Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About svercelli
svercelli
Path Finder
Member since:
06-17-2015
06-05-2020
Community Statistics
| Posts | 34 |
| Solutions | 2 |
| Karma Given | 9 |
| Karma Received | 1 |
| Member Since | 06-17-2015 |
Activity Feed
- Karma Re: Auto running of dashboard in splunk app for hardikJsheth. 06-05-2020 12:48 AM
- Karma Re: How to search for events that do not contain a field, where that field has a period in its name? for woodcock. 06-05-2020 12:48 AM
- Karma Re: How to display a dashboard in a PDF? for cmerriman. 06-05-2020 12:48 AM
- Karma Re: Why is my License Usage not matching actual index amount? for gjanders. 06-05-2020 12:48 AM
- Karma Re: Why does Splunk indicate: "Your Splunk license expired or you have exceeded your license limit too many times. " for ddrillic. 06-05-2020 12:48 AM
- Karma Re: Eval strptime not creating new field for sundareshr. 06-05-2020 12:48 AM
- Karma Re: Regex Pattern for skoelpin. 06-05-2020 12:48 AM
- Got Karma for Regex Pattern. 06-05-2020 12:48 AM
- Karma Re: How to search within a timestamp that isn't _time? for bwooden. 06-05-2020 12:47 AM
- Karma Re: Reload separate element within HTML dashboard for nfilippi_splunk. 06-05-2020 12:47 AM
- Posted Error in 'IndexScopedSearch': The search failed. More than 1000000 events found at time on Splunk Search. 08-02-2017 03:18 AM
- Tagged Error in 'IndexScopedSearch': The search failed. More than 1000000 events found at time on Splunk Search. 08-02-2017 03:18 AM
- Tagged Error in 'IndexScopedSearch': The search failed. More than 1000000 events found at time on Splunk Search. 08-02-2017 03:18 AM
- Tagged Error in 'IndexScopedSearch': The search failed. More than 1000000 events found at time on Splunk Search. 08-02-2017 03:18 AM
- Posted Re: RegEx Square Brackets not supported? on Splunk Search. 05-02-2017 12:05 PM
- Posted RegEx Square Brackets not supported? on Splunk Search. 05-02-2017 09:16 AM
- Tagged RegEx Square Brackets not supported? on Splunk Search. 05-02-2017 09:16 AM
- Tagged RegEx Square Brackets not supported? on Splunk Search. 05-02-2017 09:16 AM
- Posted Re: Regex Pattern on Splunk Search. 04-30-2017 10:57 PM
- Posted Regex Pattern on Splunk Search. 04-30-2017 10:42 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-02-2017
03:18 AM
So I seem to have an issue similar to the one in this question here and have accidentally indexed over 1,000,000 events on the same second. I want to delete them but I can't because the search won't run because it will produce the same error as seen in the title. Is there any way to solve this without deleting the whole index?
... View more
05-02-2017
09:16 AM
Using rex and it seems as if Splunk sees the open square bracket as the beginning of a subsearch. Have I written this wrong or is there a workaround
| rex \w+\.\w+\.\w+[a-z]\_(?<Facility>[[:alnum:]]+)
... View more
04-30-2017
10:42 PM
1 Karma
I'm fairly new to Regex and having a difficult time coming up with a pattern for my query. I need to match everything after the second period in all of these values but can't figure out how
TMS_KEP.Male_RTU2.Male_PRM1_GL_OUT
TMS_KEP.Male_RTU2.Male_PRM1_PS_IN
TMS_KEP.Female_RTU2.Female_WC8_RL_OUT
TMS_KEP.Male_RTU1.Male_WC3_FS_OUT
TMS_KEP.Male_RTU1.Male_WC5_FS_OUT
There are some slight variations in this but essentially I need a pattern that takes everything after the second period.
Any help is greatly appreciated.
... View more
02-05-2017
09:55 PM
I'm trying to select a specific custom time range within a search after selecting a larger time range with the time picker and narrowing down the results using eventstats. What would be the way to do this exactly? My search looks like this
index=bhs sourcetype=BHS_LBT_BAG |addinfo| eventstats earliest(_time) as FirstAppearance by BAGTAGID | where FirstAppearance=_time
In this case the second time range I want to narrow it down to is the earliest being 5AM the previous day up to 5AM the current day.
... View more
08-16-2016
02:52 AM
which java
/usr/bin/java
whereis java
java: /usr/bin/java /etc/java /usr/lib/java /usr/share/java /usr/share/man/man1/java.1
[root@DC2VTS01 java]# alternatives --config java
There are 2 programs which provide 'java'.
