Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About HCadmins
HCadmins
Communicator
Member since:
07-26-2016
06-05-2020
Community Statistics
| Posts | 58 |
| Solutions | 1 |
| Karma Given | 4 |
| Karma Received | 13 |
| Member Since | 07-26-2016 |
Activity Feed
- Karma Re: Why am I getting a "Search is waiting for input" message on my dashboard panel? for MuS. 06-05-2020 12:48 AM
- Karma Re: Explain Data Models (Like I'm Five) for koshyk. 06-05-2020 12:48 AM
- Got Karma for Re: Time format not being recognized as data point. 06-05-2020 12:48 AM
- Got Karma for Re: Time format not being recognized as data point. 06-05-2020 12:48 AM
- Got Karma for Explain Data Models (Like I'm Five). 06-05-2020 12:48 AM
- Got Karma for Explain Data Models (Like I'm Five). 06-05-2020 12:48 AM
- Got Karma for Explain Data Models (Like I'm Five). 06-05-2020 12:48 AM
- Got Karma for Explain Data Models (Like I'm Five). 06-05-2020 12:48 AM
- Got Karma for Explain Data Models (Like I'm Five). 06-05-2020 12:48 AM
- Got Karma for Explain Data Models (Like I'm Five). 06-05-2020 12:48 AM
- Got Karma for Explain Data Models (Like I'm Five). 06-05-2020 12:48 AM
- Got Karma for Re: Explain Data Models (Like I'm Five). 06-05-2020 12:48 AM
- Got Karma for Re: Explain Data Models (Like I'm Five). 06-05-2020 12:48 AM
- Got Karma for Re: Explain Data Models (Like I'm Five). 06-05-2020 12:48 AM
- Got Karma for Re: Explain Data Models (Like I'm Five). 06-05-2020 12:48 AM
- Karma Re: Simple "sort" question for gokadroid. 06-05-2020 12:46 AM
- Karma Re: tarAndChecksum error for deployed app inputs.conf for Wallen. 06-05-2020 12:46 AM
- Posted Re: Explain Data Models (Like I'm Five) on Knowledge Management. 04-10-2017 08:49 AM
- Posted Re: Explain Data Models (Like I'm Five) on Knowledge Management. 04-09-2017 02:20 PM
- Posted Re: Explain Data Models (Like I'm Five) on Knowledge Management. 04-09-2017 02:18 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 7 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-28-2016
09:25 AM
I have a search with multiple time formats, and the "Duration" time format isn't being recognized when I to a chart. Take a look at the screenshot:
I am trying to overlay "Duration" with "Throughput _GB_Hour", but on the chart Duration is always zero, whereas in the table we can see different time stamps.
My guess is I need to convert this somehow, but I am stuck as to how to make this work.
Here is my search
eventtype=cv "Source Client"=* "Destination Client"=slc-p-res* OR dab* Duration=* "Start Time"=* "End Time or Current Phase"=* "Throughput _GB_Hour"=* | convert ctime(_time) | table _time "Source Client" "Destination Client" "Start Time" "End Time or Current Phase" Duration "Throughput _GB_Hour"
... View more
12-23-2016
09:25 AM
eventtype=cv Entity="Data Size Backed Up in Last 7 Days" dailygrowth=* | eval volume=dailygrowth | eval Time=strftime(_time,"%m/%d/%y %I:%M %p") | streamstats current=f window=1 values(Volume) as prev | eval Change=round((Volume-prev)*100/prev,2) | fields - prev
... View more
12-23-2016
09:25 AM
Thanks,
Do I need to do the timechart command to get it to appear as a linechart? Adding your SPL doesn't give me a table or chart or anything. (forgive my ignorance.)
... View more
12-23-2016
09:09 AM
I have a linechart with values that increase each day. Is there a way to calculate and display the percentage of growth?
In the screenshot provided there are two values, 166,294,515,189,537 and 167,520,605,713,749
Mathematically, we would just
Find the difference of the two numbers = 1226090524212
Divide that by the original number and multiply by 100, giving us = 0.7373.... so roughly .74%
But what I want is a rolling percentage increase
Is this even possible?
