About MuS

MuS · ‎05-28-2013

thanks for this! just solved my problem with scripted inputs result are being indexed with a wrong timestamp. added current time stamp at first output line and everything is good now 😃

MuS · ‎05-28-2013

Hi markmcd using the Search Splunk Answers I found ziegfried's answer to an almost identical question, please read it here -> http://splunk-base.splunk.com/answers/57522/plotting-on-google-map-based-on-name-of-place-not-ip-address-based cheers, MuS

MuS · ‎05-23-2013

Hi cam343 you're mixing up things here, you are setting up an index time field extraction, not search time. This means, only new indexed events will have those fields and not the older events. But maybe you should test your field extraction in the search app by using only one field at the time and proceed until you get what you want, like: ... | rex "(?<nspaces:clientip>^(\d{3}.){2}x\.x)" this matches the first IP in your log data and creates in your search result a new field called nspaces:clientip . This way you can build the regex and use them in the transforms.conf to have the fields extracted at index time for any new event. as always docs is a good place to read: http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Addfieldsatsearchtime http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Configureindex-timefieldextraction hope this helps cheers, MuS

MuS · ‎05-16-2013

Hi edelocombe Please make sure that the user running the installer has the correct privileges, including being able to create or delete Windows Services. Also make sure that the Splunk install folder does not have "read-only" anywhere within its properties. Kill any remaining Splunk process after you do an installer uninstall on Windows or you manually delete the services. Windows will not always release the memory. You can delete the services from the command line using: sc delete splunkd sc delete splunkweb Check for any remaining Splunk folder and remove it, after that try the install. cheers, MuS

MuS · ‎05-14-2013

Hi tmuthuk your regex does not match the dateofbirth, d{4} looks for four d's and not four digits. I've played around at RegExr and found that this regex \d{4}-\d{2}-\d{2}(?!T) will match the dateofbirth in your provided log text. cheers, MuS

MuS · ‎04-12-2013

Hi raziasaduddin there used to be a bug in 4.1.x which matches your description, see this answer. Contact Support if not yet done, don't forget to prepare a diag file before you file a support case 😉 cheers, MuS

MuS · ‎04-11-2013

have a look at this answer http://splunk-base.splunk.com/answers/78921/splunkd-using-too-much-ram and keep analyzing what splunkd is using swap

MuS · ‎04-11-2013

This setting has an impact to the forwarder only, since it tells the forwarder how much data it can send a once. Does the forwarder really send so much data? You can check that in metrics.log or in the deployment App or the S.o.S. App. Other thing you can do if possible, revert back the change on the forwarder and see what happens.

MuS · ‎04-11-2013

Hi konradwawryn since swapping is controlled by the OS, you should troubleshot/check your OS settings like swapiness for example. You also have the possibility to set some memory related limits in splunks limits.conf - but be warned, that you also can break stuff very easily there. I can recall that in some older 4.2.x version there was a bug, causing the OS to use huge amount of swap (like 20 or 30Gb) but this was fixed later. cheers, MuS

MuS · ‎04-10-2013

Hi rlautman when I recall it correct JMeter can log its test result in almost any format to a file. Setup your JMeter test run to write its results into a csv file for example and have this log file or the containing directory monitored by Splunk. As soon as you start the test and the JMeter log gets written, Splunk will read and index the results. hope that helps to get you started..... cheers, MuS update: yes, this should be possible in JMeter - View Result in Table click configure and choose your settings.....

MuS · ‎04-10-2013

use this: index=t | head 10 | timechart span=1ms list(H_message_type) this should provide the correct chart .... at least it did for me with 5.0.1 cheers, MuS

MuS · ‎03-19-2013

Hi piebob, I cannot decide it, because there is still no 'real' answer 😉

MuS · ‎03-15-2013

python urllib2 is wonderful in doing this stuff, it will take you some time to write the script but in the end you will have exactly that one script that will fit your needs 🙂 you can find a example here: http://ryanmerl.com/2009/02/14/python-web-crawler-in-less-than-50-lines/ sit down, relax, take a deep breath and start scripting...

