About fk319

fk319 · ‎07-29-2011

well it seems it should work, so I went to my code to see how I implemented it, I ended up using a case command with the last expression as 1==1. eval a=case(match(b, "kittens"), "bar", 1==1,a) It seems that I had the same issue also, and this was how I was able to get it to work.

fk319 · ‎07-28-2011

Have you looked at the command transaction?

fk319 · ‎07-25-2011

What I did pre-searches so that I can display the data in two ways, a sumary and a more granularity. I was able to cut my searches in half. I also ran into the limit of the graphing display, so instead of setting a time limit, I let the graphing program do more of the work. I was also running into the 10,000 limit for GUI I was also able to merge several time ranges into one view by use of a time selector. In general I learned a bit since I posted this, and wanted to close the question.

fk319 · ‎07-21-2011

A guy I work with changed the ("IP....s") to the next stage and did a regex he was fortunate that all his IPs where near the same area. <search> | regex _raw="10.(8.(43.5|52.4)|9.(232.4|144.(4|33))" | <presentation> he is good with RegEx and the above is easy to add an remove, for those who can read it.

fk319 · ‎07-21-2011

if you have a short list, you can use lookup.

fk319 · ‎07-21-2011

How are you importin your CSV files, inputcsv ? There is an option start=<int> that starts importing after <int> lines.

fk319 · ‎07-21-2011

I have a similiar issue. There are cases where the server gets to busy doing a search it stops indexing. I have had cases where my indexing is gotten behind by 20 minutes and longer.<\p> We are running 4.1.5 and we are moving from a single server to a much larger cluster of servers, time frame unspecified.

fk319 · ‎07-21-2011

look at the rex command: <you search> | rex field=_raw "Response time: (?<ResponseTime>\d+)ms" | stats max(ResponseTime)

fk319 · ‎07-21-2011

use props.conf to call transforms.conf you can then build your regex # props.conf [source::fromSomewhere] TRANSFORMS-getIP = from-to-ips # transforms.conf [from-to-ips] # From 1.1.1.1:80 to 2.2.2.2:7136, proto REGEX = From ([0-9]{1-3}\.[0-9]{1-3}\.[0-9]{1-3}\.[0-9]{1-3}\:[0-9]{1-5}) to ([0-9]{1-3}\.[0-9]{1-3}\.[0-9]{1-3}\.[0-9]{1-3}\:[0-9]{1-5}), proto FORMAT = FromIP::$1 ToIP::$2 depending on how strict you want your ip:port matching to be, you can tighten your regex.

fk319 · ‎07-20-2011

is there another regex that you can use? index="hosts*"

fk319 · ‎07-20-2011

If you properly shutdown the server, the server will restart where it left off. If you crash the server, the it will do its best to start in the correct location.

fk319 · ‎07-20-2011

There are several output commands, I would suggest outputcsv. You may also opt for just using fields. I am not clear where you want the fields to go, to a file or to stdout.

fk319 · ‎07-20-2011

Due to our environment, we do IPs. Most of the machines [that I care about] I translate the IP to a cluster name at report time, via lookup. There are cases when I care about who is doing what, but most of the time I want to trend who, client clusters, is hitting our clusters.

fk319 · ‎07-20-2011

I have several servers sending WinEventLogs to my server. I have not control of the remote servers, so I would like to put them in their own indexes. All of this is in its own application, WinEvent. Here I am trying to catch the incoming data and force it to be processed via props.conf by re-routing. It does not seem to work. Below that, I tried to use sourcetype to index the data. The host names are [not really] winsql, winmail, winexchage. [splunktcp://win*:9997] route = has_key:_utf8:parsingQueue;has_key:_linebreaker:parsingQueue;absent_key:_utf8:parsingQueue;absent_key:_linebreaker:parsingQueue index = winevent disabled = o [WinEventLog:System] disabled = 0 index = winsys [WinEventLog:Security] disabled = 0 index = winsec [WinEventLog:Application] disabled = 0 index = winapp here is my props.conf [WinEventLog...] TRANSFORMS-WinApp = WinEvent_App TRANSFORMS-WinSec = WinEvent_Sec TRANSFORMS-WinSys = WinEvent_Sys and finaly my transforms.conf [WinEvent_App] SOURCE_KEY = MetaData:Source REGEX = (source::WinEventLog:Application) FORMAT = index::winapp DEST_KEY = _MetaData:Index [WinEvent_Sec] SOURCE_KEY = MetaData:Source REGEX = (source::WinEventLog:Security) FORMAT = index::winsec DEST_KEY = _MetaData:Index [WinEvent_Sys] SOURCE_KEY = MetaData:Source REGEX = WinEventLog:System FORMAT = index::winsys DEST_KEY = _MetaData:Index I have been unable to move the incoming data from the default index=main to any of my new indexes. any suggestions?