Please see screenshot.
... View more
12-22-2016
03:03 PM
I did resolve my own issue. Thanks!
... View more
12-22-2016
09:54 AM
Ah, Got it! I had a typo.
... View more
12-22-2016
09:49 AM
But my event type isn't working either.
... View more
12-22-2016
09:36 AM
This answer explains it well.
https://answers.splunk.com/answers/238355/what-are-the-definitions-of-tag-and-eventtype-and.html
I think what I need is an event type. Apparently a tag is a single key=value pair, where an eventtype can have multiple prepipe statements (which is what I have).
But, correct me if I am wrong, I could do this:
host=slc-p-cv01
tag=cv
sourcetype=csv
tag=cv
And it would be the same thing as
host=slc-p-cv01 sourcetype=csv
eventtype=cv
... View more
12-22-2016
09:09 AM
Hi Splunkers,
I have this search host=slc-p-cv01 sourcetype=csv that returns what I expect.
I am trying to make a tag called cv that contains this search.
So I create a tag, in the "Field value pair" I put the above search. In the Tag name, I put cv . I also gave the tag full permissions.
When I perform the search, it works. The tag returns nothing.
Thanks in advance!
... View more
- Tags:
- splunk-enterprise
- tag
12-14-2016
11:52 AM
I am trying to autostart Splunk on my VMware data collection node. I am in $SPLUNK_HOME/bin/
splunk enable boot-start returns Can't create RC file "/etc/init.d/splunk": Permission denied
sudo splunk enable boot-start returns sudo: splunk: command not found
I am logged in as splunkadmin
Could someone explain what's going on here?
... View more
10-31-2016
10:24 AM
What kind of visualization is this, and how did they make it?
... View more
10-07-2016
09:35 AM
Thank you! That worked well. Now how to I also exclude the word "recoverable"?
... View more
10-04-2016
09:43 AM
Could you help me understand why that fixed it?
... View more
10-04-2016
09:39 AM
Hi:
Take a look at this ESXi log
2015-11-09T21:53:54.589Z cpu28:37021)MCE: 231: cpu28: bank7: MCA recoverable error (CE): "Memory Controller Read Error on Channel 0."
Using regex, I've extracted cpu28:37021) as field CPU and MCE: 231: cpu28: bank7: MCA recoverable error (CE): "Memory Controller Read Error on Channel 0."` as CPU_Message.
Now, I want to create a report that looks for the keywords MCE or MCA in the CPU_Message field. Doing wildcards won't work because there could be other words that contain mca or mce in them. I want to be alerted on any MCA or MCE errors specifically.
I've built this search
sourcetype=vmware:esxlog* | where like(CPU_Message, MCE) OR like(CPU_Message, MCA) | table host CPU CPU_Message
Will this accomplish what I want to do?
Thanks in advance!
... View more
10-03-2016
03:36 PM
Sorry, I copied/pasted the working XML.
I just rebuilt the panel and it's no working again. Here is the full XML. The top panel (Cisco / VMware overlay) is the one that is "waiting for input."
