Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About linu1988
linu1988
Champion
Member since:
12-18-2012
06-05-2020
Community Statistics
| Posts | 979 |
| Solutions | 75 |
| Karma Given | 127 |
| Karma Received | 253 |
| Member Since | 12-18-2012 |
Activity Feed
- Got Karma for Re: Throttling-parameters in realtime search. 01-04-2023 06:13 AM
- Got Karma for Re: Convert a string into a number. 02-03-2022 07:44 AM
- Karma Re: Is there a way to change the font size or bold text in alert emails? for martin_mueller. 06-05-2020 12:48 AM
- Karma Re: Require input value in text box for dfoster_splunk. 06-05-2020 12:47 AM
- Karma Re: How to prevent | stats count in a macro from triggering a remote search? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time? for devicenul1. 06-05-2020 12:47 AM
- Karma Re: What is the easiest way to identify my universal forwarder versions for kscher. 06-05-2020 12:47 AM
- Karma Re: http://localhost/en-US/debug/refresh from terminal/console for MuS. 06-05-2020 12:47 AM
- Karma Re: Alert if source stops indexing for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: How do i ignore the new line character in the _raw field? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Python Script Not working via search command for psobisch. 06-05-2020 12:47 AM
- Karma Re: How to join value using wildcard? (Urgent) for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Are there any search and performance pitfalls with keeping data in hot buckets for 1 month and moving it from hot to cold directly? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: Is it possible to update a table with a drilldown value from another table's field in the same browser tab? for vtsguerrero. 06-05-2020 12:47 AM
- Karma Re: how to get 1st 2nd and 3rd place results? - based on value of a field - not frequency. for colineltringham. 06-05-2020 12:47 AM
- Karma Re: 6.1.3 issue with mounted Bundles for michael_herbert. 06-05-2020 12:47 AM
- Got Karma for Re: indexer configured but inactive on new Linux servers. 06-05-2020 12:47 AM
- Got Karma for Re: How to fix perfmon errors "Object specified...in conf file is not valid"?. 06-05-2020 12:47 AM
- Got Karma for Re: How to fix perfmon errors "Object specified...in conf file is not valid"?. 06-05-2020 12:47 AM
- Got Karma for Re: DBX JOIN 2 databases together. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
07-08-2013
12:28 PM
According to your post "I have a search that finds failed jobs from my logs." what does that mean? how do you know that it's a failed job event, could you tell us?
... View more
07-08-2013
12:02 PM
1 Karma
As you mentioned in the mail post your search gives you the failed job list.
Just write your search which gives you the all the events
your search jobid=[|search failed jobid]. this will only give you the failed job events.
... View more
07-08-2013
11:43 AM
First extract the job number fields and then use a subsearch, filter out the failed job events.
... View more
07-08-2013
11:36 AM
i guess you have to increase the subsearch limit in the limits.conf file. I am not fully sure but check with limits.conf which has 10000 values set. change one by one which you may feel appropriate.And for changing configs you don't have to restart server. Only splunk restart from command line will do.
... View more
07-08-2013
09:38 AM
1 Karma
From your case i suspect it will be a realtime thing. Put your search and schedule it from "rt - 1m" to "rt". It will keep searching the time window. If the case satisfies you can set up an alert. Hope i understand it correctly. Thanks
... View more
07-08-2013
08:20 AM
Currently we don't feel much impact, but Errors like javabridge error,Bundle archiver warning. Everything seems to be fine but in SOS app the error level is pretty high. I am concerned about future when it's in full scale.
... View more
07-08-2013
07:33 AM
Hello All,
I am seeing long set of splunkd errors. Most of them are repeated. I wanted to know if affects the splunk performance? Do i need to worry about the splunk internal errors, which doesn't really affect my operations?
... View more
07-08-2013
07:05 AM
http://splunk-base.splunk.com/apps/36405/sideview-utils-lgpl.
Please see the usage terms and conditions. But for reference it's the best
... View more
07-08-2013
06:31 AM
Please refer to Splunk UI examples APP / Sideview Utils APP.
