Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About cphair
cphair
Builder
Member since:
03-07-2012
06-05-2020
Community Statistics
| Posts | 220 |
| Solutions | 28 |
| Karma Given | 115 |
| Karma Received | 106 |
| Member Since | 03-07-2012 |
Activity Feed
- Got Karma for Re: Search a field for multiple values. 03-22-2024 10:26 AM
- Got Karma for Re: How to find earliest event based on Event code for once server?. 02-10-2021 12:38 PM
- Got Karma for Re: How do you set an input's conditional change to match a literal * with Simple XML?. 11-15-2020 03:03 PM
- Got Karma for identifying sourcetypes by index. 10-29-2020 07:40 AM
- Karma How to set the default value of a multiselect input box to the results of a search? for coleman07. 06-05-2020 12:48 AM
- Karma Re: How can I return specific results using head and tail commands? for maciep. 06-05-2020 12:48 AM
- Karma How to search a lookup table and return the matching term? for clv1clv1. 06-05-2020 12:48 AM
- Karma Re: How to search a lookup table and return the matching term? for gokadroid. 06-05-2020 12:48 AM
- Karma Re: How to replicate a Search Head Cluster's KV Store lookup data to an Indexer? for dwaddle. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk Enterprise Security: How to troubleshoot why the threat_activity index is no longer populating with data?. 06-05-2020 12:48 AM
- Karma Re: Method to rename field to value of another field for acharlieh. 06-05-2020 12:47 AM
- Karma Re: Distributed Search Environment: Do accelerated data models reside on the indexer or search head? for helge. 06-05-2020 12:47 AM
- Karma How extract data model fields using REST search? for Runals. 06-05-2020 12:47 AM
- Karma Re: Extract Data Model fields using REST search for reed_kelly. 06-05-2020 12:47 AM
- Karma How to re-run a relative time search on click of the submit button? for helenashton. 06-05-2020 12:47 AM
- Karma Re: How to re-run a relative time search on click of the submit button? for masonmorales. 06-05-2020 12:47 AM
- Karma Re: can I extract a field with a regexed dynamic fieldname? for MuS. 06-05-2020 12:47 AM
- Karma Re: Removing null columns from a table for pj. 06-05-2020 12:47 AM
- Karma Re: Getting error "Error in 'chart' command: The argument ' ' is invalid." when using "chart-count-over-by" clause in chart with post-process search for ishangajera. 06-05-2020 12:47 AM
- Karma Why are values for a dynamic checkbox not being populated by variables passed from 2 drop-downs? for vdevarayan. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-17-2012
01:52 PM
OK, on looking at this more carefully, it sounds like you need to both figure out what the letter is at the end of the Used field, and to strip it out so you can do math on it. I don't have df data to test on, but I suspect your search should look something like "source="df" host="hostname" | multikv fields Filesystem Size Used Avail Use% Mounted | search xfs | eval Multiplier=if(match(Used,"T"),1000,1) | eval Used=rtrim(Used, "[K,G,M,T]") | eval Used=Used*Multiplier | table _time Used "
... View more
05-17-2012
12:24 PM
Pipe your search to an eval and if.
... | eval TestVal=if(match(Value,"TB"),Value*1000,Value)
You will have fewer significant digits for the TB entries, but the scale will be corrected.
... View more
05-15-2012
07:20 AM
Hi wsw,
If you pipe your search to "| sort - Value" (or whatever the field is called), then graph it as a bar chart, it should sort automatically. Does this work for you?
... View more
05-11-2012
01:43 PM
1 Karma
For network bytes, it can make sense to show the two values together on a graph. Try a variation on the below search, make it a stacked area chart, and see if you like the results. (Subsearches are often pretty slow, and I try to avoid them.)
host=stbackup06 counter="Bytes Sent/sec" OR counter="Bytes Received/sec" | timechart avg(Value) as Avg by counter
... View more
05-11-2012
09:32 AM
No problem, @bagojunk. If my answer got close enough, could you click the check mark below the voting buttons to accept it? Thanks.