<dashboard>
<label>Cloud Ops</label>
<description>Created by Adam</description>
<row>
<panel>
<html>
<div style="background-color:#00aeef; font-family: Georgia, serif; letter-spacing: 2px; color:#fff; padding:10px; border-radius:5px; border: 1px solid #6d6e71; font-size:20em;">
<center>
<h1>CLOUD OPS</h1>
</center>
</div>
</html>
</panel>
</row>
<row>
<panel>
<chart>
<title>VMware / Cisco Overlay</title>
<search>
<query>(index=* OR index=_*) ((index=* OR index=_*) ((index=* OR index=_*) ((source=cisco:ucs:faultInst* severity=critical) OR (sourcetype=vmware:esxlog* error NOT warning)))) | rename Application AS EventObject.Application Level AS EventObject.Level Message AS EventObject.Message Object AS EventObject.Object Offset AS EventObject.Offset Vpxa AS EventObject.Vpxa ack AS EventObject.ack address AS EventObject.address app AS EventObject.app arg AS EventObject.arg body AS EventObject.body cType AS EventObject.cType cause AS EventObject.cause changeSet AS EventObject.changeSet code AS EventObject.code created AS EventObject.created date_hour AS EventObject.date_hour date_mday AS EventObject.date_mday date_minute AS EventObject.date_minute date_month AS EventObject.date_month date_second AS EventObject.date_second date_wday AS EventObject.date_wday date_year AS EventObject.date_year date_zone AS EventObject.date_zone descr AS EventObject.descr description AS EventObject.description dest AS EventObject.dest dn AS EventObject.dn dynamicType AS EventObject.dynamicType eventtype AS EventObject.eventtype explanation AS EventObject.explanation faultCause AS EventObject.faultCause faultMessage AS EventObject.faultMessage highestSeverity AS EventObject.highestSeverity id AS EventObject.id index AS EventObject.index key AS EventObject.key lastTransition AS EventObject.lastTransition lc AS EventObject.lc linecount AS EventObject.linecount message AS EventObject.message msg AS EventObject.msg occur AS EventObject.occur opID AS EventObject.opID origSeverity AS EventObject.origSeverity prevSeverity AS EventObject.prevSeverity punct AS EventObject.punct reason AS EventObject.reason rule AS EventObject.rule severity AS EventObject.severity site AS EventObject.site splunk_server AS EventObject.splunk_server src AS EventObject.src subject AS EventObject.subject system_name AS EventObject.system_name tag AS EventObject.tag tag::eventtype AS EventObject.tag::eventtype tags AS EventObject.tags timeendpos AS EventObject.timeendpos timestamp AS EventObject.timestamp timestartpos AS EventObject.timestartpos type AS EventObject.type user AS EventObject.user | eval "host"='host', "_time"='_time' | timechart dedup_splitvals=t limit=100 useother=t count AS "Errors by Host" by "host" format=$VAL$:::$AGG$ | sort limit=100 _time | fields _time *</query>
<earliest>rt-24h</earliest>
<latest>rt</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Errors by Host</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">area</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">connect</option>
<option name="charting.chart.overlayFields">10.10.10.15</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
</row>
<row>
<panel>
<title>VPN Authentication</title>
<table>
<title>Hosting VPN Auth Failures, Last 24 Hours</title>
<search>
<query>host=* sourcetype=UTM* sub=auth name="Authentication failed" OR "Authentication Failed" | head 5 | rex field=_raw "^\S+\s(?<Customer>\S+)"| eval Timestamp=strftime(_time,"%m-%d-%y %I:%M %p")| table user name Timestamp Customer | rename user as "User", name as "Reason" | eval Customer=case(Customer="portal","Main Firewall", Customer="portal-1","Main Firewall",Customer="ohfl","Orlando", Customer="quhi","Queens",Customer="chks","Children's Health Assoc.",Customer="mhnc","Mission",Customer="mgms","Gulfport",Customer="ocvt","OneCare",Customer="maca","MedAmerica",Customer="uttx","U. of Texas",Customer="adny","Adirondacks",Customer="cafe","CAFE",Customer="kuks","U. of Kansas",Customer="SLC-HOSTING-FW01","Hosting FW",Customer="uppa","U. of Pittsburgh",true(),"-")</query>
<earliest>rt-24h</earliest>
<latest>rtnow</latest>
</search>
<option name="wrap">undefined</option>
<option name="rowNumbers">undefined</option>
<option name="drilldown">row</option>
