About richgalloway

richgalloway · ‎08-19-2013

Go to the 'Searches and Reports' manager page and click the New button. Enter your search query in the Search box, start time of '-15m' and end time of 'now'. Check the 'Schedule this search' box. Choose "15 minutes" from the 'Run every' box. Under Condition, choose 'if number of events' and 'is equal to' from the respective drop-downs. Choose the alert action and save the search.

richgalloway · ‎08-19-2013

Are you sure there were results in the last 15 minutes? Did you specify the time as 'index= "metering" sourcetype="ping" earliest=-15m | rex "Ping response: (? .)" | search PingMessage=":OK*" ' ?

richgalloway · ‎08-19-2013

Include 'earliest=-15m' in your search query.

richgalloway · ‎08-19-2013

Create a search that finds your log messages. Then schedule that search and have it send an alert if the event count = 0.

richgalloway · ‎07-29-2013

When using the CSV format, how does one link the inputs.conf and transforms.conf files? Should the respective files have identical stanza names?

richgalloway · ‎07-10-2013

I've set up a DBConnect database input with output.format=csvh and output.timestamp=1. When rows are read, the timestamp is added as the first field, but without a comma separating it from the next field. Example: "2013-07-10T13:58:36.601""FOO","000.00.42.12","Microsoft SQL Server Native Client","9.00.3042.00","Microsoft Corporation","1365739200.000" I suspect this is a bug. Is there a work-around? I'm using DBX version 1.011.

richgalloway · ‎06-26-2013

The Splunk DB Connect docs say to sign on as an admin to add or manage database connections. I take that to mean non-admin users cannot perform those functions.

richgalloway · ‎06-14-2013

See a212830's comment. If that doesn't solve your problem then check the MSSQL permissions.

richgalloway · ‎06-13-2013

Check your External Databases configuration and make sure the username and password are correct. Then check the database to make sure that user is allowed access to those tables. If you use MySQL, make sure access is granted to the user accessing from the Splunk server.

richgalloway · ‎06-05-2013

We disabled the Splunk Deployment Monitor app and our memory consumption has been flat ever since.

richgalloway · ‎05-30-2013

Have you granted access to the database? For example, 'grant all privileges on database.* to root@machine.splunk.runs.on;

richgalloway · ‎05-23-2013

Thanks, cramasta, but I think I wasn't clear about my problem. The dboutput usage string says it takes either an output-stanza name or a set of arguments (type, database, etc.). I'm trying to do the former and it's not being accepted.

richgalloway · ‎05-22-2013

I'm attempting to update a MySQL table using dboutput. I have an output stanza defined to simplify my searches. If I use the following search command where 'myupdate' is my output stanza name: ...| dboutput myUpdate IPAddress NetAddress ComputerName Manufacturer Model I get this error message: "Error in 'dboutput' command: command="dboutput", Missing mandatory option: type (Usage: dboutput ([dboutput-stanza] | type=<insert|update> database=<database> table=<table> [notFound=<ignore|fail|insert>] (<field> [as column]|*)+) )" It would seem I am not specifying dboutput-stanza correctly. Can anyone set me straight? Or is this a bug in dboutput?

richgalloway · ‎05-22-2013

I'm using DB Connect to send search results to MySQL. My search command is: ... | dboutput type=update notFound=insert database=mydb table=mytable fields=IPAddress AS ip, NetAddress AS mac, ComputerName AS device_name, Manufacturer AS manufacturer, Model AS model_name key=ip,mac * This produces the error message "No value specified for parameter 1". Turning on debug logging I see the following query is generated: UPDATE mytable SET `AS`=$AS$, ip=$ip$, NetAddress=$NetAddress$, ComputerName=$ComputerName$, Manufacturer=$Manufacturer$, Model=$Model$, mac=$mac$, IPAddress=$IPAddress$ WHERE ip = $ip$ Notice the 'AS' column was inserted. Where did it come from and how do I get rid of it? Also, my key argument specified two fields, but only one appears in the query. Is that another bug or something I did wrong?

richgalloway · ‎05-22-2013

According to the documentation at http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Commands#dboutput_.28beta_feature.29, you must use key=<key_field> when performing an update.

richgalloway · ‎05-13-2013

We're also running out of memory, but have zero UDP inputs configured. Could there be another source of the leak? We increased our VM from 8GB to 16GB and splunkd used it up in two days.

richgalloway · ‎05-13-2013

Have you checked out the Splunk-on-Splunk app?

richgalloway · ‎04-18-2013

I've only used it with FlashCharts.

richgalloway · ‎03-01-2013

I assume you have a HiddenChartFormatter stanza somewhere in your xml. If so, try adding a statement like this to it: <param name="charting.fieldColors">{"Value1":0x00FF00,"Value2":0xFF0000,"Value3":0xFF0000}</param>

richgalloway · ‎02-28-2013

It works, but you have to be sure to use the results of the round() function in your chart.

richgalloway · ‎02-28-2013

If I understand your question correctly, you need to add something like the following to your HiddenChartFormatter paragraph. <param name="charting.fieldColors">{"ValueA":0x00BE00,"ValueB":0x0000BE,"ValueC":0xFFFF00,"ValueD":0xFFA319,"ValueE":0xBE0000}</param>

richgalloway · ‎12-12-2012

Would you please explain what you want to do with char(13)? Have you tried "\r"?

richgalloway · ‎11-16-2012

When you put "latest" in your search, it trumps the selection in the date/time picker. The workaround is to also include "earliest" in your search string.

richgalloway · ‎07-30-2012

Perhaps something like "disposition=(?P [^\n,]*),?" will help.

richgalloway · ‎07-25-2012

Verify the connectionString. AFAIK, SQL Server no longer uses instance names. Instead server instances are specified by port number (sqlserver://10.1.1.10:10100).

Posts	16775
Solutions	2989
Karma Given	2024
Karma Received	6720
Member Since	‎07-24-2012

Online Status	Offline
Date Last Visited	an hour ago

Receiving notifications that are disabled

collectd reports "write_http plugin: curl_easy_per...

How do you restart splunk?

stats count(eval) always returns zero

Need help getting right timestamp from CSV

How to display more than 5 questions per page on A...

What will break if I set coldPath to /dev/null?

Knowledge Object Explorer won't load

How to use a field in SingleValue label?

How to move an index to another app?

Re: To set an alert if a field doesn't exist in l...

Re: To set an alert if a field doesn't exist in l...

Re: To set an alert if a field doesn't exist in l...

Re: To set an alert if a field doesn't exist in l...

Re: Splunk DB Connect Output formatting values - w...

Timestamp not added to CSV correctly

Re: db connect and user roles

Re: command="dbquery", A database error occurred: ...

Re: command="dbquery", A database error occurred: ...

Re: Memory usage increase in V5?

Re: ERROR java.sql.SQLException: Access denied for...

Re: Syntax for dboutput

Syntax for dboutput

dboutput bug updating MySQL

Re: DB Connect App (DBX) - Using dboutput command ...

Re: Memory usage increase in V5?

Re: Splunk Memory Metrics

Re: coloring pie chart

Re: Grouping values in bar chart when using inline...

Re: Pie chart - rounding percent values

Re: coloring pie chart

Re: Converting Numerical value(s) to Character(s) ...

Re: Using latest= in search results in all time, n...

Re: Multiple REX from single search

Re: What's wrong from jdbc config?

Join the Conversation