About briancronrath

briancronrath · ‎01-30-2018

Unfortunately not, same thing happens where when you click the link the search that spawns spawns nothing past the first less than character

briancronrath · ‎01-30-2018

How are you able to save that dashboard? It gives me a "Error parsing XML on line 18: Premature end of data in tag dashboard line 1 (essentially because line 13 has those characters in it)

briancronrath · ‎01-30-2018

was able to find a workaround by using sed mode for rex. Which was also annoying because the "+" character just shows up as a space when using the clickthrough, so I had to further workaround find a way to make it work with a "*" character which seems to be one it can actually handle. In the meantime though this definitely seems like clickthrough generated searches are quite buggy, no? Several characters it just can't handle at all. I should also note that after you use these characters and save it through the UI, trying to ever edit that drilldown through the UI again is a mistake because it will delete most of your search and unless you catch that it's doing that, you'll lose everything you worked on.

briancronrath · ‎01-30-2018

Use this dashboard simplexml as a repro if you'd like: <dashboard> <label>bug_repro</label> <row> <panel> <table> <search> <query>|makeresults | eval test="test"</query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="drilldown">cell</option> <drilldown> <link target="_blank">search?q=|makeresults | eval test="$row.test$" | rex field=test "(?<testxtract>.*)"&earliest=-15m&latest=now</link> </drilldown> </table> </panel> </row> </dashboard> I'm on Splunk 7 by the way. This is just a simple example to illustrate what I see as a aggravating bug I'm running into. I need to be able to generate rex for a clickthrough search in a dashboard of mine but I can find no workaround for this, as splunk rex seems to only allow named capture groups for extracting a field and the only way to do that is by using greater than or less than characters, which seem to just not be handled at all by the clickthrough functionality. Anyone have any ideas on how I can get a gt or lt character to work in a spawned search from a clickthrough?

briancronrath · ‎01-11-2018

Are you sure about that? From the doc: _tcp_Bps is the bytes transmitted during the metrics interval divided by the duration of the interval (in seconds) _tcp_KBps is the same value divided by 1024 _tcp_avg_thruput is an average rate of bytes sent since the last time the tcp output processor was reinitialized/reconfigured. Typically this means an average since Splunk started. _tcp_KProcessed is the total number of bytes written since the processor was reinitialized/reconfigured, divided by 1024. _tcp_eps is the number of items transmitted during the interval divided by the direction of the interval (in seconds). Note that items will frequently not be events for universal/light forwarders (instead, data chunks) kb is the bytes transmitted during the metrics interval divided by 1024.

briancronrath · ‎01-11-2018

I'm reading through https://docs.splunk.com/Documentation/Splunk/7.0.1/Troubleshooting/Aboutmetricslog trying to put together some analysis of forwarders in a timechart. I'm noticing that the tcp_KBps numbers are always higher than I would expect them to be. Shouldn't they essentially just be kb/60, if my bucket were 1 minute for instance? Take the following two timecharts: index=_internal sourcetype=splunkd host=*hf* group=tcpin_connections hostname=* | timechart span=1m sum(tcp_KBps) as "KBps" by host limit=50 index=_internal sourcetype=splunkd host=*hf* group=tcpin_connections hostname=* | timechart span=1m sum(kb) as "KB" by host limit=50 Shouldn't I expect in this case that the bottom results should be essentially 60x per host per bucket compared to the top? That's not what I'm seeing. I see them follow the same trends however the numbers do not add up. For instance I will see a kb value of 676,000 and a kbps of 27,500 for the same host on the same minutely time bucket. Shouldn't the kbps be around 11,266? What am I missing here?

briancronrath · ‎10-12-2017

Thanks gareth, feel free to convert to answer and I will mark it as solved!

briancronrath · ‎10-09-2017

In the past we had an easy LINE_BREAKER regex that broke on newlines where an ip4 was present ([\r\n]+)\d+.\d+.\d+.\d+ Now we have some logs with ip6 in addition to ip4 being logged, so I was hoping I can just do this via piping it out to alternate capture groups depending on which ip it matches: ([\r\n]+)(\d+.\d+.\d+.\d+|(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]).){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]).){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))) Is there something present where splunk only expects one capture group to be here for the LINE_BREAKER regex? I'm wondering how we can handle linebreakers now that we have 2 different style of IP that can come in.

briancronrath · ‎10-02-2017

I was able to get around this issue by limiting the time range for the data it is polling. This is under the Splunk Add-on for AWS console -> Inputs -> Actions -> Edit -> Templates Specifically the "Only After" value

briancronrath · ‎08-04-2017

I've been running into some issues where I'm doing a join on data from a subsearch that uses the dbxquery command for a saved search that periodically writes us a lookup file. We ran into some db connection issues where searchheads were intermittently not able to connect to this db and run the search; however, when this occurred it would essentially destroy our lookup file because the search continued to run even though the dbxquery would fail. Is there a way I can ensure the rest of the search does not run when the dbxquery fails in a subsearch?

