About alacercogitatus

alacercogitatus · ‎07-18-2013

I wouldn't modify limits.conf to hide this, as that might cause performance issues. I have the Deployment Server App only running on my Deployment server, so I don't see that many issues with it. I would suggest moving your Deploy Server and the App to a different host (if you can) and see if that helps. Other than that, modify the cron schedule to some off-beat times. 07,37 * * * * 03,18,33,48 * * * *

alacercogitatus · ‎07-18-2013

A better sample of data would help with the regex.

alacercogitatus · ‎07-18-2013

Splunk is very versatile and configurable, so a universal simulator might not work for every case. There is a data preview available within Splunk to make sure events get broken correctly before you add a new input. Other than that, I'd setup a test instance with a dev license that has the same apps as your production, that way you know if it will work or not.

alacercogitatus · ‎07-18-2013

your_search | rex field=_raw "(?<extracted>\s:\s\d+)$"

alacercogitatus · ‎07-18-2013

Any regex tutorial would have the regex. This one only extracts the digits. your_search | rex field=_raw "\s:\s(?<extracted>\d+)"

alacercogitatus · ‎07-18-2013

I think madscient would agree, you don't need it on the indexers because it is Dashboard and View creations.

alacercogitatus · ‎07-18-2013

You can just put the first 64 in the FIELDS section, it should still pick them up correctly. But it won't really slow it down noticeably by extracting 64 fields. I have many many more fields than that and it works great. I think it's more expensive to use a regex than the FIELDS modifier.

alacercogitatus · ‎07-18-2013

If you are certain there are no other tabs in the data, you can use a props/transforms to parse without regex. props.conf [my_sourcetype] REPORT-do = extract_csv_fields_sourcetype transforms.conf [extract_csv_fields_sourcetype] DELIMS = "\t" FIELDS = field1, field2, field3, ... field100 http://docs.splunk.com/Documentation/Splunk/latest/admin/propsconf http://docs.splunk.com/Documentation/Splunk/latest/admin/transformsconf

alacercogitatus · ‎07-16-2013

Intersting, I see that error on 2.6.32-358.el6.x86_64 #1 SMP Tue Jan 29 11:47:41 EST 2013 x86_64 x86_64 x86_64 GNU/Linux. The Kernel Builds are the same....

alacercogitatus · ‎07-16-2013

What OS? if linux what does uname -a report?

alacercogitatus · ‎07-16-2013

Could you paste the query just as you are running it?

alacercogitatus · ‎07-15-2013

You could try a lookup table. roaming_weights.csv Serving_Carrier,weight JillWireless,0.055 Larry Wireless,0.10 And then your search: Domain="Bobwireless.com" AcctType="2" | lookup roaming_weights.csv Serving_Carrier | eval Roamer_Cost = weight * Total_Megabytes | table User Serving_Carrier Total_Megabytes Roamer_Cost If you need more carriers, just add them to the CSV file.

alacercogitatus · ‎07-15-2013

It did, but since source may contain path separators, I simplified the regex to not worry about path separators.

alacercogitatus · ‎07-10-2013

I tested this. Limited success, but that might just be my test system.... In props.conf [host::*] priority = 100 EVAL-readabletime = strftime(_time, "%H:%M") Then do: your_search | stats latest(readabletime) earliest(readabletime) by host

alacercogitatus · ‎07-10-2013

Great! Please accept the answer so others may find it useful.

alacercogitatus · ‎07-08-2013

More specific error messages would help determine if they are affecting your instance.

alacercogitatus · ‎07-08-2013

Your line breaker should be: LINE_BREAKER = ([\r\n]+) LINE_BREAKER is a regex, and doesn't need escaped. Additionally, that regex is the default, so you don't even need to define it as long as your Line Merge is false.