Selection Command
-----------------------------------------------
1 /usr/java/jre1.8.0_101/bin/java
*+ 2 /usr/java/jdk1.8.0_102/jre/bin/java
... View more
08-16-2016
01:58 AM
The users were different, so i used chown to change the java ownership to the splunk user. checked and it shows that the ownership is now with splunk. It hasn't fixed the issue though, still getting the same error.
... View more
08-15-2016
11:35 PM
Assuming Splunk would have the same privileges as root in this case then yes all permissions are there.
... View more
08-15-2016
11:03 PM
I did not. Ive been operating under the assumption that since splunk was installed as root, I wouldn't need to modify the rights. Like I said, I'm fairly new to Linux. Mind walking me through?
... View more
08-15-2016
10:33 PM
This is what I'm doing. This error I'm getting is when i'm trying to input the JRE Installation path in the setup.
... View more
08-15-2016
10:13 PM
It is, echo $JAVA_HOME reads /usr/java/jdk1.8.0_102
... View more
08-15-2016
10:02 PM
I would suggest you take a look at the Distributed Management Console in the settings menu of the Web Interface. It should give you the information you need as well as more information regarding license usage in your instances.
This way you don't need to rely on a report that may not be giving you exactly what you are looking for.
As far as expected usage I recommend this great website if you want to get estimates. https://splunk-sizing.appspot.com/
... View more
08-15-2016
09:42 PM
I've just installed Splunk on a new Linux Redhat instance, I'm not particularly familiar with Linux, but I believe everything to be working fine. The one thing that has become problematic is with Splunk DB Connect.
While setting it up, I've put in the path for Java I got with pwd just to make sure /usr/java/jdk1.8.0_102/
I've tried putting this as /usr/java/jdk1.8.0_102/jre as well, but I keep getting an error saying
JRE Status: OSError: [Errno 2] No such file or directory
Anyone know where I should start looking for the problem?
... View more
07-27-2016
09:13 PM
take a look at the answer they gave here https://answers.splunk.com/answers/221370/splunk6-group-visualization-elements-horizontally.html
... View more
07-26-2016
11:41 PM
Unfortunately the documentation seems to support that only Single value visualizations will group horizontally.
There was another way to do it in an answer on this question with what seems incorporating a script but it seems overly complex for what you would think would be such a simple task
... View more
07-26-2016
10:40 PM
I'm trying to create a calculation based on subtracting 2 dates so I'm trying to create a new eval field that converts the date into epoch time.
eval testing= strptime(PublicScheduledDateTime, "%d/%m/%Y %H/%M")
is what i have for the statement, and the time itself is in the format
07/05/2016 23:50
However when I run the search I don't get any errors and I know the fields have values yet no evaluated field called testing is created.
... View more
07-25-2016
10:10 PM
Additionally, in the format tab in the single value visualization there is a colors option where you can select ranges, its not set for single number values but if you add multiple ranges it should be good. (I post this as a comment not an answer because I don't have enough karma to post more replies today)
... View more
07-25-2016
09:14 PM
Would you be displaying it as a single value visualization or something else?
This is a copy paste from another answer but
Option 1: range map in a table
See the Splunk dashboard example app https://splunkbase.splunk.com/app/1603/ for some examples of how to do this. Specifically, you will want to check out “Table Icon Set (Rangemap)”.
Option 2: use custom CSS
... View more
07-25-2016
05:34 AM
You are all gonna be sooo mad but there was a typo and it turns out that was the error. the first FlightNumber was misspelled without the T.
... View more
07-25-2016
01:59 AM
Been trying to create a new field that adds a leading zero to a field value if that value is lower than 100. I've tried what i would usually but i'm sure I'm missing something obvious.
eval FLNO=if(FlighNumber<100,"0".FlightNumber,FlightNumber)
... View more
06-28-2016
01:55 AM
So what I have are two different types of events. However, both have an key field that connect the two events together. (One event type has a keynum field that has its unique ID number, and the other has a relatedkeynum field that connects these events to the first. Is there a way to run a search on the first event types and bring up only events from the second type based on their matching keynum's?
... View more
04-11-2016
10:10 AM
In my new data set, the time comes in the format 1652 as it relates to 4:52pm. However, when it is before 1AM it comes in simply as 52 representing 12:52am. What would a strptime look like for this or is it even possible?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma given to
