About gnovak

gnovak · ‎11-18-2011

I am also seeing the same thing. I have put a props.conf file in /etc/system/local directory and it looks almost identical in the format of the one post by srich. After about an hour I still am not seeing all my sourcetypes renamed. How long does this take?

gnovak · ‎11-15-2011

This finally worked...sourcetype="Cron_CheckRegistrarThreshold" NOT host=".bmp2." source="asia" earliest=-1d@d latest=-0d@d | rex "registrar username: [(?P \S+)]\s*Inserting a record" max_match=1000 | search raw_inserting_a_record="*" | eval inserting_a_record=split(lower(mvjoin(raw_inserting_a_record,";")),";")

gnovak · ‎11-15-2011

This search worked. I just added the table command and for some reason all the results are now displayed. sourcetype="Cron_CheckRegistrarThreshold" NOT host=".bmp2." source="asia" earliest=-1d@d latest=-0d@d | rex "registrar username: [(?P<inserting_a_record>S+)]sInserting a record" max_match=1000 | search inserting_a_record="" | table "registrar username" inserting_a_record | eval inserting_a_record=lower(inserting_a_record) However from doing this there are more results now...like empty lines or lines containing fields I don't want. This might not be the best solution but I'm experimenting with it.

gnovak · ‎11-15-2011

I'm actually looking here: http://splunk-base.splunk.com/answers/2537/breaking-multiline-events the example above of some of the log is 1 event. It's grouping everything together in one event...which i think is the problem.

gnovak · ‎11-15-2011

It's several events, usually in a 24 hour period.

gnovak · ‎11-14-2011

anyone have any idea? i just don't get why it's changing my answers.

gnovak · ‎11-10-2011

oh sorry about that

gnovak · ‎11-10-2011

Here's an example of some of the text from the log. Wed Nov 9 23:45:01 UTC 2011 Both DB handles are connected Resetting threshold count back to zero for registrars that have made a payment since the last run. Threshold check query succeeded. registrar username: [9345-NF] Registrar has zero or negative balance but has been warned, cease emailing. registrar username: [9715-MG] Registrar has zero or negative balance but has been warned, cease emailing. registrar username: [9153-WT] Registrar has zero or negative balance but has been warned, cease emailing. registrar username: [9643-IW] Inserting a record into the notification table Updating the registrar low threshold notification count registrar username: [9875-NI] Inserting a record into the notification table Updating the registrar low threshold notification count registrar username: [9879-NS] Inserting a record into the notification table Updating the registrar low threshold notification count registrar username: [9338-HY] Registrar has zero or negative balance but has been warned, cease emailing. registrar username: [9175-ND] Inserting a record into the notification table Updating the registrar low threshold notification count All done!

gnovak · ‎11-10-2011

Ok the first photo is the search using the eval command. You can see from the field "inserting_a_record_" that there is only about 4 results. The second photo is when I removed the eval command and the results for "inserting_a_record" were correct. There were in total 30 results for "inserting_a_record". I also tried removing the "max_match=1000" but this only produced about 15 results, which is only half.

gnovak · ‎11-09-2011

I have a search that will basically look through some logs for a line "Inserting a record" and then take the username after this line and put it in a field called "inserting_a_record" for me. I also created a workflow action for these usernames where I can click the drop down menu next to a username and select a link from the drop down menu to look up this username in a mailing list application. HOWEVER in the logs this username is displayed using capital letters. I used "eval" to tell splunk to display it in lower case letters because in the third party application where I look up there usernames, they are listed in lower case letters. Using capital letters yields no results so I had to make them lowercase. Here is the search: sourcetype="Cron_CheckRegistrarThreshold" NOT host="*.bmp2.*" source="*asia*" earliest=-1d@d latest=-0d@d | rex "registrar username: \[(?P<inserting_a_record>\S+)\]\s*Inserting a record" max_match=1000 | search inserting_a_record="*" | eval inserting_a_record=lower(inserting_a_record) PROBLEM: For some reason this search only displays 4 user names for me in the field "inserting_a_record". However I know there are 30 usernames from looking at the log. If I take away the | eval inserting_a_record=lower(inserting_a_record), I then receive the 30 usernames in the results. The only problem is the usernames have uppercase letters and the workflow action wont' work. An example of one of these usernames is 5427-TU. I use the eval command to make it display as 5427-tu. I have this same exact search with another type of log and it works perfectly but with this one, i'm not really sure why it's calculating the wrong numbers. Does anyone see anything obvious that sticks out?

