About MuS

MuS · ‎07-06-2016

If you only want to forward events for the summary index, you need to apply some route and filtering http://docs.splunk.com/Documentation/Splunk/6.4.1/Forwarding/Routeandfilterdatad but why would you do that? Forward everything, specially the _internal events you will need them in case of troubleshooting 😉

MuS · ‎07-06-2016

Hi peters1901, this is not really a DNS resolution, but it will show you how it can be done using a lookup table containing host name and ip's: ip,host 192.168.56.10,master 192.168.56.11,node1 192.168.56.12,node2 192.168.56.13,node3 Using this dash board you will be able to search in index=_internal for an IP based on the select host name in the drop down: <form> <label>Host name to ip search</label> <fieldset submitButton="true"> <input type="dropdown" token="host" searchWhenChanged="true"> <label>Host</label> <search> <query>index=_internal host=* | dedup host | table host</query> </search> <fieldForLabel>host</fieldForLabel> <fieldForValue>host</fieldForValue> </input> </fieldset> <row> <panel> <chart> <search> <query>index=_internal [ search index=_* host=$host$ | lookup ip2hosts host | dedup host | rename ip AS clientip | return clientip ] | timechart span=1d count by clientip</query> <earliest>0</earliest> <latest></latest> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="count">10</option> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">column</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> </chart> </panel> </row> </form> Of course you need to adapt it to your needs and don't nail me on performance, since I never tested this in larger environments 😉 Based on the docs about external lookups http://docs.splunk.com/Documentation/Splunk/6.4.1/Knowledge/Configureexternallookups#External_lookup_example you can replace the text file based lookup with a script based lookup. Hope this helps to get you started ... cheers, MuS

MuS · ‎07-06-2016

Hi jagadeeshm, It might sound strange, but yes you need to add the index to the search head as well. Don't worry about storing data on the search head, because if you setup data forwarding on your search head and tell Splunk just to forward the local event and not to store it you will have no local summary data on the search head. See the docs http://docs.splunk.com/Documentation/Splunk/6.4.1/DistSearch/Forwardsearchheaddata about the best practice to forward logs from search heads to the indexers. The option indexAndForward = false is the one which prevents Splunk from keeping a local copy of your events. Hope this helps ... cheers, MuS

MuS · ‎07-05-2016

or a Heavy weight forwarder - don't forget to restart the Splunk instance after you added the config files.

MuS · ‎06-30-2016

I will get someone from Splunk legal department to answer this question .... pls hold the line ...

MuS · ‎06-30-2016

I'm pretty sure you're break all kind of legal thingys by doing this In theory, since you can install the same license on multiple machines ....

MuS · ‎06-30-2016

Update ping for the answer

MuS · ‎06-30-2016

Did you read the link provide about the calculated fields? This is one way to go for you....

MuS · ‎06-30-2016

@tkwaller : Yes, that would quick fix it as you can see here 😉 /opt/splunkforwarder/bin/splunk btool limits list thruput --debug /opt/splunkforwarder/etc/apps/TA-COMPANY-int-limits.conf-thruput-unilimited/local/limits.conf [thruput] /opt/splunkforwarder/etc/apps/TA-COMPANY-int-limits.conf-thruput-unilimited/local/limits.conf maxKBps = 0

MuS · ‎06-29-2016

Hi ashishlal82, create an eval based calculated field http://docs.splunk.com/Documentation/Splunk/6.4.1/Knowledge/definecalcfields for the sourcetype of the events that contain the md5 and/or sha256 fields. The eval you could use for the calculated field could be this: EVAL-HASH = coalesce(HASH, md5, sha256) the eval will either use the value of HASH or md5 or sha256 for the calculated field called HASH . Apply the automatic lookup on the field HASH and should provide the result. Hope this helps ... cheers, MuS Update: If the calculated field approach is not doable for you try this search: your base search here to get md5 OR sha256 | eval HASH = coalesce(HASH, md5, sha256) | lookup YourLookupNameHere HASH | do more ....

