Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About Hazel
Hazel
Communicator
Member since:
04-08-2010
06-05-2020
Community Statistics
| Posts | 77 |
| Solutions | 3 |
| Karma Given | 43 |
| Karma Received | 36 |
| Member Since | 04-08-2010 |
Activity Feed
- Karma Why does Splunk have multiple indexes? for maverick. 06-05-2020 12:45 AM
- Karma Extracting multiple field values from a comma seperated list for Josh. 06-05-2020 12:45 AM
- Karma Re: How to specify an owner for pre-canned saved searches for app packaging? for muebel. 06-05-2020 12:45 AM
- Karma Re: Two different sourcetypes in the same folder for the_wolverine. 06-05-2020 12:45 AM
- Karma Re: Two different sourcetypes in the same folder for gkanapathy. 06-05-2020 12:45 AM
- Karma Re: Multiple Pie Charts from one search for gkanapathy. 06-05-2020 12:45 AM
- Karma Re: Multiple Pie Charts from one search for gkanapathy. 06-05-2020 12:45 AM
- Karma How do I perform this awk command in Splunk? for Johnvey. 06-05-2020 12:45 AM
- Karma Is there a CLI command that will return license info? for Mick. 06-05-2020 12:45 AM
- Karma Re: Is there a CLI command that will return license info? for Mick. 06-05-2020 12:45 AM
- Karma Re: Field Extractions for gkanapathy. 06-05-2020 12:45 AM
- Karma Splunking mutiline logfiles for Josh. 06-05-2020 12:45 AM
- Karma How should Splunk integrate with other operations management/monitoring tools? for Justin_Grant. 06-05-2020 12:45 AM
- Karma Can I email a pdf on demand? for matt. 06-05-2020 12:45 AM
- Karma 2 different timestamps in single log for Starlette. 06-05-2020 12:45 AM
- Karma Re: Showing multiline _raw data in a table for Johnvey. 06-05-2020 12:45 AM
- Karma Sending variables to a dashboard for vbumgarn. 06-05-2020 12:45 AM
- Karma Re: Host name in inputs.conf file for gkanapathy. 06-05-2020 12:45 AM
- Karma Can you add your own custom alert action? for Lowell. 06-05-2020 12:45 AM
- Karma checkbox in form or dashboards? for dcroteau. 06-05-2020 12:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 3 |
08-19-2010
05:20 PM
Hello again. I tried this, it works to split up the ports again. Do you know how I can get a link between the my two xpaths.. to know which port number goes with which server url?
... View more
08-19-2010
05:17 PM
Thankyou. I thought perhaps I might not be using the correct approach. We are just looking to pick out certain values from the xml config and generate a report of those values. E.g in this case, we want to know which serverUrls go with which ports. I have raised a support case.
... View more
08-19-2010
04:51 PM
Hello - thanks for the suggestion. The config file comes through as one event, as this is how we need it for another use case. So i would prefer to do it at runtime. How are you suggesting to use rex? If the lines are their own event, then how can i link up the line that says the port number and the link that says the ems server url?
... View more
08-19-2010
04:04 PM
Hello, yes if i switch them you get the same error but the other way round (serverUrl=ab, port=1, port=2)
... View more
08-19-2010
01:53 PM
2 Karma
Hello,
I am trying to use xpath to retrieve certain fields from my xml file. The file looks something like this
<machines>
<machine name=a port=1 active="true">
<value>
<replace>Example<replace/>
<cfg>
<serverUrl>URL1</serverUrl>
<serverUsername>Username1</serverUsername>
</cfg>
</value>
</machine>
<machine>
<machine name=b port=2 active="true">
<value>
<replace>Example<replace/>
<cfg>
<serverUrl>URL2</serverUrl>
<serverUsername>Username2</serverUsername>
</cfg>
</value>
</machine>
</machines>
I want to pick out certain fields and link them together. For example, one report is to get the machine port and the serverUrl and show a table. E.g it would be
Node URL
1 URL1
2 URL2
The following commands get me the info I need. But if i put them together, the first breaks.
Command is as follows
index=DTS sourcetype=config | xpath "//machine/@port" outfield=port | xpath "//machine/value/with/cfg/serverUrl" outfield=name
Separately these work correctly and I see multiple values coming up. E.g port =1, port = 2 OR name=a, name=b
If I pipe, i get port = 12, name=a, name=b ie it joins the first result into a string.
Any ideas how i can get the table i am looking for?
Thanks
Hazel
... View more
06-15-2010
05:07 PM
hello, could you let me know what exactly you typed in the box to fix this? How do i know what the url should be for my hostname?
... View more
06-15-2010
09:22 AM
I still don't understand this. They are in different indexes, but they are on different indexers, reporting to different search heads... so how can this work?
... View more
06-14-2010
07:58 AM
This answer has been voted up but it does not answer my question. The answer relates to splitting out data over a search head but my question relates to data that is sent to different search heads.
... View more
06-08-2010
03:05 PM
Hi, I'm not sure I understand your answer. The issue here as that the UAT data is indexed to one server and available on one search head and the Production data is indexed to one server and availabled on the Production search head. UAT and Production are not connected, they are different systems and setups. But, I need to get my UAT data, into the Production searches
... View more
06-08-2010
11:16 AM
Hello, are you able to help with what font packages we need for RedHat & Suse?
