About rroberts

rroberts · ‎03-19-2014

In $SPLUNK_HOME/var/run/splunk/dispatch/1312323432.11 is see: 03-19-2014 17:02:11.147 INFO SearchParser - PARSING: litsearch index=_internal source="*license_usage.lo*" type=Usage | bucket _time span=10m | eval indexer_guid=i | addinfo type=count label=prereport_events | fields keepcolorder=t "_time" "b" "indexer_guid" "prestats_reserved_*" "psrsvd_*" | prestats sum(b) by _time indexer_guid In the search.log file I see my stats command has been translated to prestats. Why is this?

rroberts · ‎02-26-2014

Unfortunately this training instance is gone. I'll spin up a new one and see if I can recreate.

rroberts · ‎02-26-2014

Working in the esanalyst role I cannot suppress a notable event in ES 3.0. Is this working as designed? If so, what capability do I need to give the role?

rroberts · ‎02-25-2014

Batch upload a diag : 5178152 2011-11-17 17:18 diag-ip-10-168-65-59-2011-11-17.tar.gz (not too big I don't think) Splunkd crashed. Any Idea what may have caused the crash? Crash log snippet indicates the OneShotFileWriter thread is the culprit but have no idea why. [build 189883] 2014-02-24 15:34:15 Received fatal signal 6 (Aborted). Cause: Signal sent by PID 1972 running under UID 521. Crashing thread: OneShotFileWriter OS: Linux Arch: x86-64 Backtrace: [0x00002AAAABC01EC5] gsignal + 53 (/lib64/libc.so.6) [0x00002AAAABC03970] abort + 272 (/lib64/libc.so.6) [0x00002AAAABBFB11F] __assert_fail + 239 (/lib64/libc.so.6) [0x0000000000B4505F] _ZN20PipelineInputChannel16addNumberedFieldERK10StrSegment + 159 (splunkd) [0x00002AAAAF020F01] ? Linux / ip-10-188-188-218 / 2.6.21.7-2.ec2.v1.2.fc8xen / #1 SMP Fri Nov 20 17:48:28 EST 2009 / x86_64 Last few lines of stderr (may contain info on assertion failure, but also could be old): Splunk std err shows… 2014-02-24 10:45:22.405 -0500 splunkd started (build 189883) Cannot open manifest file inside "/home/stu4/opt/splunk/var/lib/splunk/defaultdb/db/db_1311012880_1283850332_0/rawdata": No such file or directory Cannot open manifest file inside "/home/stu4/opt/splunk/var/lib/splunk/defaultdb/db/db_1373425154_1373415809_2/rawdata": No such file or directory splunkd: /opt/splunk/p4/splunk/branches/6.0.1/src/framework/PipelineInputChannel.cpp:706: void PipelineInputChannel::addNumberedField(const StrSegment&): Assertion `_refcnt == 1' failed. 2014-02-24 15:36:18.312 -0500 splunkd started (build 189883) Cannot open manifest file inside "/home/stu4/opt/splunk/var/lib/splunk/23456/db/db_1393265100_1393265100_2/rawdata": No such file or directory [stu4@ip-10-188-188-218 bin]$ ./splunk version Splunk 6.0.1 (build 189883) [root@ip-10-188-188-218 splunker]# uname -a Linux ip-10-188-188-218 2.6.21.7-2.ec2.v1.2.fc8xen #1 SMP Fri Nov 20 17:48:28 EST 2009 x86_64 x86_64 x86_64 GNU/Linux

rroberts · ‎02-11-2014

With the removal of check boxes on the drop down menus on the Incident Review dashboard in ES 3.0. How do I multi-select options? Im using Chrome on a Mac.

rroberts · ‎01-06-2014

This is an old thread but it might shed some light: http://answers.splunk.com/answers/111528/webstats-errors-on-every-link

rroberts · ‎01-06-2014

What version of Splunk are you on?

rroberts · ‎01-06-2014

If you scroll down on the dashboard you should see a section (panel) called: Description This example shows you how to add search-driven, custom visualizations to a dashboard, using JavaScript. The panel will you show you the underlying XML, JS and CSS. To see more information about where these files are located see: http://docs.splunk.com/Documentation/Splunk/6.0.1/Viz/CustomizeSimpleXML

rroberts · ‎12-31-2013

Have you checked out this document? http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Forwarddatatothird-partysystemsd In your props.conf you can filter by [source:: path to audit.log ] . Specifically check this section: Syslog data[edit] ... send data in standard syslog format. The forwarder sends the data through a separate output processor. You can also filter the data with props.conf and transforms.conf. You'll need to specify _SYSLOG_ROUTING as the DEST_KEY.

rroberts · ‎12-17-2013

Found the issue: link rel="stylesheet" type="text/css" media="all" href="/en-US/static/@169902:0/app/demo-bubbles/dashboard.css" /> Replace demo-bubbles with search or whatever app you copy to. And I had an old module reference: "One issue here is that it should be 'splunkjs/mvc/postprocessmanager', not 'splunkjs/mvc/postprocess'" @Itay Neeman Thanks for the module update.

rroberts · ‎12-17-2013

Trying to take a dashboard converted to HTML/JS and place on another search head. The page won't render. It just comes up blank. Seems have link elements to static version causing the problem. Example: link rel="stylesheet/less" type="text/css" media="all" href="/en-US/static/@169902/less/base/bootstrap.less" Is the static/@16992 reference causing the problem?

