About asarolkar

asarolkar · ‎07-17-2012

So I guess the issue was that I was using Google Maps App 1.0 - WHICH IS NOT COMPATIBLE WITH Splunk Version 4.3.3 !

asarolkar · ‎07-17-2012

Is it possible to write savedSearches (saved in the "Search App") into the configuration of the "GoogleMaps" module for a view (written in advanced xml) ? For instance, the following search executes this DYNAMICSEARCH every time this view is loaded. GoogleMaps will attempt to run the search dynamically and plot its results on a google map : <module name="HiddenSearch> <param name="search">DYNAMICSEARCH</param> <module name="GoogleMaps"> ... </module> </module> I want to save DYNAMICSEARCH as a saved search and use that as the search parameter instead Any ideas on how to go about this ?

asarolkar · ‎07-17-2012

I want to limit the data from one of my universal forwarders from being indexed temporarily (until we get a new Splunk Daily Limit override). Note that I do not want to block 9997 on the indexer. I do not want to shut down splunk on the forwarder either. The remedy which involves writing all logs to nullQueues is a potential solution: http://splunk-base.splunk.com/answers/11617/route-unwanted-logs-to-a-null-queue My understanding is that when we write logs from a certain sourcetype (or in this case ALL sourcetypes) to a nullQueue, it will mark it for indexing later. The key here is that I want it to go to a nullQueue NOW, but when then throw-away the nullqueue configuration and re-index everything that was sent to the nullQueue. Is that how it works ? Any other suggestions if going about it in this manner is not useful ? Thanks

asarolkar · ‎07-17-2012

Ha ! The issue was that the version of the Google Maps App I was using was not compatible with 4.3.3 which is the version of Splunk I have been using !

asarolkar · ‎07-16-2012

I have a Web Intelligence app which has a google maps component within (this has its own geoip.py and geonormalize.py). The Google Maps app has its own geoip.py and geonormalize.py). Based on my understanding for either app, those scripts are the drivers of the process of putting data from sourcetypes on the map and display everything on the map. My issue is that Google Maps doesnt work when Web Intelligence Does !!! When Web Intelligence is enabled and Google Maps is disabled, the map within the Web Intelligence app works just fine. I can actually see how the clientips, cities, ports etc are plotted on the map. When I run the following searches (see below), while I do get actual events under "interesting fields", but the results, clientips, user, host, pid etc - I do not see any results ON THE ACTUAL GOOGLE MAP (The Error Message says preparing a preview and then 0 results with location information) * | lookup geoip clientip | geonormalize sourcetype=* | lookup geoip clientip | geonormalize * | rex "(?<ip>\d+\.\d+\.\d+\.\d+)" | eval clientip=ip | lookup geoip clientip | geonormalize Why is maps working for Web Intelligence but not for Google Maps ?? Is there an unspoken rule in Splunk where that google Maps MUST be disabled for Web Intelligence to function ? Reason I ask is because while one business unit that is our customer uses the Web Intelligence App there is another that wants to use advanced xml to create a CUSTOM dashboard which which will use Google Maps

asarolkar · ‎07-16-2012

It says loading preview- error loading preview and then bails out

asarolkar · ‎07-16-2012

index=* sourcetype="access_combined" | geoip clientip did not yield any results on the google map over any time interval (it gives me matching events - it does not give me any results on the map) Error Loading preview 0 results with location information in the last 5 minutes

asarolkar · ‎07-16-2012

This is the search that I tried sourcetype="access_c*" | table user bytes clientip client_ip_country_name clientIp_latitude clientip_longitude When I runit in the "Search" app, I get results i the form of a table. I see actual values in the table However, when I run this search in the Google Maps App (I go to App -> Google Maps) , no results actually appears on the map. It has 15856 matching events but on the map it reads 0 results with location information (0 distinct locations) in the last 30 minutes

asarolkar · ‎07-16-2012

This is the search that I tried sourcetype="access_c*" | table user bytes clientip client_ip_country_name clientIp_latitude clientip_longitude When I runit in the "Search" app, I get results i the form of a table. I see actual values in the table However, when I run this search in the Google Maps App (I go to App -> Google Maps) , no results actually appears on the map. It has 15856 matching events but on the map it reads 0 results with location information (0 distinct locations) in the last 30 minutes

asarolkar · ‎07-16-2012

Hi guys: If we were to consider between 4.3.1 and 4.3.3 - is it still pretty much the same picture when we compare 4.3.2 and 4.3.3 ?