... View more
06-08-2010
11:14 AM
Hello,
We currently have a Splunk setup as follows
UAT: Three indexers (NY, LDN, SGP), each collect data from forwarders in their regions and then searches from each region also distribute across the other two regions, allowing us to get global data from each search head.
Prod: Similar setup to UAT.
The problem I have now is that I have some servers that are both my UAT and my Disaster Recovery for Production. They contain some files for UAT, which I want to search in UAT Splunk and some files for DR that I want to search in my Splunk Production.
I know that we could tell our Splunk Production to do a distributed search across UAT servers also in order to get the DR data i need, but I don't really want all UAT data also in Production, is there a way to limit it?
Is there a way to tell our Splunk Production to a distributed search across specific indexes on a server so I can get just some of the data currently going to UAT (ie the DR data) into Splunk Production without taking it all?
... View more
06-03-2010
05:28 PM
Thanks I found it, but didn't realise that with the 'Simple' module, it only takes the first row of the results..so not all that helpful for me
... View more
06-03-2010
03:43 PM
2 Karma
The below works for Firefox:
Add the following .css file, e.g in $SPLUNK_HOME/etc/apps/search/appserver/static/fullscroll.css
div.oneColRow div.layoutCell {
width: auto;
min-width: 100%;
}
Set your Dashboard to use the CSS file by adding it to the xml, e.g
<view template=”dashboard.html” stylesheet=”fullscroll.css”>
...
</view>
Restart splunk web
Note: If like me, you have a simple dashboard, you can use this link to get the advanced dashboard code for it, to which you can then add the extension
http://localhost:8000/en-US/app/<app_name>/<dashboard_name>?showsource=true
... View more
06-03-2010
02:49 PM
Ok thanks. The case you mention about to do with rangemap & singleValue module.. do you have any examples of how to use that? Perhaps I could use that if I am just using a number range to define OK/NOT OK anyway?
... View more
06-03-2010
02:23 PM
index="ems" sourcetype="queueconfig" OR sourcetype="topicconfig" | multikv noheader=true | rename Column_1 as config | search NOT "sample" | transaction instance | fields instance, application, config | fields - _time | join max=0 instance [search index="ems" sourcetype="factoryconfig" | strcat factoryName " - " url " - " type factoryconfig | fields instance, application, factoryconfig | transaction instance]
... View more
06-03-2010
01:33 PM
Yes, I agree. Have you raised this as a enhancement request to Splunk yet?
... View more
06-03-2010
07:59 AM
Hi, yes I was still hoping for an answer for this one - might raise a support case. In this one, I get the data fine, but the question is to do with the formatting. As you can see in my two separate searches, it is formatted nicely on multiple lines, but when I join the searches, you lose this feature.
... View more
05-29-2010
11:29 PM
Hi,thankyou for the comments. I didn't mention above, but this is the workaround I am using. I search for a sourcetype and for each source/file name it should come up from two hosts as each file should be configured on two servers, so the report is to check this. I use multi valued fields to combine them, so you get a table with the file name then a list of the hosts it found it on. I check how many host values there are and if it is two, i put a field with text OK and if not, i put the text NOT OK. I was just hoping to advance my report and make it more colourful, so they stand out more.
... View more
05-28-2010
01:28 PM
3 Karma
Hello,
I've created a report that counts for each file name how many servers it comes up on. The purpose of report is reconciliation as each file should come up 2 times (current server and DR server). When displaying this report, it would be really nice to get a good overlay, so for example is its not 2, it flags up in red text or red background or something and if it is ok, its green.
I noticed splunk has some overlays for example giving things red & blue borders for high/low.
Does anyone know how I would go about customising my results/if it is possible in any way? If i can write my own overlay with this criteria?
Thanks!
Hazel
... View more
05-26-2010
09:34 AM
hello! I added it to $PATH and I tested a search with a pdf report and it attached one successfully. But, the pdf report is such bad quality... I can't read the text at all... Has anyone got this to work with good quality pdfs? Am i missing a setting?
... View more
05-14-2010
08:26 AM
Hi - the xml is too big to add it as a comment and if I put it in the main section it tries to interpret the "<". Any idea how I can escape that?
... View more
05-05-2010
02:57 PM
Just an update to this. I used the 'width' setting on my xml module FlashChart to extend the panel, which adds in a scrollbar, but it only extends my panel, not the whole dashboard. Any ideas how to change the width of the whole dashboard?
... View more
05-05-2010
09:10 AM
2 Karma
I have worked this out with 2 points
By default, join will only join one result to each which is why my others get lost. Adding "join max=0..." means that it will join all results where they match, not just the first match.
Ive then followed this all with a stats values(queues),values(topics) by instance as suggested by Lowell which takes only the unique values for each and creates my columns.
... View more
04-28-2010
05:02 PM
2 Karma
Hello,
For most of our eventdata tables and dashboards, the values go for off the panel on the right hand side. The tables are also quite long too, which means you have to scroll down using the scrollbar on ie/firefox, then use the scrollbar along on the panel inside.
Would there be a way to move the bottom scrollbar to part of ie/firefox like the side scrollbar? It would be nice to scroll to the right, without having to scroll down first?
Thanks!
Hazel
... View more