fk319 · ‎07-20-2011

you also have the option of "searchtimespanminutes" http://www.splunk.com/base/Documentation/4.1.5/SearchReference/SearchTimeModifiers#List_of_time_modifiers

fk319 · ‎07-20-2011

Refer to example 2 of chain

fk319 · ‎07-19-2011

under the search option you have earlist and latest time you can "chain" times I am not sure how you are specifing your start time, but the end time would be (<starttime>+h) probably not the answer you are looking for, but I am hoping it is a baby step.

fk319 · ‎02-16-2011

Is there a place that shows what could have been changed?

fk319 · ‎02-08-2011

I would like to do an eval on every log entry, from a certian sourcetype. In this case I have a real number that I would like to quantize. I also have a series of IPs that I would like to group by location. I am using a lookup at search, but I am only interested one or two locations for a search. Some of the IP ranges are /24, so I would also like to use wildcards. I would like to make these changes when the log is loaded and not at search time so that I can search by location. Do I do this in transforms.conf? or is there another location?

fk319 · ‎02-07-2011

I had my account changed to admin, and I can see the graphs now, thanks yannk.

fk319 · ‎02-04-2011

I built my own app, and never went back to the basic search. All the "Search Activity" pages are blank, is there something that needs to be turned on?

fk319 · ‎02-03-2011

I was wondering if anyone has put an app together that watches Splunks logs? There are many details in the log, especially when it comes to the health of the server. From these logs, someone who is not me, can tune the box. I was wondering if anyone has put together such an app?

fk319 · ‎01-27-2011

I don't have much of an answer, but it can be done! I have views with several graphs, each code is identical except for the search. The thing that seem to stick out is when I use a group in my layout parameter, I don't have the bar. <module="HiddenPostProcess" layoutPanel="panel_row2_col1_grp1"> I hope this helps...

fk319 · ‎01-13-2011

It looks like it can be configured in transfomrs.conf http://www.splunk.com/base/Documentation/4.1.5/Admin/Transformsconf Things of note are MV_ADD = True and REGEX = (\S+) = (.*) FORMAT = $1::$2 you still need to deal with multi-line and extract headers A finial option is to build your own external program. I know this is not of much help, but can see the need for parsing e-mail headers for my self down the road and would like to wish you luck.

fk319 · ‎01-12-2011

This comes to mind: | table count(ip),count(distinct) by subject | top

Posts	144
Solutions	10
Karma Given	66
Karma Received	43
Member Since	‎10-19-2010

Online Status	Offline
Date Last Visited	‎03-18-2021 07:32 PM

Running a script on the Search Head initiated from...

How to search custom_data CSV files across several...

Splunk Cloud and AWS Elastic Load Balancer configs...

How to create a new rest command that creates new ...

SimpleXML HTML tokens in HTML tag

Install Directions

using sendemail in a dashboard

in Choropleth Maps, how do you set feature_id_elem...

Simple XML strips onclick from HTML button

Eval a string as an expression

Re: Reassign (or keep) variable in eval's IF state...

Re: Correlating two logs help, newbie

Re: Optimizing Dashboard Searches

Re: Search never finishes

Re: map serial to a name

Re: Removing CSV Header from Indexing

Re: Results file does not exist even though result...

Re: Max Response Time

Re: Help extracting fields (IPs and Ports) from a ...

Re: limiting the scope of index=* in a metadata se...

Re: Stopping the server during index

Re: How can I do extract fields through the CLI?

Re: IP address vs hostname

Splunk Receiving

Re: Latest + add 1 hour

Re: Latest + add 1 hour

Re: Latest + add 1 hour

Re: What changed that's requiring a restart?

adding lookup or eval to transforms.conf

Re: Is there an app to analyize splunks logs?

Re: Is there an app to analyize splunks logs?

Is there an app to analyize splunks logs?

Re: disabling chart scaling

Re: How to extract fields from email header to get...

Re: Difficult SMTP log search. Help!

Are you a member of the Splunk Community?