Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About ziegfried
ziegfried
Influencer
Member since:
11-17-2009
01-26-2022
Community Statistics
| Posts | 668 |
| Solutions | 234 |
| Karma Given | 406 |
| Karma Received | 930 |
| Member Since | 11-17-2009 |
Activity Feed
- Got Karma for Re: What's the difference between where and search in the pipeline?. 01-13-2026 11:36 PM
- Got Karma for Re: Database lookup not returning all matches. 04-21-2025 03:30 PM
- Got Karma for Re: stats by date_hour add zero count for hours with no events. 04-09-2024 12:24 PM
- Got Karma for Re: Add reports to dashboards. 12-07-2023 11:17 PM
- Got Karma for Re: stats by date_hour add zero count for hours with no events. 04-18-2023 02:05 AM
- Got Karma for Re: How do you add dummy events to a search result?. 11-06-2022 11:06 PM
- Got Karma for Re: What's the difference between where and search in the pipeline?. 09-19-2022 02:38 PM
- Got Karma for Re: What's the difference between where and search in the pipeline?. 05-12-2022 04:02 PM
- Got Karma for Re: IIS FTP LOG TIMEZONE PROBLEM. 04-28-2022 04:28 AM
- Got Karma for Re: How do I list all active input stanzas in all apps?. 03-27-2022 08:43 PM
- Got Karma for Re: How do you add dummy events to a search result?. 01-11-2022 01:42 PM
- Got Karma for Re: What's the difference between where and search in the pipeline?. 11-11-2021 02:06 AM
- Got Karma for Re: How to format _time field in results email?. 10-19-2021 11:43 AM
- Got Karma for Re: How do I determine my indexing volume by host, source, or sourcetype?. 06-07-2021 08:24 AM
- Got Karma for Re: convert bytes to megabytes in report. 05-19-2021 08:15 PM
- Got Karma for Re: What's the difference between where and search in the pipeline?. 04-30-2021 10:07 AM
- Got Karma for Re: Terminate User Session. 03-16-2021 08:22 AM
- Got Karma for Re: Splunk DB Connect - dbquery inline search and time filtering not working. 03-02-2021 02:20 PM
- Got Karma for Re: how to find the earliest and latest event in an index?. 12-09-2020 09:22 AM
- Got Karma for Re: Multiple Values per Event - transforms.conf regex. 11-24-2020 06:58 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 3 | |||
| 5 |
06-21-2011
09:42 AM
1 Karma
sourcetype=mysourcetype | rex "(?:^|\W)(?<alnum_code>\w{24})(?:\W|$)" | table alnum_code
... View more
06-21-2011
09:40 AM
Follow this guide on how to customize the navigation of an app:
http://www.splunk.com/base/Documentation/latest/Developer/Step6BuildNavigation
... View more
06-21-2011
07:52 AM
Yes, I've done it in the past. But this is a little too extensive to be described here. Essentially it's modifying the behavior of the EventsViewer module using a custom application.js.
... View more
06-21-2011
12:42 AM
1 Karma
It's possible by influencing the UI Javascript. But that's a rather sophisticated customization.
... View more
06-21-2011
12:41 AM
You're using the admin/script endpoint and not any custom setup routine. You should at least see a reference here https://localhost:8089/services/admin/script if your input is configured correctly.
... View more
06-20-2011
12:02 PM
1 Karma
The easiest way to get the entity for such setup.xml fields is to look at the REST endpoint listing. Just point your browser to https://your-splunk-server:8089/services/data/inputs/script and simply copy the url and take the entity part from it.
Btw. I second the suggestion of being able to specify scripts using forward slashes on Windows.
Update:
In my experience it's better to add scripted inputs by specifying the full path:
[script://$SPLUNK_HOME/etc/apps/myapp/bin/myscript.py]
To illustrate what I was trying to say above:
You can find multiple links (those are links to entities) at the REST page I've mentioned above. For example the link could look like this:
https://localhost:8089/servicesNS/nobody/myapp/admin/script/%24SPLUNK_HOME%5Cetc%5Capps%5Cmyapp%5Cbin%5Cmyscript.py
The entity you have to use in the setup.xml is the part after the last / . ie:
%24SPLUNK_HOME%5Cetc%5Capps%5Cmyapp%5Cbin%5Cmyscript.py
... View more
06-17-2011
10:27 AM
You could try specifying a line breaker instead of using line merging:
[bacula]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)(?!\s+)
This should break events by vertical whitespace not followed by whitespace characters.
... View more
06-17-2011
08:17 AM
The base url for the REST endpoint should probably be https://localhost:8089 .