MuS · ‎03-13-2013

Hi Jason, I will do it if you don't want to decide it 😉

MuS · ‎03-13-2013

that's a nice one and we already figured that out. Still the questions remains: what is the exact time range ' ./splunk list deploy-clients' reports on and how could this be changed? If you have phoneHomeIntervallinSecs set to 600 then you will have (with the current setting) clients that never show up...

MuS · ‎03-12-2013

bump - would be nice to know what time range is used 😉

MuS · ‎03-11-2013

Hi Mark, no I see no reason why this should be a bad idea. If you see that it will get you any troubles, than simply revert to the original values. cheers, MuS

MuS · ‎03-08-2013

just did that, go ahead and accept it 😉

MuS · ‎03-08-2013

Hi catch_mili like in your Solaris question ... it's the same here: how would you detect a newly installed RPM in CentOS and then provide it into splunk. for example: you can get with rpm -qa a full list of installed RPM and with rpm -qi <RPM Name> you can get the install date. With this you can build a scripted input. cheers, MuS

MuS · ‎03-08-2013

I wonder if this will work, because 'timechart' can only take one 'split by' series, 'chart' can take two. So for timechart it would be: ...| timechart span=1mon count(recipient) by hour_type and for chart it would be: ...| chart count by recipient,hour_type on the other hand, count(recipient) will count all events that have a recipient and not events for each recipient....

MuS · ‎03-08-2013

hmmmmm I must be doing something wrong here Ayn, but I get an 'Error in 'timechart' command: The argument 'hour_type' is invalid.' if I use your search?

MuS · ‎03-07-2013

Hi mark I'll try to answer this: In the docs about what splunk logs about itself link>, you can find the following information: metrics.log Contains periodic snapshots of Splunk performance and system data, including information about CPU usage by internal processors and queue usage in Splunk's data processing. The metrics.log file is a sampling of the **top ten items* in each category in 30 second intervals, based on the size of _raw. It can be used for limited analysis of volume trends for data inputs.* license_usage.log Indexed volume in bytes per pool, source, sourcetype, and host. This means, if you want to get reliable information about your license usage you have to use license_usage.log. metrics.log can provide different results, because it only contains the top 10 hot data sources. You can change this setting in the [metrics] stanza in limits.conf . Find further information on working with metrics.log here> hope this helps and if my answer was wrong, I'm sure hexx and/or Ayn can provide a superb and detailed one 🙂 cheers, MuS

MuS · ‎03-07-2013

http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Configuretimestamprecognition ?

MuS · ‎03-07-2013

Hi braddockinfotech use your preferred web browser and open up http://<yourservername>:8000 to use splunk web UI. cheers, MuS

MuS · ‎03-07-2013

dammit, you were 14 seconds faster 🙂

Posts	4458
Solutions	814
Karma Given	2144
Karma Received	3944
Member Since	‎05-02-2011

Online Status	Offline
Date Last Visited	3 weeks ago

Report Capture app for Splunk: Exception capturing...

How to use eval if there is no result from the bas...

How to compare fields over multiple sourcetypes wi...

Splunkbase Apps update bug?

docs.splunk.com wrong link to answers

splunkbase feature request

splunkbase colored background

Captain Picard's Star fleet messages

the pony command

max throughputs of forwarders

Re: Very strange issue with timestamp's from a scr...

Re: How can I calculate lat/long from a physical a...

Re: search time field extraction doesn't work

Re: Crazy idea - Installing Splunk - Getting 'Fail...

Re: Masking a data at search time

Re: Splunk Folder Permissions keep getting reset i...

Re: Splunk server swapping - why ?

Re: Splunk server swapping - why ?

Re: Splunk server swapping - why ?

Re: JMeter Logging

Re: timechart without spaning

Re: What timerange does ./splunk list deploy-clien...

Re: Any apps for web site crawling?

Re: What timerange does ./splunk list deploy-clien...

Re: What timerange does ./splunk list deploy-clien...

Re: What timerange does ./splunk list deploy-clien...

Re: Variance between licence_usage.log and metrics...

Re: Timechart expression - No results found.

Re: RPM detection

Re: Merging two chart together

Re: Merging two chart together

Re: Variance between licence_usage.log and metrics...

Re: How do I extract a timezone expressed as the d...

Re: Unable to open Splunk web interface

Re: Can splunk forwarders be configured to find lo...

Join the Conversation