Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About Jason
Jason
Motivator
Member since:
05-13-2010
08-07-2024
Community Statistics
| Posts | 477 |
| Solutions | 60 |
| Karma Given | 93 |
| Karma Received | 586 |
| Member Since | 05-13-2010 |
Activity Feed
- Got Karma for Re: Deleting an Index from the fish bucket. 10-01-2024 12:52 PM
- Got Karma for Re: Comparing Multivalue Fields. 09-16-2024 12:34 PM
- Got Karma for Re: How do I create a field whose name is the value of another field? Like backticks or eval() in other languages.. 01-23-2024 10:11 PM
- Got Karma for Re: How do you chart a cumulative sum?. 01-20-2023 12:03 PM
- Got Karma for Re: How do I create a field whose name is the value of another field? Like backticks or eval() in other languages.. 09-14-2022 07:30 AM
- Posted Re: How do I remove all special characters from all field names? on Splunk Search. 07-28-2022 02:22 AM
- Posted How do I remove all special characters from all field names? on Splunk Search. 07-28-2022 02:13 AM
- Posted Re: Comparing Multivalue Fields on Splunk Search. 05-31-2022 08:59 AM
- Got Karma for Re: How to determine daily license usage in GB?. 03-04-2022 12:47 PM
- Got Karma for Re: How do I remove \x00 characters from my log message?. 01-23-2022 07:09 PM
- Got Karma for Re: How do I create a field whose name is the value of another field? Like backticks or eval() in other languages.. 11-30-2021 02:56 PM
- Got Karma for Add a comment to a search?. 11-29-2021 02:21 PM
- Got Karma for Re: How do I find the name of a scheduled search just from the RMD5?. 03-16-2021 11:40 PM
- Got Karma for Re: How do I create a field whose name is the value of another field? Like backticks or eval() in other languages.. 01-26-2021 02:13 PM
- Got Karma for Re: How do I create a field whose name is the value of another field? Like backticks or eval() in other languages.. 12-23-2020 04:23 AM
- Got Karma for Re: drilldown from a hidden column. 09-16-2020 11:07 AM
- Got Karma for Re: How do I create a field whose name is the value of another field? Like backticks or eval() in other languages.. 09-08-2020 08:47 AM
- Karma Re: Why does Splunk_TA_nix rlog.sh cause huge amount of duplicate audit events on Ubuntu? for dshakespeare_sp. 06-05-2020 12:47 AM
- Karma Re: When archiving to Hadoop using Hunk from an indexer cluster, is only the primary copy of a bucket archived, or are all copies archived? for hsesterhenn_spl. 06-05-2020 12:47 AM
- Karma Re: How to restart a SHC (search head cluster) at the server level? for mahamed_splunk. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 2 | |||
| 1 | |||
| 0 |
02-06-2012
06:43 AM
1 Karma
This might be a silly answer, but I seem to remember this working in one odd case I was working on:
Have you tried putting a literal newline in your search? e.g. searching for
mysearch | eval p=mvjoin(myMvField,"
") | stats dc(p) AS "Permutation Count" values(p) AS "Permutations"
In the search bar? I would be interested to hear if this works when saved, and if so, what it actually puts in the appropriate savedsearches.conf on the back end.
... View more
11-28-2011
07:06 PM
1 Karma
Thanks. I think the confusion arises when you run a search, the search bumps up to the next summary granularity, then the search realizes it has hit the end of the results (or is finalized) and then shrinks back to the events available, sometimes showing only a few time bars.
... View more
11-24-2011
09:57 PM
2 Karma
I have noticed that when doing a search in the default Search view, flashtimeline, the green time bars will be a useful small amount of time - up to a certain point. Then the time per bar will round up and the bars will be very wide and not useful.
What is the number of x-axis datapoints that can be displayed on the flashtimeline's histogram, and can this be changed?
Searches over a week could easily show 7 days x 1hr or 4hr increments on a screen as wide as mine, but instead show only 1 day increments.
... View more
11-08-2011
09:10 PM
I have seen Deployment Server overloaded to the point that splunkd is close to unresponsive. That is when you really know it is overloaded!
... View more
11-08-2011
09:09 PM
I often do this when installing enterprise-grade Splunk installations, if the server is brawny like yours.
Also you mentioned restarts - you should never have to restart a machine when working with Splunk - only restarting Splunk. Or in the case of Deployment Server, running ./splunk reload deploy server to reload the Deployment Server's configuration.
... View more
10-16-2011
06:22 PM
I had been planning on using a Splunk Batch directory to immediately index and delete downloaded files, but I guess I could use a Monitor directory instead and remove old files periodically.
I still need to have a script that doesn't re-download every file every time. Does anyone have any examples?
... View more
10-16-2011
06:20 PM
I am a fan of the Splunk Forwarder. However, the data is generated on a closed system (no OS access) and FTP download is the only way we have to gather this data.
... View more
10-14-2011
01:53 AM
FTP download is the only way this particular system is allowing us to access its logs. Files are dumped into the FTP area and then never changed, so they are perfect for a Splunk batch folder. But, we need to get them over to the Splunk box first.
Does anyone have a scripted input for monitoring a FTP site? I assume it would have to keep a listing of files already downloaded, but also keep an eye on that listing so it doesn't get too large.
... View more
10-11-2011
11:18 PM
I updated the question above with better clarity. Both fields are in the same event. I just need to compare the two fields to one another, and it seems a bit unreasonable that you have to use a separate command for this.