gnovak · ‎09-07-2011

I have a bunch of logs I've added to splunk and created sourcetypes for these logs. These logs are updated once a week when a cron runs. Each log only has a small amount of data in them and usually we check these logs to make sure the cron ran and processes were successful. for each log we're only talking about a few lines of text. So we know what is considered "normal" and "successful" from these few lines inserted once a week when the cron runs. However what we want to do is have splunk tell us when something is "not" normal and alert us. Problem is, we don't always know what that would be! In short, we don't know the types of errors we would get. We just now "if it doesn't look like this, tell us". Here's an example of something you might see in a log that is normal. Starting at Sun Aug 28 23:59:01 UTC 2011 [cronjobthatruns.sh] All domains hosted on nameservers currently sponsored by the Registrar ==> Retrieving data from database. ==> Splitting report data by registrar. Processing /opt/export/blahblah-reports/report_data/full/host/blahblahblah... Ended at Mon Aug 29 00:19:10 UTC 2011> How would I be able to tell splunk to monitor the log and look for anything other then what I posted? I was looking at the filesystem monitor but I'm not sure how I would use it in this situation. Any ideas? I'm currently reading http://docs.splunk.com/Documentation/Splunk/4.2.3/Data/Monitorchangestoyourfilesystem and am wondering what it means to use fschange to detect optional SHA256 hash of file contents. Is that perhaps something that would solve my problem?

gnovak · ‎09-07-2011

closing and reopening a new question as i want to change title and it cut off my snipped of the log!

gnovak · ‎09-07-2011

I'm currently reading http://docs.splunk.com/Documentation/Splunk/4.2.3/Data/Monitorchangestoyourfilesystem and am wondering what it means to use fschange to detect optional SHA256 hash of file contents. Is that perhaps something that would solve my problem?

gnovak · ‎09-07-2011

I have a bunch of logs I've added to splunk and created sourcetypes for these logs. These logs are updated once a week when a cron runs. Each log only has a small amount of data in them and usually we check these logs to make sure the cron ran and processes were successful. for each log we're only talking about a few lines of text. So we know what is considered "normal" and "successful" from these few lines inserted once a week when the cron runs. However what we want to do is have splunk tell us when something is "not" normal and alert us. Problem is, we don't always know what that would be! In short, we don't know the types of errors we would get. We just now "if it doesn't look like this, tell us". Here's an example of something you might see in a log that is normal: Starting at Sun Aug 28 23:59:01 UTC 2011 [cronjobthatruns.sh] All domains hosted on nameservers currently sponsored by the Registrar ==> Retrieving data from database. ==> Splitting report data by registrar. Processing /opt/export/blahblah-reports/report_data/full/host/blahblahblah... Ended at Mon Aug 29 00:19:10 UTC 2011 How would I be able to tell splunk to monitor the log and look for anything other then what I posted? I was looking at the filesystem monitor but I'm not sure how I would use it in this situation. Any ideas?

gnovak · ‎06-07-2011

For some reason it won't let me comment my answer so I had to put it here as an "answer" Balance_email_sent_asia sourcetype="cron_BalanceEmail" source="*asia*" starthoursago="24" BalanceEmail sent | rex field=_raw "\[BalanceEmail\](?<TotalEmailsSent>[\d]+) of (?<TotalEmailsToSend>[\d]+) of email notification sent\." | search TotalEmailsSent="*" | chart sum(TotalEmailsSent) Balance_email_to_send_asia sourcetype="cron_BalanceEmail" source="*asia*" starthoursago="24" BalanceEmail sent | rex field=_raw "\[BalanceEmail\](?<TotalEmailsSent>[\d]+) of (?<TotalEmailsToSend>[\d]+) of email notification sent\." | search TotalEmailsToSend="*" | chart sum(TotalEmailsToSend)

gnovak · ‎06-07-2011

I'm wondering can you do something like: field=TotalEmailsSent red=TotalEmailsSent < TotalEmailsToSend default=green or something like that....I could try it and see what happens perhaps....

gnovak · ‎06-06-2011

I was also referencing this link as well to get ideas... http://splunk-base.splunk.com/answers/24210/single-value-module-question

