Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About stcrispan
stcrispan
Communicator
Member since:
08-18-2016
06-05-2020
Community Statistics
| Posts | 51 |
| Solutions | 1 |
| Karma Given | 10 |
| Karma Received | 10 |
| Member Since | 08-18-2016 |
Activity Feed
- Karma Re: How do you count the least number of events (as opposed to the highest number)? for renjith_nair. 06-05-2020 12:50 AM
- Karma Re: How to edit my index to change the cold path? for gcusello. 06-05-2020 12:50 AM
- Got Karma for Re: What's wrong with my rex?. 06-05-2020 12:50 AM
- Got Karma for Is there an order of precedence in the serverclass.conf?. 06-05-2020 12:50 AM
- Got Karma for Is there an order of precedence in the serverclass.conf?. 06-05-2020 12:50 AM
- Karma Re: Can you use a regex in serverclass.conf? for somesoni2. 06-05-2020 12:49 AM
- Karma Re: How do you count the difference in an ongoing count for a given time period? for renjith_nair. 06-05-2020 12:49 AM
- Karma Re: Can you use a regex in serverclass.conf? for somesoni2. 06-05-2020 12:49 AM
- Got Karma for SPLUNK4JMX Not polling data from specified servers. 06-05-2020 12:49 AM
- Karma Re: Dividing a value by 1000 for somesoni2. 06-05-2020 12:48 AM
- Karma Re: How to collect Windows event logs that are not from .evtx or .evt files? for woodcock. 06-05-2020 12:48 AM
- Karma Re: Two serverclass.conf files - now what? for sloshburch. 06-05-2020 12:48 AM
- Got Karma for Re: How to collect Windows event logs that are not from .evtx or .evt files?. 06-05-2020 12:48 AM
- Got Karma for Re: How to collect Windows event logs that are not from .evtx or .evt files?. 06-05-2020 12:48 AM
- Got Karma for Re: How to collect Windows event logs that are not from .evtx or .evt files?. 06-05-2020 12:48 AM
- Got Karma for How to collect Windows event logs that are not from .evtx or .evt files?. 06-05-2020 12:48 AM
- Got Karma for How to collect Windows event logs that are not from .evtx or .evt files?. 06-05-2020 12:48 AM
- Got Karma for How to collect Windows event logs that are not from .evtx or .evt files?. 06-05-2020 12:48 AM
- Karma Re: Universal Forwarder ParsingQueue KB Size for ashleyherbert. 06-05-2020 12:46 AM
- Karma Re: Omit "NULL" and "OTHER" from area chart for Stephen_Sorkin. 06-05-2020 12:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
10-12-2018
07:49 AM
Good suggestion, thank you! I went back in to my Fowarder Management, and found that I actually was gathering devices in my new server class...but I'm still gathering them in the old class, too.
I'm thinking that I need to work on my white/black lists.
... View more
10-12-2018
06:43 AM
2 Karma
In serverclass.conf ...
I'm creating different classes, for deployment. I've inherited this setup, and the previous guy got pretty fancy, so I can't use the GUI to edit any more. I have multiple stanzas within my serverclass.conf , and now I'm trying to split out my tablets into different indexes (and applications).
So, I have a class of devices called tablets, which incorporates every tablet that has been released into the enterprise. Now they are rolling out a sub-class of tablets, which are using a different model tablet with Windows 10. Up until now, tablets have been released with an unpopulated deploymentclient.conf:
[deployment-client]
[target-broker:deploymentServer]
targetUri= 10.10.12.12:8089
The new tablets are being released with a populated deploymentclient.conf
[deployment-client]
SLATE-$HOSTNAME
[target-broker:deploymentServer]
targetUri= 10.10.12.12:8089
So I inserted a pair of stanzas into my serverclass.conf , to cover the new tablets using Windows 10:
######### Original tablets stanza
[serverClass:MYAPP_TABLETS]
whitelist.0 = SLATE*
blacklist.0 = SLATE549G2
[serverClass:MYAPP_TABLETS:app:_server_app_MYAPP_TABLETS]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled
######### New tablets stanza
[serverClass:MYAPP_TABLETS10]
whitelist.0 = SLATE-*
whitelist.1 = SLATE*-*.stores.roomstogo.rtg
blacklist.0 = SLATE549G2
[serverClass:MYAPP_TABLETS10:app:_server_app_MYAPP_TABLETS10]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled
...and restarted the deployment server (for all apps).
