Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Justin_Grant
Justin_Grant
Contributor
Member since:
12-10-2009
06-05-2020
Community Statistics
| Posts | 112 |
| Solutions | 9 |
| Karma Given | 583 |
| Karma Received | 193 |
| Member Since | 12-10-2009 |
Activity Feed
- Got Karma for Best practices for installing and configuring apps in a distributed Splunk install?. 10-26-2023 10:20 AM
- Got Karma for Feature Request: troubleshooting/debugging for field extraction config files. 10-26-2020 08:28 AM
- Karma How do I use the SingleValue module to color code search results? for tpaulsen. 06-05-2020 12:45 AM
- Karma Re: How do I use the singleValue module to color code search results? for Johnvey. 06-05-2020 12:45 AM
- Karma How do i set the default App in splunk? for Erik_Swan. 06-05-2020 12:45 AM
- Karma Re: What does (?m) mean at the beginning of a regex for Johnvey. 06-05-2020 12:45 AM
- Karma Can I add python modules to the Splunk environment? for Simeon. 06-05-2020 12:45 AM
- Karma Re: Can I add python modules to the Splunk environment? for Johnvey. 06-05-2020 12:45 AM
- Karma Re: Can I add python modules to the Splunk environment? for amrit. 06-05-2020 12:45 AM
- Karma Re: Can I inject events into Splunk via a script? for Johnvey. 06-05-2020 12:45 AM
- Karma Re: Can I inject events into Splunk via a script? for ampledata. 06-05-2020 12:45 AM
- Karma how to tell if I have multiline events? for V_at_Splunk. 06-05-2020 12:45 AM
- Karma Re: how to tell if I have multiline events? for V_at_Splunk. 06-05-2020 12:45 AM
- Karma Re: how to tell if I have multiline events? for Stephen_Sorkin. 06-05-2020 12:45 AM
- Karma are search language *keywords* case-sensitive? for V_at_Splunk. 06-05-2020 12:45 AM
- Karma Finalize action for searchscript? for jrodman. 06-05-2020 12:45 AM
- Karma Re: Finalize action for searchscript? for gkanapathy. 06-05-2020 12:45 AM
- Karma I can't see data I know is indexed for cfrln. 06-05-2020 12:45 AM
- Karma Re: I can't see data I know is indexed for cfrln. 06-05-2020 12:45 AM
- Karma How do I allow users to edit a view? for matt. 06-05-2020 12:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 2 | |||
| 3 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 13 |
03-22-2010
07:53 PM
@kode - If I'm reading @k8to's post correctly, even though this happened in search, the job-management URL it came from is part of Manager, hence you ran into this problem in Manager. Regardless, sounds like this is fixed in 4.0.10, so an upgrade should solve the issue.
... View more
03-16-2010
06:20 PM
wow, a downvote. tough crowd. seems like a legit question to me. +1.
... View more
03-16-2010
06:08 PM
Hi Glenn, mostly I'm trying to avoid the complexity of having a separate view just for this. Want to keep things simple. But I like your idea of redirection. Want to post this as an example on Splunkbase.com?
... View more
03-16-2010
06:02 PM
as usual, great answer! out of curiosity, why are transaction types not recommended in this scenario?
... View more
03-15-2010
06:13 AM
Our office has a specific TRANSACTION search we do frequently to track all events related to a particular user. The search is always the same except for the user ID, which the Splunk user copies in from an email.
What's the best way to store the search so that I can quickly call it from the search bar but plug in the Session ID I want to restrict results to?
I guess I could use a macro and stick a | WHERE after it, but I was wondering if there was a more proper/efficient or proper way to do it.
I see there's a "transaction type" feautre I can use-- is this the right solution?
I also know I can do a Form Search but in this case we want to use the "plain" search bar.
... View more
03-14-2010
10:45 PM
re: "is it that you're simplifying and making it seem so". Yep, I'm simplifying. But the general use-case here (dealing with slow lookups) is pretty common, where you want to annotate logged data with other data (e.g. reverse DNS lookup, search engine results, etc.) which take a few hundred milliseconds to return. In most cases, throughput shouldn't be a problem since these kinds of data sources usually are OK wtih making many calls in parallel-- as long as you don't end up having only one thread doing the querying.
... View more
03-14-2010
04:01 AM
1 Karma
dude that's a genius idea! The only other way I knew to handle this case was with SPLUNK CLEAN and a test index, but your approach sounds much easier. thanks!