asarolkar · ‎07-15-2012

Hi guys: We are looking to monitor amongst other items FOR an instance on which Cisco Call Manager Runs (Cisco CDR) i) the JVM Usage ii) CDR statistics This two-part question is a Splunk best practices question about how to go about accomplishing the two tasks above: i) I want to install a Universal Forwarder on the instance on which Cisco CDR actually lives - and push data to an indexer using this App ( the app is installed on the same box as the Universal Forwarder) Apparently based on this BLURB here THAT is NOT how this app works. http://sideviewapps.com/apps/splunk-for-cisco-cdr/docs/getting-the-data-out-of-callmanager/ Can anyone who has actually done this step up and help us with some good ol' advice ? ii) Of all the apps listed here http://sideviewapps.com/apps/sideview-utils/ Which app is the most beneficial to install if data is to be captured in Splunk particular to CDR performance metrics only ? Also, are ANY of these apps known to provide JVM metric data for Cisco CDR on which they are installed ? Thanks,

asarolkar · ‎07-13-2012

Hi guys: In our current PROD architecture we have various OS flavors of the 4.3.2 Universal forwarders pushing data to ONE 4.3.2 Splunk Indexer We are anticipating an upgrade to 4.3.3 and I am doing a analysis on pros/cons of the actual upgrade. There are 3 questions to which I am seeking answers to. This is not about the "right" way to do this - but rather evaluating the overall benefit of an update and then implementing that change in line with known best practices : i) There are several combination of upgrade protocols that can be used. First of which is to upgrade BOTH the indexer and the forwarders to 4.3.3 ** An alternative** is to upgrade just the indexer to 4.3.3 and keep forwarders at 4.3.2 Would you favor one over the other ? ii) Considering the second approach described earlier, what problems could one face with having Splunk components that talk to each other every second in a system architecture with different versions (some are 4.3.3 others are 4.3.2 in this case). I have done some research and my findings there should really NOT be any major issues with this approach. Anybody strongly agree/disagree with that ? The indexer is backward compatible with the forwarers and this should not be a big deal. Note that folks who have done something similar for 4.2.X to 4.3.X have not seen any major issues - the findings in this post here more than likely also apply to an upgrade between two versions of 4.3.X http://splunk-base.splunk.com/answers/38117/updating-to-splunk-43-with-existing-42-universal-forwarders ii) Advantages of upgrading to 4.3.3 What advantages do heavy users of Splunk get in terms of functionality/efficiency for an upgrade from 4.3.2 to 4.3.3 ? There is very little material out there and I was wondering if there was any empirical evidence/known pros to performing this upgrade. Thanks

asarolkar · ‎07-11-2012

All: I am trying to chart browsers used by my app based on the "useragent" field from access_combined (apache logs) in this manner. sourcetype="access_combined" useragent!="-" AND useragent!="Apache" AND useragent!="Load-weight" AND useragent!="Java" AND useragent!="Jakarta Commons-HttpClient" | stats count(eval(match(useragent, "Firefox"))) as "Firefox", count(eval(match(useragent, "Chrome"))) as "Chrome", count(eval(match(useragent, "Safari"))) as "Safari", count(eval(match(useragent, "MSIE"))) as "IE", count(eval(NOT match(useragent, "Chrome|Firefox|Safari|MSIE"))) as "Other" The problem is that the actual log entry looks like this: For firefox: 97.76.108.114 - - [11/Jul/2012:08:36:37 -0700] "POST /forgotPassword HTTP/1.1" 200 3799 "https://www.easycareonline.com/forgotPassword" "Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1" For IE: 97.76.108.114 - - [11/Jul/2012:08:36:37 -0700] "POST /forgotPassword HTTP/1.1" 200 3799 "https://www.easycareonline.com/forgotPassword" "MSIE 8.0; Windows NT 5.2; Trident/4.0" The useragent entry files these two under OTHER because the ACTUAL VALUE for useragent is : "Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1" AND "MSIE 8.0; Windows NT 5.2; Trident/4.0" Any ideas on how to go about this ? Maybe regexes ? The problem with using field extractions is that there is no set standard for what a UA (User Agent) string should look like, at all. I wonder what the chrome entry looks like (obviously we have none yet)

asarolkar · ‎07-10-2012

Guys: i want to simply chart the events over time without using the Report builder. Any ideas on how to go about it ?

