Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About TiagoTLD1
TiagoTLD1
Communicator
Member since:
09-20-2016
06-05-2020
Community Statistics
| Posts | 52 |
| Solutions | 2 |
| Karma Given | 4 |
| Karma Received | 8 |
| Member Since | 09-20-2016 |
Activity Feed
- Got Karma for Job inspector - Search takes 3 seconds to run but takes 20 to show the chart in dashboard. 06-05-2020 12:49 AM
- Karma Re: How to use the replace command to modify a regex token on my dashboard? for sundareshr. 06-05-2020 12:48 AM
- Karma Re: Are scheduled searches run in background? What is the runtime limit for them? for rjthibod. 06-05-2020 12:48 AM
- Got Karma for Re: How to combine two accelerated saved searches to access the summary indexes of both searches?. 06-05-2020 12:48 AM
- Got Karma for How to resolve "err=not_connected" error in Deployment Server configurations?. 06-05-2020 12:48 AM
- Got Karma for How to resolve "err=not_connected" error in Deployment Server configurations?. 06-05-2020 12:48 AM
- Got Karma for Why is my HTTP Event Collector curl successful, but it returns no data in Splunk?. 06-05-2020 12:48 AM
- Got Karma for Why is my HTTP Event Collector curl successful, but it returns no data in Splunk?. 06-05-2020 12:48 AM
- Got Karma for Appendcols Error. 06-05-2020 12:48 AM
- Got Karma for Re: How to configure auto_summarize.timespan for accelerated reports to increase the minimum timespan to 1 day?. 06-05-2020 12:47 AM
- Karma Re: mvexpand multiple multi-value fields? for mrobichaud_splu. 06-05-2020 12:45 AM
- Karma Re: Eval on Multi Valued Fields for Stephen_Sorkin. 06-05-2020 12:45 AM
- Posted Job inspector - Search takes 3 seconds to run but takes 20 to show the chart in dashboard on Dashboards & Visualizations. 08-03-2017 10:36 AM
- Tagged Job inspector - Search takes 3 seconds to run but takes 20 to show the chart in dashboard on Dashboards & Visualizations. 08-03-2017 10:36 AM
- Posted Custom Visualization "precedence" on All Apps and Add-ons. 06-29-2017 08:05 AM
- Posted Re: Summarization timespan incongruent on Splunk Search. 04-27-2017 03:33 PM
- Posted Summarization timespan incongruent on Splunk Search. 04-27-2017 09:09 AM
- Tagged Summarization timespan incongruent on Splunk Search. 04-27-2017 09:09 AM
- Posted Why am I unable to access Splunk Docker Containers through the web interface? on Security. 04-12-2017 08:30 AM
- Tagged Why am I unable to access Splunk Docker Containers through the web interface? on Security. 04-12-2017 08:30 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
02-15-2017
03:56 AM
Is this data of ONE SINGLE EVENT? I mean, you have one event with two Account Name ?
... View more
02-15-2017
03:50 AM
Hi,
Check index=_internal for the connection from the por you are expecting. If data is really hitting splunk, some message will show up there about it.
Let me know once you have results
... View more
02-15-2017
02:51 AM
Hi,
Here is my scenario:
UF1->
UF2->
HF-> IDX1;IDX2;IDX3
->SH1
Note: Connections are all good and I have got the files through the chain into my indexers perfectly.
The data I'm monitoring is in UF1, where I am monitoring a folder.
The files in there are CSV and have fixed fields, so I want them to be automatically extracted. I read in the documentation that INDEXED_EXTRACTIONS would not work with tcp inputs, which are exactly what I am doing, passing data by tcp from splunk instance to splunk instance.
So it appears that I would need only a REPORT to specify which fields are in the Data, bu that would be done in search-time.
QUESTIONS:
- What really are the implications of using INDEXED_EXTRACTIONS ?
- What are the disadvantages of not using INDEXED_EXTRACTIONS in the sourcetype and instead use REPORT?
- If my sourcetype is mainly only about that REPORT, should I just have it defined in the SH? Why would I need it to be somewhere else?
Thanks in advance
... View more
02-01-2017
07:21 AM
If I do this search
index=log NOT "*INFO*" earliest=-40d@d latest=-39d@d
| cluster t=0.3 field=raw showcount=t labelonly=false delims=" "
| eval old_label=cluster_label
| eventstats sum(cluster_count) as total_events
| eval Freq_Baseline=cluster_count/total_events
| fields _time, raw, old_label, cluster_count, Freq_Baseline, total_events
| collect index=clusters
Everything gets collected in index=clusters
BUT if I include this in a map,
index=is_log | head 1
| streamstats count as latest
| eval latest = 40
| eval earliest=latest + 1
| eval earliest= tostring(-earliest) + "d@d"
| eval latest= tostring(-latest) + "d@d"
| map maxsearches=35 search="search index=is_log NOT "*INFO*" earliest=$earliest$ latest=$latest$
| cluster t=0.3 field=raw showcount=t labelonly=false delims=" "
| eval old_label=cluster_label
| eventstats sum(cluster_count) as total_events
| eval Freq_Baseline=cluster_count/total_events
| fields _time, raw, old_label, cluster_count, Freq_Baseline, total_events
| collect index=clusters"
Then nothing is collected in the index, although the same results show up on the screen
... View more
Yes that is actually what I mean
Do scheduled sabed searches might not finish due to taking too long?
... View more
Hi
I am facing some issues with the time the jobs can run.
Are scheduled searches run in background? What is the runtime limit for them?
