Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About splunkjas1
splunkjas1
Path Finder
Member since:
01-12-2018
07-26-2023
Community Statistics
| Posts | 14 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 1 |
| Member Since | 01-12-2018 |
Activity Feed
- Posted Re: How to troubleshoot Splunk search performance slow on Splunk Search. 07-26-2023 09:25 AM
- Posted Re: Issue with SPL query on Splunk Search. 06-28-2023 09:47 AM
- Posted Re: using MV expand to extract a data grouped by itself on Splunk Search. 04-27-2023 05:44 PM
- Posted Re: using MV expand to extract a data grouped by itself on Splunk Search. 04-27-2023 05:39 PM
- Got Karma for Re: Can you help me filter out wineventlog eventcode 4656 account names in transforms.conf?. 06-05-2020 12:49 AM
- Karma Re: Why is my sourcetype configuration for JSON events with INDEXED_EXTRACTIONS making each extracted field multivalue with duplicate values? for asieira. 06-05-2020 12:47 AM
- Posted Re: In Splunk Cloud, once you have indexed extractions, you're stuck.. forever on Getting Data In. 10-29-2019 12:38 PM
- Posted In Splunk Cloud, once you have indexed extractions, you're stuck.. forever on Getting Data In. 10-29-2019 11:25 AM
- Tagged In Splunk Cloud, once you have indexed extractions, you're stuck.. forever on Getting Data In. 10-29-2019 11:25 AM
- Tagged In Splunk Cloud, once you have indexed extractions, you're stuck.. forever on Getting Data In. 10-29-2019 11:25 AM
- Tagged In Splunk Cloud, once you have indexed extractions, you're stuck.. forever on Getting Data In. 10-29-2019 11:25 AM
- Posted Re: per_sourcetype_thruput logging stopped on Getting Data In. 08-30-2019 12:17 PM
- Posted per_sourcetype_thruput logging stopped on Getting Data In. 08-30-2019 07:19 AM
- Tagged per_sourcetype_thruput logging stopped on Getting Data In. 08-30-2019 07:19 AM
- Tagged per_sourcetype_thruput logging stopped on Getting Data In. 08-30-2019 07:19 AM
- Tagged per_sourcetype_thruput logging stopped on Getting Data In. 08-30-2019 07:19 AM
- Posted Re: Can you help me filter out wineventlog eventcode 4656 account names in transforms.conf? on Getting Data In. 09-25-2018 11:30 AM
- Posted Re: Universal Forwarder resending event log data on Getting Data In. 01-12-2018 09:28 AM
- Posted Re: Universal Forwarder resending event log data on Getting Data In. 01-12-2018 09:24 AM
- Posted Re: Universal Forwarder resending event log data on Getting Data In. 01-12-2018 09:08 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
07-26-2023
09:25 AM
We're gonna need more info than that. Can you share a search that's slow?
... View more
06-28-2023
09:47 AM
Woah, that data is wonky. I'd probably do something like this: | makeresults | eval _raw="message: Dataframe row : {\"_c0\":{\"0\":\"{\",\"1\":\" \\\"compaction_table\\\": [\",\"2\":\" \\\"md_proc_control_v2\\\"\",\"3\":\" \\\"md_source_control\\\"\",\"4\":\" ]\",\"5\":\" \\\"Timestamp\\\": \\\"2023\/06\/26 12:05:43\\\"\",\"6\":\" \\\"compaction_status\\\": \\\"Successful\\\"\",\"7\":\"}\"}}" | rex field=_raw mode=sed "s/\s|{|}|\"|\\\//g" | eval parts=split(_raw, ",") | fields parts That gives me something a bit more sane to deal with: I could deal with that then. Just trying to help you get there. 🙂
... View more
04-27-2023
05:44 PM
I can help you finish this. you should reach out to me.
... View more
04-27-2023
05:39 PM
in my opinion, you're doing wayyy too much work. let splunk do the work. i love how i see people forcing all these things when splunk has amazing abilities if you'll just let it. i can help you.
... View more
10-29-2019
12:38 PM
After much trial and error, the only thing that seems to work is setting INDEXED_EXTRACTIONS to a space.
... View more
10-29-2019
11:25 AM
Has anyone ever been able to select none in the indexed extractions dropdown once you already have something else selected? I have a sourcetype with csv selected and every time I choose none, it resets to csv on save. Oh, and you can't delete sourcetypes and start over.
... View more
08-30-2019
07:19 AM
For several UF's, I've noticed that the metrics.log 'per_sourcetype_thruput' entries have stopped completely, for days now. I have verified that the UF is sending events and that metrics.log is being written to. Has anyone else experienced this?
... View more
09-25-2018
11:30 AM
1 Karma
This worked for me:
(?s)(EventCode=4656.*Account Name:[^\$]+\$)
... View more
01-12-2018
09:28 AM
Okay, thank you.
... View more
01-12-2018
09:24 AM
I asked the folks who performed the upgrade and they told me they do uninstall the 6.4.4 version before installing 6.4.9. So that's probably what caused the logs to be resent, would you agree?
... View more
01-12-2018
09:08 AM
The forwarders are resending event logs. We upgraded them from 6.4.4 to 6.4.9. Would the upgrade cause logs to be resent?
... View more
01-12-2018
08:12 AM
If the IP address for a host changes or if it gets a new GUID, would the forwarder resend the entire Windows event log?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-26-2023
12:52 PM
|