MuS · ‎06-29-2016

This http://blogs.splunk.com/2015/01/30/remembering-david/ is the reason why the app is no longer maintained

MuS · ‎06-29-2016

Hi daniel333, the value of the ./SplunkUniversalForwarder/default/limits.conf is # Version 6.4.1 [thruput] maxKBps = 256 and this take precedence over your TA 😉 S before T ... Learn more about the Splunk config precedence here http://docs.splunk.com/Documentation/Splunk/6.4.1/Admin/Wheretofindtheconfigurationfiles and / or use btool to check the applied config: /opt/splunkforwarder/bin/splunk btool limits list thruput --debug Hope this helps ... cheers, MuS

MuS · ‎06-29-2016

@annalisefolsen , I don't know what you are trying to achieve - but if you look at this example here http://docs.splunk.com/Documentation/Splunk/6.4.1/Search/Customsearchcommandshape you will learn how to pass a Splunk search result into a python script, do stuff with the result and return it into Splunk.

MuS · ‎06-27-2016

don't really want to put a default app in Deployment Server What do you mean with the term default app ? Why should it be a problem to use a default directory inside the app? The deployment server will overwrite everything - the entire app folder on the client. Basically, the client creates a hash of the folder, and the deployment server creates a hash of the folder. If the system checks the hashes and finds they are different the server sends the app folder to the client. http://docs.splunk.com/Documentation/Splunk/6.4.1/Updating/Howdeploymentupdateshappen This works differently if you look at the deployment within a SHC.

MuS · ‎06-27-2016

@a212830 is right, you can see it there. I just uploaded a screenshot where you can see the Parallel Data Pipelines . Did you check they are enabled and do you run DMC on the correct instance? This was take running a stand alone instance. cheers, MuS

MuS · ‎06-27-2016

Hi simpkins1958, Have a look at the docs here http://docs.splunk.com/Documentation/Splunk/6.4.1/AdvancedDev/TranslateSplunk#Translate_Apps about How to translate an App . Hope this helps ... cheers, MuS

MuS · ‎06-27-2016

Bottleneck is cpu Where did you get this information from? Did you check the job inspector as previously suggested? If so, what is using the most resources or time in the list? cheers, MuS

MuS · ‎06-27-2016

Hi mcrawford44, have considered to use the eval further down the search pipe after an automatic lookup? This should work fine. cheers, MuS

MuS · ‎06-21-2016

@daniel_augustyn , theses setting need to be done where the parsing is happening, usually an indexer or a heavyweight forwarder. See this http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F to learn more about this topic.

MuS · ‎06-21-2016

Hi bacchussr, there is a nice fiction of eval where you can use the {} to create new fields based on a value of another field. index=_internal sourcetype=splunkd or sourcetype=scheduler | eval hour-{sourcetype}=date_hour will create fields that are named hour-splunkd or hour-scheduler with the value of the corresponding date_hour field of splunkd or scheduler . Or as written in the docs http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Eval You can also use the value of another field as the name of the destination field by using curly brackets, { }. For example, if you have an event with the following fields, aName=counter and field aValue=1234, use | eval {aName}=aValue to return counter=1234. So this means you could try something like this: index=sendmail [ search index=sendmail host=mail-gw* to="someone@example.org" | fields qid ] | eval my_{qid} = qid | transaction my_qid Another hint: try to avoid sub searches for multiple reasons like limits and performance implications. You can get some nice example to replace transaction search with stats in the March 2016 session here http://wiki.splunk.com/Virtual_.conf or some other example to replace sub searches here https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html Hope this helps ... cheers, MuS