... View more
05-11-2012
08:14 AM
4 Karma
Hello bagojunk,
Pipe your search to "| dedup device,event" (or whatever the name of the fields are).
Did you look at the examples for the delete command? One purges based on a regex and one on an exact string, so one of those should do what you want. Of course, do the search without the delete first to make sure you're pulling the right stuff, and make sure you have admin rights.
http://docs.splunk.com/Documentation/Splunk/4.3.2/SearchReference/Delete
... View more
05-10-2012
02:25 PM
@nick, do you have any examples of drilling down from one chart to another? The examples in Sideview all use tables, and I wasn't sure of the syntax to modify parameters/search when "row" and "cell" don't really make sense.
... View more
05-10-2012
09:30 AM
1 Karma
Oh, good lord. Was passing variables to a HiddenSearch instead of a Search. Once I changed that it worked fine.
This was a helpful link for debugging: http://splunk-base.splunk.com/answers/24278/having-trouble-with-custom-drilldowns-in-advanced-xml
... View more
05-10-2012
08:57 AM
I'm sure this is a dumb question, but my brain is not working today and it's kind of urgent that I figure this out. I can't figure out how to pass click variables to a new view. I have a table of values (time, host, CpuLoad) that result from one search, and I want to load a separate view with a distinct search that takes the clicked-on time and host as arguments. (I guess I could load them in another panel in the same form if that's easier; I just need to run an entirely new search.) I've tried to copy the sideview examples (the views are already in advanced XML), but all that happens is that my second form gets the literal strings $click.fields.host$ and $click.fields.time$ and doesn't substitute the variables. What am I doing wrong?
... View more
05-09-2012
10:43 AM
You need to put the word "search" explicitly in your subsearch: [search source=...
You could also try counter="Bytes Sent/sec" OR counter="Bytes Received/sec" and cut out the subsearch entirely. Might need to fiddle with the rest of the command some.
... View more
05-09-2012
06:53 AM
@mship, I see a similar problem on a Win7 machine running the universal forwarder. For this host, it only happens for one particular event code in the application log, so a corrupted DLL might be the reason. I don't have access to the machine itself at the moment, so I can't verify anything about the local log or the DLLs.
... View more
04-27-2012
07:08 AM
@singhg, are you on an earlier version of Splunk? It looks like the earliest function was introduced in 4.3. You can try last(_time) instead of earliest(_time), which looks at the time the event was indexed rather than the actual timestamp and so may be a bit less accurate.
... View more
04-26-2012
12:14 PM
3 Karma
You can use rex to first pad the number with "enough" zeroes, then to trim it to the length you require. I broke it into two parts since rex's sed mode doesn't seem to like concatenated commands; I don't know whether you consider this cleaner, but it does allow for variable-length numbers. Let me know if this is useful.
... | rex mode=sed field=myInt "s/(\d+)/00000000\1/" | rex mode=sed field=myInt "s/0*([0-9]{8})/\1/"
... View more
04-26-2012
10:27 AM
1 Karma
For a known host foo:
index=main EventCode=4656 host=foo | stats earliest(_time) as Earliest | eval FirstSeen=strftime(Earliest,"%+") | table FirstSeen
To find the first time the event occurred on each host in the index:
index=main EventCode=4656 | stats earliest(_time) as Earliest by host | eval FirstSeen=strftime(Earliest,"%+") | table host,FirstSeen
... View more
04-25-2012
02:51 PM
I just encountered this myself. I think you're hitting the "reasonable resolution" limit discussed here: http://splunk-base.splunk.com/answers/33050/a-month-time-of-x-axis-with-span-of-5-min-window If no timespan is specified, Splunk picks a reasonable default based on the time range and returns data over the entire range, but if you bother to explicitly specify a timespan, it figures you must really care about the detail, so it sacrifices some of the range in order to display what you asked for.
