Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About tauliang
tauliang
Communicator
Member since:
04-14-2020
05-20-2026
Community Statistics
| Posts | 61 |
| Solutions | 4 |
| Karma Given | 20 |
| Karma Received | 62 |
| Member Since | 04-14-2020 |
Activity Feed
- Got Karma for Re: HTTP Event collector - call not properly authenticated. 07-03-2024 10:04 AM
- Karma Re: How to force Splunk to use Python 3 for our app? for richgalloway. 06-05-2020 12:51 AM
- Karma Re: How to log to metric with unstructured data? for DalJeanis. 06-05-2020 12:51 AM
- Karma Re: Can I use time range tokens in an eval expression? for to4kawa. 06-05-2020 12:51 AM
- Karma Re: what is the minimum level of logging required for erex to output its regex in the search information icon in splunk? for richgalloway. 06-05-2020 12:51 AM
- Karma Re: How can I enable the dumpAllThreads input from the Apache Tomcat add-on for another JMX-based application server? for jhollfelder_spl. 06-05-2020 12:51 AM
- Karma Re: How can I enable the dumpAllThreads input from the Apache Tomcat add-on for another JMX-based application server? for sureshms. 06-05-2020 12:51 AM
- Karma Re: Unable to login into splunk for PavelP. 06-05-2020 12:51 AM
- Karma Re: AppInspect API error: "Do not use `default/setup.xml` in the Cloud environment" for PavelP. 06-05-2020 12:51 AM
- Karma Re: How do you re-take the training course after it expired? for DalJeanis. 06-05-2020 12:51 AM
- Karma NetApp Data ONTAP support for Splunk Enterprise 8.0.2? for edwardrose. 06-05-2020 12:51 AM
- Karma Re: What connection type should be used for mongodb to SPLUNK db connect for umlawren. 06-05-2020 12:51 AM
- Karma Re: Detecting outliers query for to4kawa. 06-05-2020 12:51 AM
- Karma Re: Detecting outliers query for to4kawa. 06-05-2020 12:51 AM
- Karma Re: auto-arima in arima model for grana_splunk. 06-05-2020 12:51 AM
- Karma auto-arima in arima model for vinitpathri. 06-05-2020 12:51 AM
- Karma Re: Can not get my subsearch work for masonmorales. 06-05-2020 12:51 AM
- Karma Re: How To Get User Login ID and Login Attempts by Application for to4kawa. 06-05-2020 12:51 AM
- Karma Re: Docker container won't restart if mgmt port is disabled. for PavelP. 06-05-2020 12:51 AM
- Karma Re: What will happen with my license during the upgrade from version 7.0.3 to 7.3? for richgalloway. 06-05-2020 12:51 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 |
05-02-2020
06:30 PM
1 Karma
I am not sure if your desired behavior is correct. Here is what I got
temp1 = ['twotwotwo.nl','two.nl', 'three.nl', 'four.nl', 'five.nl']
temp2 = ['twotwo.nl', 'three.nl','four.nl']
list(set(temp1).symmetric_difference( set(temp2)))
the result is
['twotwo.nl', 'two.nl', 'five.nl', 'twotwotwo.nl']
instead of these two you were expecting:
twotwo.nl
five.nl
The algorithm in your code is len(file1)*len(file2) so it is not surprising that it took forever. Theoretically you only need to load them into two sets, and do a symmetric_difference, which has a worst case time complexity of len(file1)*len(file2).
From your description, each file would only around 40MB-100MB to load, which should not be a problem.
Good luck!
... View more
05-02-2020
08:57 AM
2 Karma
I would use a stacked column chart like this example below:
| gentimes start=3/29/2018 increment=24h end=04/12/2018
| eval startunix=strptime(starthuman,"%a %B %d %H:%M:%S.%N %Y")
| eval c_time=strftime(starttime,"%Y-%m-%d")
| eval TOTALCOUNT = starttime%100000/100
| eval SUCCESSONE = floor((random() % TOTALCOUNT)/2 + 1)
| eval FAILEDONE = TOTALCOUNT - SUCCESSONE
| eval SUCCESSTWO = floor((random() % FAILEDONE)/2 + 1)
| eval FAILEDTWO = FAILEDONE - SUCCESSTWO
| table c_time, SUCCESSONE, FAILEDONE, SUCCESSTWO,FAILEDTWO][1]
The total will be the height of the stacked column for a particular date. Is this what you are looking for?
