About rchudzinski

rchudzinski · ‎03-17-2020

I am doing a fresh install of the Slack notification add-on to our on-prem enterprise Splunk. It requires Slack Webhook Alert. Are there substantial differences between Slack Webhook Alert and Slack Webhook Alert v3? Should I simply install v3 because it is newer and I am not doing an update/install? tia, ray

rchudzinski · ‎11-07-2018

The problem still exists in 7.2. I encountered it with the recent upgrade . The cause is as loatswil describes. The searchheads don't see the indexes on the index cluster when populating the UI. The workaround given by support is to create 'dummie' indexes with the same names as the missing ones on the searchhead. This will populate the list. Not very elegant but that is a workaround until they patch it.

rchudzinski · ‎07-21-2016

Hi, This is a very nice dashboard. One comment, I notice that the 'Host Usage - Current Day - Top 20' panels are displaying the indexer name as the 'host' field. I suspect you want to use the 'h' field which is the name of the forwarding agent. At least that is where I find the most value. So the search text would become "index=_internal source=license_usage.log type=Usage pool= | stats sum(b) as b by h | eval "Bytes"=round(b) | rename h as Host | fields Host, "Bytes" | sort 20 - Bytes" Warm Regards, ray

Posts	3
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎07-21-2016

Online Status	Offline
Date Last Visited	‎11-03-2023 12:03 PM

difference between Slack Webhook versions

host field in 'Host Usage - Current Day - Top 20' ...

difference between Slack Webhook versions

Re: Why are only some indexes listed in the availa...

host field in 'Host Usage - Current Day - Top 20' ...