rroberts · ‎12-13-2013

"tscollect" contributes statistics while "tstats" does exactly what you mention. "tscollect" creates a TSIDX file. TSIDX is similar to summary indexing that allows dramatically improved performance. It is used in several applications such as Enterprise Security (version 2.4 and later). This feature was first available in Splunk 5.0. Check the scheduled saved searches in the app and see how often they run. At least one of those should have tscollect command in it. You might check out: http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Tscollect

rroberts · ‎12-12-2013

Glad you found it useful!

rroberts · ‎12-12-2013

Try this ... index=_audit action="login attempt" | dedup user | join [| rest /services/authentication/users ] | table user roles

rroberts · ‎12-12-2013

I ran this as well and it worked. I got userName->admin , splunk_server->192.168.2.11, timeAccessed-> yada yada.. Im on Splunk 6.0 Build 174933.

rroberts · ‎11-01-2013

Are there any updates to this topic? I notice the docs mention. "For security reasons, you should implement this feature using SSO." Any examples?

rroberts · ‎10-14-2013

One approach would be to leverage lookups. Checkout: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources?r=searchtip You can create field=value pairs on the the fly to augment knowledge about your events.

rroberts · ‎10-14-2013

Ah, gotcha.

rroberts · ‎10-14-2013

Found this section in the .. http://docs.splunk.com/Documentation/Splunk/6.0/Installation/Aboutupgradingto6.0READTHISFIRST doc. "We have changed a number of the Splunk terms that you've come to know" 1.Manager, Splunk's main configuration interface, is now known as Settings. 2.Launcher, the initial menu you see when you run Splunk, is now known as Home. 3.Saved searches are now known as reports. 4.A saved search with an alert is now known as an alert. 5."TSIDX stats" are now known as indexed field statistics.

rroberts · ‎10-10-2013

Don't plan on using file-handle-less modular input so I'll ignore the message. By the way, sc query SplunkMonitorNoHandle reports: SERVICE_NAME: SplunkMonitorNoHandle TYPE: 2 FILE_SYSTEM_DRIVER STATE: 1 STOPPED WIN32_EXIT_CODE: 1077 (0x435)

rroberts · ‎10-02-2013

Getting this error message after new install: "Unable to initialize modular input "MonitorNoHandle" defined in the system context: Introspecting scheme=MonitorNoHandle: script running failed (exited with code 255)." However splunk seems to be running fine.

rroberts · ‎09-30-2013

Found it looks like it will be created under : /opt/home/rick/splunk/var/run/splunk/dispatch/1380485760.325/tsidxstats

rroberts · ‎09-30-2013

If I run : 1.index=_* | fields action | tscollect namespace=myaction ...(creates tsidx file) 2.The myaction namespace will be created under $SPLUNK_HOME/var/lib/splunk/tsidxstats/myaction 3.| tstats count from myaction groupby action ...(read tsidx file) However, if I don't use a namespace value where does the tsidx get created?

rroberts · ‎09-20-2013

http://answers.splunk.com/answers/95491/replacing-splunk-logo-in-the-footer-of-scheduled-pdf-reports Looks like you can remove the Splunk logo but dont see an adding example yet.

rroberts · ‎09-17-2013

TSIDX namespace- I contributed to a namespace by running index=_* | fields action | tscollect namespace=myaction. This created a myaction folder with a time series file under $SPLUNK_HOME/var/lib/splunk/tsidxstats. My dashboard runs searches against this namespace by running | tstats count from myaction groupby action. Report Acceleration- The report acceleration summary is actually a tsidx file created with and rolls with the buckets. ie $SPLUNK_HOME/var/lib/splunk/defaultdb/hot_v1_1

Posts	299
Solutions	56
Karma Given	158
Karma Received	174
Member Since	‎04-28-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

After upgrading to 6.5.0, why are there so many Ti...

Splunk Add-on Builder: Why isn't the download butt...

Why does search typeahead no longer show "matching...

Splunk App for Enterprise Security 3.3.1: How to c...

Does SHC support ES app

Is this Splunk App for Stream free?

REST API endpoint for prebuilt panels doesnt seem ...

Is it possible to have a search string so long tha...

What is the purpose of fieldforLabel attribute?

Checking conf files for problems...

prestats vs stats

Re: Crashing thread: OneShotFileWriter

Cannot suppress notable event

Crashing thread: OneShotFileWriter

Multi select options ES 3.

Re: webstats.spl

Re: webstats.spl

Re: Can we create a Tagcloud with Splunk ?

Re: how to send audit and splunkd logs of splunk i...

Re: Trying to share HTML/JS file

Trying to share HTML/JS file

Re: Splunk for bluecoat tstats searches

Re: Search for Splunk logon and role info

Re: Search for Splunk logon and role info

Re: Find Current logged in users in Splunk 6, quer...

Re: Embed Splunk dashboard

Re: Append field to event data

Re: Splunk 6 - saved searches... now reports?

Re: Splunk 6 - saved searches... now reports?

Re: Windows 7 32-bit install of Splunk 6

Windows 7 32-bit install of Splunk 6

Re: Where is tsidx created?

Where is tsidx created?

Re: Customize report template

Re: tsidxstats? What is this?

Join the Conversation