<option name="dataOverlayMode">none</option>
<option name="count">10</option>
</table>
</panel>
<panel>
<title>AD Authentication</title>
<table>
<title>AD Auth Failures Above 3, Last 24 Hours</title>
<search>
<query>index=wineventlog Account_Domain=* ("EventCode=4625" OR "EventCode=4740") | head 10 | stats count count(eval(EventCode=4740)) as LockedCount by user Account_Domain | search count>3 | eval Locked=if(LockedCount>1, "yes", "no") | table user count Account_Domain Locked | rename user as "User" count as "Failed Authentication Attempts" Account_Domain as "Domain"</query>
<earliest>rt-24h</earliest>
<latest>rt</latest>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="count">10</option>
</table>
</panel>
<panel>
<title>VM Alarms</title>
<table>
<title>VM Alarms "RED", 30 Minute Window</title>
<search>
<query>sourcetype="vmware:events" alarm.name=* | head 10 | eval Timestamp=strftime(_time,"%m-%d-%y %I:%M %p") | spath to | search to=* | spath alarm.name output=alarm | spath vm.name output=vm_name | spath vm.vm.moid output=vm_moid | search host=* | stats first(to) as cur_status by Timestamp alarm vm_name | search cur_status="red" | rename alarm as Alarm, vm_name as VM, cur_status as Status</query>
<earliest>rt-30m</earliest>
<latest>rt</latest>
</search>
<option name="charting.chart">pie</option>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="count">10</option>
</table>
</panel>
</row>
<row>
<panel>
<title>UCS Critical</title>
<table>
<title>UCS Critical Alerts, Last 24 Hours</title>
<search>
<query>source=cisco:ucs:faultInst ("critical" OR "severe" OR "major") NOT "security" | head 10 | eval Time=_time | convert ctime(Time) | table Time severity descr | rename severity as Severity, descr as Message</query>
<earliest>rt-24h</earliest>
<latest>rtnow</latest>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="count">10</option>
</table>
</panel>
</row>
</dashboard>
... View more
10-03-2016
08:10 AM
<dashboard>
<label>Cloud Ops</label>
<description>Created by Adam</description>
<row>
<panel>
<html>
<div style="background-color:#00aeef; font-family: Georgia, serif; letter-spacing: 2px; color:#fff; padding:10px; border-radius:5px; border: 1px solid #6d6e71; font-size:20em;">
<center>
<h1>CLOUD OPS</h1>
</center>
</div>
</html>
</panel>
</row>
<row>
<panel>
<chart>
<title>UCS / VMware Overlay</title>
<search>
<query>(index=* OR index=_*) ((index=* OR index=_*) ((source=cisco:ucs:faultInst* severity=critical) OR (sourcetype=vmware:esxlog* error NOT warning))) | rename Message AS EventObject.Message Type AS EventObject.Type index AS EventObject.index linecount AS EventObject.linecount reason AS EventObject.reason severity AS EventObject.severity splunk_server AS EventObject.splunk_server | eval "host"='host', "_time"='_time' | timechart dedup_splitvals=t limit=100 useother=t count AS "Critical / Error Messages" by "host" | sort limit=100 _time | fields _time *</query>
<earliest>rt-24h</earliest>
<latest>rt</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Count of Events (Warning or higher)</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">area</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.overlayFields">10.10.10.15</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
</row>
<row>
<panel>
<title>VPN Authentication</title>
<table>
<title>Hosting VPN Auth Failures, Last 24 Hours</title>
<search>
<query>host=* sourcetype=UTM* sub=auth name="Authentication failed" OR "Authentication Failed" | head 5 | rex field=_raw "^\S+\s(?<Customer>\S+)"| eval Timestamp=strftime(_time,"%m-%d-%y %I:%M %p")| table user name Timestamp Customer | rename user as "User", name as "Reason" | eval Customer=case(Customer="portal","Main Firewall", Customer="portal-1","Main Firewall",Customer="ohfl","Orlando", Customer="quhi","Queens",Customer="chks","Children's Health Assoc.",Customer="mhnc","Mission",Customer="mgms","Gulfport",Customer="ocvt","OneCare",Customer="maca","MedAmerica",Customer="uttx","U. of Texas",Customer="adny","Adirondacks",Customer="cafe","CAFE",Customer="kuks","U. of Kansas",Customer="SLC-HOSTING-FW01","Hosting FW",Customer="uppa","U. of Pittsburgh",true(),"-")</query>
<earliest>rt-24h</earliest>
<latest>rtnow</latest>