... View more
04-24-2012
11:19 AM
@MHS, note that you also need a backslash before the d to make it match a digit. You also may need to escape (backslash) the single quotes, but I don't have data handy to test that.
... View more
04-24-2012
09:04 AM
Hello,
I have Splunk on some Windows VMs that run on ESX hosts. For each guest, the ESX hosts generate customized performance data that I'd like to ingest into Splunk as well, in order to correlate the hosts' data with the data reported from Splunk within the guest OS.
The problem is that the custom performance data is saved under a different name than the guest OS, so I can't make a direct comparison if I just ingest the data--for instance, a guest OS might be named foo01456, but the ESX host knows it as bar01456, so Splunk would consider them two different machines. The machine name is not contained within the custom data, only in its filepath (e.g. \\dir1\dir2\bar01456\data.log). What are my options? It looks like editing inputs.conf to set the default host only will return me an exact match on a portion of the path, and I'd want to transform it from bar01456 to foo01456. Transforms.conf has a similar option, but I think the machine name has to be somewhere within the data for that to work. Do I understand this correctly? Is the name correlation better done at search time? Do I have to resort to a custom script?
http://docs.splunk.com/Documentation/Splunk/latest/Data/Setadefaulthostforaninput
... View more
- Tags:
- dynamic
- inputs.conf
04-24-2012
06:01 AM
2 Karma
Add these two parameters with a value of 0 in your HiddenChartFormatter:
param name=charting.primaryAxisTitle.height /param
param name=charting.primaryAxisTitle.margin /param
The question you referenced mentions changing CSS, but I just checked it on one of my forms and you don't have to. They may have modified the CSS to remove some of the whitespace.
... View more
04-20-2012
12:04 PM
3 Karma
Use the delta command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delta
It is applied in the order of events (that is, newest to oldest), so you will see negative deltas on an accumulated field, but you should be able to work out the graph you want from that data.
... View more
04-12-2012
02:20 PM
Well, there wasn't an option two years ago: http://splunk-base.splunk.com/answers/2745/enable-vertical-scrolling-in-dashboard-panel. Would a pager be acceptable, to let you see the data one page at a time? Another possibility is to set the "count" option to some suitably high number, but that is only useful if the data isn't too unwieldy to begin with.
... View more
04-12-2012
06:09 AM
@Lowell, thanks for the reply. Since I posted this, I figured out how to run the bundled Python interpreter (.\splunk cmd python), and I tested non-Splunk subsections of my script successfully. I tried to set up custom logging but didn't have much luck; I'll give it another shot.
The only parts of my script I couldn't test directly were the calls to Intersplunk. Is there a way to provide input/output from the command line, e.g. a small specially formatted text file as a dummy result?
... View more
04-11-2012
08:17 AM
Yep, that's exactly it. Guess I should search more carefully before I post. Thanks!
My Splunk version is 4.3 build 115073, if that helps you.
... View more
04-11-2012
08:06 AM
2 Karma
Hello,
I have a silly problem. I can't get stats latest(_time) to return a value. It's a basic search--just trying to find the last time each host reported in.
index=foo | stats latest(_time) by host
earliest(_time) seems to work, and so do the first and last functions, but latest just gives me a blank entry. What's going on? If it matters, this is perfmon data and I think it's pretty clean. It's not just the _time field either; no field I pass to latest is giving me a result.
... View more
04-11-2012
06:31 AM
It may be the join that's messing you up. Try it without the subsearch:
index=myindex sourcetype=my-app host=04 OR host=050 Status_type="ERROR" NOT "The remote server returned an error: (401) Unauthorized." | rex " (?<title_text>.) " | rex " (? .) " | rename id AS "Asset" | table "Asset" task_id owner_text title_text
Since you're doing a left join anyway, you're keeping all the results from the original search, so you don't have to do another search over the same data cut.
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma from
| User | Karma Count |
|---|---|
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
