Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About Marinus
Marinus
Communicator
Member since:
03-30-2010
10-11-2021
Community Statistics
| Posts | 74 |
| Solutions | 8 |
| Karma Given | 8 |
| Karma Received | 46 |
| Member Since | 03-30-2010 |
Activity Feed
- Got Karma for Re: How to use Splunk for root cause analysis for SAP application?. 01-29-2021 02:23 PM
- Got Karma for Re: How do you produce a chart like this. 06-05-2020 12:46 AM
- Got Karma for How do you add dummy events to a search result?. 06-05-2020 12:46 AM
- Got Karma for How do you add dummy events to a search result?. 06-05-2020 12:46 AM
- Got Karma for How do you add dummy events to a search result?. 06-05-2020 12:46 AM
- Got Karma for How do you add dummy events to a search result?. 06-05-2020 12:46 AM
- Got Karma for How do you add dummy events to a search result?. 06-05-2020 12:46 AM
- Got Karma for How do you add dummy events to a search result?. 06-05-2020 12:46 AM
- Got Karma for How do you add dummy events to a search result?. 06-05-2020 12:46 AM
- Got Karma for How do you perform a sub search over indexes?. 06-05-2020 12:46 AM
- Got Karma for How do you chart a cumulative sum?. 06-05-2020 12:46 AM
- Got Karma for How do you chart a cumulative sum?. 06-05-2020 12:46 AM
- Got Karma for How do you chart a cumulative sum?. 06-05-2020 12:46 AM
- Got Karma for How do you chart a cumulative sum?. 06-05-2020 12:46 AM
- Got Karma for Re: How do you chart a cumulative sum?. 06-05-2020 12:46 AM
- Got Karma for Re: How do you chart a cumulative sum?. 06-05-2020 12:46 AM
- Got Karma for Re: How do you chart a cumulative sum?. 06-05-2020 12:46 AM
- Got Karma for Re: How do you chart a cumulative sum?. 06-05-2020 12:46 AM
- Got Karma for Debugging custom search commands. 06-05-2020 12:46 AM
- Karma Re: How can I search for a missing field? for dinh. 06-05-2020 12:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 4 | |||
| 0 | |||
| 7 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 |
10-10-2011
03:28 AM
Running splunk under a normal user account solves the problem.
On Windows splunk cmd python doesn't run in the same context as the service.
... View more
09-28-2011
01:28 AM
I am able to trap the error. The issue is what the splunkd process does to the environment that causes the python interpreter to behave differently.
... View more
09-26-2011
05:51 AM
1 Karma
I've been tinkering with a custom search command that uses win32com.client.
When I try to invoke my search command I get the following error
(-2147352567, 'Exception occurred.', (0, None, None, None, 0, -2147200925), None)
I've tried to call the offending section using the bundled interpreter, and it works just fine.
./splunk cmd python
Any ideas I'm kinda stumped.
I really don't want to have my search command, exec an external interpreter.
== Update ==
I've implemented another version that execs a vbs script to invoke the win32 com component.
It also fails which leads me to believe that splunkd is doing something funny.
... View more
09-09-2011
06:36 AM
I found a workaround. I'm using the internal index as an example.
index=_internal [search index=_internal | head 1000 | fields + user] | transaction user
... View more
09-06-2011
01:52 AM
1 Karma
I've recently split up my data into indexes and some of my searches that make use of sub searches are now breaking.
For example I previously did a
tag::host=esb* [search TestService | fields + transaction_id] | transaction transaction_id
To cater for the index change I did
index=test tag::host=esb* [search TestService | fields + transaction_id] | transaction transaction_id
No luck, I even stuck an index into the subsearch with no results.
What is the correct syntax?
Marinus
... View more
08-18-2011
02:09 AM
Thanks Ayn RTFM!
| metadata index=* type=sources | search totalCount
... View more
08-16-2011
04:40 AM
If I use the metadata command it only gives me keys for the main index, can I call it for other indexes? For example
index=* | metadata type=sources | search totalCount
... View more
- Tags:
- metadata
08-04-2011
06:49 AM
I think it's because it's not reading the header.
set the HEADER_MODE in props.conf
[source::/tmp/splunk/var/spool/splunk]
HEADER_MODE = always
... View more
08-02-2011
11:35 AM
2 Karma
Just received a reply from support, the behavior is now configurable via props.conf by modifying the HEADER_MODE param.
[source::/tmp/splunk/var/spool/splunk]
HEADER_MODE = always
... View more
07-22-2011
02:07 PM
Something's up with the batch processor. I send the following file to a sink and it doesn't set any of the metadata fields as it used to previously.
Also documented at http://www.splunk.com/base/Documentation/latest/Data/Assignmetadatatoeventsdynamically
dummy.log
***SPLUNK*** host=something source=keyboard sourcetype=text
this is an event!
Subsequent processing of props and transforms don't event happen.
The event get's indexed as if I never specified the header.
Fails on a fresh Splunk 4.2.2 (build 101277) on Windows 7 64bit but works Splunk 4.1.7 (build 95063).
