Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About the_wolverine
the_wolverine
Champion
Member since:
01-14-2010
11-24-2025
Community Statistics
| Posts | 994 |
| Solutions | 187 |
| Karma Given | 1004 |
| Karma Received | 956 |
| Member Since | 01-14-2010 |
Activity Feed
- Got Karma for Re: BUG: tstats not displaying latest time modifier correctly. 04-19-2025 10:52 AM
- Got Karma for Re: How do I reload authentication from CLI?. 01-17-2025 12:00 PM
- Got Karma for Re: Question about "run as" (Owner or User ) for saved searches. Missing in version 7.. 05-16-2024 05:58 AM
- Got Karma for Re: Someone else configured field extractions, but I would like to delete some of them. Where do I find them?. 01-18-2024 12:12 PM
- Got Karma for Re: What are the minimum capabilities needed to modify and push config change from Deployment Server?. 07-02-2023 01:36 AM
- Got Karma for Re: Is there a way to accurately measure data model acceleration disk usage via Splunk?. 03-07-2023 11:51 PM
- Got Karma for Re: Question about "run as" (Owner or User ) for saved searches. Missing in version 7.. 01-20-2023 07:43 AM
- Karma Re: Why would Splunk NOT obey "dispatch.ttl" and delete results/artifacts early? for matthewhasty. 12-20-2022 01:19 PM
- Got Karma for Re: Autostart Splunk on boot. 12-09-2022 05:46 AM
- Got Karma for Re: Perform two lookups with same table and two different lookup fields?. 11-21-2022 04:47 AM
- Got Karma for Re: How to determine daily license usage in GB?. 11-08-2022 02:37 PM
- Karma Re: Can i assign a color to a string in a field if it is present in the field ? for varun99. 11-03-2022 09:57 AM
- Got Karma for Re: Getting error "Streamed search execute failed because: JournalSliceDirectory: Cannot seek to 0" when running a search. 10-01-2022 04:25 AM
- Got Karma for Re: Multiple SEDCMDs. 06-29-2022 11:41 AM
- Got Karma for Re: How to efficiently calculate max events per second (eps) by hour over long timeranges, like 30 days?. 05-31-2022 02:54 PM
- Got Karma for Splunk alert reply-to field doesn't exist?. 04-28-2022 02:13 PM
- Got Karma for BEWARE: srchFilter usage may negate each other in certain situation.. 04-28-2022 02:11 PM
- Got Karma for What is the correct earliest_time format for searches when programmatically querying Splunk?. 04-28-2022 02:07 PM
- Got Karma for Re: What is the correct earliest_time format for searches when programmatically querying Splunk?. 04-28-2022 02:07 PM
- Got Karma for Re: Is there any way to get Splunk to replicate Search History in a Search Head Cluster?. 04-28-2022 02:06 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-31-2012
11:26 AM
Which version are you running? Sometime in version 3.x there was a bug which exhibited the same symptom that you report (slow to delete.)
One option is to run the same delete command from CLI:
./splunk search "your search terms startdaysago=2 enddaysago=1"
(verify by running search above first before running again with the added delete command)
./splunk search "your search terms | delete"
... View more
10-31-2012
10:18 AM
Thank you, sideview 😉
... View more
10-31-2012
10:14 AM
I was just trying to get it to work 🙂 Thanks for your example, I think the main issue is with my converted Advanced XML which includes many unnecessary params.
... View more
10-30-2012
03:07 PM
Per documention, I can delete all userdata using ./splunk clean userdata -f
http://docs.splunk.com/Documentation/Splunk/4.3.4/Admin/DeleteuserdatafromtheCLI
Question: will this affect the admin account?
... View more
10-30-2012
02:41 PM
1 Karma
I've got a dashboard that renders using summarized data. When a user clicks on the chart, I want Splunk to return the raw events associated, not the summary events.
I believe I need to use Converttointention and click.value but I'm not getting it from the various examples posted here.
