Splunk Enterprise

license pool name : whitespace

lculot
New Member

Hi,

We noticed that spaces in license pool names are not escaped for some monitoring console license searches (historic data)

For a pool name like : My Pool

a license monitoring search will try 

search (index=_internal host=myserver source=*license_usage.log* type="RolloverSummary" earliest=-30d@d pool=My Pool) | eval _time=('_time' - 43200) | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | timechart span=1d sum(b) AS "volume" fixedrange=false | join type=outer _time [| search (index=_internal host=myserver source=*license_usage.log* type="RolloverSummary" earliest=-30d@d pool=My Pool) | eval _time=('_time' - 43200) | bin _time span=1d | stats latest(poolsz) AS "pool size" by _time] | fields - _timediff | foreach "*" [ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3) ]

which produces no results because $pool_clause$ values are not in double quotes (pool="My Pool") or whitespace is not escaped (pool=My\ Pool)

Can we modify this behavior somewhere ?

Labels (2)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You should be able to go to $SPLUNK_HOME/etc/splunk_monitoring_console/default, copy the relevant searches from savedsearches.conf to ../local/savedsearches.conf, then change $pool_clause$ to $pool_clause|s$.  Restart the MC instance and the searches should work better.

File a support request, too, so Splunk can fix that bug.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

lculot
New Member

Thanks for the suggestion, as the pool_clause exist only in macros.conf we tried adding the change there but after restart search result throws

Unknown search command 's'


Because the historical data is new we will rename the pool without whitespace as a workaround (system/local/server.conf).

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!