... View more
10-11-2011
06:57 PM
I'm dealing with a stream of monitoring data with good and bad events, but no text to distinguish them apart. Good vs. bad is defined as follows, by comparing the same two fields found in every event:
Good event: previous_status < current_status
Bad event: current_status < previous_status
I need to be able to eventtype and tag these events, but comparing two fields in the search command does not seem possible - I only got expected results by using a | where and that is not supported in an eventtype.
How do I eventtype this data properly?
And why can we only compare a field to a static numeric value in search , rather than another numeric field??
... View more
08-31-2011
08:23 AM
Does anyone on here know how to interpret results from the IOzone disk benchmarking app to identify the results most relevant to Splunk?
Categories:
Reader
Writer
Fread
Fwrite
Re-reader
Re-writer
Random Read
Random Write
Record Rewrite
Re-fread
Re-fwrite
Backward Read
Stride Read
The output data is in a table of "Record Sizes" from 4-16384, by "File Sizes" from 64 to 524288.
... View more
- Tags:
- performance
08-11-2011
11:37 AM
1 Karma
I am at a client where they are setting up a system based on a CSV lookup file. This file is managed by another system and will be output to the appropriate Splunk config directory on some interval.
Assuming they have that system write to a temporary file and then atomically move it to the CSV filename when finished, are they going to run into any issues with this lookup failing? They have summary generation searches that need to run and use this lookup. I assume Splunk keeps a lookup file in memory, but probably a hash as well so it will know when to re-read the file from disk if it changes. Is this correct?
... View more
08-11-2011
07:54 AM
2 Karma
Is it possible to set up a chart in advanced XML that will:
allow a drilldown if you click in the chart (meaning it passes X and Y values) and
disable the drilldown if you click on the legend (meaning it would only pass the Y value)?
The receiving dashboard needs to have both the X and Y values and doesn't look right if only Y is passed.
... View more
08-10-2011
01:49 PM
1 Karma
Don't you just love Advanced XML. Turns out you're missing just one bit:
<param name="charting.legend.labelStyle.overflowMode">ellipsisEnd</param>
And if you want to do the same thing in your mouseover label on the graph itself, you can use this:
<param name="charting.tooltip.content.fieldStyle.overflowMode">ellipsisEnd</param>
... View more
08-05-2011
10:14 AM
3 Karma
Yes, there is a way to do this. The important caveat here is that if you are using the "syslog" sourcetype, "host" is getting extracted from the message and forced - but this is at the same time you are also trying to force the sourcetype. Splunk doesn't know of this change yet, so you need to use the original host, sourcetype or source:
--props.conf--
[syslog] <-- important part. host=barracuda hasn't been set yet, so use syslog or the hostname of the forwarder
TRANSFORMS-force_st_for_barracuda = force_barracuda_st
--transforms.conf--
[force_barracuda_st]
DEST_KEY = MetaData:Sourcetype
REGEX = (barracuda-hostname.domain|bar.rac.uda.ip) <-- some unique string that only appears in Barracuda events
FORMAT = sourcetype::barracuda
... View more
07-13-2011
07:47 PM
11 Karma
This is a search that seems to be the shortest possible way to do this. The idea is:
break out events into a graphable number of discrete time buckets
get a total number of events per time bucket
count up the number of each status by time bucket, keeping the totals intact
calculate the percentage for each status/time bucket combination
throw out any status you do not want to graph (for example, success messages)
timechart the percentage by status
... | bucket _time bins=100
| eventstats count as total by _time
| stats count first(total) as total by _time, http_response
| eval percent=(count/total)*100
| search NOT http_response="2*"
| timechart first(percent) by http_response
This will give you a graph of percentage numbers by each type of error over time. The Y axis will likely be from 0-1 (as in percent) for a properly functioning system.
... View more
07-13-2011
07:42 PM
5 Karma
I'm working with some HTTP access logs that have a status code in them. Most are successful messages, naturally. I would like to see a chart, over time, that plots the percentage of messages that are errors, to avoid daily cycles in amount of hits and see if a growing proportion of the messages are error messages.
There doesn't seem to be this "percentage of whole" function in stats / chart / timechart. What can I do?
I basically need the "percentage" column from top, over time.
... View more
06-24-2011
07:36 AM
1 Karma
Note, if you update cold buckets, you still need to touch the meta.dirty file in the hot/warm directory, even if it is on a different filesystem. Touching meta.dirty in the cold folder has no effect.
... View more
06-20-2011
02:28 PM
Symbolic AND hard links don't work, Splunk appears to remove the file before rewriting it. It appears Linux does not have the ability to allow write but disallow delete of the one tags.conf file in etc/users/username/appname/local while allowing updating of the other files.
... View more
06-20-2011
02:13 PM
2 Karma
We have a review process set up in Splunk where multiple end users log in and tag individual events. These tags MUST be public by default so other users will not duplicate work. Forcing each user to go into manager and make all their tags public is not acceptable - it is way too much work for hundreds of review items every day.
What options do I have for forcing all tags to be public (app-level) upon creation?
... View more
- Tags:
- permissions
- tags
06-15-2011
12:37 PM
1 Karma
We have a long search running, and need to restart Splunk. Will a job that is "paused" be able to be restarted after a restart of Splunk?
I tested it briefly and the search (histogram, fields) reappears, but the events do not, and no more events are added to the search, even though it looks like it's running.
... View more
06-14-2011
12:16 PM
You can now get an MD5 for the file after you click on the filename to download. On the page you arrive at, there are a few links under the "Your download is starting..." and one of them is an MD5 file.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-07-2024
07:26 AM
|
Karma given to
| User | Karma Count |
|---|---|
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 3 |