asarolkar · ‎07-10-2012

The number of calls IS the same as number of events. I want to graph is by time and then orgName

asarolkar · ‎07-10-2012

When I execute this search, I get all events from organization : Barclays that contains records for 2012. index="log" | search orgName="org\\barclays" | search "*2012*" However, i want to do two things: i) graph the number of calls made into a report ii) find the timestamp for the last event. I want to be able to do both without using report builder. Any pointers on how to proceed with this ?

asarolkar · ‎07-09-2012

I have log that looks like this: 2012-02-23 09:25:21 VShellSSH2 sftp 108660 172.59.56.8 62386 NESTLE - C:\SFTP\NESTLE\file.csv 0 0 350754 350754 - - "108660: FLETCHER\NESTLE has accessed 'C:\SFTP\NESTLE\file.csv 350754 bytes downloaded" I need to figure out a way to apply field extractions to extract the name of the org (which usually appears after the keyword FLETCHER\ ) and then similarly extract the # of bytes downloaded. Any pointers so as to how I should go about it ? Here's what Im thinking : i) I will create a field extraction to pick out the name of the org - eg. NESTLE in this case This field will be called org ii) I will create a regex that will filter out the # of bytes downloaded. this field will be called usage iii) I will do a sourcetype=SFTP_records stats bytes by org Does that make sense ? There are multiple events like these for every ORG and needless to say there are multiple ORGS

asarolkar · ‎07-09-2012

hi i tried doing sourcetype="access_combined"| geoip clientip and that did not produce any results apparently. Any ideas ?

asarolkar · ‎07-08-2012

I installed the google maps app and I am "enabled" it under "Apps". I go into the app and am trying to execute the following in the search bar that appears under "Google Maps" - but it does not work. index=* sourcetype="access_combined"| geoip clientip | search clientip="199.47.245.5" | stats count by uri_path clientip_city | sort - count | stats list(clientip_city) AS city list(count) AS hits BY uri_path | rename uri_path AS uri | eval city=mvindex(city, 0, 4) | eval hits=mvindex(hits, 0, 4) Note that data for this sourcetype is being forced inward into the indexer from a forwarder. The /props.conf over under /apps/search/local ON THE INDEXER contains an entry for "access_combined". I SEE THIS when I execute the results: On the left there are 19 interesting fields that appear ( bytes, clientip, eventtype, file ) values for all of which get populated (you can see the sampling of indexed data associated with these fields coming in) - BUT NOTHING appears on the actual map Instead, I see a blank google map and this message 0 results with location information ( 0 distinct locations) in the last 4 hours. Any idea what is going on here ? If i can see values populated for clientip, bytes, eventtype etc, why can I not see those generated on the actual google map ? Am I missing something here ? The great goal of this exercise is to get it to execute this search within the context of Google Maps -- and leverage the GoogleMaps element into the advanced xml creation of a non-form dashboard which contains this googleMaps saved search.

asarolkar · ‎07-05-2012

So it turns out that a variation of your query worked out for me !! sourcetype="metrics" OrgID=* | bucket span=1d _time | dedup OrgID _time | stats sum(OrganizationPatientCount) by _time Life Lesson learnt : the best things in life are free... and elegant 🙂

asarolkar · ‎07-05-2012

I tried option #1 and it came back to me with no results (oddly enough) I tried the following version of option #2 (I made a few changes for the typos) sourcetype=metrics OrgID=* | bucket _time span=1d | stats latest(OrganizationPatientCount) as lastOrganizationPatientCount by _time,OrgID | stats sum(lastOrganizationPatientCount ) by _time but that did not work out either - there was no data. I am assuming #2 is REALLY what you wanted me to test Also with option#2, there was no dedup.. Also, I examined all content from my queries for case-sensitivity and everything checks out

