About hartfoml

hartfoml · ‎04-29-2014

thanks this was the answer. If you would like credit please post this as an answer.

hartfoml · ‎04-29-2014

I have several apps and dashboards that i need to add a group/role to. this will take a long time through the WEB GUI. Is there a faster way that I can add a role to views and searches through a unix text editor? What file would I edit to give access to a view and the searches in that view?

hartfoml · ‎04-24-2014

I have more than 40 class B subnets in my geographically dispersed enterprise. I would like to create a lookup for my companly subnets so that when I do searches on firewall and IDS data I can exclude or include company to and from IP's using the cidr notation for the Class B subnets. the reason I want to use Cidr is because I have a few superneted class B groups with a /14 cidr designation. I have a search like this: index=firewall action!=deny source_zone_name="Untrust" source_address!=X.X.0.0/16 OR source_address!=Y.Y.0.0/14 OR source_address!=Z.Z.0.0/16 | stats count by source_address This search is not filtering out the subnets identified with the Cidr notation. Do I have to do something special to get Splunk to recognize the notation?

hartfoml · ‎04-24-2014

thanks Yann, This was very good advice. Yesterday I had a busy day and the virtual memory went way high and then dropped down after the work was done. The SOS app does not map PID numbers to searches so I can not see witch Splunkd process is tied to which user/search. Also the Swap file on my indexer was never released and I had to bounce splunk to get the swap file freed up. I find that when the swap file is close to 100% utilized the server is likely to crash. RHEL 5.x

hartfoml · ‎04-18-2014

Never Mind this works OK thanks anyway I just had my search wrong it it wasn't showing and data

hartfoml · ‎04-18-2014

I am using the simple xml example from the "UI Examples" APP in the example the output is a count field. I would like to change the output to a table field. Can someone help please. the show results section is where I'm missing it. <input type="text" token="IPAddressStr"> <label>IP Search</label> <seed>0.0.0.0</seed> </input>  <input type="time" />  <table> <event> <title>Results</title>  </event> </table>

hartfoml · ‎04-18-2014

Martins Answer below is the better long term answer. setting up a lookup will allow me to use the lookup over and over again. I chose this answer because it was easy to setup rather than modifying and implementing a database lookup. I will use the answer below just not right now.

hartfoml · ‎04-18-2014

Thanks Martin, This is good stuff!!!

hartfoml · ‎04-18-2014

Martin, This is a great suggestion and while the answer below works, (thank you very much Linu it works great), it may not be as flexible as your suggestion. Can you maybe give an example of the syntax as an answer rather than a comment so I can try it, and if it works better, then I can use it as the answer for this question? Thanks Mike H.

hartfoml · ‎04-18-2014

The table is not that big and there is a join as well. the search only takes about 10 seconds Thanks Linu and Martin can you offer an example of the lookup suggestion above

hartfoml · ‎04-17-2014

I have a subsearch that finds destination IP's like this [search sourcetype=ids sid=xxxx | dedup dst | table dst] I want to use my local vulnerability scanner database to id the system using the query with the "dst" as the "IPAddressStr" | dbquery "SQL" "SELECT IPAddressStr, NBName FROM Assets where ipAddressStr LIKE '$dst$'"

hartfoml · ‎04-17-2014

Thanks this helps a bit. I was hoping for a way to know which pid was running which job. Something with btools or REST API or something that would tell me which splunkd process is running which job. Thanks for the help I really appreciate it.

hartfoml · ‎04-17-2014

I am having this same problem. any help would help the community [MyIndexer1.local.com] Empty csv lookup file (contains only a header) for table 'MyLookupFile': /opt/splunk/var/run/searchpeers/MyIndexer1.local.com-1397750703/apps/search/lookups/MyLookupFile.csv [MyIndexer2.local.com] Empty csv lookup file (contains only a header) for table 'MyLookupFile': /opt/splunk/var/run/searchpeers/MyIndexer2.local.com-1397750703/apps/search/lookups/MyLookupFile.csv

hartfoml · ‎04-17-2014

I logged into the indexer https://MyIndexer:8000 as admin opend the jobs window selected all apps All Owners Status Running ans even though Top shows several Splunkd processes running no jods or at time only a few jobs are running. thanks this helps a little to see what scheduled or search jobs are running on the indexer

