Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About raidercom
raidercom
Communicator
Member since:
05-03-2012
12-19-2021
Community Statistics
| Posts | 42 |
| Solutions | 3 |
| Karma Given | 1 |
| Karma Received | 4 |
| Member Since | 05-03-2012 |
Activity Feed
- Karma Re: Splunk Studio Dashboard Chart Options Not working for TooManyQuestion. 12-19-2021 06:36 AM
- Got Karma for Splunk Studio Dashboard Chart Options Not working. 12-17-2021 01:00 AM
- Posted Re: Backfill Scripted Input Data on Getting Data In. 09-11-2021 02:47 PM
- Posted Splunk Studio Dashboard Chart Options Not working on Dashboards & Visualizations. 09-09-2021 05:40 PM
- Posted Backfill Scripted Input Data on Getting Data In. 09-08-2021 09:22 PM
- Posted Re: Chained Searches in a Dashboard on Dashboards & Visualizations. 08-06-2021 11:36 AM
- Posted Chained Searches in a Dashboard on Dashboards & Visualizations. 08-06-2021 07:05 AM
- Posted Re: Garmin Add-On for Splunk Issue on All Apps and Add-ons. 06-04-2021 04:59 PM
- Posted Garmin Add-On for Splunk Issue on All Apps and Add-ons. 06-04-2021 02:25 PM
- Posted Re: Dockerized Splunk Time Zone Forced to UTC on Splunk Search. 06-02-2021 07:41 PM
- Got Karma for Dockerized Splunk Time Zone Forced to UTC. 06-02-2021 02:57 PM
- Posted Dockerized Splunk Time Zone Forced to UTC on Splunk Search. 06-02-2021 02:51 PM
- Got Karma for Re: Query against a list of computers. 06-05-2020 12:46 AM
- Got Karma for Re: Query against a list of computers. 06-05-2020 12:46 AM
- Posted Re: Query against a list of computers on Splunk Search. 01-10-2014 07:52 AM
- Posted Query against a list of computers on Splunk Search. 01-10-2014 06:22 AM
- Tagged Query against a list of computers on Splunk Search. 01-10-2014 06:22 AM
- Tagged Query against a list of computers on Splunk Search. 01-10-2014 06:22 AM
- Posted Re: Splunk DB Connect App not putting data in Splunk index on All Apps and Add-ons. 08-19-2013 01:16 PM
- Posted Re: Splunk DB Connect App not putting data in Splunk index on All Apps and Add-ons. 08-19-2013 11:19 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-11-2021
02:47 PM
I ended up merging 2 solutions. 1) scripted input that runs a bash script that outputs to a file 2) monitor that log file
... View more
09-09-2021
05:40 PM
1 Karma
I'm following the Line Chart example in the Studio Dashboard app in Splunk index=_internal _sourcetype IN ( splunk_web_access, splunkd_access) | timechart count by _sourcetype "viz_ZrQCy9wp": { "type": "viz.line", "options": { "fieldColours": { "splunk_web_access": "#FF0000", "splunkd_access": "#0000FF" } }, I cannot get it to set the field name colours in a timechart. I'm having an issue with that on other searches, as well as the 2nd y axis settings not appearing to work. Has something changed with how Splunk handles charts in Studio Dashboard? Thanks
... View more
Labels
- Labels:
-
Dashboard Studio
-
timechart
09-08-2021
09:22 PM
I'm running Splunk 8.2.2 in a docker container. I'm using a separate app with a scripted input to get data into Splunk via a bash script. That script works perfectly, except when the source API screws up, or when I delete the index and need to backfill all of the previous data. The scripted input is setup in inputs.conf as: [script://$SPLUNK_HOME/etc/apps/app/bin/app.sh] interval = */5 * * * * Is there a way to manually run a script one time and have splunk consume the output? I'd really like to avoid setting up a regular monitor, and have splunk consume a regular file just for a backfill operation. I'd also like to avoid modifying the working scripted input. Thank you for any suggestions you can provide.