</search>
<option name="wrap">undefined</option>
<option name="rowNumbers">undefined</option>
<option name="drilldown">row</option>
<option name="dataOverlayMode">none</option>
<option name="count">10</option>
</table>
</panel>
<panel>
<title>AD Authentication</title>
<table>
<title>AD Auth Failures Above 3, Last 24 Hours</title>
<search>
<query>index=wineventlog Account_Domain=* ("EventCode=4625" OR "EventCode=4740") | head 10 | stats count count(eval(EventCode=4740)) as LockedCount by user Account_Domain | search count>3 | eval Locked=if(LockedCount>1, "yes", "no") | table user count Account_Domain Locked | rename user as "User" count as "Failed Authentication Attempts" Account_Domain as "Domain"</query>
<earliest>rt-24h</earliest>
<latest>rt</latest>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="count">10</option>
</table>
</panel>
<panel>
<title>VM Alarms</title>
<table>
<title>VM Alarms "RED", 30 Minute Window</title>
<search>
<query>sourcetype="vmware:events" alarm.name=* | head 10 | eval Timestamp=strftime(_time,"%m-%d-%y %I:%M %p") | spath to | search to=* | spath alarm.name output=alarm | spath vm.name output=vm_name | spath vm.vm.moid output=vm_moid | search host=* | stats first(to) as cur_status by Timestamp alarm vm_name | search cur_status="red" | rename alarm as Alarm, vm_name as VM, cur_status as Status</query>
<earliest>rt-30m</earliest>
<latest>rt</latest>
</search>
<option name="charting.chart">pie</option>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="count">10</option>
</table>
</panel>
</row>
<row>
<panel>
<title>UCS Critical</title>
<table>
<title>UCS Critical Alerts, Last 24 Hours</title>
<search>
<query>source=cisco:ucs:faultInst ("critical" OR "severe" OR "major") NOT "security" | head 10 | eval Time=_time | convert ctime(Time) | table Time severity descr | rename severity as Severity, descr as Message</query>
<earliest>rt-24h</earliest>
<latest>rtnow</latest>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="count">10</option>
</table>
</panel>
</row>
</dashboard>
... View more
09-29-2016
12:05 PM
Okay I found out what format=$VAL$:::$AGG$ is, and I actually need it.
It's the chart overlay values, which I need to keep (see screenshot).
... View more
09-28-2016
12:52 PM
I removed it and things seem to be working. I wonder why that was there.
... View more
09-28-2016
12:32 PM
That's a good question. I don't know. It was generated by the Pivot feature in Splunk.
... View more
09-28-2016
12:26 PM
Hi Splunkers!
I am getting "Search is waiting for input..." on one of my dashboard panels. Based on reading other Splunk Answers it seems there may be malformed XML. I used the pivot builder for this, so I am not sure where the issue is. Any help would be appreciated.
<row>
<panel>
<chart>
<title>UCS / VMware Overlay</title>
<search>
<query>(index=* OR index=_*) ((source=cisco:ucs:faultInst*) OR (sourcetype=vmware:esxlog*)) | rename Application AS EventObject.Application CPU AS EventObject.CPU CPU_Message AS EventObject.CPU_Message Cpu AS EventObject.Cpu Level AS EventObject.Level Message AS EventObject.Message Object AS EventObject.Object Offset AS EventObject.Offset Type AS EventObject.Type VM AS EventObject.VM WorldId AS EventObject.WorldId accessGenNo AS EventObject.accessGenNo address AS EventObject.address app AS EventObject.app args AS EventObject.args arguments AS EventObject.arguments body AS EventObject.body cc AS EventObject.cc chainId AS EventObject.chainId changeTag AS EventObject.changeTag clnPwrOff AS EventObject.clnPwrOff code AS EventObject.code computeResource AS EventObject.computeResource config_version AS EventObject.config_version createdTime AS EventObject.createdTime curBytes AS EventObject.curBytes curPowerOnCount AS EventObject.curPowerOnCount curPwrState AS EventObject.curPwrState datacenter AS EventObject.datacenter date_hour AS EventObject.date_hour date_mday AS EventObject.date_mday date_minute AS EventObject.date_minute date_month AS EventObject.date_month date_second AS EventObject.date_second date_wday AS EventObject.date_wday date_year AS EventObject.date_year date_zone AS EventObject.date_zone defaults AS EventObject.defaults descr AS EventObject.descr description AS