... View more
05-02-2020
08:18 AM
Auto-ARIMA is supported in other languages like R, however, I don't see a way to use it out of the box with Splunk MLTK.
Of course, one can always add a custom algorithm to the MLTK. I'd love to know as well how one can use auto-ARIMA without writing any custom code.
... View more
05-01-2020
08:47 PM
Cool. I didn't know this getting started app for Splunk Cloud Services exits. Thanks Tim!
... View more
05-01-2020
08:21 PM
2 Karma
Not at this moment. Add-ons extend the capabilities of Splunk Light, usually by providing pre-defined data inputs for a specific technology or vendor. Splunk Light includes a set of add-ons that you can install and enable to configure new data inputs.
Elasticsearch Data Integrator is NOT on the list of add-ons that would work with Splunk Light.
... View more
05-01-2020
07:59 PM
2 Karma
Do something like this instead:
| stats count as Count by APPLICATION_NAME USER_ID
| stats list(USER_ID) as USER_ID list(Count) as Count by APPLICATION_NAME
A full example including the lines generating data:
| makeresults count=40
| streamstats count
| eval count = count %4
| eval APPLICATION_NAME = case(count=1 OR count=3, "AppName2", count=0 OR count=2, "AppName1")
| eval USER_ID = case(count=1, "User ID 1", count=0, "User Id 2", count=2, "User Id 3", count=3, "User Id 4")
| stats count as Count by APPLICATION_NAME USER_ID
| stats list(USER_ID) as USER_ID list(Count) as Count by APPLICATION_NAME
You should get what you wanted:
Of course, rename the columns to whatever more aesthetically pleasing as needed.
... View more
05-01-2020
01:20 PM
In this case you can do some manual filtering in the query to return events from certain times, e.g., only the events that landed on 0th, 15th, 30th or 45th minutes of any given hour. An example is below:
index=_internal
| eval eventMin=strftime(_time,"%M")
| table _time, eventMin
| search (eventMin=0 OR eventMinute=15 OR eventMinute=30 OR eventMinute=45)
of course, you can adjust the value of eventMinute to whatever you see fit.
... View more
05-01-2020
12:17 PM
1 Karma
Is there a reference app built using Splunk Cloud Services SDK, similar to Splunk Reference App - PAS, except that it is not a App running on top of Splunk Enterprise, but an application in Java/Python/Go showcasing the features of Splunk Cloud Services SDK?
Thanks,
... View more
05-01-2020
12:06 PM
5 Karma
First, you can tweak the height of the chart by adding an option such as
<option name="height">600</option>
Second, you can use CSS Override to remove the margins so the white spaces are removed.
Third, if you can live without the labels, remove them so more spaces are used for showing the pies.
<option name="charting.chart.showLabels">false</option>
An example is show below using the _internal index
<dashboard>
<label>Charts in Single Row</label>
<row>
<panel>
<html>
<h3 style="text-align:center;">Option 1: Trellis Layout (6.6 and above Out of the box no CSS)</h3>
</html>
</panel>
</row>
<row>
<panel>
<chart>
<search>
<query>index=_internal sourcetype=splunkd log_level IN ("INFO","WARN","ERROR")
| stats count by component log_level</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.axisTitleY2.visibility">collapsed</option>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">all</option>
<option name="charting.legend.placement">none</option>
<option name="height">346</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">1</option>
<option name="trellis.scales.shared">0</option>
<option name="trellis.splitBy">log_level</option>
</chart>
</panel>
</row>
<row>
<panel>
<html>
<h3 style="text-align:center;">Option 2: Multiple panels with respective Chart (CSS override to merge panel margins)</h3>
<style>
#multiplePanelsWithIndividualCharts .dashboard-panel{
margin-right: 0px !important;
}
</style>
</html>
</panel>
</row>
<row id="multiplePanelsWithIndividualCharts">
<panel>
<chart>
<title>INFO</title>
<search>
<query>index=_internal sourcetype=splunkd log_level=INFO
| chart count as INFO by component</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">all</option>
<option name="charting.legend.placement">none</option>
<option name="height">400</option>
<option name="refresh.display">progressbar</option>
