairly new Splunk admin here. I've a question about unauthorized forwarders.
Is there anything to prevent my indexer from indexing something from a "rogue forwarder"? That is, if someone set up their laptop to forward huge logs to my indexer, will my indexer slurp up those logs? Is there anything built in to prevent this?
This question came up because I'm troubleshooting an issue where Splunk doesn't seem to be indexing events from an external host sending events on port 8089. tcpdump confirms that data is being passed from that host to our indexer, but nothing seems to show up.
Thanks in advance!
... View more
08-28-2013
06:51 PM
Hey guys, one of my users encountered an issue where he is unable to delete his own saved search. Even though he is listed as the owner of the search, he is unable to delete or move the search. I read somewhere that if a saved search is shared with others, its owner cannot delete the search. Is that right?
Thanks in advance!
... View more
- Tags:
- delete
- savedsearches
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-10-2021
02:27 AM
|