... View more
Labels
- Labels:
-
scripted input
08-06-2021
11:36 AM
Found the issue Didn't notice this one line in the documentation: If the base search is a non-transforming search, you must explicitly state in the base search what fields will be used in the chain search using the fields command. from https://docs.splunk.com/Documentation/Splunk/8.2.1/DashStudio/dsChain
... View more
08-06-2021
07:05 AM
Hi: I am testing out the new dashboard options with Dashboard Studio, and I am a bit confused as to how a feature works. I want to use a base search 'index=nginx source="/var/log/nginx/access.log"', I have that setup in DataSource. I then want to chain that to multiple modifiers. For this end, I added a Chain search '| stats count by status', linked to the Parent Search above, I also created another chain search '| search splunk*' for some testing. If I create a dashboard panel graph (pie), and link it to the stats search, it says it can't find any data 'Search ran successfully, but no results were returned'. If I click the magnifying glass from that, it returns results. If I have a table panel, and use the splunk search chain search, it finds results. If I have a chained search that uses '| search site=splunk*', despite that field existing, it finds no results, but the magnifying glass does. Can auto extracted fields not be used in this manner? The data in the source logs are all in the format <key>="value" for easy auto extraction of the fields. Thank you for any assistance/information you can provide.
... View more
06-04-2021
04:59 PM
I did put some dummy data into the index, so I know that the index does work. I am confused about the metrics, because that leads me to believe that the script is pulling data, just not indexing it for some reason. I cannot see the file within the container that is being referenced by the metrics, nor any non-dummy data in the index. Really confused as to what is happening.
... View more
06-04-2021
02:25 PM
Hi: I was trying to get the app Garmin Add-On for Splunk (https://splunkbase.splunk.com/app/5035/) working on my dockerized instance. I followed the entire setup procedure without issue, but when the cron tried to run, it doesn't appear to post any data into the index. I upped the run interval, for one of the inputs to run at 1-59/5 * * * * and the other at */5 * * * * When I check the _internal index to see what it is doing, the only events I can see are: 06-04-2021 17:20:00.000 -0400 INFO ExecProcessor [895 ExecProcessor] - setting reschedule_ms=300000, for command=/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA_garmin/bin/activities.py 2021-06-04 17:20:00,262 INFO Authenticating to Garmin Connect... 06-04-2021 17:20:27.939 -0400 INFO Metrics - group=per_source_thruput, series="/opt/splunk/var/log/splunk/ta_garmin_activities.log", kbps=0.005, eps=0.097, kb=0.146, ev=3, avg_age=0.000, max_age=0 06-04-2021 17:21:00.008 -0400 INFO ExecProcessor [895 ExecProcessor] - setting reschedule_ms=299992, for command=/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA_garmin/bin/daily_summary.py 2021-06-04 17:21:00,247 INFO Authenticating to Garmin Connect... 06-04-2021 17:21:29.939 -0400 INFO Metrics - group=per_source_thruput, series="/opt/splunk/var/log/splunk/ta_garmin_dailysummary.log", kbps=0.005, eps=0.097, kb=0.146, ev=3, avg_age=0.000, max_age=0 06-04-2021 17:21:29.940 -0400 INFO Metrics - group=per_sourcetype_thruput, series="ta_garmin:log", kbps=0.005, eps=0.097, kb=0.146, ev=3, avg_age=0.000, max_age=0 I tried running it manually within the container with: sh-4.4$ export LD_LIBRARY_PATH=/opt/splunk/lib/:$LD_LIBRARY_PATH sh-4.4$ /opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA_garmin/bin/activities.py but, that just hangs waiting forever, doing something. Please let me know if I opened this in the wrong area. Any thoughts on things I could try? Thanks -Jeff
... View more
Labels
- Labels:
-
configuration
-
installation
-
troubleshooting
06-02-2021
07:41 PM
Figured out the issue. Was able to fix it with: docker exec -ti splunk sudo microdnf -y --nodocs reinstall tzdata rather than the original: docker exec -ti splunk sudo microdnf -y --nodocs update tzdata Not sure why the docker image acts differently, especially since the Linux version used is the same between 8.1.3 and >8.1.3