You can create dashboards with pulldown /dropdown modules to fill your session ids. Then pass the variable to the search in the dashboard panel. Thanks.
http://docs.splunk.com/Documentation/Splunk/latest/Viz/Exampledashboard
... View more
you need to replace the _time fields as below(if i understand correctly you are using timechart):
your search|eval _time=strptime(Time,"%y/%m/%d %H:%M:%S")|timechart ...
then see in a table if its correct. You will be able to use the timechart option according to the custom Time field. Thanks, hope it clarifies..
... View more
07-08-2013
03:46 AM
From the splunk documentation there is no additional parameters can be passed. But what is the difference between the sourcetype and additional_info? it's the same if we use in search.
... View more
07-08-2013
03:15 AM
1 Karma
Could you try table A,B then mvexpand B? Then try with mvzip.
... View more
07-08-2013
03:12 AM
use the props.conf to set up your indexing time rather than the event time.
DATETIME_CONFIG=NONE/ CURRENT
If the data is already indexed there is nothing that can be done. Either it has to be deleted/ the captured time needs to be used.
... View more
07-05-2013
02:31 PM
First of all it will not matter in some cases. I would consider below points.
1) Existing implementation plan
2) Whether all the functionality are still available as old versions (Depreciated functionality)
3) Some forwarders doesn't work well even if it's newer version (tested on my own/check compatibility)
4) Upgrading means splunk will migrate settings to newer version of installation (i.e. almost a single step)
Hope you will figure out these things before you go for a full implementation
... View more
07-05-2013
11:13 AM
That's splunk for you. You cant delete the indexed data randomly. The above one is actually a pretty good workaround. The metadata can never be removed until and unless you clean the index.
... View more
07-05-2013
11:04 AM
I suppose we need to delete the index to clean the data. While forwarding the data we have to explicitly define source/sourcetype to avoid the confusion. But the source name is important. So we can use blacklist/whitelist to forward the required files only.
... View more
07-05-2013
10:56 AM
You can't delete the sources itself. If you want to delete the data in your indexes, please use the below command
Stop splunkd
Go to -> splunk//bin folder
splunk clean eventdata. Your data will be cleaned from the indexes.
Please refer this:
http://docs.splunk.com/Documentation/Splunk/5.0.3/Indexer/RemovedatafromSplunk
... View more
07-05-2013
08:32 AM
1 Karma
What i checked, Bucket command is making it an interval of 1 hour to latest events to older ones. When you apply transaction it doesn't find the respective end to complete the transaction.
... View more
07-05-2013
02:03 AM
1 Karma
Please don't extract it, Do a installation in the default folder. I think JVM is not installed properly. I did some research and i found that in the python files we have paths as C:\Program files(x86)\Java\jdk6/jre6 mentioned by default or it will search for the environment variable. I would urge you to remove the existing folder and delete the env variable. Do a fresh installation with jdk-7u25-windows-x64.exe, then set the environment variable. It should work perfectly.
... View more
07-05-2013
01:19 AM
Which version it is? 64-bit/32-bit? Delete the existing JAVA_HOME variable. set JAVA_HOME=C:\Progra~1\Java\jdk1.7.0_25 then check.. because i has the same issue setting up Java_Home.
and where did you install in program files / program files//Java directory?
... View more
07-05-2013
12:55 AM
1 Karma
By default the subsearch result set limit is set to 10000. You can increase it in the limits.conf file. But it's not recommended to go beyond 10500. I have not tried to modify it to greater value but if its not working then need to think of something else. May be you can use Join which has a greater sub search value.
maxout =
* Maximum number of results to return from a subsearch.
* This value cannot be greater than or equal to 10500.
* Defaults to 10000.
Please refer:
http://docs.splunk.com/Documentation/Splunk/5.0.3/Admin/Limitsconf
... View more
07-04-2013
10:33 PM
try run-> cmd
set JAVA_HOME=C:\Program Files\jdk1.7.0_25
that will do the job
... View more
07-04-2013
11:21 AM
May be dc doesn't work on multiple fields..
you can get it like this:
| stats distinct_count(ua_family) ua_ip dd by ua_family,cp_ip|stats count(ua_ip)
... View more
07-04-2013
07:42 AM
From my point of view, NOT is like a logical operator rather than the exact "Not equal to operator" which should be considered as an arithmetic operator. Internally it should work like that as other languages, but sometimes it's output makes us think them the same.
... View more
