Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About ziegfried
ziegfried
Influencer
Member since:
11-17-2009
01-26-2022
Community Statistics
| Posts | 668 |
| Solutions | 234 |
| Karma Given | 406 |
| Karma Received | 930 |
| Member Since | 11-17-2009 |
Activity Feed
- Got Karma for Re: What's the difference between where and search in the pipeline?. 01-13-2026 11:36 PM
- Got Karma for Re: Database lookup not returning all matches. 04-21-2025 03:30 PM
- Got Karma for Re: stats by date_hour add zero count for hours with no events. 04-09-2024 12:24 PM
- Got Karma for Re: Add reports to dashboards. 12-07-2023 11:17 PM
- Got Karma for Re: stats by date_hour add zero count for hours with no events. 04-18-2023 02:05 AM
- Got Karma for Re: How do you add dummy events to a search result?. 11-06-2022 11:06 PM
- Got Karma for Re: What's the difference between where and search in the pipeline?. 09-19-2022 02:38 PM
- Got Karma for Re: What's the difference between where and search in the pipeline?. 05-12-2022 04:02 PM
- Got Karma for Re: IIS FTP LOG TIMEZONE PROBLEM. 04-28-2022 04:28 AM
- Got Karma for Re: How do I list all active input stanzas in all apps?. 03-27-2022 08:43 PM
- Got Karma for Re: How do you add dummy events to a search result?. 01-11-2022 01:42 PM
- Got Karma for Re: What's the difference between where and search in the pipeline?. 11-11-2021 02:06 AM
- Got Karma for Re: How to format _time field in results email?. 10-19-2021 11:43 AM
- Got Karma for Re: How do I determine my indexing volume by host, source, or sourcetype?. 06-07-2021 08:24 AM
- Got Karma for Re: convert bytes to megabytes in report. 05-19-2021 08:15 PM
- Got Karma for Re: What's the difference between where and search in the pipeline?. 04-30-2021 10:07 AM
- Got Karma for Re: Terminate User Session. 03-16-2021 08:22 AM
- Got Karma for Re: Splunk DB Connect - dbquery inline search and time filtering not working. 03-02-2021 02:20 PM
- Got Karma for Re: how to find the earliest and latest event in an index?. 12-09-2020 09:22 AM
- Got Karma for Re: Multiple Values per Event - transforms.conf regex. 11-24-2020 06:58 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 3 | |||
| 5 |
12-07-2012
10:06 AM
The Java Bridge in DB Connect is actually something different to the "Java Access Bridge" you are referring to. You can safely remove this package, since this is not required by DB Connect.
As for your problem regarding the Java Bridge not running:
1) Have you completed the setup page of the app? If not, in DB Connect, go to "Settings" in the navigation menu and Choose "Splunk DB Connect Configuration". You have to enter a valid Java/JRE installation directory (in your case probably /usr/lib/jvm/java-6-openjdk/jre ) and then hit the "Save" button. If the JVM is for some reason not compatible with DB Connect, you should see an error message.
2) Please take a look into the jbridge.log and see if you can spot any errors. There is a saved search in the DB connect app that filters this log for errors (ie. Searches -> "Recent Java Bridge errors")
3) Take a look into DB Connect's debug log (Searches -> "Recent DB Connect errors")
... View more
12-07-2012
07:51 AM
21 Karma
The persistent state of database inputs is stored in $SPLUNK_DB/persistentstorage/dbx ( $SPLUNK_DB is, if not specified otherwise: $SPLUNK_HOME/var/lib/splunk ). Each input has it's own directory, which is a hash of it's name (ie. a 32 character long hex string). This directory typically contains 2 files:
manifest.properties: contains meta-information, such as the name of the input
state.xml: contains the actual state in XML format
So you need to first identify the state directory and then you can modify (or delete) the XML file.
For modifying it, this state file looks something like this:
<list>
<value key="latest.record_update">
<value class="sql-timestamp">2012-12-07 04:22:25.703</value>
</value>
</list>
The value may vary, depending on the datatype of the rising-column you chose.
A Splunk restart might be necessary in order for DB Connect to recognize the changes.
... View more
09-09-2012
12:03 PM
1 Karma
Unfortunately, HiddenPostProcess doesn't work with the GoogleMaps module at the moment. This will be fixed soon.
... View more
09-09-2012
06:49 AM
3 Karma
The parameters the python endpoint receives are sent by the javascript part of the module. You can override the generation of this parameter list:
<app>/appserver/module/MyFunkyModule/MyFunkyModule.js
Splunk.Module.MyFunkyModule = $.klass(Splunk.Module.DispatchingModule, {
...
getResultParams: function($super) {
var params = $super();
params['startsize'] = this.getParam('startsize');
params['endsize'] = this.getParam('endsize');
return params;
}
...
}
then you'll be able to use it in python:
<app>/appserver/module/MyFunkyModule/MyFunkyModule.py
def generateResults(self, host_app, client_app, sid, count=1000, offset=0, entity_name='results', startsize, endsize):
... View more
09-04-2012
12:26 AM
2 Karma
You need to map those names to geographic locations (ie. latitude and longitude). Splunk builtin lookup mechanism is absolutely suited for such a use-case. A lookup table could look like this:
city,_geo
"City1","47.11,8.15"
"City2","28.77,7.99"
...
You can find more information on how to build lookups in Splunk here:
http://docs.splunk.com/Documentation/Splunk/4.3.3/Knowledge/Addfieldsfromexternaldatasources
You should be able to find sources for such lookups somewhere in the internet. For example this site: http://geocoder.ca/?freedata=1 provides a table with US City names and their geographic location.
