About emiller42

emiller42 · ‎04-29-2013

Terrible yet effective! I've put in a ticket about the issue, as I think it should be properly escaping the parens in the path. But in the meantime, this gets the job done.

emiller42 · ‎04-29-2013

I have a series of files I'm monitoring on windows servers that have to have wildcards in the monitor path. C:\Program Files (x86)\folder\04-29-2013\foo.xml C:\Program Files (x86)\folder\04-29-2013\bar.xml The date part of the path changes each day. Foo and Bar are different source types. So I have a monitor stanzas like so: [monitor://C:\Program Files (x86)\folder\*\foo.xml] [monitor://C:\Program Files (x86)\folder\*\bar.xml] This seems like it should work fine, but I'm not getting any of the files indexed. Further digging using using fileMonitor.py showed me the following errors: Did not match partial whitelist '^c:\\Program Files (x86)\\folder\\[^\\]*\\foo\.xml$' It appears that when the monitor stanza is expanded to a regex for whitelisting purposes, the parens aren't being escaped properly. It should be: ^c:\\Program Files $x86$\\folder\\[^\\]*\\foo\.xml$' Not sure how I can work around this. If I wildcard the 'Program Files' folder, that means Splunk will try to match every file in C:\ with the generated whitelist, which isn't going to work. Any ideas?

emiller42 · ‎04-26-2013

to see your running jobs, click on 'Jobs' link in the upper right of the Splunk window. In the popup, change the 'App' and 'Owner' to 'All', and change the Status to 'Running'. That will show you all running searches, along with their details.

emiller42 · ‎04-26-2013

What you're altering there isn't a search, it's an input stanza. So that syntax isn't going to do anything functional. If you want to modify what those scripts output, you'll need to go into $SPLUNK_HOME/etc/apps/unix/bin/ and then modify the relevant script. As to what to change in the script to accomplish what you want, that depends on the platform. You're working with shell scripts there, not Splunk specific language.

emiller42 · ‎04-26-2013

Try something like this: index="norlogs" sourcetype="devicelog" category="NSException" OR category="FinishLaunching" | eval A=if(category=="NSException", 1, 0) | eval B=if(category=="FinishLaunching", 1, 0) | stats sum(A) as TotalA sum(B) as TotalB | eval pct=TotalB/TotalA

emiller42 · ‎04-26-2013

Because we don't specify an 'endswith' or 'maxpause' it won't close the transaction at all. Each transaction will start with the first user login and end on the last event for that user. It will not start subsequent transactions for the same user in the same day.

emiller42 · ‎04-25-2013

That's a good regex filter for a whitelist. Glad it worked!

emiller42 · ‎04-25-2013

... | transaction user day startswith(action_type="login") This will start a transaction on first action_type="login" and not close it until the next day. When you use startswith, you can have it be freeform text, an eval, or a valid search string. They have different syntax which is somewhat confusing in the documentation. The () indicates search syntax instead of simple text matching.

emiller42 · ‎04-25-2013

The whitelist= parameter expects a regular expression. So instead of: _whitelist = Dhcp*.log You should use something like: whitelist = .+?\\Dhcp[^\.]+\.log And something similar for your dns whitelist if you care to apply it.

emiller42 · ‎04-16-2013

My first guess is that the tags you created aren't exported outside of your scope. There are three levels of scope that knowledge objects can belong to: User Application Global Items created in the User scope are only visible to the user that created them. This allows person A to build their own knowledge without disrupting the work of user B. Items in the Application scope are visible to all users when they are in the context of an application. (So items in the Search App scope only apply when the user is in the Search app) Finally, items can have a Global scope which apply to everything. Any tags you create in the UI will have a User scope by default. So you'll need to change that for others to see them. Go to "Manager > Tags" and then look for the tags you created. There will be a "Sharing" column which shows the current scope of the item. Clicking "Permissions" there will bring you to a new window where you can define the scope of the item. Change your tags to either "This app only" or "all apps" to make them visible to other users.

emiller42 · ‎03-14-2013

The set command has the ability to union two sub searches: | set union [search foo] [search bar] So just figure out the base searches for the two queries you're trying to do separately, then throw them in the subsearch brackets above. Set Reference However, I'm not sure why the SQL you presented needs a union in the first place. I'm assuming the goal is to get all records from t_resources and t_users, matching where possible, and retaining all records from either table that do not have a match. That can be simplified to a full outer join in mySQL, and appears to be possible with the Splunk join command: ... | join type=outer field [search foo] Join Reference

emiller42 · ‎03-14-2013

The problem is that gc log lines don't buffer, so there's actually often a significant delay between when the first part of the event is written and when the second part is written. (It can actually split into more chunks on abnormally long collections) The default time splunk waits before it starts considering something a new event is three seconds. There is a config for that, and since your gc logs actually have a timestamp (mine don't) this may help: In your inputs.conf try setting the TIME_BEFORE_CLOSE parameter to a higher value. (default is 3) Another option is to not parse gc logs at all. Instead, use something like SPLUNK4JMX to poll the JVM for info around garbage collection.

emiller42 · ‎03-14-2013

If this is working, would you mind accepting the answer? That way other people searching will see this is something with a resolution. Thanks!

