Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About MHibbin
MHibbin
Influencer
Member since:
11-03-2011
01-31-2025
Community Statistics
| Posts | 562 |
| Solutions | 87 |
| Karma Given | 241 |
| Karma Received | 363 |
| Member Since | 11-03-2011 |
Activity Feed
- Got Karma for Re: Running external script from search. 10-14-2025 03:56 AM
- Got Karma for Re: How to Manipulate Multiple Lookup Results. 08-28-2024 10:37 AM
- Got Karma for Re: How to Manipulate Multiple Lookup Results. 08-28-2024 10:36 AM
- Got Karma for Re: Table Column Headings. 10-25-2023 12:03 PM
- Got Karma for Re: REST API: Why am I hitting a limit of 100 exported results?. 05-11-2023 01:01 PM
- Got Karma for Re: Changing table column header names. 06-15-2022 08:25 AM
- Got Karma for Re: Scripted input stream mode. 11-23-2021 02:34 PM
- Got Karma for Re: How to export logs to Excel or text file. 07-14-2021 08:58 AM
- Got Karma for Re: Getting rid of "other" in pie chart. 08-07-2020 09:34 AM
- Got Karma for How do you migrate historic data from on-prem Splunk Enterprise to Splunk Cloud?. 06-05-2020 12:50 AM
- Karma Re: Splunk App for Enterprise Security: How to add additional fields to events under "Incident Review"? for ekost. 06-05-2020 12:47 AM
- Got Karma for Splunk App for Enterprise Security: How to add additional fields to events under "Incident Review"?. 06-05-2020 12:47 AM
- Karma Updated Splunk Visio Stencil or Deployment Icons for Drainy. 06-05-2020 12:46 AM
- Karma Re: Updated Splunk Visio Stencil or Deployment Icons for ChrisG. 06-05-2020 12:46 AM
- Karma Re: Does Splunk support Redhat chkconfig? for dwaddle. 06-05-2020 12:46 AM
- Karma Re: Reasonable Search performance? for dwaddle. 06-05-2020 12:46 AM
- Karma Re: Gaps in graphs for dwaddle. 06-05-2020 12:46 AM
- Karma Re: mastering splunk for MarioM. 06-05-2020 12:46 AM
- Karma Re: mastering splunk for araitz. 06-05-2020 12:46 AM
- Karma Re: SplunkWeb Certificates Issue for araitz. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
02-04-2013
05:36 AM
No problem, to close this question off, can you mark the answer as accepted with the empty tick beside the answer.
Thanks.
... View more
02-04-2013
05:01 AM
1 Karma
I would firstly try simplifying the names you are using the timechart command, and use something simple like:
OC-Main-player-loaded --> loaded
Then pipe to your eval command and use the simplified field labels in your calculation. I have had issues in the past with processing certain field names.
I would then pipe to rename to change the simplified field labels to something more legible.
Hope this helps.
... View more
02-04-2013
03:52 AM
2 Karma
You should look at the rex command... something like this should do it...
<yoursearch> | rex field="UserName" "\w+\s+\-\s+(?P<UserName>\w+)"
Hope this helps
... View more
12-12-2012
01:40 PM
Okay so my work around to avoid restarting Splunk each time a new host is added was to write the updates to a seperate deployment-app.. So two apps get sent out, one containing the collection script, one containing the the hosts file. This appears to work without requiring a restart.
... View more
12-07-2012
12:23 AM
1 Karma
I am going to assume that you are monitoring files here, I'm also assuming you have "cleaned" the indexes from the command line using, " ./splunk clean "...
To cut a long story short, Splunk uses CRC and other mechanisms to record whether a file has been monitored or not, and (if tailing) how far through that file it has read. This is to avoid duplication in normal circumstances.
You will need to clean make sure _thefishbucket index is cleaned as well.. However, if you have other indexes that are still working from before the clean that you performed, it may (and probably will) cause duplication in the indexing of events to those indexes. If you only use the main index then you should be fine. Please read the following.
http://blogs.splunk.com/2008/08/14/what-is-this-fishbucket-thing/
To clean a specific index (again,I'm assuming you have already done this):
./splunk clean eventdata -index <indexName>
... View more
12-05-2012
01:21 PM
I have used restartSplunkd since I noticed the scripted input wasn't picking up the change, and it does work, however I was just curious if there was something I should be looking out for. I haven't really looked into modular inputs (or splunk 5) as the time left for this particular project is running out very soon.
... View more
12-05-2012
10:29 AM
@dart, I re-read my question, and have subsequently updated it (all), so that it makes sense to everyone else, and not just myself. The "hosts file" is a file I use to maintain list of hosts to be used by a scripted input for data collection, which may need to change at various points in the future.. So I use the hosts file to avoid "hard-coding" anything.
... View more
12-05-2012
08:43 AM
Hi,
I just wanted to confirm something...
I have a deployment set up, where the deployment server maintains list of hosts in a text files, called hosts.txt , which differ based on the forwarder. These files and their parent deployment-apps are distributed as expected to the relevant forwarders (based on whitelisting). The hosts.txt file are referenced by a python script, which is configured as a scripted input.
The deployment update/reload process seems to work fine, apart from one aspect, the python script does not seem to read the updates in the file until after a reboot. To expand on this...