... View more
03-13-2010
10:49 PM
13 Karma
I accidentally imported some files into Splunk and the default line-breaking didn't work correctly. Now I want to repeat the import using a fixed props.conf and transforms.conf.
But I know that Splunk won't re-index files that it's already seen (meaning unchanged CRCs). How can I get Splunk to re-import these files?
... View more
03-13-2010
10:45 PM
5 Karma
I am trying to index an XML file which looks like this:
<?xml version="1.0" encoding="utf-8" ?>
<Posts2Votes>
<row>
<Id>1</Id>
<PostId>7</PostId>
<UserId>2</UserId>
<VoteTypeId>2</VoteTypeId>
<CreationDate>2009-11-06T02:22:37.063</CreationDate>
<TargetUserId>7</TargetUserId>
<TargetRepChange>10</TargetRepChange>
<IPAddress>64.127.105.60</IPAddress>
</row>
<row>
<Id>2</Id>
<PostId>6</PostId>
<UserId>2</UserId>
<VoteTypeId>2</VoteTypeId>
<CreationDate>2009-11-06T02:22:38.25</CreationDate>
<TargetUserId>31</TargetUserId>
<TargetRepChange>10</TargetRepChange>
<IPAddress>64.127.105.60</IPAddress>
</row>
<!-- more "row" elements go here -->
</Posts2Votes>
Splunk's default parser will recognizes the timestamps correctly but does not split the events on each <row> element, and no fields are extracted by default. OK, now I need to figure out how to extract these fields and break the lines correctly. Any ideas?
... View more
03-13-2010
08:57 PM
2 Karma
I would like to use a lookup into an external database to add fields to my events, but need some advice about performance and caching of expensive lookups.
For example, say I have a log of orders made by users on my website. For each order I'd like to record the employee ID of the last customer support person who contacted that customer before purchase. This info is stored in an external database I can only query one record at a time (send customer ID, get back ID of support rep). The problem is that this system has no memory-- once a customer talks to another support rep, I can't get a record of the previous rep-to-customer interaction.
This means that we should be capturing the mapping as close as possible to when the initial data is logged.
Also, that external database is pretty slow (1 query = 0.5 seconds) so even if I could solve the history problem, I can't realistically do a lookup directly into that system every time I want to report on this data.
Finally, there will be millions of orders I am reporting over (each one with a potentially unique mapping to a support rep ID).
I know about external lookup scripts, but I'm not sure if that's a good match for this use case, both for performance reasons and because the mapping changes over time.
Anyone have advice about how to handle this case?
... View more
03-09-2010
02:08 AM
Splunk's web GUI makes a few external calls out, e.g. to load the list of available apps from Splunkbase.
If my corporate network has a proxy server, how can I configure Splunk Web to use that proxy server for its remote calls?
I'm running Splunk Web on Windows Server 2008, if that's important to the answer.
... View more
02-28-2010
01:19 PM
3 Karma
I'd like to build a "Recent Alerts" report listing which alerts have been fired by Splunk in the last few days.
When a splunk alert is fired, I'm assuming there's an event written somewhere in the _internal index which I can use for this. Anyone know what search query I should be using to pull out these events from Splunk's internal logs?
BTW, this report will be useful for several reasons, including:
troubleshooting problems with our alert scripts (e.g. alert fired but alert script didn't do what we thought it should)
giving folks outside the ops team a view into the problems the ops team is working on
providing a failsafe option if email is down
... View more
02-22-2010
08:47 PM
1 Karma
[I heard this question on an internal mailing list, but it seemed generally relevant so asking it here too]
I have a scripted input that talks to an SDEE interface on the Cisco IPS. This interface can be flakey at times and I am running into an issue where if a connection fails Splunk will no longer retry the script. I assumed with the scheduler set -1 it would just try to reconnect after the script exits. I am catching the exception and exiting gracefully but that doesn't seem to work or I am just doing it wrong. Can anyone give me a pointer as to what I need my script to do in order to get Splunk to retry it if the first connection fails.?
... View more
- Tags:
- scripted-inputs
02-22-2010
07:28 PM
Can you add a sample line(s) from the log you're trying to use? I think you're asking about how to create a transaction when there are multiple QID values in the same log line, but seeing examples of the specific events you're trying to handle will be helpful to clarify.
