Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About bmacias84
bmacias84
Champion
Member since:
09-02-2011
12-08-2025
Community Statistics
| Posts | 790 |
| Solutions | 98 |
| Karma Given | 265 |
| Karma Received | 442 |
| Member Since | 09-02-2011 |
Activity Feed
- Got Karma for Re: Powershell unattended installation. 04-15-2024 10:06 PM
- Got Karma for Re: Using rex to extract one or two character digit from string. 11-12-2023 11:38 PM
- Got Karma for Re: How to Update Splunk after JavaScript Changes without Restarting Splunk. 04-06-2023 04:01 PM
- Got Karma for Re: How to do HTTP address health check in Splunk?. 08-01-2022 08:00 AM
- Got Karma for Re: How do I get Splunk to extract nested JSON arrays properly?. 07-20-2022 10:50 AM
- Got Karma for Re: How to Update Splunk after JavaScript Changes without Restarting Splunk. 02-22-2022 06:54 AM
- Got Karma for Re: How to Update Splunk after JavaScript Changes without Restarting Splunk. 12-11-2021 06:34 PM
- Got Karma for Re: Cannot get app logo to show up.. 08-27-2021 02:11 PM
- Got Karma for Re: How is linebreaking of events configured when receiving XML logs via REST input?. 07-16-2021 03:51 AM
- Got Karma for Re: How to achieve Optimized Search time in Splunk. 09-25-2020 04:09 AM
- Got Karma for Re: How to achieve Optimized Search time in Splunk. 09-25-2020 04:09 AM
- Got Karma for Re: Summary search count of events. 09-02-2020 05:57 PM
- Karma Re: splunk license usage question for ChrisG. 06-05-2020 12:49 AM
- Karma Re: Where can I find Splunk's Agentless Log Collection Library? for starcher. 06-05-2020 12:49 AM
- Got Karma for Re: Ingore last result in timechart. 06-05-2020 12:49 AM
- Karma Re: Where should I apply props and transforms: search heads or indexers? for richgalloway. 06-05-2020 12:48 AM
- Karma Re: How to combine two different searches? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: Send trap NSMP to an external system for jkat54. 06-05-2020 12:48 AM
- Karma Re: How to setup summary index using existing date field in data for somesoni2. 06-05-2020 12:48 AM
- Karma Re: Log Segregation ? for esix_splunk. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 2 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 6 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-03-2015
02:02 PM
2 Karma
Javascript provides a method called preventDefault(). The method must be tied to an event. Below is an example using table.
splunkTable = new TableView({
id: "members"+epoch2.getTime(),
managerid: elementSearch,
el: $(innerElement)
}).render();
splunkTable.on("click", function(e) {
e.preventDefault();
});
The sample above is an extract from a working Splunk project.
preventDefault
... View more
02-03-2015
01:53 PM
If you are using DNS entry or FQDN for the Splunk server you could create a cname entry in DNS. If you are on Windows you could write a one time start up script to rename or remove the outputs .conf. Basically your going to have to script the deletion or renaming of the $SPLUNK_HOME/etc/system/local/outputs.conf.
... View more
02-03-2015
01:40 PM
Yes you should be able to too using the following. It resembles they way you apply CSS win jquery.
<option name="charting.legend.labelStyle.defaultTextFormat">{italic:true,size:14}</option>
CustomChartingConfig-chartlegend
Cheers,
... View more
01-28-2015
10:02 AM
@avilandau,
I would recommend using the data previewer in Splunk to make sure you data is being broken correctly. You really should be using SHOULD_LINEMERGE=true=, which combines several lines of data into a single multiline event. The MAX_TIMESTAMP_LOOKAHEAD will also speed up indexing by telling Splunk to only lookup to 32 char instead of scanning the event. The other stuff can be ignored. Make sure these settings are applied to your indexer. The settings below have been tested with your sample data.