... View more
06-02-2021
02:51 PM
1 Karma
I'm having an issue with dockerized splunk post 8.1.3 free. The timezone in the web interface remains as UTC. With 8.1.3, I could get around the timezone issue by running: docker exec -ti splunk sudo microdnf -y --nodocs update tzdata on startup of the container Post 8.1.3, the time within the container remains as UTC, even with tzdata installed. Is this expected behaviour? Sample from the docker compose that brings up splunk: Docker compose: splunk: container_name: splunk image: splunk/splunk:latest #image: splunk/splunk:8.1.3 environment: - TZ=America/Toronto #- TZ=Canada/Eastern With 8.1.3 Pulling splunk (splunk/splunk:8.1.3)... 8.1.3: Pulling from splunk/splunk Digest: sha256:fd7dfb17323ee093ca36b71befa71e5074f8a6dc592475407927a0d443022a03 Status: Downloaded newer image for splunk/splunk:8.1.3 date Wed Jun 2 17:19:41 EDT 2021 With Latest: latest: Pulling from splunk/splunk date Wed Jun 2 21:36:34 America 2021 Does anyone have any suggestions of things I could try? Thanks -Jeff
... View more
Labels
- Labels:
-
other
01-10-2014
06:22 AM
Hi:
We have a bunch of searches that are being run against a specific set of hosts (we'll say:
TV-host1, TV-host2, TD-host1, TD-host2
i want a way to run a set of saved searches against a list of hosts specified in another saved search.
I currently am doing this in the following method:
savedsearch1:
host="T*-host*"
saved searches that use this:
| savedsearch1 | rest of query
I realize that this is extremely inefficient because it pulls all the logs for those hosts, then narrows down the results from there.
Is there a way to take the actual search syntax from a saved search and apply it to another search inline?
The reason I'm asking this is because I want some saved searches set so that it queries against specific hosts, and if we have a new naming standard, then all I need to do is modify the search that handles the hostnames, rather than modifying 25 other searches and modifying the host syntax on those.
Another question I have, is there a way to narrow down hostname based on a regex, rather than the any character *?
Such as T*-host[0-9]*
So that would find TV-host1, but not TV-hoster2?
We have a couple of hosts that are named similar, and it is confusing some of the saved searches we have.
Thanks for any assistance you could provide
-Jeff
... View more
- Tags:
- host_regex
- search
08-19-2013
01:16 PM
Getting a different error related to the previous error: dbx5932:WARN:ResultSetOutputPayload - Error parsing timestamp '2013-08-19 15:22:35' with the given format 'java.text.SimpleDateFormat@ff7867f8': java.text.ParseException: Unparseable date: "2013-08-19 15:22:35"
Doing the conversion on the SPlunk end because I didn't think that it would be able to handle:
2010-07-28 09:42:33 == 1280324553.432
... View more
08-19-2013
11:19 AM
Why use initial date in the rising column field?
The only field that increments will be the redeem_id. Everything else can be duplicated or fluctuate depending on when the data was input into the database.
I'm also not sure why the date should be specified in the format:
yyyy-MMM-dd HH:mm:ss.SSS
When the format in the SQL query is YYYY-MM-DD HH24:MI:SS
I'm running another test with:
output.timestamp.parse.format=yyyy-MMM-dd HH:mm:ss.SSS in the inputs.conf in the dbx app
and with the format for the date as:
yyyy-MMM-dd HH:mm:ss.SSS
... View more
08-19-2013
10:44 AM
I've switched it to a much simpler query, and I'm getting a weird error on the timestamp:
Timestamp format:
yyyy-MM-dd HH:mm:ss
Query:
SELECT to_char(r.INITIAL_DATE,'YYYY-MM-DD HH24:MI:SS') AS "InitialDate", r.REDEEM_ID, r.PDC_USER_ID FROM PDC.REDEEM r {{WHERE $rising_column$ > ?}}
Error:
dbx6516:WARN:ResultSetOutputPayload - Unrecognized timestamp format: '2013-08-01 09:24:05'
host=tps-splunkweb1.points.com Options| sourcetype=dbx_debug Options| source=/opt/splunk/var/log/splunk/dbx.log Options
... View more
08-15-2013
12:01 PM
When I try a tail, I cannot get the query to work at all, just says that the SQL is invalid. I've worked with our DBA, and it seems to be related to multiple WHERE clauses, since the select we are using is joining multiple tables.