Is there a Cliff's Notes on how to do this? Learn by simple example?
... View more
- Tags:
- how-to
10-18-2012
03:49 PM
Thanks for all the suggestions! I have to use a specific start time for my use case -- but based on the suggestions in comments, I've gotten this to work:
Here is my query with subsearch
[search index=summary marker=abc earliest=1350595800 | rename info_max_time as _time | format maxresults=0 ] OR index=main sourcetype=xyz OR sourcetype=123 earliest=1350595800 | timechart span=10m count(eval(sourcetype=="abc")) as XYZ count(eval(sourcetype=="123")) as 123 count(eval(marker=="abc")) as ABC
... View more
10-17-2012
07:41 PM
Yes, it works! But only as a simple search:
search | rename info_max_time as _time
However if I want to subsearch that, Splunk doesn't agree with me.
... View more
10-17-2012
04:42 PM
Yeah, I'm seeing odd behavior as well but I'm not sure how I would timechart this if I don't use _time?
My outersearch is just (filtered) events, all fields. I'm trying to combine 2 sources of data so I can timechart them all based on _time.
... View more
10-17-2012
03:00 PM
I'm running a search where I perform a rename of another time field to _time:
mysummarysearch | rename info_max_time as _time
It works as a simple search but if I try to do anything bolder, like use it in a subsearch and append to another search, I lose the results of the subsearch entirely (only the results of the outer search are returned.)
... View more
10-16-2012
11:29 PM
From experience, it appears that DELETE is relatively expensive. When performing DELETE against many events (more than 10k), if done repeatedly in succession, for example, in the case of scheduled search that finds and "DELETE"s, bad things can happen if your system is undersized so watch it carefully. No idea what happens in a properly sized implementation but maybe Splunk can answer.
... View more
10-13-2012
04:22 PM
I've halfway figured this one out. The searches span -7d to now and I'm backfilling 7 days. Splunk is using the info_min_time (first event used in stats) as the timestamp for the summary event.
Is there a way to get Splunk to use info_max_time as the summary timestamp? In the meantime, I am using a workaround of
| rename info_max_time as _time
Would be nice to be able to tell Splunk to use info_max_time as the timestamp when writing to summary.
... View more
10-12-2012
09:29 PM
I'm running a summary search to calculate stats over 7 days. The summary is setting the timestamp as info_min_time. How can I get it to use info_max_time as the summary event timestamp?
... View more
10-12-2012
05:33 PM
8 Karma
OMG. I got it to work by changing '=' to '==' and putting the value in quotes! HOW FICKLE!!
sourcetype=a OR sourcetype=b | stats count as Total
count(eval(sourcetype=="a")) AS a_count
count(eval(sourcetype=="b")) AS b_count
... View more
10-12-2012
05:24 PM
2 Karma
What am I doing wrong? I've tried several iterations of the following all which return 2 columns with a count of 0:
sourcetype=a OR sourcetype=b | stats count
count(eval(sourcetype=a)) AS a_count
count(eval(sourcetype=b)) AS b_count
"sourcetype=a OR sourcetype=b | stats count by sourcetype" <= returns the correct counts but I'm unable to split the count out for further evaluation. I need to be able to eval diff=(b_count-a_count).
... View more
- Tags:
- stats
10-12-2012
12:11 PM
2 Karma
I've seen numerous variations of this ERROR in Answers and wanted to post a specific one. I use a query that combines subsearch, eval and duration to generate a dashboard chart.
When a user clicks on the chart, the resulting flashtimeline looks great. However, clicking on any results from the flashtimeline fail (return nothing.)
I realize there is some trick to getting this to work, perhaps with ConvertToIntention but I'm failing to get it to work. My dashboard started as Simple XML and was converted to Advanced XML using the ?showsource=1 trick. I suspect there is some ugliness in the syntax I have from showsource with respect to properly modifying it to get ConvertToIntention to work properly.
