About myu_splunk

myu_splunk · ‎03-12-2018

Hi Kamal, A JIRA has been opened with the engineering team for this update. However, we currently do not have an expected timeline for completing this work. Thanks and apologies for any inconvenience this may have!

myu_splunk · ‎03-12-2018

You need JRE version 8 to use DBConnect 3.1.2. I've updated the documentation. Thanks!

myu_splunk · ‎01-22-2018

Hi Terry, Try preprocessing your logs an AWS Lambda function to decompress and decode the data before sending it to Splunk. See https://www.splunk.com/blog/2016/11/29/announcing-new-aws-lambda-blueprints-for-splunk.html for information on new lambda blueprints that were shipped with the Kinesis Firehose integration. The CloudWatch logs to Splunk blueprint can be found here: https://console.aws.amazon.com/lambda/home?#/create/configure-triggers?bp=splunk-cloudwatch-logs-processor

myu_splunk · ‎12-11-2017

You need to use a lambda transform when 1) your data is in a format that is not supported by HEC (ex: VPC flow logs), or 2) if you want to use the /events HEC endpoint for doing things like index/source/sourcetype/timestamp overriding, or 3) if you want to transform your data in any custom way before getting indexed into your Splunk deployment.

myu_splunk · ‎12-11-2017

When should I use transforms via Lambda with Kinesis Firehose when sending in application data through Kinesis?

myu_splunk · ‎05-03-2017

Hi, We currently do not have a way to change the default keyboard shortcuts. Some of the keyboard shortcuts are the same as the default mac shortcuts. You can see exactly what keyboard shortcuts are in Splunk here: http://docs.splunk.com/Documentation/Splunk/6.5.0/Search/Parsingsearches#Search_bar_shortcuts

myu_splunk · ‎05-03-2017

Hi jzapantis, We've added some more information concerning XPath in the geospatial documentation here: http://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/Configuregeospatiallookups#Xpath_and_feature__id__element_example In the example, it won't work because the KML path is different from the default feature_id_element.

myu_splunk · ‎05-03-2017

Hi Srinathd, You need to also set permissions for the Lookup definition. You can do this by going to Settings > Lookups > Lookup definitions. Remember that your permissions for lookup table files must be at the same level or higher than those of the lookup definitions that use those files.

myu_splunk · ‎03-08-2017

Hi MonkeyK, if you have a lookup table file that is 100MB or larger, I'd consider that a large lookup table file. As far as the CSV vs KV store lookup question goes, KV Store collections live on the search head and are not passed down to indexers. CSV lookups are replicated to the indexers so if your lookup table changes frequently, this could lead to performance problems.

Posts	9
Solutions	1
Karma Given	5
Karma Received	8
Member Since	‎12-06-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Splunk Add-on for Amazon Kinesis Firehose: When to...

Re: Is there any documentation stating the compati...

Re: Is there any documentation stating the compati...

Re: Kinesis Firehose - InvalidEncodingException - ...

Re: Splunk Add-on for Amazon Kinesis Firehose: Whe...

Splunk Add-on for Amazon Kinesis Firehose: When to...

Re: Option for default Mac (MacOS, OS X) home/end/...

Re: Cannot find any featureID in Geospatial Visual...

Re: lookup table does not exist

Re: CSV vs KV store lookup. How large is large?