hartfoml · ‎04-17-2014

My indexer is running at 97,8% CPU utalisation and there are about 18 splunkd threads running along with python and splunk_optimizer and ssl_test.pl How can I tell what all the Splunkd threads are doing and if I can kill some of them to ease the load or at least look at what they are so that i can schedule them to run at different times. Thanks for your help... 🙂

hartfoml · ‎04-15-2014

Thanks Timewrap is almost the answer I was looking for a difference (i.e 39 new clients were added last month) Like this - Number of clients last months subtract number of clients two months ago equals number of clients added Mar Clients 120 Feb Clients -110 New Clients 20 20 clients added last month Seems simple enough I just cant figure out how to do it in one search or report query? Thanks everyone for your help

hartfoml · ‎04-14-2014

Thanks I see the different Columns using the chart command. then I can subtract one column from the other. I am looking at the small app called "Timewrap" this might work for me http://apps.splunk.com/app/1645/

hartfoml · ‎04-14-2014

Thanks this is helping to get the previous two months of data. I still need to separate the two months and compare the results to see the change between months. the last month compered to this month type thing to get the difference. I guess it wasn't too clear. sorry... Thanks again for the help 🙂

hartfoml · ‎04-14-2014

thanks much I'll try to lookup how to do that

hartfoml · ‎04-14-2014

I can find the number of clients talking to my deployment server by client group name like this. index=_internal hostname=* component="Metrics" group="ds_connections_default" | stats dc(hostname) by name | addcoltotals labelfield=name label=TOTAL this might not be the fastest or most efficient method and if you know a better way please let me know. I want to run this search for the last month and compare to the month before that so that I get a number of clients per client group name with "coltotal" added last month report. Does that make sense??? any help would be appreciated.

hartfoml · ‎04-08-2014

this is the final filer if anyone is interested. Thanks Martin for getting me there index=customer_index OR (index=_internal AND series="customer_index")

hartfoml · ‎04-07-2014

I will try this out as soon as I can. Could you add this as your answer and if it works I can give you credit for the answer 🙂

hartfoml · ‎04-07-2014

Thanks for helping Martin, I really appreciate it. So How would I do that. All the customer users are in a group/Role. The group has access to there index. I would give them access to the _internal but how do I restrict access in only the _internal to the search term [series="Customer_Index_group"] I am on version 4.3.1, build 119532 PS will be onsite to help with the upgrade in 8 weeks. Until then I can not upgrade.

hartfoml · ‎04-07-2014

they are for the UF. I know this is maybe not best practice because the metrics.log's put in the customers index count against the license. Where is the best place to record the UF Metrics Logs so that they don't count agents the license and how could I give this info to the customer without letting them see too much.

hartfoml · ‎04-07-2014

So that the customer [who did not want to install the splunk UF] can see and troubleshoot splunk UF issues.

Posts	584
Solutions	20
Karma Given	37
Karma Received	122
Member Since	‎10-05-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Host name not showing correctly

Why is Splunk Web limited to 50 users when using S...

How to use timechart and streamstats

how to troubleshoot role restriction presidence

How to force retention time pruning

how to convert dbquery search to dbxquery search

Can a RHEL Universal Forwarder be installed on a R...

Splunk TA for Solaris 11: How to get the Solaris l...

Can I manualy create "_telemetry" index on older v...

What permissions can I give a role that will allow...

Re: Roles Permission on Several Apps and Dashboard...

Roles Permission on Several Apps and Dashboards

cidr notation not working

Re: What is Splunkd Doing

Re: simple xml for table display

simple xml for table display

Re: Use subsearch results for dbquery

Re: Use subsearch results for dbquery

Re: Use subsearch results for dbquery

Re: Use subsearch results for dbquery

Use subsearch results for dbquery

Re: What is Splunkd Doing

Re: Error: [indexer1] Empty csv lookup file

Re: What is Splunkd Doing

What is Splunkd Doing

Re: Compare this month to last month results

Re: Compare this month to last month results

Re: Compare this month to last month results

Re: Compare this month to last month results

Compare this month to last month results

Re: Index Volume, Licence Use Question

Re: Index Volume, Licence Use Question

Re: Index Volume, Licence Use Question

Re: Index Volume, Licence Use Question

Re: Index Volume, Licence Use Question

Join the Conversation