[gpp_error_log]
SHOULD_LINEMERGE=true
MAX_TIMESTAMP_LOOKAHEAD=32
REPORT-fields = gpp_error_log_fields
Cheers,
... View more
01-28-2015
09:50 AM
I think some of your problems are related to transaction. The transaction command is great but adds quite a bit of overhead. Also you are running sub search which run serially. Consider using mulitsearch instead of saved search.
http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Multisearch
... View more
01-23-2015
04:05 PM
Hello,
I had very similar issue. I was able to work around the issue by using epoch and attaching it to my id. For the second issue you can set the timeout attribute in the search manager. The timeout specifies in seconds how long to keep the search after processing has stopped.
poolSearch = new SearchManager({
id: elementSearch+epoch,
autostart: "true",
latest_time: "now",
earliest_time: "-1d@d",
cache: 'false',
search: splunkQuery,
timeout: "5"
});
... View more
01-23-2015
03:25 PM
1 Karma
Never mind on this I found the method. I was glazing over it.
poolSearch.cancel();
... View more
01-23-2015
02:56 PM
Hello,
I am trying to write a simple SPA using JS on the Search Head. I have a page where objects are generated dynamically based on a saved search. When an user clicks on an object, all other objects are hidden and the objects in focus pass data-device attribute to a second search which renders a new panel with data. This is fine except for when the user decides to switch focus mid search and they receive an error.
var poolSearch = new SearchManager({
id: elementSearch,
autostart: "true",
latest_time: "now",
earliest_time: "-1d@d",
cache: 'false',
search: splunkQuery
});
\
poolSearch.on('search:done', function(properties) {
console.log("DONE!\nSearch job properties:", properties.content);
var psearch = splunkjs.mvc.Components.getInstance(elementSearch);
var poolResults = psearch.data("results");
poolResults.on("data", function() {
console.log(poolResults.data());
});
});
I know how to check when a search is done or a search event has occurred, but how to cancel this search mid run?
Cheers,
... View more
01-07-2015
04:57 PM
1 Karma
@awurster
Keep in mind any data stored in Splunk is not state full. Even with summary Indexing data can be aged out to frozen/deleted. I have used DB connect or custom Splunk command to send data such as your to a third party database such as mysql, mssql, etc. Then using DB connect to call that information back.
... View more
01-07-2015
04:37 PM
Hello @stefanlasiewski,
Your regex statement will work just find by simply adding it to the REGEX settings in the transforms.conf. I do what you are doing all the time.
[syslog-header-stripper-ts-host-proc]
REGEX = yourRegex statement
This will working for search search time extraction, but are you trying to create an Index time extract? In your example it seems like you are trying to overwrite the _raw data.
... View more
12-17-2014
01:47 PM
This could be because of the zone the Splunk Cloud instance is in or set to. If the system is set to UTC and you are in Central Time Zone that would account for the 6 hour difference.
... View more
12-17-2014
09:16 AM
I would try using $SPUNK_HOME/bin/splunk cmd btool --debug savedsearches list. It possible that you have two saved searches running on different schedules outputting the data twice on two different intervals. The following command will output savedsearched stanza with what app running them
... View more
12-10-2014
03:30 PM
6 Karma
Hello,
On Splunk 6.2 I want to change users default dashboard and I wish to do this for all new Splunk users. Currently we are running search head clustering. I know that this is controlled by $SPLUNK_HOME/etc/users/<USER>/local/user-prefs.conf. initial I thought I could use $SPLUNK_HOME/etc/system/local/ui-prefs.conf, but that doesn't seem to work. Next I thought $SPLUNK_HOME/etc/system/local/user-prefs.conf would work but after reading the spec user-prefs.conf only applies to $SPLUNK_HOME/etc/users/<USER>/local/ directory.
display.page.home.dashboardId = /servicesNS/nobody/<appName>/data/ui/views/<viewName>
... View more
11-25-2014
09:23 AM
1 Karma
I believe this has something to do with search_command_internals.py.
I was able to over come this issue by settings local=true and streaming=true with the commands.conf.
... View more
11-20-2014
04:32 PM
My custom GeneratingCommand command seems to break when trying set command to local on a search head with streaming=True.
\@Configuration(streaming=True,local=True)
class mycustomcommand(GeneratingCommand):
"""
Class used to generate stream data from remote system
"""
jql = Option(
doc='''Syntax: jql=
Description: JQL query string ''')
maxresults = Option(
doc='''Syntax: maxresults=
Command works on stand-alone instance, but fails when adding *streaming=True.
Looking for assistance.