... View more
08-15-2013
07:06 AM
The first part of the select query is SELECT to_char(r.INITIAL_DATE,'YYYY-MM-DD HH24:MI:SS') AS "InitialDate",
... View more
08-15-2013
06:21 AM
crud, was looking at the wrong file.
it contains (some information changed for <>:
[script://$SPLUNK_HOME/etc/apps/dbx/bin/jbridge_server.py]
disabled = 0
[batch://$SPLUNK_HOME/var/spool/dbmon/*.dbmonevt]
crcSalt =
disabled = 0
move_policy = sinkhole
sourcetype = dbmon:spool
[dbmon-dump:// /DBXTest3]
host =
index = dbxtest
interval = 20 * * * *
output.format = kv
output.timestamp = 1
output.timestamp.column = Timestamp
output.timestamp.format = yyyy-MMM-dd HH:mm:ss
query = SELECT
sourcetype = dbmon:kv
table = DBXTest3
... View more
08-15-2013
05:45 AM
No.
the only thing in my dbx/local/inputs.conf is the lines specifying the index:
[dbxtest]
coldPath = $SPLUNK_DB/dbxtest/colddb
homePath = $SPLUNK_DB/dbxtest/db
thawedPath = $SPLUNK_DB/dbxtest/thaweddb
... View more
08-14-2013
01:44 PM
The app version is the same, the OS and Splunk version are different:
Actual:
CentOS 6.4
Splunk 5.0.2 (build 149561)
Splunk DB Connect dbx 1.0.11
Test:
Windows Server 2003 Standard
Splunk 5.0.1 (build 143156)
Splunk DB Connect dbx 1.0.11
... View more
08-14-2013
12:59 PM
Hmm... Splunkd.log and the other splunkd.log* files don't mention anything like that.
Does that mean that the app wasn't installed correctly in the first place?
-Jeff
... View more
08-14-2013
12:02 PM
2013-08-14 14:20:06.159 dbx9265:INFO:DumpDatabaseMonitor - Database monitor=[dbmon-dump://DMART/DBXTest3] finished with status=true resultCount=226687 in duration=6157 ms
2013-08-14 14:20:06.159 dbx9265:INFO:ExecutionContext - Execution finished in duration=6158 ms
2013-08-14 14:20:06.159 monsch1:INFO:Scheduler - Execution of input=[dbmon-dump://DMART/DBXTest3] finished in duration=6157 ms with resultCount=226687 success=true continueMonitoring=true
... View more
08-14-2013
12:02 PM
2013-08-14 14:20:00.001 dbx9265:INFO:DumpDatabaseMonitor - Executing database monitor=[dbmon-dump://DMART/DBXTest3]
2013-08-14 14:20:00.297 dbx9265:INFO:SpoolOutputChannel - Moving temporary file /opt/splunk/var/run/tmp/dbx/kv_7011579052063595050.dbmonevt with size=5243011 to destination /opt/splunk/var/spool/dbmon/kv_1376504400296939423.dbmonevt
... View more
08-14-2013
12:02 PM
Nothing strange in the dbx log, just the execution successful messages.
Splunkd.log doesn't have anything related to dbx
The index still appears to be empty
The query works perfectly from the DB Query page, returning the same # of results as the scheduled query.
... View more
08-14-2013
06:01 AM
Hmm.. I've created a new index, created a new database input. I get the same thing.
2013-08-14 08:20:07.671 monsch1:INFO:Scheduler - Execution of input=[dbmon-dump://DMART/DBXTest3] finished in duration=7635 ms with resultCount=226669 success=true continueMonitoring=true
Even weirder, have the exact same query, database connections, indexes on a test server, and it works there. Have a problem with the dates on the test server, but that is another story.
... View more
08-12-2013
12:36 PM
Will do.
I'll test this in the next day or so.
Thank you VERY much for the assistance you've provided.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-19-2021
09:56 AM
|