PS I noticed another post with a similar problem
http://splunk-base.splunk.com/answers/9110/batch-input-doesnt-honor-line_breaker-settings
... View more
06-17-2011
06:05 AM
2 Karma
The short answer is you can't easily by default. SAP produces a vast array of logs and traces in all kinds of formats, which you can't parse out the box easily. The J2EE stack is the exception where you can find Log4J style logs, which you can parse without much hassle. However most of the action is on the ABAP side which is what you are after 😞 You have two options, write a SAP ABAP app to log the data out so Splunk can eat it or write a connector that deals with the SAP complexity and forwards events to Splunk in a sane format.
Our SAP collector is now availible http://telicthoughts.blogspot.com/2013/08/splunking-sap.html
... View more
06-17-2011
06:03 AM
Look at my answer at http://splunk-base.splunk.com/answers/12544/how-to-get-useful-reports-from-logs-generate-by-sap-application-server-ie-netweaver-pi-what-kind-of-reports-we-can-get-from-these-application-logs?page=1#26500
... View more
06-17-2011
06:02 AM
The short answer is you can't by default. SAP produces a vast array of logs and traces in all kinds of formats, which you can't parse out the box easily. The J2EE stack is the exception where you can find Log4J style logs, which you can parse without much hassle. However most of the action is on the ABAP side 😞 You have two options, write a SAP ABAP app to log the data out so Splunk can eat it or write a connector that deals with the SAP complexity and forwards events to Splunk in a sane format.
... View more
06-07-2011
02:34 AM
1 Karma
I getting an eval error when I'm trying to use eval on a host tag.
"Error in 'eval' command: The expression is malformed. Expected )"
Most hosts have more than on tag.
* | eval nr_tags=eval(mvcount(tag::host))
... View more
- Tags:
- eval
05-24-2011
04:46 AM
Here's an example script I write to do a reverse DNS lookup for an IP, it adds a new field dns_name. You can refactor it with your code.
search > * | long2ip field=ip
import splunk.Intersplunk
import sys
import socket
def resolve(ip):
name = 'unresolved'
try:
name = socket.gethostbyaddr(ip)[0]
except:
pass
return name
try:
# get the field
field = None
if len(sys.argv) > 1:
for a in sys.argv:
if a.startswith("field="):
where = a.find('=')
field = a[where+1:len(a)].strip()
if not field:
results = splunk.Intersplunk.generateErrorResults("no field specified")
else:
results,unused1,unused2 = splunk.Intersplunk.getOrganizedResults()
for result in results:
result['dns_name'] = resolve(result[field])
splunk.Intersplunk.outputResults(results)
except Exception, e:
results = splunk.Intersplunk.generateErrorResults(str(e))
... View more
03-21-2011
04:16 PM
It works as per http://www.splunk.com/base/Documentation/latest/Developer/AddATable on my build 4.1.7, build 95063
... View more
03-10-2011
02:29 PM
Perhaps my example was too simplistic. Let's stay the one data set is avg CPU and the second Memory usage
... View more
03-08-2011
07:58 AM
I have two timecharts that I'd like to overlay them on one chart
example search to produce the two charts
source=a | timechart count by host
source=b | timechart count by host
I was hoping I could do
`source=a | eventstats count as a by host | search source=b eventstats count as b by host | timechart avg(a), avg(b) by host`
Is this possible?
... View more
01-13-2011
02:11 PM
It's fine to do it for a source, I'm doing it at the event level. Each event can have it's own unique key.
... View more
11-17-2010
02:13 PM
Thanks Stephen, I'm just not sure that I'm following your logic here. Step 1, would be to locate my special value V and index it using a new meta key K::V
Step 2, would be to remove the value from the host
Am I missing something from your post?
... View more
11-17-2010
12:13 PM
I'm currently collecting logs on a lightweight forwarder.
I'm adding a special field to the messages which I'd like
to extract index it for later use at search time to enrich
events with a lookup.
I don't want to add the field into the message.
Is there s simple way to get my field to the indexer?
My first plan was to concatenate it to the host meta key on the forwarder and
then extract and index it on the indexer. The host key can then be cleaned up.
[forwarder]
host=xyz,special_key
[indexer]
host=xyz
special_field=special_key
[seach_time]
enrich using special_field
... View more
11-04-2010
02:40 PM
The closest I've come is to export CA-TSS/LDS journal files via FTP and index them on another host.
... View more
11-03-2010
12:55 PM
1 Karma
I'd like to compare the configuration of several nodes using a single search.
Each node has multiple keys expressed as one key value pair per event i.e.
timestamp audit=true
timestamp enabled=true
Is there a way to compare all the keys against each other and report deltas?
I've updated the quested to ensure it's correctly formatted.
... View more
- Tags:
- search
10-28-2010
12:30 PM
Stephen, does the batch input eat files one at a time? If it does I'd expect the file monitor to perform better?
... View more
- « Previous
-
- 1
- 2
- Next »