...and got jack. None of the new tablets decided to bite on the new setup.
So my question is, is there an order of precedence in serverclass.conf? Since all my tablets have been using the first stanza, will they simply ignore the second stanza? Or is there a problem with my white/blacklisting? Is it an issue with the deployment client?
Open to suggestions...
... View more
10-11-2018
11:27 AM
Fantastic.
Thank you!
... View more
10-11-2018
10:04 AM
Is there a way to break out the results?
For instance, I have 200 devices. 42 of them have only a single 10060 event, 23 of them have two 10060 events, 19 of them count three events, and so on.
Is there a way to have a chart which, on the bottom puts 1 event, 2 events, 3 events (and so on), and for each category charts the count?
... View more
10-11-2018
09:15 AM
Yup, that works!
But I have 45 which are one event, and 10 more which are two events, and 6 which are three events.
And (maybe as a consequence) my chart no longer provides count by Computer Name, it provides a count by...well, event count.
But please don't think I'm ungreatful; thank you for your quick response!
Now I just have to figure out how to display this data to my customers.
... View more
10-11-2018
08:46 AM
I have a Top Ten report going which counts the highest number of network timeout/disconnects on wireless devices by the total number of events and listed by device name.
index=dss_tablet sourcetype=dss_tablet_App "TCP error code 10060"| timechart limit=10 useother=f count by ComputerName
My customers have asked, "What are the best performing devices?"
My initial reaction was to simply eliminate the 10060 event, but this isn't an accurate summation -- that would give me the tablets which merely had the highest event code count.
So what I need is a search which looks for Event 10060 and then takes the lowest incidences. So if I have 100 devices, and only two of them registered one 10060 event each...and one device claims to have it four times...and another three which say only five times....then the idea is that these devices would come up in a Top Ten list, listed by device and how many times they had the event, with the understanding that these were the least afflicted by this condition.
Brain teaser, or childishly simple?
... View more
09-20-2018
12:59 PM
Have you tried it without CRC? or, in your CRSalt line, try putting quotes around the entire thing.
https://answers.splunk.com/answers/35210/crcsalt-issue.html
... View more
09-20-2018
10:14 AM
Do all your files end in .splunk?
My advice is to add that to your wildcard pattern. so instead of
[monitor:///home/mqm/mqstatistics/splunk/*_QM_Q_*]
Make it
[monitor:///home/mqm/mqstatistics/splunk/*_QM_Q_*.splunk]
... View more
09-17-2018
09:40 AM
So it turn out that NO, you cannot use Regex in the serverclass.conf file, and in fact, you can't use the DOS wildcard expressions either.
So if you have
LAPTOP100-BR549.jr.samples.autosales.com
LAPTOP101A.jr.samples.autosales.com
LAPTOPL42D.Jr.samples.autosales.com
LAPTOP8701-BR5.jr.samples.autosales.com
LAPTOP549-JSAS.jr.samples.autosales.com
You can't use
[serverClass:JUNIORS_LAPTOPS]
whitelist.0 = ^LAPTOP(\d+\S+\S)-(\S\S\S)$
blacklist.0 = ^LAPTOP(\d+\S)$
You can't even use a
LAPTOP???-???49.jr.samples.autosales.com
To sort out specific, I had to use
LAPTOP*-*.jr.samples.autosales.com
just to get the ones which had a dash in them.
... View more
09-17-2018
08:19 AM
Interesting...I only recently added a time picker to the dashboard, will removing the _time still allow the search to use the time specified by the time picker?
... View more
09-13-2018
12:53 PM
index=dot_activemq_jmx mbean_property_destinationName=RTGOrder | bucket _time span=1d | stats range(Messages_Enqueue) AS "Total Process Orders Today" by jvmDescription mbean_property_destinationName _time
... View more
09-13-2018
12:52 PM
Landen99, thanks for your answer.
This works, but I'm still getting the jvmDescription in my Singlevalue display.
... View more
09-13-2018
05:37 AM
I'm still muddling my way through these sophisticated queries you've provided. I can say that they're not working like I was hoping they would work. 😞 The one where someone took the series of numbers, picked the first number, then picked the last number (by time), and then did an eval of the difference between seemed so promising...but didn't actually work. I'm not sure any more if it's my query or if it's my dataset....but the dataset does provide a list of numbers, I just need to get the delta of the change between first and last.