Another option is to use geocoding services, but that probably requires a lot resources and will slow down the search significantly.
... View more
09-03-2012
06:02 AM
Unfortunately this is not possible at the moment. Clustering cannot be disabled in the current version. There will be a new version where it can be turned off, but that might take some time.
... View more
08-29-2012
08:36 AM
4 Karma
I planned on adding that to the app but haven't gotten to that yet. You should be able to do it yourself, though. Just add a lookup table (Such tables should be easy to find somewhere on the web) which maps the zip code to the geo coordinates.
| zip | _geo |
| 47111 | 47.11,8.15 |
| 47112 | 28.77,7.99 |
Here's an example of such a freely available list: http://geocoder.ca/?freedata=1
It should be pretty easy to transform it to a lookup list like the example above.
... View more
08-29-2012
04:00 AM
1 Karma
You can find information about which forwarder downloaded a deployment app in Splunkd's access log on the deployment server:
index=_internal sourcetype="splunkd_access" uri_path=/services/streams/deployment | rex field=name ":(?<serverClass>.+?):(?<app>.+)" | table _time clientip serverClass app
... View more
08-29-2012
12:18 AM
3 Karma
You can use scheduled searches to maintain such a lookup table from your indexed data ( outputlookup ). If this information changes over time, you can create and maintain a time-based lookup to get accurate results for events from the past.
... View more
08-28-2012
08:38 AM
2 Karma
You could use the loadjob command:
| loadjob 1346168165.751
It will emit the results of the previously executed (and saved) search.
... View more
08-24-2012
12:31 PM
Yes, I'm aware of that, it's a major flaw in the current drilldown implementation. It occurs because the _geo value is converted to two float values and when drilldown is triggered it converted back to a string. So the precision of floats in Javascript limits the drilldown functionality as well, as very precise latitude or longitude values can potentially lead to different drilldown values as well.
I'm already working on an overhaul on how the module handles drilldown.
... View more
08-24-2012
08:22 AM
2 Karma
The easiest option is to use the IFrameInclude module. Otherwise you could copy and modify the alerts splunkweb controller $SPLUNK_HOME/lib/python*/site-packages/splunk/appserver/mrsparkle/controllers/alerts.py and the corresponding template $SPLUNK_HOME/share/splunk/search_mrsparkle/templates/alerts/index.html or create a custom module.
... View more
08-24-2012
12:47 AM
DBX allows you to do that. It's possible to setup a database monitor on a sqlite database and index new records, when the database is updated.
It's a commercial extension, though.
... View more
08-23-2012
10:22 AM
index=webproxy user="test" Company="test" | transaction user maxpause=5m | stats sum(duration) as browsing_time by user | sort -browsing_time | head 10 | fieldformat browsing_time = tostring(browsing_time,"duration")
... View more
08-22-2012
10:30 AM
Creating such a scripted input is pretty simple. Everthing that the script sends to STDOUT will be indexed by Splunk.
... View more
08-22-2012
10:29 AM
1 Karma
Another option is to use the unarchive command. There has been a blog entry that illustrates how to do that:
http://blogs.splunk.com/2011/07/19/the-naughty-bits-how-to-splunk-binary-logfiles/
It still involves scripting, though.
... View more
08-21-2012
02:58 PM
Have you tried to clear the browser cache? It that doesn't work, please take a look at the browser's console and see if you can find any error messages.
... View more
08-21-2012
08:41 AM
yes, I'll upload an updated version of the app sometime later today.
... View more
08-20-2012
09:28 AM
You can create realtime searches and add them to a dashboard. Simply select a real-time range instead of a historic one from the timerange picker (next to the search bar). When you use such a search in a dashboard, the content will be updated automatically.
For more information on realtime search, see the Splunk docs:
http://docs.splunk.com/Documentation/Splunk/4.3.3/User/RealtimeSearch
... View more
08-20-2012
05:40 AM
4 Karma
With the latest version of the Google Maps app (1.1.1) it should work fine in Chrome. The only problem is when SSL is enabled for Splunkweb. Chrome will block the Google Maps API (because its loaded via HTTP).
... View more
08-16-2012
11:15 PM
So the rest of the event your're seeing is the actual (multipart encoded) HTTP body.
I'd suggest to use another substitution in the SEDCMD to eliminate the multipart boundaries.
eg.
SEDCMD-stripheader = s/^(?ms)POST.+?(r?n){2}//g s/-{30}\V+//g
... View more
08-16-2012
11:12 PM
The regex matches "POST" at the beginning of the event up until two CRLF (newlines) are found. \r\n\r\n is the termination of the header in the HTTP protocol.
... View more
08-16-2012
02:57 PM
My last guess is to additionally adjust the line-merging settings (also props.conf):
SHOULD_LINEMERGE=false
LINE_BREAKER=------------------------------\w+--([\r\n]+)
SEDCMD-stripheader = s/(?ms)^POST.+?(\r?\n){2}//g
... View more
08-16-2012
02:37 PM
you didn't use both of them at the same time, did you?
... View more
08-16-2012
02:31 PM
Since all URI's in Splunkweb are typlically prefix by the locale, you should be able to create to reverse proxy settings just using the /en-US part (without using the HTML rewite stuff)
ProxyPreserveHost On
ProxyPass /en-US http://127.0.0.1:8000/en-US
ProxyPassReverse /en-US http://127.0.0.1:8000/en-US
In addition you could create a redirect rule to forward requests to /splunk to the /en-US
... View more