briancronrath · ‎06-08-2017

I figured it out. Opening up permissions actually caused objects to show in the calls that had their json structure not include certain keys that the jira_rest python script it assigning. To resolve, I needed to add in if statements to make sure the key existed in the objects as they are iterated through.

briancronrath · ‎06-07-2017

I should also note that after reverting the permissions it still doesn't work, so it's almost as if it triggered something. I still get everything back fine if I issue direct Rest commands w/ the user, stumped as to why the app no longer returns any data.

briancronrath · ‎06-07-2017

I was able to get the command to return data up until today when the permissions were changed for the user we use to access our jira api. All that was done was to add access to additional projects, and now I can't get anything to return with the jira command. When I run a curl against the rest API endpoints using the same user I get data back just fine. Any ideas on what might be broken just by adding more projects available to the user?

briancronrath · ‎06-07-2017

I can run that curl with my user creds that are in my config and get good data back, yet I'm not getting anything to return in splunk. The real kicker for me is that I used to be able to get data back through the splunk command, but after someone opened up permissions for the user to view more projects, it just returns nothing anymore in the splunk command. Any ideas?

briancronrath · ‎05-15-2017

Unfortunately a clean option doesn't really exist, really wish we could just specify limit and sorting per the "bins". There is a different option that the above mentioned workaround of naming the field, which is to use a locallimit. You can set globallimit=0 to have no globallimit, but have locallimit=20 so that the top 20 values per "map view area" are displayed. What I mean by this, is that if you zoom in, and start scrolling around, based on all the data showing up on your current map area, you will get the top 20 values for that map area as a whole.

briancronrath · ‎05-08-2017

since you are doing an inputlookup, you need a | character as the first part of that subsearch. If I were you though since you are using a lookup table to join the data, why not just use he "lookup" command itself? You could just do: index="abc" source_type="xyz" | lookup abcdef fieldX as fieldA

briancronrath · ‎05-08-2017

is it the same 30 second time range for both indexes you need to query? If so I don't think any subsearch is necessary, just search both indexes in your base search, something like: (index=A OR index=B) | Then can do fill some null values and enable a stats call where you group by field c. If the field is named differently in each index you'll also need to add in an eval that creates a singular field to use for the grouping. So something like this: (index=A OR index=B) | fillnull value="" a,b,c,d | stats sum(a) sum(b) sum(d) by c Can change the sum to be whatever function you need for your particular stats call.

briancronrath · ‎05-01-2017

That's just what I used for a quick example, but the issue still persists regardless of using append or not. In my real world use-case I don't use append anywhere.

briancronrath · ‎05-01-2017

I couldn't find much on this in the docs, I did see on http://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Viz/Savedsearches#Post-process_searches it has an example of a chained post process search so I had figured it should work - but what I observed is that it isn't really practical for dashboards with inputs. By that, I mean that I was working on a dashboard that took in a dropdown input that set a token used in what we will refer to as "search 3". "search 3" used a base search of "search 2", which used a based search of "search 1". On initial load, the results for search 3 populate fine. However, if I try to change the input on the dropdown at all, the results for search 3 wouldn't change, and the bar below it where you can normally click on a magnifying glass to see new results then just becomes a grey bar. The only way I was able to resolve was by copying all of search 2, and placing it in front of search 3, and making search 1 the base search for search 3. After this now I get the results I desire, where whenever the input changes, search 3 changes accordingly. Ideally I don't want to do this though, as it's causing redundant searching to be done. Is this a bug or by design? Here is an easy repro you can do to try it yourself. Try changing the input on this one: <form> <label>Repro bug</label> <search id="base"> <query>|makeresults | eval bogus_stuff="stuff"</query> <earliest>-1min</earliest> <latest>now</latest> </search> <search id="post1" base="base"> <query>|append[|makeresults | eval bogus_stuff="more stuff"]</query> <earliest>-1min</earliest> <latest>now</latest> </search> <fieldset submitButton="false"> <input type="dropdown" token="token_val" searchWhenChanged="true"> <label>field1</label> <choice value="a">a</choice> <choice value="b">b</choice> <choice value="c">c</choice> <initialValue>a</initialValue> </input> </fieldset> <row> <panel> <table> <title>test</title> <search id="search3" base="post1"> <query>|append [|makeresults | eval testing_stuff="$token_val$"]</query> </search> <option name="wrap">true</option> <option name="rowNumbers">true</option> <option name="drilldown">row</option> <option name="dataOverlayMode">none</option> <option name="count">10</option> </table> </panel> </row> </form> Notice how above the results never changed. Now try it with this one and see they change fine: <form> <label>Repro bug Clone</label> <search id="base"> <query>|makeresults | eval bogus_stuff="stuff"</query> <earliest>-1min</earliest> <latest>now</latest> </search> <search id="post1" base="base"> <query>|append[|makeresults | eval bogus_stuff="more stuff"]</query> <earliest>-1min</earliest> <latest>now</latest> </search> <fieldset submitButton="false"> <input type="dropdown" token="token_val" searchWhenChanged="true"> <label>field1</label> <choice value="a">a</choice> <choice value="b">b</choice> <choice value="c">c</choice> <initialValue>a</initialValue> </input> </fieldset> <row> <panel> <table> <title>test</title> <search id="searchWorks" base="base"> <query>|append [|makeresults | eval bogus_stuff="more stuff"]|append [|makeresults | eval testing_stuff="$token_val$"]</query> </search> <option name="wrap">true</option> <option name="rowNumbers">true</option> <option name="drilldown">row</option> <option name="dataOverlayMode">none</option> <option name="count">10</option> </table> </panel> </row> </form>