<option name="charting.chart.showLabels">false</option>
</chart>
</panel>
<panel>
<chart>
<title>ERROR</title>
<search>
<query>index=_internal sourcetype=splunkd log_level=ERROR
| chart count as ERROR by component</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">all</option>
<option name="charting.legend.placement">none</option>
<option name="height">400</option>
<option name="refresh.display">progressbar</option>
<option name="charting.chart.showLabels">false</option>
</chart>
</panel>
<panel>
<chart>
<title>WARN</title>
<search>
<query>index=_internal sourcetype=splunkd log_level=WARN
| chart count as WARN by component</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">all</option>
<option name="charting.legend.placement">none</option>
<option name="height">400</option>
<option name="refresh.display">progressbar</option>
<option name="charting.chart.showLabels">false</option>
</chart>
</panel>
</row>
<row>
<panel>
<html>
<h3 style="text-align:center;">Option 3: Single Panel with multiple Charts (CSS override to pull all charts in Single row and adjust width or charts)</h3>
<style>
#panelWithMultipleCharts .dashboard-panel{
display: flex !important;
}
#panelWithMultipleCharts .panel-element-row{
width:33.33% !important;
}
</style>
</html>
</panel>
</row>
<row id="panelWithMultipleCharts">
<panel>
<chart>
<title>INFO</title>
<search>
<query>index=_internal sourcetype=splunkd log_level=INFO
| chart count as INFO by component</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">all</option>
<option name="charting.legend.placement">none</option>
<option name="height">400</option>
<option name="refresh.display">progressbar</option>
<option name="charting.chart.showLabels">false</option>
</chart>
<chart>
<title>ERROR</title>
<search>
<query>index=_internal sourcetype=splunkd log_level=ERROR
| chart count as ERROR by component</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">all</option>
<option name="charting.legend.placement">none</option>
<option name="height">400</option>
<option name="refresh.display">progressbar</option>
<option name="charting.chart.showLabels">false</option>
</chart>
<chart>
<title>WARN</title>
<search>
<query>index=_internal sourcetype=splunkd log_level=WARN
| chart count as WARN by component</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">all</option>
<option name="charting.legend.placement">none</option>
<option name="height">400</option>
<option name="refresh.display">progressbar</option>
<option name="charting.chart.showLabels">false</option>
</chart>
</panel>
</row>
</dashboard>
This is how it looks like after these tweaks. Hope this helps.
... View more
05-01-2020
09:46 AM
Did you restart Splunk after enabling HEC?
... View more
05-01-2020
08:55 AM
2 Karma
You can specify a sampling ratio of 3 by activating event sampling for your search in Splunk Web.
In Splunk Web, below the Search bar, click No Event Sampling.
You can use one of the default ratios or specify a custom ratio.
a. To use one of the default ratios, click the ratio in the Sampling drop-down.
b. To specify a custom ratio, click Custom and type the ratio value, e.g, in you case, 3. Then click Apply.
Note, the ratio value must be a positive integer greater than 1.
If you 'd like it to be more widely applied, specify the value in ui-prefs.conf . More details could be found in Splunk Docs.
... View more
04-30-2020
06:03 PM
3 Karma
Since every app when invoked first can only be accessed by invoking the app ur, you can find out the apps being used by searching the index=_internal and sourcetype=splunk_web_access to find all the invocations of the app url like this:
index=_internal sourcetype=splunk_web_access
| rex ".*\"(?<url>http(s)*\:\/\/[^\"]+)\""
| rex field=url "http(s)*\:\/\/(?<domain>[^\:]+)\:(?<port>[^\/]+)\/.*\/app\/(?<appName>[^\/]+).*"
| table appName
| dedup appName
This will take care of the app part. That said, since Splunk App for Windows Infrastructure has some knowledge objects that are shared, you will have to check them individually.
... View more
04-30-2020
05:40 PM
What exactly is the issue? There is a video on Youtube which is pretty good.
... View more
04-30-2020
04:10 PM
3 Karma
Something like this?