EventObject.description dest AS EventObject.dest details AS EventObject.details dn AS EventObject.dn ds AS EventObject.ds dvs AS EventObject.dvs dynamicType AS EventObject.dynamicType enabled AS EventObject.enabled encoding AS EventObject.encoding eventTypeId AS EventObject.eventTypeId eventtype AS EventObject.eventtype explanation AS EventObject.explanation fault AS EventObject.fault faultCause AS EventObject.faultCause fileOwner AS EventObject.fileOwner fileSize AS EventObject.fileSize fileType AS EventObject.fileType fullFormattedMessage AS EventObject.fullFormattedMessage group AS EventObject.group handshakeTimeoutUs AS EventObject.handshakeTimeoutUs hostId AS EventObject.hostId hostReporting AS EventObject.hostReporting host_list_version AS EventObject.host_list_version id AS EventObject.id index AS EventObject.index ioSizeBytes AS EventObject.ioSizeBytes isolated AS EventObject.isolated key AS EventObject.key linecount AS EventObject.linecount master AS EventObject.master matchPattern AS EventObject.matchPattern maxObjectUpdates AS EventObject.maxObjectUpdates maxWaitSeconds AS EventObject.maxWaitSeconds message AS EventObject.message modification AS EventObject.modification msg AS EventObject.msg name AS EventObject.name needsUnregister AS EventObject.needsUnregister net AS EventObject.net newPwrState AS EventObject.newPwrState oIO AS EventObject.oIO objectId AS EventObject.objectId objectName AS EventObject.objectName objectType AS EventObject.objectType opID AS EventObject.opID powerInfo AS EventObject.powerInfo prevBytes AS EventObject.prevBytes prevCommands AS EventObject.prevCommands punct AS EventObject.punct query AS EventObject.query rc AS EventObject.rc returnoutput AS EventObject.returnoutput searchCaseInsensitive AS EventObject.searchCaseInsensitive service AS EventObject.service severity AS EventObject.severity soapenc AS EventObject.soapenc soapenv AS EventObject.soapenv sortFoldersFirst AS EventObject.sortFoldersFirst splunk_server AS EventObject.splunk_server src AS EventObject.src startAction AS EventObject.startAction startDelay AS EventObject.startDelay startOrder AS EventObject.startOrder state AS EventObject.state stopAction AS EventObject.stopAction stopDelay AS EventObject.stopDelay subject AS EventObject.subject system_name AS EventObject.system_name tag AS EventObject.tag tag::eventtype AS EventObject.tag::eventtype timeendpos AS EventObject.timeendpos timeout AS EventObject.timeout timestamp AS EventObject.timestamp timestartpos AS EventObject.timestartpos type AS EventObject.type user AS EventObject.user userName AS EventObject.userName val AS EventObject.val value AS EventObject.value version AS EventObject.version versionId AS EventObject.versionId vm AS EventObject.vm vmDowntime AS EventObject.vmDowntime vmPrecopyBandwidth AS EventObject.vmPrecopyBandwidth vmPrecopyStunTime AS EventObject.vmPrecopyStunTime vm_metadata_version AS EventObject.vm_metadata_version waitForHeartbeat AS EventObject.waitForHeartbeat worldID AS EventObject.worldID x3a AS EventObject.x3a x480 AS EventObject.x480 x481 AS EventObject.x481 x482 AS EventObject.x482 x483 AS EventObject.x483 x484 AS EventObject.x484 x485 AS EventObject.x485 x486 AS EventObject.x486 x487 AS EventObject.x487 x488 AS EventObject.x488 x489 AS EventObject.x489 x48a AS EventObject.x48a x48b AS EventObject.x48b x48c AS EventObject.x48c x48d AS EventObject.x48d x48e AS EventObject.x48e x48f AS EventObject.x48f x490 AS EventObject.x490 x491 AS EventObject.x491 xc0010114 AS EventObject.xc0010114 xce AS EventObject.xce xmlns AS EventObject.xmlns xsd AS EventObject.xsd xsi AS EventObject.xsi | eval "host"='host', "_time"='_time' | timechart dedup_splitvals=t limit=100 useother=t count AS "Count of Events (Warning or higher)" by "host" format=$VAL$:::$AGG$ | sort limit=100 _time | fields _time *</query>
<earliest>rt-24h</earliest>
<latest>rt</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Count of Events (Warning or higher)</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">area</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.overlayFields">10.10.10.15</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
</row>
... View more
09-26-2016
10:15 AM
Hi Splunkers!
