About alacercogitatus

alacercogitatus · ‎10-07-2013

Easy enough. So first, fill in your nulls with a value to check. Then in your stats, match on those that are null, and those that aren't null. your_search | fillnull value="nullify" FIELDNAME | stats count(eval(searchmatch("FIELDNAME='nullify'"))) AS FOUND_NULL count(eval(searchmatch("FIELDNAME!='nullify'"))) AS FOUND_DATA EDIT: updated searchmatch to make sure you are matching on the field. Per docs, searchmatch argument is a search string.

alacercogitatus · ‎10-07-2013

The dashboard can be as simple as creating an App, and denying the roles required to a single App. Once that is done, I'd create Dashboards under this "restricted app" that only each client can view based on role. This will effectively limit what data is being presented to each client. For example: Client A has a restricted role "clienta_role" limiting search to "(index=myindex gravity=0.49)" Allow "clienta_role" read access in the "Restricted App". Allow "clienta_role" Read/write to "Client A Stats" Dashboard. No other roles except admin should be added to the role or dashboard. Set the default App for Client A as "Restricted App".

alacercogitatus · ‎10-07-2013

What version of ES?

alacercogitatus · ‎10-07-2013

A quick way is to setup a windows scripted input. Inside the scripted input, you run the command: $SPLUNK_HOME\bin\splunk.exe edit user admin -password $NEWPASSWORD -auth admin:changeme Once this is run, you can delete the input from the forwarders. It won't run correctly again, because the admin password is now changed. After they have all been updated, you can remove the input. I'm assuming you have Deployment Server

alacercogitatus · ‎10-03-2013

There isn't a previous search to pull earliest/latest times. You could put in fields that take earliest and latest. <input type="text" token="earliestDBTime" /><input type="text"token="latestDBTime" /> <searchString> |dbquery mydb limit=10000 "select DATE_FORMAT(......) | table fecha * |addtotals fieldname="TOTAL DIA" * </searchString>

alacercogitatus · ‎10-01-2013

Yes, yes you can. You will need to make a transforms for the splunkd_access logs. Ref: http://docs.splunk.com/Documentation/Splunk/5.0.5/admin/Transformsconf props.conf [splunkd_access] TRANSFORMS-splunkdhash = splunkd-masker transforms.conf [splunkd-masker] REGEX = (?m)^(.*)fieldofhash=YOUR_REGEX_FOR_HASH(.*)$ FORMAT = $1=anonyhash$2 DEST_KEY = _raw

alacercogitatus · ‎09-30-2013

Actually, you should be able to do this without a join. host="HOST_X" | eval does_match = if(searchmatch("SPECIFIC_WORD"),1,0) | stats sum(does_match) as Specific_Word count as Total by date_hour | eval percent_out_of = (Specific_Word/count)*100

alacercogitatus · ‎09-30-2013

Do what kkolb says. Fieldnames can't be "S/A", it needs to be s_a.

alacercogitatus · ‎09-29-2013

Not sure why it's not working without experiment, but you could do something "odd". |metadata type=hosts index=* | outputlookup tmp_meta.csv | inputlookup append=t tmp_meta.csv | more_search_here The idea behind this is that "metadata" doesn't return "actual events", and as such, can't do more searching on them. So I believe you can write to a lookup with metadata, and then input those values, turning them into "actual events" that can then have extra search stuff applied. I think. Give it a whirl and see if it helps.

alacercogitatus · ‎09-29-2013

Possible, but not recommended. It might break when you upgrade (move to the local folder for the app just in case). That being said: In the file $SPLUNK_HOME/etc/apps/search/default/data/ui/manager/apps_local.xml , locate the section for "Version". Add this into the list (in between list and create): <view name="edit"/> . This will work for any other properties as well.

alacercogitatus · ‎09-27-2013

Possible, but if you upgrade, you may lose the files.

alacercogitatus · ‎09-26-2013

To prevent reloading the entire set of reports on every Splunk restart, they are scheduled for overnight and not on startup. So, I'd wait 24 hours, let things even out, and check it again in the morning. If it is still not working, feel free to ping me! Edit: Since we met at .conf, Modular Input is now setup and running as expected. Please accept this answer. Thanks!

alacercogitatus · ‎09-05-2013

I'm going to answer this in the best way possible. But seriously, from http://docs.splunk.com/Documentation/Splunk/5.0.4/releasenotes/Deprecatedfeatures : CHECK_FOR_HEADER props.conf attribute (for index-time field extractions): This feature is deprecated and might be removed in a future release.

alacercogitatus · ‎09-05-2013

Here's the situation. I have an international server. When trying to search it as a distributed peer, it exits with this message. [REMOTE_WAN_HOST] Search process did not exit cleanly, exit_code=-2, description="exited with code -2". Please look in search.log for this peer in the Job Inspector for more info. So I take a look in the peer's dispatch directory for the search log. I find this. 08-27-2013 00:56:51.884 INFO UserManager - Setting user context: USER 08-27-2013 00:56:51.884 WARN AuthorizationManager - Unknown role 'admin' 08-27-2013 00:56:51.884 WARN AuthorizationManager - Unknown role 'ess_admin' 08-27-2013 00:56:51.884 WARN AuthorizationManager - Unknown role 'ess_analyst' 08-27-2013 00:56:51.884 WARN AuthorizationManager - Unknown role 'ess_user' 08-27-2013 00:56:51.884 WARN AuthorizationManager - Unknown role 'power' 08-27-2013 00:56:51.884 WARN AuthorizationManager - Unknown role 'user' 08-27-2013 00:56:51.884 ERROR UserManagerPro - user="USER" had no roles 08-27-2013 00:56:51.884 ERROR UserManager - Error while setting user context: user="USER" had no roles 08-27-2013 00:56:51.884 INFO UserManager - Done setting user context: NULL -> NULL 08-27-2013 00:56:51.884 INFO UserManager - Unwound user context: NULL -> NULL 08-27-2013 00:56:51.884 ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: Application does not exist: search All of these roles and the USER exist in exactly the same way as on the search head. I'm at a loss on why it's not working correctly.

