Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About gabriel_vasseur
gabriel_vasseur
Contributor
Member since:
03-14-2016
11-26-2025
Community Statistics
| Posts | 138 |
| Solutions | 8 |
| Karma Given | 73 |
| Karma Received | 39 |
| Member Since | 03-14-2016 |
Activity Feed
- Posted Re: Input settings for Microsoft Office 365 Reporting Add-on for Splunk on All Apps and Add-ons. 11-26-2025 09:16 AM
- Got Karma for Re: How to remove \ (backslash) using from URLs rex sed?. 12-10-2024 11:32 AM
- Got Karma for Re: How to run btool as REST command or via Search GUI?. 10-24-2024 01:50 PM
- Got Karma for Re: Is there a Splunk Version Control app?. 09-13-2023 01:28 PM
- Posted Re: How to change a Simple XML table height when no results is found? on Dashboards & Visualizations. 09-11-2023 07:44 AM
- Karma Re: How to change a Simple XML table height when no results is found? for Paul_Dixon. 09-11-2023 07:40 AM
- Posted Re: How to execute javascript after a search on Splunk Search. 07-05-2023 08:24 AM
- Karma Re: Can an HTML button with value be done without using JS and CSS scripts? for niketn. 07-05-2023 05:16 AM
- Posted Dashboard prebuilt panel not using JS/CSS from the dashboard on Dashboards & Visualizations. 07-05-2023 02:29 AM
- Got Karma for Re: How to export a dashboard as a PDF file and still maintain the same screen layout?. 06-29-2023 11:21 AM
- Posted Re: How to change a Simple XML table height when no results is found? on Dashboards & Visualizations. 06-27-2023 05:27 AM
- Posted Re: How to change a Simple XML table height when no results is found? on Dashboards & Visualizations. 06-27-2023 02:23 AM
- Posted Re: How to change a Simple XML table height when no results is found? on Dashboards & Visualizations. 06-27-2023 01:22 AM
- Posted Re: How do you make a table that reduces in height when your dashboard search returns no results? on Splunk Search. 06-26-2023 06:45 AM
- Posted How to change a Simple XML table height when no results is found? on Dashboards & Visualizations. 06-26-2023 06:44 AM
- Posted Re: How do you make a table that reduces in height when your dashboard search returns no results? on Splunk Search. 06-26-2023 01:59 AM
- Posted Re: Is there a Splunk Version Control app? on Knowledge Management. 05-17-2023 02:57 AM
- Posted Re: Splunk Enterprise Security: How to backup and version control correlation searches used on Splunk Enterprise Security. 05-17-2023 02:54 AM
- Posted Re: Source Control Management on Knowledge Management. 05-17-2023 02:53 AM
- Posted Re: Version control management for Splunk Dashboards, Reports and Alerts on Dashboards & Visualizations. 05-17-2023 02:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-06-2019
08:12 AM
I'm using the following search to measure throughput of each forwarder:
index=_internal sourcetype=splunkd metrics source=*metrics.log group=per_sourcetype_thruput | stats sum(kb) as kb by host
This works well generally, but there is one forwarder for which this gives nothing. I really don't understand why.
We do get its metrics logs in _internal, but they have no thruput logs. The docs say:
Thruput is measured in the indexing pipeline. If your data is not reaching this pipeline for some reason, it will not appear in this data.
I don't understand what that means. The forwarder in question is a universal forwarder. We have very similar forwarders for which we have no problem, so I can't really understand what's different.
Can anyone shed some light on this?
... View more
03-04-2019
06:57 AM
I came here with a similar question and as the existing answers didn't help me I kept on looking and found the Timeline - Custom Visualization app ( https://splunkbase.splunk.com/app/3120/ ). I haven't played with it yet but I believe it's exactly what I want to achieve. I also think it's a better solution to your problem as it will make it more obvious if you have overlaps between your jobs and you'll be able to visualise how many jobs were running at any given point.
... View more
01-10-2019
02:42 AM
1 Karma
We have the same problem. Lots of analysts are hitting their maximum concurrent search quotas and getting their searches queued, sometimes for several minutes, even though they are not running much at all. I'm disappointed no one answered that question. Did you figure out any solution yourself?
... View more
01-30-2018
07:31 AM
On the command line you can do:
splunk show kvstore-status
In a similar vein that you can check the SH cluster status:
splunk show shcluster-status
http://docs.splunk.com/Documentation/Splunk/7.0.1/Admin/TroubleshootKVstore
... View more
01-15-2018
01:48 AM
I downvoted this post because sorry, this doesn't help
... View more
01-15-2018
01:48 AM
Thanks for the link, unfortunately it doesn't help. Whether I search the notable index directly, with the macro, or use the Incident Review web UI, the fields I want are not there.
... View more
01-15-2018
01:37 AM
Yes, the fields are populated when I run the search in the search bar, but they are not included in the notable event.
... View more
01-05-2018
12:57 AM
I have a correlation search that includes the field host and is enriched with all the usual fields such as host_nt_host, host_ip, etc from using the get_asset macro.