If, for example, I add the line 1.2.3.4 to the hosts.txt file in the deployment-app, foo (i.e. $SPLUNK_HOME/etc/deployment-apps/foo ), and reload the deployment (as @dart points out using the ./splunk reload deploy-server command). I will see the updated list on the forwarder under $SPLUNK_HOME/etc/apps/foo , however the script will not "see" the new entry (i.e. " 1.2.3.4 ") until I restart Splunk on the forwarder.
When I had this python script/hosts file combo working on a single server in test, it worked fine. And the script would pick up the update on the next interval cycle. I'm just wondering why I now have to reboot.
Has anyone any thoughts on this?
Cheers,
MHibbin
... View more
- Tags:
- deployment-server
12-05-2012
02:08 AM
2 Karma
Hi All,
I have had a look through some Q&A on here, but haven't really seen much in the way of automation with regards to the Deployment Server... I hope I have not missed something blindingly obvious/stupid.
I have a use-case where regular changes happen within the deployment that need to be distributed to forwarders, mainly lists of hosts which need to be passed to a collection script. The user maintains this list from Splunkweb, with the help of a python script. In this script I have included a subprocess to call the " ./splunk reload deploy-server " command, which is fine.
I was, however, wondering about having a script running in the background which does a periodic reload of the deployment server to confirm that all of the deployment is up-to-date, perhaps running every 5 minutes (perhaps).
Has anyone done anything similar to this?
Are there any pitfalls to watch out for?
Any reason why I shouldn't do this?
Thanks in advance,
MHibbin
... View more
12-04-2012
06:01 AM
you also have to make sure you are not using the default admin password (i.e. changeme ), as this will not work... but then I'd assume you are not if you have already added it... but then again, assume nothing 🙂
... View more
12-04-2012
12:24 AM
Glad it helped.
... View more
12-03-2012
08:54 AM
1 Karma
Using the SPL, you can try the following rex command and test the following regex
q=(?P<q>[^\&]+)
So, once you have your results:
<yourGeneratingSearch> | rex field=_raw "q=(?P<q>[^\&]+)"
This should look in the raw field and then assign the field as anything from q= upto the next use of & .
If this works, you can update/save this as the extraction for q and it will override Splunk's extraction.
Hope this helps.
... View more
11-30-2012
09:34 AM
Create you own flashtimeline and include the indexes as a dropdown...
This would allow to have a free text box for the search string, and then have a dropdown that includes a list of indexes that users can search on.
Perhaps a bit "radical" but hey-ho...
Good starting points:
http://docs.splunk.com/Documentation/Splunk/5.0/AdvancedDev/AdvancedSearch
http://docs.splunk.com/Documentation/Splunk/5.0/AdvancedDev/AdvancedSearch
Just an idea, but hope it helps.
... View more
11-30-2012
05:40 AM
@DamianS is referring to:
http://en.wikipedia.org/wiki/Gravitational_time_dilation
and
http://en.wikipedia.org/wiki/Global_Positioning_System#Timekeeping
... View more
11-27-2012
08:55 AM
1 Karma
Typically this can be worked around by running the CMD prompt as an Administrator.
Before clicking "command prompt" from the start menu, right click the icon, and select "run as..." and then "Administrator" (or "Run as administrator", depending on your OS).
This should be able to correct you issue, this will probably fix issues with starting Splunk as well.
... View more
@megancarney, changed the " 5.1 " to " 5.0.1 ", as I assume this is what you meant.
If it's not what you meant I apologise as you must be time-travelling as Splunk v5.1 is not a current release. 🙂
... View more
11-22-2012
08:55 AM
@richcollier, definately if we are talking about the file transfer method... loads of ways to achieve that. I was just thinking on the level of pure simplicity... nothing quicker than ol' "Copy and Paste" 😉 Hah!
... View more
11-22-2012
08:12 AM
Not sure I can help you there 🙂
Perhaps you could create an App to interact with the tool, and release to SplunkBase users.
... View more
11-22-2012
08:11 AM
You could probably use a python script that runs from start-up (via inputs, but with NO printing to STDOUT, otherwise you will affect your license limit) and checks takes data out of the PHP file and put it into an application.css file, although this seems a bit "excessive".
... View more
11-22-2012
07:24 AM
1 Karma
Don't believe this is possible to interact with Splunk in this way.
Does FireFile not support CSS output? - Bit odd to allow CSS changes, but not output in the standard file format.
If you don't like using Vi(m) - although it is a powerful tool and good fun - typically people use tools like Nano on Nix systems. This is a bit more use friendly and easier to use.
You could alway write create/modify the CSS into a text editor and the "Copy and Paste" into your server-side CSS file.
If you have a blank application.css file you could just open in it vi, having copied the text to your clipboard, and the press "i" to insert, and then right-click paste (or an alternative, that most terminals/prompts will allow).
Probably not the answer you are looking for, just some food for thought.
... View more
11-22-2012
01:21 AM
Please note, that this appears to be currently unavailable... perhaps for maintenance purposes.
... View more
11-22-2012
01:16 AM
@Outer_Limits,
Are you talking about your SplunkBase/Splunk.com password?
If so, you are right that you can not through your profile on Splunkbase, however when you are logged in, if you navigate to Splunk.com (there is a link at the top-left of the page). You can then navigate to your splunk.com account via the link in the top-right (It will appear as the full name you signed up with, not your user name) . You should then navigate to "Edit Login and Email Subscriptions", here you should find an option to change your password.
Hope this helps.
... View more