... View more
06-17-2011
07:47 AM
Things you need to consider:
configurations referencing the app path (eg. scripted inputs).
all "private" configurations of users located at at $SPLUNK_HOME/etc/users/<app>/local/<config>.conf
... View more
06-17-2011
05:01 AM
3 Karma
I've written such a script which fetches the PDF from the REST endpoint. It will be part of a little extension which adds a "Download PDF" link to the actions menu. I'll release this very soon.
Update:
The app is now online: http://splunk-base.splunk.com/apps/26915/pdf-download-extension
It contains a script called "fetch_pdf.py" in the bin folder. You can use this to create and download PDF reports and store them somewhere. For information on how to use it execute:
splunk cmd python fetch_pdf.py --help
... View more
06-17-2011
01:40 AM
1 Karma
The performance impact on Splunk highly depends on the searches you're executing via the REST API.
... View more
06-16-2011
08:02 AM
Please note that as of Google Maps 1.1 this has changed. A single field _geo containing both the latitude and the longitude separated by a comma is now used as location information.
... View more
06-16-2011
06:30 AM
Choose if number of events is greater than 0 since you're already evaluating the condition in the search string.
... View more
06-15-2011
04:25 PM
1 Karma
The easiest way is probably to study the 2 demo views that ship with the app.
The module supports drilldown in 2 ways:
Custom field drilldown
When using the module in a custom dashboard, you can specify a drilldown field. All unique field values are then collected per location. When a marker or Cluster is clicked, those values are automatically combined/formatted in the form of
((<drilldown_field>=<value1>) OR (<drilldown_fields>=<value2) OR ...)
This partitial search string will be propagated to downstream modules as a setting ( maps.drilldown ) an can be leveraged using eg. a stringreplace intention.
Automatic drilldown
When there is no drilldown_field specified the drilldown can only happen when a marker is clicked that represents a single location (ie. not when a cluster is clicked). So when a marker with 2 or more locations (distinct _geo values) is clicked, the maps view will be centered on the cluster location and the zoom level will be incremented. In the case of a single location the module will propagate the setting maps.click containing the _geo value. This setting can be used in all kinds of intentions (stringreplace, addterm, etc) or using the GeoDrilldown Module which will essentially append | search _geo=<value> to the search string.
... View more
06-15-2011
03:30 PM
1 Karma
Your best bet is to use the punct field which is the pattern of the event. You can read more about this field here: http://www.splunk.com/base/Documentation/4.2.2/User/UseDefaultAndInternalFields#punct
For example:
sourcetype=syslog | stats count first(_raw) as event by punct | table count event | sort -count
... View more
06-15-2011
12:26 PM
even if you did not generate the logs, you can still configure how splunk is doing the line breaking
transforms.conf
[disk_logs]
SHOULD_LINEMERGE = false
... View more
06-15-2011
11:23 AM
3 Karma
Assuming that all lines are seperate events, you can use such a regex:
index=disk sourcetype="disk_logs" | rex "^(?<fs>.+?)\s+(?<fs_total>\d+)\s+(?<fs_used>\d+)$"
Otherwise you can split the events into seperate results:
index=disk sourcetype="disk_logs" | rex "(?m)^(?<line>\V+)$" max_match=10000 | table line | mvexpand line | rex field=line "^(?<fs>.+?)\s+(?<fs_total>\d+)\s+(?<fs_used>\d+)$"
... View more
06-15-2011
10:46 AM
4 Karma
this might be more efficient:
index=myindex product=myvpnappliance | stats dc(src_ip) as src_ip_count by username | where src_ip_count>1
... View more
06-14-2011
10:28 AM
1 Karma
Yes, the metadata search can be executed via REST. I can't tell the specifics of the SplunkNet API, but the search string should not start with a leading | . I've just successfully tested it with the following POST data:
search=metadata%20type%3Dhosts
Here is a simple example how this is done using curl:
Dispatch the job:
$curl -k -u admin:changeme -d "search=metadata%20type%3Dhosts" https://localhost:8089/services/search/jobs
Response:
<?xml version='1.0' encoding='UTF-8'?>
<response><sid>1308072253.175</sid></response>
Fetch the results:
curl -k -u admin:changeme https://localhost:8089/services/search/jobs/1308072253.175/results?output_mode=json
Response:
<... the results ...>
... View more
06-09-2011
12:39 PM
No AFAIK this is only possible for the sourcetype field where the original can be retrieved with the _sourcetype field.
... View more
06-09-2011
12:29 PM
2 Karma
There is an app which add a jsonkv command to Splunk which acts like xmlkv for JSON formatted data. Check it out:
http://splunk-base.splunk.com/apps/22337/jsonutils
... View more
06-09-2011
12:28 PM
jQuery runs on the client side. So it won't help much in terms of processing JSON formatted events.
... View more
06-09-2011
09:53 AM
1 Karma
You can also do simple string comparison in the where command:
... | where NOT hello_world="*"
... View more