emiller42 · ‎03-14-2013

I believe the following would work, but only as an index-time extraction. (Not tested) in Transforms.conf [stanza_name] REPEAT_MATCH = true REGEX = Elapsed\sProcessing\sTime\s::\s\[\w+$([^$]+)\),\s\w+$([^$]+)\),\s\w+$([^$]+)\)\].+?#\s\w+:\s(\d+)\s+\w+:\s[\w\.]+-([\w_]+) FORMAT = $5-Max::$1 $5-Avg::$2 $5-Min::$3 $5-Total::$4 My regex may not be the most clean/efficient, but it appears to capture everything correctly on regexr. So from: Eventing Processing Time :: [Max(0.421), Avg(0.308), Min(0.194)] sec(s) # Total: 00002 MenuId: rtdMenu.rtnIntervalDispatch.rtnIntervalDispExecuctionControl-RT_RTD_REVIEW_PERIOD it will extract: $1 = 0.421 $2 = 0.308 $3 = 0.194 $4 = 00002 $5 = RT_RTD_REVIEW_PERIOD So $5-Max::$1 should become 'RT_RTD_REVIEW_PERIOD-Max = 0.421' According to the documentation on transforms.conf, you can only do concatenated fields with index-time extractions.

emiller42 · ‎03-12-2013

I'm just another user, so I can't see your cases. Sorry!

emiller42 · ‎03-12-2013

Then I would add a max_match= condition to the rex, so it could capture more than one JSON array into a multi-valued field. Then pipe that to mvexpand so that they get split to multiple events. rex max_match=10 "regex_string" |mvexpand field_name | spath ...

emiller42 · ‎03-12-2013

I think the most important thing is that in your original rex, the closing } wasn't part of the capture group, so the field being extracted was { "start" : 1, "returned" : 0, "count" : 0 which spath will fail on.

emiller42 · ‎03-12-2013

You push the Splunk for Unix and Linux TA app to all of your forwarders. They will collect and forward OS metrics to your indexer, and the dashboards there will show all hosts.

emiller42 · ‎03-12-2013

I believe you need to keep the {} in the field as well, which your rex omits. Try this for your rex: rex "(?< json_field>{[^}]+})" (remove the space used to keep text from disappearing) Or if you want to keep the more complex regex, simply move the closing } into the capture group. You should then be able to use spath on the rex'ed field. EDIT TO ADD: If you've got events with multiple JSON objects, then you'll have to do a bit more work with it. I would recommend adding the max_match param to the rex, which will find multiple matches and collect them into a multi-valued field. Then you can mvexpand that field to multiple events, and parse that with spath. rex max_match=10 "(?< json_field>{[^}]+})" | mvexpand json_field | spath input=json_field ... (replace rex as needed)

emiller42 · ‎03-06-2013

Then you simply remove the | where status="Open" bit

emiller42 · ‎03-05-2013

What are you trying to accomplish here?

emiller42 · ‎03-05-2013

I would use a stats command to aggregate things: | stats last(_time) as _time first(status) as status by BugId THis will give you one row per BugId with the oldest _time it was seen, and the most recent status. THen you can pipe that to a filter so you only get the Open BugId's, and timechart that set of results. | stats last(_time) as _time first(status) as status by BugId | where status="Open" | timechart count

emiller42 · ‎03-05-2013

You can simply use a fieldformat command to change how the number is displayed without actually changing the content. index=coreops sourcetype="snmp_stats" HOST=IVE* |stats avg(CONNECTIONS) as CONNECTIONS, avg(MEM) as MEM, avg(CPU) as CPU by HOST | fieldformat CONNECTIONS=round(CONNECTIONS, 2) | fieldformat MEM=round(MEM, 2) | fieldformat CPU=round(CPU, 2) | sort - num(CONNECTIONS) Fieldformat documentation

emiller42 · ‎03-05-2013

I'm assuming you want the entire previous day from midnight to midnight. That being the case, start time of -1d@d and end time of @d should give you the timeframe you're looking for.

emiller42 · ‎02-13-2013

The == is the proper operator for comparison according to the splunk documentation. For a working example of what you're trying to do, use the following: index=_internal sourcetype="splunkd" component="StatusMgr" | rex "source(?<value>.+?)=" | eval test=case(value=="Host", "This is a host", value=="Port", "This is a port") | table value test If you're not getting results from your rex but not your eval, then the conditions of your case statement don't actually match the values being set in the rex.

Posts	275
Solutions	58
Karma Given	102
Karma Received	331
Member Since	‎08-11-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Why does my Search Head Cluster Captain start dele...

Why do scheduled searches randomly stop running in...

Changes to forwarder->indexer connectivity in 6.3....

Why does the Splunk Add-on for Cisco UCS not respe...

How to disable the schedule_rtsearch capability?

Fire Brigade Install on Distributed Environment

Summary Index -nolocal

Problem using multikv to parse tabular data

streamstats is reversed?

Inputs.conf - wildcard monitor stanzas on Windows

Re: Inputs.conf - wildcard monitor stanzas on Wind...

Inputs.conf - wildcard monitor stanzas on Windows

Re: realtime searches canceled

Re: How can I alter the searches being executed by...

Re: Joining two queries and getting a percentage

Re: Transaction startswith

Re: troubleshooting a customer monitor config line

Re: Transaction startswith

Re: troubleshooting a customer monitor config line

Re: Created search with tags but does not work for...

Re: Union in Splunk like in MySQL

Re: Line Breaking Issue/Time Stamp for Indextime f...

Re: Part 1: How to extract a json portion of an ev...

Re: Extracting multiple similar values from a mult...

Re: Part 1: How to extract a json portion of an ev...

Re: Part 1: How to extract a json portion of an ev...

Re: Part 1: How to extract a json portion of an ev...

Re: Monitoring OS parameters using Splunk

Re: Part 1: How to extract a json portion of an ev...

Re: Timechart accumulation of all events from prev...

Re: Timestamp Regex need help here!

Re: Timechart accumulation of all events from prev...

Re: rounding numbers in splunk

Re: Saved Search Start and End Time

Re: REX pipe to EVAL

Join the Conversation