alacercogitatus · ‎08-28-2013

Hark! Me thoughts begin to ponder upon your stated intentions. Hearing only wonders of Regex and Confucianism, I direct my cerebral temperament to a solution. If you wish to capture all information until a line return, try the below supposition! sourcetype="imap" | rex field=_raw "Total(?<body>[^\r\n]+)"

alacercogitatus · ‎08-20-2013

Depends on the version numbers. In theory, you can do this: Stop Splunk on OLD server Copy /opt/splunk to NEW server Start Splunk on NEW server. However, if this is also your indexer, you may have to wait a looong time to transfer the indexes.

alacercogitatus · ‎08-15-2013

Can you verify your inputs? Did you make changes in a default/inputs.conf file? They may have been overwritten. Does the input appear in the manager?

alacercogitatus · ‎08-07-2013

Unfortunately, linu1988, time recognition isn't one that can be hit with a debug/refresh. That one requires the Indexer restarts as kristian.kolb mentioned.

alacercogitatus · ‎08-06-2013

Just a reminder: please accept the answer if we have answered your question. Thanks!

alacercogitatus · ‎08-05-2013

But if you don't explicitly declare in your search which index, the search still hits every index location, and depending on your disk speeds, might introduce some latency.

alacercogitatus · ‎08-05-2013

I'd wager that it is still tied to the number of indexes. Even if those indexes don't contain data, each bloomfilter on each index bucket must be checked for matches. So even though its a quick search of the bloomfilter, you are still performing it ~3500 * #BucketsInIndex times. Try doing your search like this and see if it speeds up: index=main sourcetype=x| blah blah http://docs.splunk.com/Splexicon:Bloomfilter

alacercogitatus · ‎08-01-2013

It's very very close. The b isn't reported quite as regularly as the rest portion, that I think is real-ish time, the log only gets written every so often, but it should be very close.

alacercogitatus · ‎08-01-2013

This would work for a Daily Report of Volume used, but not for a running throughout the day Report.

alacercogitatus · ‎08-01-2013

index=_internal source=*usage.log type=Usage | stats sum(b) as b max(poolsz) as poolsz by pool | eval percent = b/poolsz * 100 This should give you what you want. It might take a while to run over your time range. I use the one below and summarize every hour, and then you can do an eval over as long a time range as you have in summary. So I can go back 6 months and check indexing for report purposes. Default splunk only leaves 2-4 weeks in the logs. To make summary every hour: index=_internal source=*usage.log type=Usage | eval category="splunk_metric" |eval subcategory="indexing"| eval src_type="license_usage"| stats sum(b) as b by st h s pool poolsz category subcategory src_type | collect index=summary To eval the summary: index=summary category=splunk_metric subcategory=indexing src_type=license_usage | stats sum(b) as b max(poolsz) as poolsz by pool| eval percent = b/poolsz*100

alacercogitatus · ‎07-31-2013

Based on your specs provided for searchheads and amount data processed, you're good in terms of hardware. I'd start by doing sowings recommendation, and back it off to 5 minutes minimum. 5 minutes notification is normally more than enough time and doesn't cause huge issues. most users don't even notice it's down that fast.

Posts	1174
Solutions	262
Karma Given	465
Karma Received	1318
Member Since	‎04-19-2011

Online Status	Offline
Date Last Visited	a week ago

SplunkJS/HTML Dashboards + map command + $foo$ sub...

Transpose Multi Value Fields

Web Framework Require Local File

Search Returns Exit Code -2

Splunk Daemon Not Responding

Splunk-system-user Report Acceleration Search Stuc...

Modular Input Scripts Don't Die during Splunk rest...

Beta Testers Wanted - Google Apps Modular Input

AutoRun form from populated dropdown when only one...

Linebreaking Failure - BREAK_ONLY_BEFORE_DATE

Re: replace found data with "fix" and no data with...

Re: Restricting Roles with Lookups and Limited Das...

Re: How to restore default ES correlation searches...

Re: Globally change universal forwarder password

Re: insert the earliest and latest in the DBquery

Re: Mask Splunk access logs

Re: How do I search for a Term, then get the Perce...

Re: timechart , streanstats Question

Re: Metadata as a drill-down search

Re: Splunk App and edit app.conf

Re: Python script. Module not loading when execute...

Re: Google Apps For Your Domain: Installation Easy...

Re: best practice question around CHECK_FOR_HEADER

Search Returns Exit Code -2

Re: what is the reverse of an end call ?

Re: Migrate Splunk to a new server

Re: Syslog data source and Splunk 5.0.3 on Windows...

Re: Date Time parsed incorrectly

Re: Significant search performance hit using multi...

Re: Significant search performance hit using multi...

Re: Significant search performance hit using multi...

Re: License usage fun

Re: License usage fun

Re: License usage fun

Re: Saved search performance question

Join the Conversation