Learning, learning, learning . . . Our Splunk "expert" is gone, and the non-programmer gets to learn the task! How do you spell SPLUNK?
The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Michael Wilde commented on Michael Wilde's video
Sure... When you do group mapping, map them to groups that don't have the domain admins in them. I have a separate OU=Groups that has "Splunk Users, Splunk Admins, Splunk Power Users" as group names, and specific users…
Mike Hartford commented on Michael Wilde's video
I want to give LDAP access to my splunk servcie but I don't want the LDAP users to have admin capabilitys in Splunk. Can I keep the domain admins out of Splunk if I have LDAP authentication???
Mike Hartford left a comment for Jonathan Hawes
Helow Jonathan,
Glad to have another Splunker. I've been useing Splunk for 2 years and am hooked. I leared how to spell splunk and | transaction too. you'll learn that one soon.
Go over to Splunk…
Mike Hartford commented on Mike Hartford's blog post 'tees for the holy day'
Holy Batskins Ninja, zzzzzwap zgruppp kapow a hidden stash, how great is that!!!!
The team that found them must have special bat senses and highly tooned Splunking skills
I like to wear Extra Lovable…
Marcelo Finkielsztein's Discussions
Encountered the following error while trying to update: In handler 'savedsearch': Argument "action.summary_index." is not supported by this handler
1 Reply
Hi,While trying to save a very simple search I ran into this:Encountered the following error while trying to update: In handler 'savedsearch': Argument "action.summary_index." is not supported by…Continue
Started this discussion. Last reply by Marcelo Finkielsztein Apr 8, 2010.
asking for OS recommendation: install on Unix or Windows?
4 Replies
Hi,I am going to use Splunk to monitor a group of log files; they are currently stored in Windows servers.Disregarding that the logging system is in Windows, I can choose between these environments…Continue
Started this discussion. Last reply by Marcelo Finkielsztein Mar 24, 2010.
Marcelo Finkielsztein's Page
Gifts Received
Marcelo Finkielsztein has not received any gifts yet
Latest Activity
Marcelo Finkielsztein updated their profile photo
Marcelo Finkielsztein replied to Marcelo Finkielsztein's discussion 'Encountered the following error while trying to update: In handler 'savedsearch': Argument "action.summary_index." is not supported by this handler'
Amend:
I installed Splunk free version 4.0.9 build 74233 on another server and got the same error.
Any ideas !?
Encountered the following error while trying to update: In handler 'savedsearch': Argument "action.summary_index." is not supported by this handler
Hi,While trying to save a very simple search I ran into this:Encountered the following error while trying to update: In handler 'savedsearch': Argument "action.summary_index." is not supported by this handler.I recently upgraded to free version 4.1 (Windows 64bit), so i suspect this is an Issue of this version.I get the same error for any search i try to save. Even one like this...[search2]search = * | head 10I tried adding a line likeaction.summary_index = 0but that did not solve it.Any help…See More
Discussion posted by Marcelo Finkielsztein
Marcelo Finkielsztein replied to Patrick Swackhammer's discussion 'Regex For Identifying IP Addresses (To Extract Field)'
what about this?
index=* frominternet | rex field=_raw ".*?\s(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}).*\s(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}).*" | fields + IP1, IP2 | head 3
note that this search filters only lines that contain…
Marcelo Finkielsztein replied to Patrick Swackhammer's discussion 'Regex For Identifying IP Addresses (To Extract Field)'
just a humble note.
I *ALWAYS* write a comment beside a regex, translating it step by step into "plain human readable".
The more verbose the documentation, the better.
I find regexes very risky; this comes together with their great power,…
Marcelo Finkielsztein replied to Marcelo Finkielsztein's discussion 'asking for OS recommendation: install on Unix or Windows?'
I am staying on Windows, then.
Many thanks Michael.
Marcelo
Michael Wilde replied to Marcelo Finkielsztein's discussion 'asking for OS recommendation: install on Unix or Windows?'
stability has gotten Waaay better on windows. Performance only slightly better on unix. as far as time in the market, Windows wins over HP-UX (been available for about a month)
Marcelo Finkielsztein replied to Marcelo Finkielsztein's discussion 'asking for OS recommendation: install on Unix or Windows?'
Thanks.
I would not have thought of two servers. Will have to think about it.
I was more concerned about stability, bugs, ... that type of thing.
I am running already a Windows server and I have had some crashes, and non-explained failures.
Not…
Michael Wilde replied to Marcelo Finkielsztein's discussion 'asking for OS recommendation: install on Unix or Windows?'
64 bit is a general rule. Then, which ever indexer has the fastest disk I/O
also, you can always use both. Have forwarders send to both and use distributed search. More servers=more capability.
asking for OS recommendation: install on Unix or Windows?
Hi,I am going to use Splunk to monitor a group of log files; they are currently stored in Windows servers.Disregarding that the logging system is in Windows, I can choose between these environments for my Splunk installation: A) Unix - HPUX Itanium B) VMWare Windows Server 2003 64bits 4GB memoryWould you recommend one over the other?Thanks,MarceloSee More
Discussion posted by Marcelo Finkielsztein
Marcelo Finkielsztein replied to Patrick Swackhammer's discussion 'Regex For Identifying IP Addresses (To Extract Field)'
pffff ... show me someone who says they "know everything" about regex and i will show you a liar.
glad to help :-)
Marcelo
Marcelo Finkielsztein replied to Patrick Swackhammer's discussion 'Regex For Identifying IP Addresses (To Extract Field)'
Have you tried something like:
\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}
meaning:
(1 to 3 digits), (then a dot), (1 to 3 digits), (a dot), (1 to 3 digits), (dot), (1 to 3 digits).
HTH
Marcelo
Marcelo Finkielsztein updated their profile
Profile Information
- Are you an existing splunk user?
- Free
- What do you do for your day job?
- System Analyst
Comment Wall
- No comments yet!
© 2012 Created by Michael Wilde.