I am wondering if I can create a chart that overlays two sourcetypes: one from VMware, and one from Cisco. My goal is to correlate certain ESXi errors with certain Cisco errors.
My two sourcetypes are
source=cisco:ucs:faultInst sourcetype=vmware:esxlog:vmkernel
And the keywords I want to look for are—from the Cisco side: “severe” and “error”
From the VMware side: “MCE” and “MCA”
One of the issues I am running into is that both sourcetypes have a host field, so I’d want to strip out from which sourcetype each ‘host’ field comes. (For VMware, we have 11 ESXi hosts that populate that field, and only one Cisco host.)
My end goal would be a line or area chart that shows counts over time one of the sourcetype+associated keywords overlaid with the other one.
I’m not really sure where to begin.
... View more
09-25-2016
12:36 PM
Okay, I solved the first part of my problem. Just needed to add | where Message NOT null .
Here's my current search string
sourcetype=vmware:esxlog:vmkernel * * * * * * * | head 20 | rex field=sourcetype "^vmware:esxlog:(?<sublogger>.+)$" | rex field=Message "^(?:[^ \n]* ){7}(?P<CPU>[^\)]+)\)(?P<CPU_Message>.+)" | eval Time=_time | convert ctime(Time) | table Time, host, CPU, CPU_Message | Rename host as Host, CPU_Message as "Message" | where Message NOT null
Now, I only want to display something if there are certain keywords in the Message field, like "MCE", "MCA" and "Error". I am not sure how to do that.
... View more
09-24-2016
08:26 PM
Hi Splunkers.
A year ago we had a hardware issue that disabled our operation for 24 hours. The VMware vmkernel error looked like this:
2015-11-09T21:55:08.687Z cpu28:37026)MCE: 222: cpu28: bank7: status=0x8c00004000010090: (VAL=1, OVFLW=0, UC=0, EN=0, PCC=0, S=0, AR=0), ECC=no, Addr:0x1425a5200 (valid), Misc:0x42ef6f0000 (valid)
Now that we have Splunk, I am trying to set up a search that would specifically track these errors. I want the date/time, the CPU, and keyword "MCE"
I borrowed and modified a search from the VMware app that looks like this
sourcetype=vmware:esxlog:vmkernel * * * * * * * | head 10000 | rex field=sourcetype "^vmware:esxlog:(?<sublogger>.+)$" | rex field=Message "^(?:[^ \n]* ){7}(?P<CPU>[^\)]+)\)(?P<CPU_Message>.+)" | eval Time=_time | convert ctime(Time) | table Time, host, CPU, CPU_Message | Rename host as Host, CPU_Message as "Message (if any)"
My first question is, what are all those * for? I know that an * is a wildcard, but for the VMware app, what does the multiple *'s do?
For the two rex fields, I used the field extractor and extracted the cpu28:37026 part from the above log, but I also want the MCE: part.
My search mostly works. I am getting the time, host, that CPU field, and then a message that doesn't usually contain the MCE errors (or anything useful). How do I make it show time, host, CPU And then either an MCE or MCA error, but only if an MCE or MCA error exists.
Thanks in advance!
... View more
09-22-2016
10:44 AM
Error in 'eval' command: The arguments to the 'if' function are invalid.
... View more
- « Previous
-
- 1
- 2
- Next »
