Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mdzmuran
mdzmuran
Observer
Member since:
02-09-2017
12-19-2021
Community Statistics
| Posts | 16 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 02-09-2017 |
Activity Feed
- Posted Ignore throttle value in specific cases on Alerting. 08-13-2021 12:59 AM
- Tagged Ignore throttle value in specific cases on Alerting. 08-13-2021 12:59 AM
- Posted Re: Variable reference in To: field of an email alert. on Splunk Search. 07-19-2021 10:33 PM
- Posted Variable reference in To: field of an email alert. on Splunk Search. 07-19-2021 01:19 PM
- Posted Re: Several email distribution lists on alert on Splunk Search. 07-16-2021 05:23 AM
- Posted Several email distribution lists on alert on Splunk Search. 07-16-2021 12:09 AM
- Tagged GIT repository for Splunk configurations on Splunk Enterprise. 09-03-2020 04:16 AM
- Posted GIT repository for Splunk configurations on Splunk Enterprise. 09-03-2020 04:15 AM
- Posted Re: Monitor and generate alert if no changes are made to a monitored file on Alerting. 03-13-2019 12:59 AM
- Posted Monitor and generate alert if no changes are made to a monitored file on Alerting. 03-13-2019 12:38 AM
- Tagged Monitor and generate alert if no changes are made to a monitored file on Alerting. 03-13-2019 12:38 AM
- Tagged Monitor and generate alert if no changes are made to a monitored file on Alerting. 03-13-2019 12:38 AM
- Tagged Monitor and generate alert if no changes are made to a monitored file on Alerting. 03-13-2019 12:38 AM
- Posted Re: Access to directories on Deployment Architecture. 02-13-2019 04:51 AM
- Posted Access to directories on Deployment Architecture. 02-13-2019 03:33 AM
- Tagged Access to directories on Deployment Architecture. 02-13-2019 03:33 AM
- Posted Re: Filtering fields in log before forward to indexing on Getting Data In. 06-19-2017 04:54 AM
- Posted Re: How to extract string from a position until the end of line? on Splunk Search. 03-09-2017 03:06 AM
- Posted How to extract string from a position until the end of line? on Splunk Search. 03-08-2017 08:17 AM
- Tagged How to extract string from a position until the end of line? on Splunk Search. 03-08-2017 08:17 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-13-2021
12:59 AM
Hi Team. I have an alert with throttle value defined, for example 4 hours. If the alert is generated at 4 am, subsequent alerts are suppressed until 8 am. However, I need to generate the alert at 6 am if the alert condition is met no matter if we are in the throttle period or not. The reason is that working hour start at 6 am, we have a hotline active and we need to make sure that everything is up and running. The hotline does not know about the alert generated at 4 am.
... View more
- Tags:
- throttle
Labels
- Labels:
-
alert condition
-
throttling
07-19-2021
10:33 PM
HIi venkatasri. The alerts are triggered, I can see them in Triggered alerts. If I replace $result.distribution_list$ with regular email address, the emails are sent. The queries suggested do not return any data. It may be due to access permissions, I asked administrators to run them. One more info, it may be important. The distribution_list variable is not defined in the search query. It is defined in the Calculated Fields setting for this particular sourcetype. I can see it, however, in the search results if I run the alert query manually. Michal
... View more
07-19-2021
01:19 PM
Hi Splunk Team. Can I use variable reference in To: field of an email alert? I have a distribution_list variable associated with my sourcetype and it is set to correct email address depending on date and time. U put $result.distribution_list$ in the To: field, but it does not send email. Thanks Michal
... View more
Labels
- Labels:
-
other
07-16-2021
05:23 AM
Later on I may have found one option. I will work on it next week. I could set a new variable in the query with values "distribution_list_one", "distribution_list_two". Based on current date and time the variable should be set to one of these values. Question: Can I put this variable to the To: field in the mail recipient section of the alert.
... View more
07-16-2021
12:09 AM
Hi Splunk Community. I have an alert, which runs a query regularly, for example hourly 24*7*365. If the alert is triggered, an email is sent to a distrubution list. I need two distinct distrbution lists on this alert. One distribution list should receive the email during working hours, Monday 7am to 6pm. The other distribution list should receive the email outside working hours. Is there a simple way to do it with just one alert, or is it better to create two identical alerts? Thanks Michal
... View more
Labels
- Labels:
-
other
09-03-2020
04:15 AM
Can Splunk be intergrated with GIT repository? I would like to use simple UI Splunk tools to define indexes, data inputs, etc using Splunk UI and store these configurations in a GIT repository. The reason is that GIT repository is a standard for NN, all configurations should be stored there and distributed to various Splunk servers within the company.
... View more
- Tags:
- configuration-files
Labels
- Labels:
-
configuration
03-13-2019
12:59 AM
The monitored files are on a UNIX machine. The directories are accessible from a Windows machine with Splunk Forwarder (UNC is used in Spunk directory definition). Splunk Forwarder monitores these files, it is working now and communicating with Splunk Free (at this moment). So monitoring files works, I can check for errors, generate alerts on errors, etc. And I want to check an event "nothing happens to the files".
... View more
03-13-2019
12:38 AM
A monitored file changes very frequently. If no new change occurs during a specified interval, it means that the process which makes changes to the log file is down. This can be used to monitor if the process is alive. How can I monitor and generate alert on an event "no changes made to monitored file during nnn minutes"?
... View more
02-13-2019
04:51 AM
UF was the first option, but the old AIX version is not supported by Splunk. Thanks for the ideas, however.
... View more
02-13-2019
03:33 AM
I have a directory accessible through UNC path. As a normal domain user, I have read access to that directory and I can see it in File Explorer. But if I put the UNC path in the File or Directory field form new data input, it accepts the input, but it shows that there are no files in the directory.
My idea is that because the local system user running the Splunk server does not have access to that directory, it cannot read the contents, but am not sure.
Any idea how to fix it?
Thanks
Michal Dzmuran
... View more
- Tags:
- splunk-enterprise
06-19-2017
04:54 AM
Hi. Are these features also available in Splunk Light (version 6.5.1)?
... View more
03-09-2017
03:06 AM
Thanks. It works.
... View more
03-08-2017
08:17 AM
I have lines like this:
[2011/02/11@10:33:13.978+0100] P-18679 T-0 I Usr 2: (49) SYSTEM ERROR: Memory violation.
How can I extract the string beginning with "Memory viol" till the end of line? The string is one line only, but may be much longer with any characters.
... View more
03-03-2017
07:09 AM
I have date and time in this format,
[2010/01/14@08:43:17.561+0100]
How to read it correctly into Splunk?
... View more
02-10-2017
04:18 AM
Thanks for the answer. This brings another question. How can I direct Splunk to store any object in a specific directory. The Splunk UI has 3 options only, Privat, AppContext and Global, but we have at least seven options in the above list of directories.
... View more
02-09-2017
06:23 AM
Suppose I have 3 macros of the same name, one defined for user admin, other for application MyApp and the third one as Global. I am logged in as admin, in application MyApp and referencing the macro in the query. Which macro Splunk uses? What are the preferences?
The same question is in place for other objects like reports, dashboards, data models,
Question2: Is there a specific syntax to direct the search to use other instance?
mdz
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-19-2021
05:59 AM
|