I know that the host field in the correlation search results is replaced with the orig_host field in the stored notable event, but why are the other host_* fields not included in the notable index, even as orig_host_* fields? How can I get them?
I can see that etc/apps/SA-ThreatIntelligence/default/log_review.conf mentions fields like orig_host_nt_host in the list of incident review attribute. Yet still no trace of that field in the notable index.
The best workaround I can think of so far is to rename host to dest early in the correlation search, because I know this will work. However, it is not a satisfying solution since in the context of my correlation search the host is not a source or a destination, it's just a host...
... View more
06-01-2017
02:15 AM
I have noticed a correlation between RAM usage and I/O on my indexers. Whenever RAM usage goes around or above 50%, I/O usage goes crazy. My understanding is it's because spare RAM is used by the OS as I/O cache. We want to add more RAM to the indexers to help but I have two questions:
1) how much RAM is too much? We're thinking of doubling it, but would there be much value for performance and/or future-proofing in quadrupling it instead? (note: we're using Enterprise Security quite extensively)
2) can anybody give me recent official-looking references backing this up? This is required to justify the cost to people who might say "why do you need more memory, you're only using half at the moment?". All I have so far is this and that ancient articles, as well as somebody saying "I'm not from splunk so I can say it: you need as much RAM as you can afford" in the "It Seemed Like a Good Idea at the Time...Architectural Anti-Patterns" talk from conf 2016.
Thank you!
... View more
- Tags:
- ram
- splunk-enterprise
02-10-2017
02:25 AM
\o/ hurrah!
... View more
01-19-2017
05:08 AM
This is awesome, I had no idea it was possible to do this! 🙂
... View more
09-22-2016
02:51 AM
Thanks Sundaresh, I do appreciate your spending your time on my issue. I have added the following to your example:
<row>
<panel depends="$tokChk$">
<html>
<h1>Hello World!</h1>
</html>
</panel>
</row>
And it worked as intended: the panel is only displayed if the checkbox is ticked. However, one thing doesn't work as needed, and that's if the checkbox is not ticked, the search doesn't run at all. It just says "Search is waiting for input...". The fix for that is to specify either <default></default> or <initialValue></initialValue> in the checkbox definition. If I do that, the search works well whether the box is ticked or not, but now the problem is that the panel that depends on $tokChk$ is now displayed all the time.
That's why in my original post I was trying to solve that problem by using another token...
... View more
09-21-2016
05:59 AM
I'm not sure what you mean, but $transaction_token$ gets set as soon as I hit the submit button, whether or not the checkbox is ticked. Whatever happens, it is never unset after that. That's why I think I need $using_transactions_token$ , but I just can't get that to work.
... View more
09-20-2016
08:48 AM
This is awesome, as I had the same issue, however I am not using a drilldown from within the table, so I'm guessing table.on('click',... needs to be replaced with something along the lines of submitButton.on('click',... ? The question then becomes how to get the submitButton? I can't give it an id in my simple XML, because all I have is <fieldset submitButton="true" ... can anybody help a bit further?
... View more
09-20-2016
12:55 AM
Thanks, that will be useful once I've past the first hurdle, which is to get a token to be set/unset when the check box is ticked. As I said in my question, the following doesn't work (the token is always set to NOTRANSACTION, presumably because $value$ is not the right thing to be looking at...):
<change>
<condition match="isnull($value$) OR $value$==""">
<set token="using_transactions_token">NOTRANSACTION</set>
</condition>
<condition>
<unset token="using_transactions_token"/>
</condition>
</change>
Any suggestions about this?
... View more
09-19-2016
03:54 AM
Variations of this questions have been asked many times but so far none of what I've seen has helped me. That's why I need your wisdom.
I have a form with 2 text fields and a check box. I want a panel to appear if the check box is ticked and the text fields are both left to their default value '*'. This is because the check box makes the search use a transaction and if none of the text fields are populated, it's going to have to work on possibly a huge amount of data. If that happens, I want a panel to appear to warn the user.
<fieldset submitButton="true" autoRun="false">
<input type="text" token="user_token" searchWhenChanged="false">
<label>user</label>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="text" token="host_token" searchWhenChanged="false">
<label>host</label>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="checkbox" token="transaction_token" searchWhenChanged="false">
<label>Transaction</label>
<choice value="| transaction session_id">Transaction</choice>
<default></default>
</input>
</fieldset>
To start small, I have tried this:
<row>
<panel depends="$transaction_token$">
<html>
<b>Warning</b> blah blah blah
</html>
</panel>
</row>
But this displays the panel as soon as I press the submit button, whether or not I have ticked the box.