| makeresults count =1
| eval _raw = "
{
\"Name\": \"Test\",
\"extensionData\": {
\"entries\": [
{
\"key\": \"machinesTotal\",
\"value\": {
\"type\": \"integer\",
\"value\": 7
}
},
{
\"key\": \"endpoint\",
\"value\": {
\"type\": \"string\",
\"value\": \"vcenter.local\"
}
},
{
\"key\": \"quotaAllocatedPercentage\",
\"value\": {
\"type\": \"string\",
\"value\": \"27% (6 of 22)\"
}
},
{
\"key\": \"storageUsed\",
\"value\": {
\"type\": \"integer\",
\"value\": 1006
}
},
{
\"key\": \"machinesAllocatedPercentage\",
\"value\": {
\"type\": \"string\",
\"value\": \"86% (6 of 7)\"
}
},
{
\"key\": \"memoryAllocatedPercentage\",
\"value\": {
\"type\": \"string\",
\"value\": \"20% (72 GB of 352 GB)\"
}
},
{
\"key\": \"computeResource\",
\"value\": {
\"type\": \"string\",
\"value\": \"Data-Cluster\"
}
},
{
\"key\": \"storageAllocatedPercentage\",
\"value\": {
\"type\": \"string\",
\"value\": \"23% (1006 GB of 4400 GB)\"
}
},
{
\"key\": \"storageUsedPercentage\",
\"value\": {
\"type\": \"string\",
\"value\": \"23% (1006 GB of 4400 GB)\"
}
}
]
}
}"
| spath
| rename extensionData.entries{}.key as key
| rename extensionData.entries{}.value.type as type
| rename extensionData.entries{}.value.value as value
| eval zipped=mvzip( key, mvzip( type, value ) )
| mvexpand zipped
| eval zipped=split( zipped, "," )
| eval key=mvindex( zipped, 0 )
| eval type=mvindex( zipped, 1 )
| eval value =mvindex( zipped, 2 )
| table key,value
| transpose
... View more
04-30-2020
03:48 PM
2 Karma
Use data checkpoints in your modular inputs. An example using it could be found in Splunk Add-on for Bamboo if my memory serves me right. Look in the bin folder for the largest Python code file. Good luck!
... View more
04-30-2020
03:26 PM
2 Karma
You can add an extra line in the end to flip the axes
| transpose
... View more
04-30-2020
03:13 PM
Assuming your events have _time in them, besides the fields you already have, can you try this really quick?
... <whatever searches you have>
earliest =-120d@d
Or
earliest="01/01/2020:00:00:00"
latest="05/01/2020:00:00:00"
Either should work.
... View more
04-30-2020
02:56 PM
Interesting. If somehow it doesn't work for you, I suggest downloading this app
https://splunkbase.splunk.com/app/2949/
and see if it shows all the meta data correctly.
... View more
04-30-2020
02:29 PM
1 Karma
Try this: divide "b" by 1024*1024=104857, you will get the usage in MB:
index=_internal source=*.log source="license_usage.log"
type="usage" idx=* earliest_time=-7d@d
|eval UsageInMB = round(b/1048576,2)
| convert timeformat="%F" ctime(_time)
| chart sum(UsageInMB) over idx by _time
| eval Time=strftime(_time,"%m-%d")
... View more
04-28-2020
11:23 AM
1 Karma
Here is what I did with your JSON:
...
|spath
|rename getAccountResponse.account.divisionID as divisionId
|rename getAccountResponse.account.accountNumber as accountNumber
|rename getAccountResponse.account.accountDetail.ppvCreditLimit as ppvCreditLimit
|rename getAccountResponse.account.accountDetail.ppvRemainingCreditLimit as ppvRemainingCreditLimit
|rename getAccountResponse.account.accountStatus as accountStatus
|table divisionId, accountNumber, ppvCreditLimit, ppvRemainingCreditLimit, accountStatus
You might want to do some preprocessing to get rid of the extra white spaces and "\n" etc.
And I was able to get results back. Refer to spath reference for more details if needed.
... View more
04-27-2020
09:34 PM
One thing you could try is to apply a time-based window of 30m to streamstats
streamstats
and build your alert condition based on that.
... View more
04-27-2020
09:12 AM
How did you disable the port?
Usually, you can add an app with a server.conf like this:
[httpServer]
disableDefaultPort = true
Or use this app on Splunkbase:
https://splunkbase.splunk.com/app/3246/
... View more
04-25-2020
02:30 PM
The question mentioned that "which among other things, disable the mgmt port", in that case, the error message is expected. If you don't disable the management port, do you still have the error?
... View more
04-23-2020
11:24 AM
A couple of questions
is the "test server" pointed to valid license master after it was reinstalled?
when you said "I'm still unable to run searches on the server itself", were you referring to the same "test server"
did you bounce the "test server" after it was reinstalled?
... View more
- « Previous
-
- 1
- 2
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-20-2026
05:59 PM
|
Karma from
Karma given to