briancronrath · ‎04-17-2017

Ahh that was my issue, I was using strftime after strptime to format it how I see _time when I output it through the UI, but I should have just been keeping it in epoch format. Thank you somesoni2 !

briancronrath · ‎04-17-2017

I am using a saved search that pulls in data from an external source with it's own time format. I've converted the format to match what I see when I output _time, and eval'd _time to be that converted value, but it doesn't seem to be getting recognized, because whenever the data comes in and I search on it, all the data just gets put to the beginning of today. Is there an extra step I'm missing in order to get _time to be overridden with my own values?

briancronrath · ‎04-14-2017

Wondering if anyone can suggest a good method of how to ingest PagerDuty incident data into splunk. Trying to leverage Splunk to create a dashboard showing who/which groups get paged and for what commons things they get paged for. It looks like the PagerDuty integration app only is a one way street of sending Splunk data over to PagerDuty - does anyone know of an app or similar that can ingest data the other direction of PagerDuty over to Splunk? Or do I need to create a customized script to accomplish this?

briancronrath · ‎04-03-2017

If you want to avoid searching the results twice, you could just add up the values and manually calc the total average (and remove the fields you don't care about): | timechart span=1d avg(eventDuration) sum(eventDuration) as s_ed count(eventDuration) as c_ed by project | addtotals fieldname=s_ed s_ed* | addtotals fieldname=c_ed c_ed* | eval total_avg=s_ed/c_ed | fields - s_ed* - c_ed*

briancronrath · ‎04-03-2017

What if you just made the choice value be what you eval to in your query and pass that as a token? <input type="radio" token="radio" searchWhenChanged="true"> <label>Radio</label> <choice value="*">All</choice> <choice value="avg(low) AS 2.4GHz">2.4 GHz</choice> <choice value="avg(high) AS 5.0Ghz">5.0 Ghz</choice> <default>*</default> </input> <query>source="snmp://Cisco-Wifi-clients" | timechart $radio$</query>

briancronrath · ‎03-27-2017

Do you have an extraction_cutoff value set anywhere in your limits.conf files?

Posts	122
Solutions	6
Karma Given	29
Karma Received	11
Member Since	‎01-03-2017

Online Status	Offline
Date Last Visited	‎07-13-2026 10:14 AM

Not able to have a "no downtime" upgrade now that ...

How to correct the GUID of a rebuilt Searchhead on...

Amazon Linux 2023 performance troubleshooting

How to determine what is filling the srtemp folder...

Indexers having periodic splunk-system-user failin...

Why are removed search heads still showing in the ...

Indexers frequently going to internal indexes only...

Is it possible to have multiple license managers b...

What do "total_slices" represent in the audittrail...

Why am I able to get values via joining on an inpu...

Re: Seems like a bug - why can't I include greater...

Re: Seems like a bug - why can't I include greater...

Re: Seems like a bug - why can't I include greater...

Seems like a bug - why can't I include greater tha...

Re: Why doesn't the kb and tcp_KBps numbers line u...

Why doesn't the kb and tcp_KBps numbers line up?

Re: How to handle LINE_BREAKER regex for multiple ...

How to handle LINE_BREAKER regex for multiple capt...

Re: Splunk Add-on for Amazon Web Services: Why do ...

Is there a way I can ensure the rest of the search...

Re: Add-on for JIRA: After user was granted additi...

Re: Add-on for JIRA: After user was granted additi...

Add-on for JIRA: After user was granted additional...

Re: Does the add-on for jira work?

Re: geostats sorting

Re: Problem while joining

Re: Join data from two indexes

Re: Is using a post-process search as the base of ...

Is using a post-process search as the base of a fu...

Re: How do I override _time in a saved search that...

How do I override _time in a saved search that sav...

Has anyone set up automatic ingestion of PagerDuty...

Re: in timechart, how do you display average by fi...

Re: How to create dynamic commands in search?

Re: Raw json file getting truncated

Join the Conversation