Thanks
... View more
01-13-2017
11:39 AM
Incredible thing just happened, I brought my pc home and connected to my company network using the vpn.... suddenly th Client appeared in the Forwarder Management
So somehow there is network problem whith my office network that I am not aware of...
... View more
01-13-2017
11:36 AM
Hi.
Thanks for the response! Yes I did that too. Incredible thing just happened, I brought my pc home and connected to the network using the vpn.... suddenly th Client appeared!
Weird:
Thanks anyway!
... View more
01-13-2017
10:54 AM
2 Karma
Hi
In the Deployment Server (DS):
- I copied an app to the /opt/splunk/etc/deployment-apps/
In the Universal Forwarder (UF), I configured it as a Deployment Client:
- splunk set deploy-poll 10.10.10.117:8089
Telnet from the UF to DS in 8089 works fine.
In the DS, I get the errors
"DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected"
Any ideas?
Thanks in advance
... View more
01-12-2017
09:22 AM
2 Karma
Hello,
I am testing a simple HTTP Event Collector input:
$ curl -k "https://localhost:8088/services/collector" -H "Authorization: Splunk xxxxxxxxxxxxxxxxxxxxxxxxxx" -
d '{"event": "andfnadjf"}'
It returns success but data is not getting into the default index (actually into any index)
Returns: {"text":"Success","code":0}
Any ideas?
... View more
12-28-2016
07:25 AM
1 Karma
I tried that but since the subsearch uses mvzip, expand and rex, it is not worth it
... View more
12-28-2016
02:34 AM
Thank you for your suggestions!
1 - The savedsearch replacing the code did not bring any better results, only the part before the subsearch used acceleration summaries.
2 - Will try that, despite the fact that automatic maintenance won't be available with that scenario.
Thanks
... View more
12-28-2016
02:24 AM
Hi, thank you for your time.
I checked the link you posted and in the end, it shows exactly the same behaviour I am experiencing. The fact that only the first transforming command is used might be the "problem", weird though.
Thanks anyway
... View more
12-24-2016
03:17 AM
index=KK (A=1 B!="x" C!="y" D=1) OR info OR (E=*) OR F=* OR G=*
| timechart avg(xxx) as RT, sum(eval(if(r1=1,1,0))) as CL, sum(eval(if(isnotnull('B') OR 'AX'!="0", 1, 0))) as ERR, sum(qq) as M, sum(g) as GT, avg(eval(100*cur/max)) as T, sum(CT) as cc, avg(dp) as DD
| fields _time, CL, RT, ERR, M, GT, T, CC, D
| appendcols [ search index=KK W=*
| bucket _time span=5m
| eval ff= mvzip('WA','WB')
| eval fff= mvzip(ff, 'WC')
| mvexpand fff
| rex field=fff "(?<CB>\d+),(?<CM>\d+),(?<P>.+)"
| stats sum(CB) AS cbs , sum(CM) AS cmx by _time
| eval rate=100*(cbs/cmx)
| timechart cont=false max(rate) AS Pool% partial=false ]
... View more
12-23-2016
09:16 AM
Hi,
I have two searches, A and B, and they are accelerated.
When I run A or B separately, job inspector shows they are accesing their specific summaries to get the data I need. However, when I do search A and appencols search B, it only accesses the summaries of search A, making the part of appendcols to take too long.
It is a similar problem...
... View more
12-23-2016
08:13 AM
Hello,
I have two searches, A and B, and they are accelerated.
When I run A or B separately, job inspector shows they are accessing their specific summary indexes to get the data I need. However, when I do search A and appencols search B, it only accesses the summary index of search A, making the part of appendcols to take too long.
Is there any way to make Splunk be able to access both summary indexes of saved searches?
Thank you
... View more
12-05-2016
09:31 AM
Does Splunk know that "new_index" is a summary index?
Create a saved search with that search and enable summary indexing
collect
Description
Adds the results of a search to a summary index that you specify. You must create the summary index before you invoke the collect command.
... View more
11-21-2016
08:51 AM
Are you fixing your Time Range or is it a Relative Time Range? That could explain the intermittence of 0 and 1 values
... View more
11-21-2016
06:41 AM
The only thing I see that might cause that is the followTail, because as you recall:
If set to 0, monitoring starts at the beginning of the file.
... View more
11-16-2016
06:29 AM
Hi
1st scenario: gives you the jobs that were executed more than 100 times
| stats count(JobName) AS COUNTER avg(Duration_sec) AS AVG_DURATION by JobName | where COUNTER>100 | table JobName, AVG_DURATION
2nd scenario: if you want to calculate the avg_duration of jobs that were executed more than 100 times, you can do this:
| eventstats count(JobName) AS COUNTER by JobName | where COUNTER>100 | stats avg(Duration) as AVG_DURATION by JobName | table JobName, AVG_DURATION
That returns only the
... View more
10-25-2016
12:08 AM
Thank you, that was my suspition. I'll have to live with that.
... View more
10-24-2016
10:41 AM
Hello,
I have a base search as simple as
<search id="root">
<query>index=w
</query>
</search>
And the I have
<search base="root">
<query> filter1=A AND filter2=B
</query>
</search>
This is not working because Splunk adds a pipe between the root and leaf search:
index=w | filter1=A filter2=B
What I wanted to happen is
index=w filter1=A filter2=B
Any ideas how to change this behaviour?
... View more
09-21-2016
01:31 AM
Thank you!
... View more
09-20-2016
01:16 PM
Sure, i already do that replace in order to compare data values without " against the token values. But the token mustn't have the " too. So I still need that token to not have ". The behaviour of replace function in the eval is apparently different inside the Dashboard and in a simple search.
... View more
- « Previous
-
- 1
- 2
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma from