... View more
10-11-2012
01:59 PM
I'm working with multiple logs which have different field naming conventions for the same date. Is there a way to list out fieldnames (by sourcetype) ?
... View more
10-10-2012
09:13 AM
I'm scheduling a search that spans -1h@h and ends -@h, however the UI doesn't like my syntax:
Cannot parse time argument 'dispatch.latest_time': '-@h'
... View more
10-09-2012
10:44 AM
We are trying out a method of deleting events from the index. It looks like a metadb rebuild takes place every time we do this so would like to know what the performance implications are, if any:
10-09-2012 16:01:13.287 +0000 INFO databasePartitionPolicy - Detected a deletion, rebuilding metadata in directory '/var/lib/splunkdb/main' 10-09-2012 16:01:38.986 +0000 INFO databasePartitionPolicy - rebuildMetadata called: full=true path=/var/lib/splunkdb/main reason= delete_fixup 10-09-2012 16:02:05.529
+0000 INFO databasePartitionPolicy - Detected a deletion, rebuilding metadata in directory '/var/lib/splunkdb/main' 10-09-2012 16:02:30.585 +0000 INFO databasePartitionPolicy - rebuildMetadata called: full=true path=/var/lib/splunkdb/main reason= delete_fixup 10-09-2012 16:02:56.595
+0000 INFO databasePartitionPolicy - Detected a deletion, rebuilding metadata in directory '/var/lib/splunkdb/main' 10-09-2012 16:03:23.114 +0000 INFO databasePartitionPolicy - rebuildMetadata called: full=true path=/var/lib/splunkdb/main reason= delete_fixup 10-09-2012 16:03:48.600
+0000 INFO databasePartitionPolicy - Detected a deletion, rebuilding metadata in directory '/var/lib/splunkdb/main' 10-09-2012 16:04:14.583 +0000 INFO databasePartitionPolicy - rebuildMetadata called: full=true path=/var/lib/splunkdb/main reason= delete_fixup 10-09-2012 16:04:40.996
+0000 INFO databasePartitionPolicy - Detected a deletion, rebuilding metadata in directory '/var/lib/splunkdb/main' 10-09-2012 16:05:06.330 +0000 INFO databasePartitionPolicy - rebuildMetadata called: full=true path=/var/lib/splunkdb/main reason= delete_fixup 10-09-2012 16:05:32.331
+0000 INFO databasePartitionPolicy - Detected a deletion, rebuilding metadata in directory '/var/lib/splunkdb/main'
... View more
- Tags:
- delete
- performance
10-09-2012
08:24 AM
THANK YOU. That worked exactly the way I needed!
... View more
10-08-2012
10:38 PM
My subsearch returns 2 fields from a single event. I want to use those fields, kv pairs, to find all associated events that match (field1=a OR field2=b)
... View more
10-08-2012
08:03 PM
I have the following search which isn't returning results:
mysearchevents [ search sourceA | fields a b ]
For my subsearch, I'm taking an event and pulling out fields "a" and "b". Then I want any event (in mysearchevents) that contain field "a" OR field "b".
I want the raw event so no formatting is necessary.
My search returns nothing. 😞
... View more
- Tags:
- subsearch
10-05-2012
10:24 AM
1 Karma
I encounter this when I forget to "share" my summary search to the search app. I don't have to specifically assign privs to any role but the search app needs access. 2 clicks in UI will fix it.
... View more
10-02-2012
11:59 AM
Try asking this as a new question so others can easier find and make use of it. In your case have you tried using coalesce for queue_id and queued_as fields?
... View more
09-26-2012
03:32 PM
I added count to the XML to try to workaround this issue. Why is Splunk adding "count" in addition to my specified series? I've updated my question to show that count is removed but regardless, "count" appears in the legend. Could this be a bug?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-24-2025
08:16 AM
|
Karma given to
