About patilsonali1729

patilsonali1729 · ‎07-27-2021

Hello, Did you figure out the solution for this one. Facing the same issue.

patilsonali1729 · ‎10-14-2020

Were you able to find the solution? Have same question.

patilsonali1729 · ‎03-14-2019

Thanks! Just to clarify the steps- 1. setting -> Searches, reports, alerts 2. Find report name 3. click on edit 4. select Advanced Edit

patilsonali1729 · ‎03-14-2019

I want to add the dispatch.ttl=1800 to few reports which otherwise keep the search artifacts for 2p time. 1. Is there a way to set this value from GUI while creating a report or once the report is created? Or changing the config on deployer and pushing it to all SHs is the only option?

patilsonali1729 · ‎03-07-2019

The alert.results csv file has __mv_field name for every field added in the search. Is there is a way to stop these fields from being added in the file? Or is there a way to remove them using python?

patilsonali1729 · ‎01-14-2019

any update on this?

patilsonali1729 · ‎12-13-2018

index=indexname earliest=-7d@d | eval Time=strftime(_time,"%m/%d/%Y") | bin span=1d Time | stats count by Time | sort -Time

patilsonali1729 · ‎07-27-2018

Hello, Try using below in tensforms.conf. [mytransform] REGEX = \s+(\w+)='(.*?)' FORMAT = $1::$2 MV_ADD = true REPEAT_MATCH = true Use the correct name in props.conf(mytransform) e.g [] REPORT-fieldextr = mytransform

patilsonali1729 · ‎07-20-2018

DO you get any warning/error when you restart Splunk Enterprise instance?? Ideally, once the restart is complete it should give a message like: The Splunk web interface is at https://hostname:8000

patilsonali1729 · ‎07-19-2018

Also, verify if the user running Splunk has read permission to outputs.conf (the user should have access to all the conf files, in short to /opt/splunkforwarder)

patilsonali1729 · ‎07-19-2018

1.Splunk universal forwarder does not have web UI. 2.Where is your outputs.conf file located? Please run ./splunk btool --debug outputs list and paste the response here.

patilsonali1729 · ‎07-19-2018

can you paste the content of your outputs.conf here

Posts	12
Solutions	0
Karma Given	12
Karma Received	1
Member Since	‎08-21-2017

Online Status	Offline
Date Last Visited	‎07-28-2021 12:07 AM

Search head cluster - changing dispatch.ttl for re...

How to get rid of __mv_* fields in alert.results ....

Re: Splunk Add-on for Amazon Web Services - Custom...

Re: SmartStore: How to encrypt data in-flight with...

Re: Search head cluster - changing dispatch.ttl fo...

Search head cluster - changing dispatch.ttl for re...

How to get rid of __mv_* fields in alert.results ....

Re: O365 is configured to send the messagetrace lo...

Re: How to give last 7 days dates to the drop-down...

Re: How to override automatic key-value extraction...

Re: ERROR TcpOutputProc - LightWeightForwarder/Uni...

Re: ERROR TcpOutputProc - LightWeightForwarder/Uni...

Re: ERROR TcpOutputProc - LightWeightForwarder/Uni...

Re: ERROR TcpOutputProc - LightWeightForwarder/Uni...