... View more
02-22-2010
12:19 AM
Good question -- I was wondering the same thing. FWIW, although @johnvey's answer is helpful, I really think @sigfried's answer below deserves the checkmark, since it actually answers your question directly.
... View more
02-12-2010
09:40 PM
Dude, your images point to broken links. I removed them for now, feel free to add them back once you have the right URLs.
... View more
01-28-2010
10:55 PM
5 Karma
Per Steve Z, one of Splunk's rocket scientists:
The tag approach is definitely not
scalable beyond a few thousand.
Tags were designed to handle expanding
to tens or hundreds of values, not
tens of thousands or more. Also, note
that tagging is designed to tag
specific values of a single field,
rather than events as a whole
... View more
01-25-2010
06:39 PM
2 Karma
I'm trying to use Splunk to monitor both runtime metrics and configuration state of a server application like JBoss or SQL Server. My goal is to test each application against a set of "known good" tests and report on which server software is out of compliance.
If I just wanted to monitor one metric (e.g. free disk space > 10%) or one configuration setting (e.g. the value of a particular Windows registry key) this would be easy in Splunk via a saved search.
But operations teams can sometimes document a "known good" definition which can include tens or even hundreds of checks for one piece of server software.
What's the most efficient way using Splunk to do hundreds of different tests against logged metrics or configuration data? I assume that having hundreds of saved searches is not the best way to do this. 🙂
... View more
01-22-2010
05:46 AM
2 Karma
I'm thinking about using the DEDUP commend to solve the following problem: I have an event with an ID field and I'd like to show only the latest event matching each unique ID value. In most cases all the events with the same ID will be near each other (in time) but they won't be adjacent.
First, is DEDUP the right command to use in this scenario?
Second, how can I ensure that DEDUP (or whatever command is best for this) performs optimally? I have control over all aspects of the data (what fields are emitted, index-time vs. search-time fields, etc.) other than how many events are generated and I have limited control over the size of each event.
... View more
01-22-2010
05:39 AM
3 Karma
How many tags can be created before Splunk's performance is adversely affected? And what specifcally is adversely affected when too many tags are defined-- index perf, search perf, or both?
... View more
- Tags:
- performance
- tags
01-22-2010
05:36 AM
Cool! BTW, the docs for the dedup command are here: http://www.splunk.com/base/Documentation/latest/SearchReference/Dedup
... View more
01-20-2010
11:46 PM
3 Karma
Yes! Splunk can monitor Windows Registry. For more info, take a look at the documentation here.
Also, there's a blog post from some guy named Ledio announcing this feature. Any relation? 🙂
... View more
01-19-2010
08:36 PM
18 Karma
[UPDATE: from the answer below, it sounds like what I'm looking for is not supported in the product today. I'm tacking on the feature-request tag accordingly.]
When creating field extractions by editing props.conf/transforms.conf, it often takes a few iterations and experiments with regexes and config settings before I get it working.
What's the best way to troubleshoot and debug these problems? My ideal would be a trace or debug facility which would tell me, for a particular input (e.g. an imported log file) info like the following:
which config files were used to try to extract fields? (can use this to track down problems like a config file having the wrong permissions or being in the wrong folder)
for each config file, which stanzas were usd by that input? (to spot problems like typos in stanza names or auto-detection of sourcetype gone awry)
for each stanza, verbose output about what happened when processing. For example if CHECK_FOR_HEADER = true was set, which header fields were actually captured? If there's a regex for field extraction, then how many times that regex matched? (if it's zero, I'll know there may be a problem with the regex)
and so on... I'm not sophisticated enough to know all the things I should be asking for here, only that such a critical part of the product needs better troubleshooting/debugging support.
Essentially I want a record of what splunk tried to do, so I'll know at what stage the extraction failed.
Is something like this possible with Splunk 4.0 today? If so, how?
... View more
01-15-2010
07:43 PM
I have a log which often has redundant events, where "redundant" is defined as 2+ events, on subsequent lines, where each redundant event has the same value for a particular field (e.g. "ID").
How can I suppress the second and subsequent events so only the first event in a set shows up in my search results?
... View more
- Tags:
- transactions
01-15-2010
07:36 PM
2 Karma
when there's an option to put something in props.conf or transforms.conf, could you add more detail about when you'd want to put info in one vs. the other?
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:02 AM
|