MuS · ‎06-20-2016

I agree on your answer in general; but reading the instruction of the App: 1- Install the app on the Splunk forwarder by extracting the tar file or doing it from the UI 2- Install Python 3.4 or above outside of the Splunk directory path on the same Splunk forwarder 3- Install selenium and user-agents modules using pip. To do so, you can follow the steps below: a- From the newly installed python directory , go to the bin folder and run the following commands: b- pip3.4 install user_agents c- pip3.4 install selenium This one uses the OS python instead of the Splunk shipped Python. My assumption based on the error message is that selenium was not installed therefor the module is not available. cheers, MuS

MuS · ‎06-20-2016

@annalisefolsen, Try to run this on your Splunk server (assuming it's linux) : /opt/splunk/bin/splunk cmd python -c "import splunk.Intersplunk" This will not fail. Remember to use Splunk's Python in your script and not the OS one located in /usr/bin/ . You can find some documentations here http://docs.splunk.com/Documentation/Splunk/6.4.1/Search/Writeasearchcommand and here http://dev.splunk.com/view/python-sdk/SP-CAAAEU2 Hope this helps ... cheers, MuS

MuS · ‎06-20-2016

Indeed, my answer was not complete. Refere to the other answer and follow the three steps after the base search and you should get it working.

MuS · ‎06-19-2016

@goodsellt, maybe you should check out the start-end option of the bin command: <start-end> Syntax: start=<num> | end=<num> Description: Sets the minimum and maximum extents for numerical bins. The data in the field is analyzed and the beginning and ending values are determined. The start and end arguments are used when a span value is not specified. You can use the start or end arguments only to expand the range, not to shorten the range. For example, if the field represents seconds the values are from 0-59. If you specify a span of 10, then the bins are calculated in increments of 10. The bins are 0-9, 10-19, 20-29, and so forth. If you do not specify a span, but specify end=1000, the bins are calculated based on the actual beginning value and 1000 as the end value. If you set end=10 and the values are >10, the end argument has no effect. http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Bin#Bin_options

MuS · ‎06-19-2016

Hi nasamajh09, take a look at this answer https://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas-1.html which show a way how to do it. In your case you could do something like this: your base search here to get all events | eval volume=if(isnotnull(volume), volume, "0") | do more stuff here This will search in your events for the field volume and if it is not null it will uses the value of volume otherwise it will be set to 0 . Hope this helps ... cheers, MuS

Posts	4458
Solutions	814
Karma Given	2144
Karma Received	3944
Member Since	‎05-02-2011

Online Status	Offline
Date Last Visited	4 hours ago

Report Capture app for Splunk: Exception capturing...

How to use eval if there is no result from the bas...

How to compare fields over multiple sourcetypes wi...

Splunkbase Apps update bug?

docs.splunk.com wrong link to answers

splunkbase feature request

splunkbase colored background

Captain Picard's Star fleet messages

the pony command

max throughputs of forwarders

Re: Should a summary index be created on both Sear...

Re: DNS Resolution: How to convert a hostname ente...

Re: Should a summary index be created on both Sear...

Re: Trouble ignoring events

Re: How many master Splunk instances can one Enter...

Re: How many master Splunk instances can one Enter...

Re: How to compare 2 fields in an index to 1 field...

Re: How to compare 2 fields in an index to 1 field...

Re: Why is my universal forwarder not respecting m...

Re: How to compare 2 fields in an index to 1 field...

Re: TimeWrap Source Code

Re: Why is my universal forwarder not respecting m...

Re: Passing search results to external python scri...

Re: Why am I getting incorrect results from btool ...

Re: How to monitor multiple data pipelines?

Re: Are there any Splunkbase apps that have been l...

Re: How to troubleshoot Splunk 6 search performanc...

Re: Can you specify the order of operations for so...

Re: How to configure Splunk to extract the correct...

Re: How handle case-sensitive results from a subse...

Re: How to get Splunk to run my Python shell scrip...

Re: Passing search results to external python scri...

Re: How to search all events and corresponding vol...

Re: How do I modify the span for timechart to matc...

Re: How to search all events and corresponding vol...

Join the Conversation