asarolkar · ‎07-04-2012

We have a sample report that we generate everyday -it contains two fields: i) OrgID (which is duplicated in the events from time to time) and ii) OrganizationPatientCount (each OrgID has one of these) We are trying to graph the second attribute over a 30 day timeframe like this: sourcetype="metrics" OrgID=* | dedup OrgId | bucket _time span=1d | stats sum(OrganizationPatientCount ) by _time Which seems to be working except that it gives me JUST TODAY's OrganizationPatientCount. We need to use stats in such a way that it avoids duplicates AND it can give me patient count for everyday in that 30 day time period. I tried looking up how bucketing actually works when used WITH stats and I read through this: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/bucket but that wasnt particularly helpful. Note that if I dont specify buckets explicitly at all, stats() used with sum() in this way gives me results for EVERY DAY in a 30 day time-interval - except that it gives me a completely incorrect count. Any ideas ?

asarolkar · ‎07-04-2012

We are in a bit of pickle currently trying to disassociate indexed data from a sourcetype that is currently tied to a certain index - both of which we wish to discard. The data was pushed out from the universal forwarder which was setup in this manner in the inputs.conf: [monitor://c:\accesslog\access*.log] disabled=false followTail=0 index=os sourcetype=accesslog I want to change configuration on the indexer (or the forwarder) such that it goes to sourcetype="access_combined" which is associated with index="default" WITHOUT having to edit the aforementioned segment in the inputs.conf on the forwarder. How do I do this without having to setup a brand new configuration set (like the one above) and re-indexing EVERYTHING again. Bear in mind, this is a tonne of data and we are attempting to avoid an overage.

asarolkar · ‎07-03-2012

Finally got it !

asarolkar · ‎07-03-2012

Finally got it work. Had to just move it around quite a bit but it worked out. For those that care, this is how I got those two sourcetypes to work: From props.conf and transforms.conf respectively: [syslog] TRANSFORMS-null = setnull [applog] TRANSFORMS-null = ignore [setnull] REGEX=healthCheck DEST_KEY=queue FORMAT=nullQueue [ignore] REGEX=\[/healthCheck/status] DEST_KEY=queue FORMAT=nullQueue Apparently the key is to NOT use the same REGEX in both places. No idea (?) but it worked out 🙂

Posts	174
Solutions	3
Karma Given	59
Karma Received	32
Member Since	‎11-08-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Could not use strptime to parse timestamp

Timestamp extraction issue

AuthenticationManagerLDAP Error Message and BaseDN...

Anybody know what this error means

Timed out while waiting for splunkd daemon to resp...

Splunk for WinSSHD question

Splunk 5 and search indexers

Remove Chart in PDF report in Splunk 5

Trial version of WinSSHD

Display table with empty values marked as NONE

Re: Google Maps does not work on my splunk indexer

Saved Searches in google Maps

NullQueue and Re-indexing Logs

Re: Google Maps for windows does not work / Web in...

Google Maps for windows does not work / Web intell...

Re: Google Maps does not work on my splunk indexer

Re: Google Maps does not work on my splunk indexer

Re: Google Maps does not work on my splunk indexer

Re: Google Maps does not work on my splunk indexer

Re: Benefits to an upgrade from 4.3.2 to 4.3.3

Sideview App for CDR : open questions

Benefits to an upgrade from 4.3.2 to 4.3.3

Extracting browser statistics from access logs

Re: Timechart or stats or lastTime

Re: Timechart or stats or lastTime

Timechart or stats or lastTime

Field extraction and regex strategy

Re: Google Maps does not work on my splunk indexer

Google Maps does not work on my splunk indexer

Re: Sample search to look over data using stats, d...

Re: Sample search to look over data using stats, d...

Sample search to look over data using stats, dedup...

Change sourcetype/index after data is indexed from...

Re: Multiple filters in multiple sourcetypes to be...

Re: Multiple filters in multiple sourcetypes to be...

Join the Conversation