gnovak · ‎06-06-2011

Hi! I have a dashboard created that evaluates the number of emails that should be sent and then the ACTUAL number of emails that were sent for a particular location. This section of the dashboard produces 2 numbers, TotalEmailsToSend and TotalEmailsSent. Each one of these values is put into a single value box on my dashboard. Now the fun part. Both numbers need to match. If they do not, the non matching number should turn red while the other is green. If both numbers match, I would like them to both be green. The TotalEmailsSent is the number that will differ if there was a problem. That number needs to turn red if it does not match the TotalEmailsToSend. Here is the code from my dashboard: <html> <h1><b>ASIA - Last 24 Hours</b></h1> <a href="https://lists.afilias.info/lurker/search/20121201.000000.00000000@ml:asia cc-notify,sb:balance,sb:notification.en.html">Check ASIA stats on Lurker</a><br /> </html> <single> <searchName>balance_email_to_send_asia</searchName> <fields>TotalEmailsToSend</fields> <option name="beforeLabel">Total Emails To Send</option> <option name="linkView">flashtimeline</option> <option name="linkSearch">sourcetype="cron_BalanceEmail" source="*asia*" starthoursago="24" Registrar="*" | eval Registrar=lower(Registrar) </option> </single> <single> <searchName>balance_email_sent_asia</searchName> <fields>TotalEmailsSent</fields> <option name="beforeLabel">Total Emails Sent</option> <option name="linkView">flashtimeline</option> <option name="linkSearch">sourcetype="cron_BalanceEmail" source="*asia*" starthoursago="24" Registrar="*" | eval Registrar=lower(Registrar) </option> </single> From reading about how to do a color change, it looks like they want a "range" to work off of in regards to the color change. In this case, I have no idea what the values would be, just that they both need to match and if they don't, the non matching one should be red. Also I see that in the examples most people were putting their search in the code for the dashboard where I am using SearchName. After explaining all of this, is what I am trying to do even possible?

gnovak · ‎05-10-2011

NM...i did a find and found a few last minute traces of it. Hey try a find and see if you can get anything. Do a search from your home directory for like "find ./ -name "SplunkforF5" and see if you notice anything out of place or weird.

gnovak · ‎05-10-2011

I am also having this problem. I completely removed an app and it's gone everywhere else except the management list. I did a ./splunk restart and it still did not remove it.

gnovak · ‎05-10-2011

-Turn field discovery off if you haven't used any additional fields perhaps.... -select a smaller time range then "All Time" -Perhaps your search is too generic? Try narrowing the search down to more specific data that you are looking for.... Thinking of other ways......hmmm....

gnovak · ‎05-05-2011

this worked thanks...

gnovak · ‎05-04-2011

HI, I recently upgraded to the new version of splunk (4.2) and I was experimenting with some apps. I tried installing Afterglow but decided to put it on a test server first instead of my main indexer. I decided to delete it. I removed the entire directory from /opt/splunk/etc/apps and restarted splunk. However it still shows up in the apps management page in splunk as "enabled". I disabled the app on this page and did a "ls" in /opt/splunk/etc/apps and the afterglow directory was back!!! How can I delete this app? I've tried twice so far and get the same results?

gnovak · ‎05-04-2011

I am having the same issue. Running version 4.2, have GraphViz installed but don't understand the read me instructions of to modify the config file. The examples are in MAC language so where in the app directory for AFterglow should I point to in the file? AFTERGLOWLOCATION = "/Users/ram/afterglow/src/perl/graph" AFTERGLOWPARAMETERS = "-c /Users/ram/afterglow/src/perl/graph/sample.properties -e 1.2" I have no idea where these live in splunk. My afterglow is located in /etc/apps/afterglow. If this flat out doesn't work in 4.2 i'll skip it.

gnovak · ‎04-29-2011

This worked. Great thanks..

Posts	373
Solutions	6
Karma Given	6
Karma Received	45
Member Since	‎10-07-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Transforms, Regex and wrong source names OH MY!

User keyword Lookup and Replace

Timechart values not working

Regex not pulling out all values

Schedule search every 12 hours

Line breaks in log vary depending on job - How to ...

Failed to decode 1945 bytes error: Backup Exec lo...

Index past logs under one source

Indexes not showing data

Indexing output of a live script correctly

Re: Sourcetype renaming not taking

Re: eval lower command producing incorrect results

Re: eval lower command producing incorrect results

Re: eval lower command producing incorrect results

Re: eval lower command producing incorrect results

Re: eval lower command producing incorrect results

Re: eval lower command producing incorrect results

Re: eval lower command producing incorrect results

Re: eval lower command producing incorrect results

eval lower command producing incorrect results

Use Fschange to monitor log files for errors

Re: Can Splunk do this?

Re: Can Splunk do this?

Can Splunk do this?

Re: Single Value color change based on diff

Re: Single Value color change based on diff

Re: Single Value color change based on diff

Single Value color change based on diff

Re: Remove listing of an app from the Management A...

Re: Remove listing of an app from the Management A...

Re: best tips for speeding up searches?

Re: remove app

remove app

Re: Afterglow application

Re: Change start screen for app

Join the Conversation