So then I tried something like:
<input type="checkbox" token="transaction_token" searchWhenChanged="false">
<label>Transaction</label>
<choice value="| transaction session_id">Transaction</choice>
<default></default>
<change>
<condition match="isnull($transaction_token$) OR $transaction_token$==""">
<set token="using_transactions_token">NOTRANSACTION</set>
</condition>
<condition>
<unset token="using_transactions_token"/>
</condition>
</change>
</input>
And that almost works but it's erratic just like a previous question I asked a while ago. So I thought the fix would be similar and I did:
<input type="checkbox" token="transaction_token" searchWhenChanged="false">
<label>Transaction</label>
<choice value="| transaction session_id">Transaction</choice>
<default></default>
<change>
<condition match="isnull($value$) OR $value$==""">
<set token="using_transactions_token">NOTRANSACTION</set>
</condition>
<condition>
<unset token="using_transactions_token"/>
</condition>
</change>
</input>
But that does not work. I even tried value instead of $value$ like I've seen in some other answers here, but to no avail. That is my first hurdle. Once I get that working, I'll then need something similar for the text fields (I think that should be easier) and then I need to get something like this to work:
<row>
<panel depends="$using_transaction_token$ AND $default_user$ AND $default_host$">
<html>
<b>Warning</b> blah blah blah
</html>
</panel>
</row>
I'm not even sure if ANDing depends is possible and, if it is, how to do it.
Beyond helping me with that particular problem, I would be grateful if someone could also advise me on where I can get proper information on how these things work. Searching splunk answers yields the occasional gem, but more often than not it goes in many directions that are not my exact problem. I had a look at the docs but they barely scratch the surface of what's possible. So any good resource pointer would be great. Give a man a fish versus teach a man to fish, etc...
If that's relevant: I'm on 6.4.
... View more
08-23-2016
12:43 AM
Yes, that is best. I mostly commented for the educational value!
... View more
08-22-2016
06:53 AM
That's a good point, I don't know how easy it is to gather an exhaustive list.
... View more
08-22-2016
02:03 AM
I like mhpark's answer, but I thought I would comment on your original regex too.
First, is your main problem with it performance or elegance? I think the job inspector might help measure the performance, maybe there's a line dedicated to regexes. If performance isn't an issue, then elegance should not keep you awake at night, as much as maintainability. In that respect, your regex isn't particularly nasty.
About the regex itself, first up all your dots should be escaped, especially the one outside the parenthesis. As I'm sure you know, dots match any character so for instance this bit of your regex: (com.pega.pegarules.pub).(?<type>\w+)(\s|:)" would match the string com.pega.pegarules.public: and extract "ic" as a type... 🙂
You can also speed things up a bit by starting with a word boundary: \b(com\.pega\.apache\.http\.conn|java\.sql|....... .
Finally, you could regroup similar alternatives together. So for instance, you could replace com\.pega\.apache\.http\.conn|...|com\.pega\.pegarules\.pub\.clipboard with com\.pega\.(apache\.http\.conn|pegarules\.pub\.clipboard)|... . That should speed things up a bit, but again you need to benchmark it to see if it's worth the loss in readability.
That's assuming you're not going with something a lot simpler (but is it faster? :-P) like mhpark suggested.
... View more
08-18-2016
02:44 AM
No solution so far. I still need to formally tell splunk about the bug.
... View more
08-05-2016
12:44 AM
1 Karma
Interesting read, thanks!
... View more
08-04-2016
06:43 AM
Glad I could help! For tidyness (and karma!) I have copy-pasted my comment as an answer so that you can accept it. 🙂
... View more
08-04-2016
06:42 AM
2 Karma
The index-time extraction is definitely an option, but that will take up a lot of resources and my understanding is it's not recommended unless it's a very important use case for you.
An in-between solution would be to create a simple data model, extracting exactly the fields you need, and accelerating it. If you mostly only do searches for recentish times (say in the last week or the last month) that will have a smaller impact (you can choose how long you accelerate the data model for: 1d, 7d, 30d, 3 months, 12 months, all time). The advantage is that you can wipe it out at any point and start over, since the acceleration is independent from the indexed raw data.
... View more
08-04-2016
03:19 AM
1 Karma
I have a form with a table populated by a search. The search can be tweaked via a few dropdown inputs: value of some fields, time picker, etc. I have noticed the following bug:
I choose some combination of filters, I get 4 results in my table
I choose another combination of filters, I get many results, much more than can be displayed in a single page of the table
I click next >> at the bottom of the table to see what's on page 2
I revert to the initial combination of filters that gets 4 results: the table shows No results found <--- BUG!!!! 😞
I change back to the other combination of filters, I have results again and the table is still on page 2
I click << prev at the bottom of the table to go back on page 1
I revert to the initial combination of filters that get 4 results: the results are displayed once again as expected
Splunk developers: please fix the bug!
Splunk gurus: can you think of a some option I can use so that when the search runs the page to display gets reset to 1?
If that's relevant: I'm using Splunk Enterprise 6.4.1, the inputs are all set to searchWhenchanged="true" and there is no submit button.
... View more
08-03-2016
03:34 AM
1 Karma
Apparently there is some white space at the end of the lines. So this should take care of it:
(?P‹lastIP›\d+\.\d+\.\d+\.\d+)"\s*$
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-26-2025
09:04 AM
|
Karma given to