Python SDK Version 1.3.0
Splunk 6.2
Output:
11-20-2014 16:02:54.808 ERROR ScriptRunner - stderr from '$SPLUNK_HOME/bin/python $SPLUNK_HOME/etc/apps/zcommands/bin/mycustomcommand.py GETINFO jql="project=SPLK"': Traceback (most recent call last):
11-20-2014 16:02:54.808 ERROR ScriptRunner - stderr from '$SPLUNK_HOME/bin/python $SPLUNK_HOME/etc/apps/zcommands/bin/mycustomcommand.py GETINFO jql="project=SPLK"': File "$SPLUNK_HOME/etc/apps/zcommands/bin/mycustomcommand.py", line 74, in
11-20-2014 16:02:54.808 ERROR ScriptRunner - stderr from '$SPLUNK_HOME/bin/python $SPLUNK_HOME/etc/apps/zcommands/bin/mycustomcommand.py GETINFO jql="project=SPLK"': class mycustomcommandCommand(GeneratingCommand):
11-20-2014 16:02:54.808 ERROR ScriptRunner - stderr from '$SPLUNK_HOME/bin/python $SPLUNK_HOME/etc/apps/zcommands/bin/mycustomcommand.py GETINFO jql="project=SPLK"': File "$SPLUNK_HOME/etc/apps/zcommands/bin/splunklib/searchcommands/decorators.py", line 60, in call
11-20-2014 16:02:54.809 ERROR ScriptRunner - stderr from '$SPLUNK_HOME/bin/python $SPLUNK_HOME/etc/apps/zcommands/bin/mycustomcommand.py GETINFO jql="project=SPLK"': settings=self.settings)
11-20-2014 16:02:54.809 ERROR ScriptRunner - stderr from '$SPLUNK_HOME/bin/python $SPLUNK_HOME/etc/apps/zcommands/bin/mycustomcommand.py GETINFO jql="project=SPLK"': File "$SPLUNK_HOME/etc/apps/zcommands/bin/splunklib/searchcommands/search_command_internals.py", line 65, in init
11-20-2014 16:02:54.809 ERROR ScriptRunner - stderr from '$SPLUNK_HOME/bin/python $SPLUNK_HOME/etc/apps/zcommands/bin/mycustomcommand.py GETINFO jql="project=SPLK"': 'The value of configuration setting %s is managed' % name)
11-20-2014 16:02:54.809 ERROR ScriptRunner - stderr from '$SPLUNK_HOME/bin/python $SPLUNK_HOME/etc/apps/zcommands/bin/mycustomcommand.py GETINFO jql="project=SPLK"': AttributeError: The value of configuration setting streaming is managed
... View more
09-11-2014
02:07 PM
@gartnerj, my idea would be that your new style logs be called *yoursourcetype_v2 and apply a new transform with the correct delim. You would keep your old data with a separate transform with the appropriate delim applied. Hope that makes sense.
... View more
09-11-2014
10:44 AM
That is true, but both new styles have the some field field count. If gartnerj keeps the original as foo and names the new format with a source type foov2 he shouldn't have any problems. and the fields can be made global.
... View more
09-11-2014
10:26 AM
Yes you can do it that way. But cloning data is not a feature that UF are capable of. HF are the ability to do what is call data cloning and routing if thats what you want from Forwarder. Else it can be down at the indexer level. Its easy to clone data to two different system than to clone data the same system.
... View more
09-11-2014
10:02 AM
I agree with @David. This would not account for saved searches or where users used a wildcard or specified no index.
... View more
09-11-2014
09:59 AM
Why are you use regex? its seem like you should be using a transform with delim = ,. Then specify the fields.
... View more
09-05-2014
12:24 PM
2 Karma
hello,
their are two settings in props.conf one for truncation and event breaking. TRUNCATE applies to maximum line length of a line in bytes and the other is MAX_EVENTS which specifies the maximum number of input lines to add to any event. If you event is over 16,000 chars long and multi line you will have to set both. By default MAX_EVENTS breaks an event after 256.
Modifying these setting may cause performance issues.
[bluestripe]
TRUNCATE = 0
MAX_EVENTS = 1000
... View more
09-05-2014
10:55 AM
I don't believe that this works on multiline events.
... View more
09-05-2014
10:47 AM
checkout http://answers.splunk.com/answers/39885/match-an-ip-with-a-cidr-mask-into-a-csv-file. I believe this what you want.
... View more
09-04-2014
01:57 PM
Hello,
Splunk provides an app called Splunk Support for Active Directory. This SA has a custom command to search AD and append information to your results.
Splunk Support for Active Directory
... View more