... View more
09-12-2018
02:02 PM
I actually do need the difference between the earliest and latest.
This query -
index=dot_activemq_jmx mbean_property_destinationName=RTGOrder | stats values(Messages_Enqueue) AS Orders by jvmDescription, mbean_property_destinationName |eventstats earliest(Orders) as earliest,latest(Orders) as latest by jvmDescription, mbean_property_destinationName|eval diff=latest-earliest
Does a listing of orders, incrementing, but does not populate the Single Value with that count, it populates it with the jvmDescription field.
... View more
09-11-2018
01:49 PM
Also, is there any way to put a comment in the serverclass.conf file?
... View more
09-11-2018
01:38 PM
Wildcard? You mean like a DOS convention?
When I do a DIR in DOS, I can do a DIR *.exe or DIR *.??e , and get the same file in each listing.
Something like that?
... View more
09-11-2018
01:00 PM
Trying to filter out a specific type of device type, by host name, in serverclass.conf.
Currently all our tablets are known by SLATEXXXY or SLATEXXXXY , or in some cases, even SLATEXXXYY (where XXX or XXXX represents a location number, and Y or YY represents an iteration of tablet at that location. We are now fielding the next generation of tablets, which will be known by the new convention SLATEXXX-YYY or SLATEXXXX-YYY .
Originally, in serverclass.conf we simply filtered by grabbing all tablets, by using SLATE* . Now we are trying to create a whole new set of indexes and apps for the new devices, which means a new deployment app...but we can't just type SLATE* any more.
So my question is, can I use a regex in serverclass.conf ? I have done some independent research and it appears that
^SLATE(\d+\S)-(\S\S\S)
...should work to sort out the right set of parameters to grab all the new tablet names (though I'm damned if i can get it to work in a simple search).
The bottom line is, will it work in serverclass.conf , if I use it as a template to whitelist the new devices?
If not, what would work?
... View more
09-07-2018
01:34 PM
DalJeanis,
The original was supposed to provide a Single Value in the Visualization window.
What it returns instead is the jvmDescription field.
... View more
09-07-2018
01:31 PM
renjith.nair, thank you for the fast response!
Unfortunately, this is not working for me. As I understand it, this was supposed to use the expression "eval diff" to take the difference between the earliest order and the latest order and then return that result?
When I return the result in Visualization as a Single Value - I get back the jvmDescription.
If I strip the command down, just to get the list of order counts, then run the stats command on it, I get the list of order counts in my Visualization as my Single Value.
index=dot_jmx mbean_property_destinationName=RTGOrderProcessed | stats values(Messages_Enqueue) as Orders | eventstats earliest(Orders) as earliest,latest(Orders) as latest |eval diff=latest-earliest
returns
11413,11414,11415,11417,11418,11419,11420,11421,11422,11423,11424,11425,11426,11427,11428,11429,11431
Thoughts?
... View more
09-07-2018
08:46 AM
I have a JMX search going on which tracks orders placed every 30 seconds.
index=dot_jmx mbean_property_destinationName=RTGOrderProcessed | stats values(Messages_Enqueue) AS Orders by jvmDescription, mbean_property_destinationName
The search produces and output like this:
Server Name Orders
SRV1 Processed 11238
SRV1 Processed 11239
SRV1 Processed 11240
SRV1 Processed 11241
SRV1 Processed 11242
SRV1 Processed 11243
SRV1 Processed 11244
SRV1 Processed 11246
SRV1 Processed 11247
SRV1 Processed 11248
SRV1 Processed 11249
SRV1 Processed 11250
This goes in a dashboard with a picker, and for the time period provided by the picker, there should be a way to output a visualization which counts the difference between the earliest count number and the latest count number — the goal is to display the total new orders for the time period requested. (So - displays the count for the last 15 minutes or the last week.)
The guy before me had it like this:
index=dot_jmx destinationName=RTGOrderProcessed | stats values(Messages_Enqueue) AS Orders by jvmDescription,destinationName| delta Orders as Orders p=1 | search Orders < 100| stats sum(Orders) As "Total Process Orders Today"
...but for some reason, when I added the time picker, that stopped working...but the time picker is now a requirement, and the guy is gone.
Any suggestions?
... View more
- « Previous
-
- 1
- 2
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
