About patrickprodoehl

patrickprodoehl · ‎01-13-2021

Thanks for sharing. Why is the last | fillnull needed though? I removed is and the _time bins are still filled with 0 values and interpreted correctly in the dashboard.

patrickprodoehl · ‎04-02-2020

amendment: the first code sections contains a closing form tag, which is missing the closing / in </form>. Thanks for sharing the answer! Works like a charm for me!

patrickprodoehl · ‎03-22-2020

awesome! works for me with two adaptions: props.conf [source::/data/reports/*/*/*.log] TRANSFORMS-hostExtract = hostExtract transforms.conf [hostExtract] SOURCE_KEY = MetaData:Source REGEX = (\w+)\/(\w+)\/\w+.log$ FORMAT = host::$1_$2 DEST_KEY = MetaData:Host

patrickprodoehl · ‎03-19-2020

Dear community, I am lost in creating a regexp that will ease up my data input creation. So I do have a file share being monitored by splunk with the following structure: /data/reports/ApplicationA/LocationA/very_interesting.log /data/reports/ApplicationA/LocationB/very_interesting.log /data/reports/ApplicationB/LocationB/very_interesting.log To scale at ease, I would like to define a single data input for ApplicationA which extracts the host using 2 parameters of the path. i.e. ApplicationA_LocationA ApplicationA_LocationB Do you have any idea, how I could transform the / between ApplicationA and the location subfolders to a _ and after do the pattern matching to extract the host? Thanks in advance!

patrickprodoehl · ‎05-27-2019

I have an similar issue, as my payload (i.e. imported content) is misleading: Example: a service class for computer displays was created as monitor. As most of my users use the german locale to view the dashboard, monitor is translated to "Ueberwachung" which is obviously correct, but misleading in my app and dashboard. Especially, because only some words are translated, not all. Printer is translated, "Multi Functional Device" is not. Any advise is appreciated!

patrickprodoehl · ‎03-05-2019

I have created an searchbnf.conf for this app, but couldn't find it on github or related. Modified: default/searchbnf.conf metadata/default.meta Let me know, where to provide the content as I cannot yet add attachments nor links here.

patrickprodoehl · ‎11-14-2018

Changing this file doesn't show up when I try with http://localhost:8000/robots.txt.

patrickprodoehl · ‎10-24-2018

I have a similar issue: With a dedicated Webservice Loadbalancing and SSL Encryption Infrastructure I need to put an empty .html probe to a specific folder (i.e. /lbprobe/lbtest.html). By adding to the local web.conf "testing" section, I managed to provide the file for a moment: testing_endpoint = /lbprobe testing_dir = share/splunk/lbprobe Putting an empty file with the name "lbtest.html" to folder ./share/splunk/lbprobe/lbtest.html will make the folder and the file accessible with a browser client, as the browser will do the 303-redirection to a subfolder (i.e. /en-US/ or /de-DE/). Trying to access via telnet or the proxied URL will return in a failure due to the 303 (moved temporary) failure.

Posts	8
Solutions	0
Karma Given	10
Karma Received	0
Member Since	‎09-10-2018

Online Status	Offline
Date Last Visited	‎01-13-2021 02:00 PM

Using multiple parameters for regexp host extracti...

Where to update the SA-readability app?

Re: How to produce empty time buckets

Re: Want to add a custom slider input

Re: Using multiple parameters for regexp host extr...

Using multiple parameters for regexp host extracti...

Re: disable localization in app

Where to update the SA-readability app?

Re: Where can I place a robots.txt on Splunk?

Re: After editing the web.conf to add root_endpoin...