alacercogitatus · ‎07-03-2013

If the system you are seeing this error on is a forwarder, then this can be ignored. Forwarders do not have license for a deployment server, they are the client. Your deployment server (the full Splunk instance that you enable the deployment server on) needs to have a license for it to work, yes. http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/Aboutdeploymentserver

alacercogitatus · ‎07-03-2013

As long as each file is a different source withing Splunk, you can: your_search_for_files | eval has_error = if(match(_raw, "Error"),1,0)| stats sum(has_error) by source If you want to get the number of Errors per transaction within a source, try this (UNIQ_ID_FIELD refers to the field with the individual transaction id in it): your_search_for_files | eval has_error = if(match(_raw, "Error"),1,0)| transaction startswith="Start" endswith="Success" source | stats sum(has_error) by UNIQ_ID_FIELD

alacercogitatus · ‎07-02-2013

You can login with the local admin user. You need to set SSOMode = permissive. Permissive: Requests to Splunk Web that originate from an untrusted IP address are redirected to a login page where they can log into Splunk without using SSO.

alacercogitatus · ‎06-20-2013

curl -k -u admin:PASSWORD https://HOSTNAMEREMOTE:8089/services/server/control/restart -X POST This should work as long as the PASSWORD is NOT the default (mainly for forwarders)

alacercogitatus · ‎06-18-2013

index=books sourcetype=titles title=TITLE | join type=outer title_id [search index=books sourcetype=authors ]|join type=outer queue_id [search index=books sourcetype=locations]| stats count by title author location title_id queue_id Should get you started. join's are a little ineffective, but if you make them static lookups, they would run faster.

alacercogitatus · ‎06-12-2013

The configuration stacks. So if it says disabled = 0 then it is not disabled. The scheduler looks exactly like the btool outputs. If you want it in the myownapp context, move it from the BlueCoat app to the myownapp in the GUI.

alacercogitatus · ‎06-12-2013

This looks like precedence of Folders. They will follow precedence so it's disabled. splunk cmd btool --debug savedsearches list "BlueCoat - Stats - Collect" This will show you what settings are applied from where. I don't think you need to copy it at all. Just set permissions global, and it's available for all apps.

alacercogitatus · ‎06-12-2013

Yeah that might backfire because if it find action=purchase in the referer, it would grab it. I'd have to test and see, but I don't think we are setup with that structure.

Posts	1174
Solutions	262
Karma Given	465
Karma Received	1318
Member Since	‎04-19-2011

Online Status	Offline
Date Last Visited	a week ago

SplunkJS/HTML Dashboards + map command + $foo$ sub...

Transpose Multi Value Fields

Web Framework Require Local File

Search Returns Exit Code -2

Splunk Daemon Not Responding

Splunk-system-user Report Acceleration Search Stuc...

Modular Input Scripts Don't Die during Splunk rest...

Beta Testers Wanted - Google Apps Modular Input

AutoRun form from populated dropdown when only one...

Linebreaking Failure - BREAK_ONLY_BEFORE_DATE

Re: Deployment monitor causing "maximum historical...

Re: Proper REX command

Re: Splunk Simulator

Re: Proper REX command

Re: Proper REX command

Re: Sideview on my indexer

Re: Distinguish between space and tab - REGEX

Re: Distinguish between space and tab - REGEX

Re: Splunk reporting running out of memory on a VM...

Re: Splunk reporting running out of memory on a VM...

Re: Splunk reporting running out of memory on a VM...

Re: Splunk reporting running out of memory on a VM...

Re: Creating universal search-time field extractio...

Re: Creating universal search-time field extractio...

Re: Each line of the text file needs to be appeare...

Re: Splunkd errors.

Re: Each line of the text file needs to be appeare...

Re: Deployment server

Re: Counting the occurence of a string in log file...

Re: logging in with local admin while SSO is enabl...

Re: restart splunkd remotely

Re: Correlation between 3 sources with 2 IDs

Re: Re-using a scheduled search in another app

Re: Re-using a scheduled search in another app

Re: Is splunk counting key/value in referer too?

Join the Conversation