Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About Ayn
Ayn
Legend
Member since:
02-28-2010
06-05-2020
Community Statistics
| Posts | 3370 |
| Solutions | 730 |
| Karma Given | 1392 |
| Karma Received | 3246 |
| Member Since | 02-28-2010 |
Activity Feed
- Got Karma for Re: Splunk's $SPLUNK_HOME/etc/passwd File syntax and encryption/hashing algorithm. 08-20-2026 06:29 AM
- Got Karma for Re: My own Python script cannot import Splunk Python library modules?. 05-20-2026 11:37 AM
- Got Karma for Re: Host field getting overwritten in syslog processing. 10-13-2025 04:20 AM
- Got Karma for Re: Add Line Breaks with Eval. 01-15-2025 12:44 AM
- Got Karma for Re: Get the output in double quotes.. 12-26-2024 09:48 AM
- Got Karma for Re: Calculating Percentage. 11-08-2024 11:22 AM
- Got Karma for Re: Can I reload savedsearches.conf without restarting?. 09-10-2024 01:55 AM
- Got Karma for Re: rex - matching everything until a tab. 07-31-2024 08:05 PM
- Got Karma for Re: Pulling data from a remote Splunk server via REST with Authentication. 07-26-2024 01:28 AM
- Got Karma for Re: Currently logged on username in search. 01-20-2024 05:43 PM
- Got Karma for Re: Use of "NOT" vs "!=". 12-13-2023 08:41 AM
- Got Karma for Re: How does one search for a CIDR range of addresses?. 11-19-2023 11:31 PM
- Got Karma for Re: getting unique values of the field. 08-29-2023 06:21 AM
- Got Karma for Re: eval isnull. 07-11-2023 04:44 PM
- Got Karma for Re: Get Data lookup from Other Remote Peer. 06-07-2023 08:06 AM
- Got Karma for Re: Calculating Percentage. 05-15-2023 11:02 AM
- Got Karma for Re: getting unique values of the field. 04-14-2023 01:22 PM
- Got Karma for Re: How does one search for a CIDR range of addresses?. 11-07-2022 04:28 PM
- Got Karma for Re: Can AND or OR be used in case statements in eval expressions?. 10-24-2022 06:06 PM
- Got Karma for Re: How does one search for a CIDR range of addresses?. 09-13-2022 07:11 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 7 | |||
| 4 | |||
| 0 | |||
| 1 | |||
| 19 |
08-30-2011
11:28 PM
1 Karma
One simple way is to involve your custom fields in some stats command, for instance top :
<yoursearch> | top custom_field
... View more
08-30-2011
03:43 AM
7 Karma
The chart command could be used to be achieve this. By giving chart two fields to split the results by, it will output a table like the one you show in your question where the columns are made up from the distinct values of the first field, and the rows are correspondingly made up from the distinct values of the second field. So, using the field names program_name and program_version this will give you the table you want:
<yourbasesearch> | chart count by program_name,program_version
... View more
08-28-2011
09:24 AM
1 Karma
How are you creating the fields? As part of your search using the rex operator, through the field extractor or directly through a configuration file such as props.conf ?
... View more
08-26-2011
03:17 AM
3 Karma
The data amount that is counted against the license is the amount of uncompressed raw data, i.e. how much data Splunk has to handle when indexing it. So, in your case the amount of data that is counted against the license is the >500MB uncompressed data per file rather than 30MB for the compressed equivalent.
... View more
08-26-2011
12:04 AM
1 Karma
No, there is no such functionality in Splunk. What you could do is trigger a script that does something with the file (like copying it to a fileshare somewhere) but that process would be separate from Splunk.
... View more
08-24-2011
01:19 PM
As a means of troubleshooting the issue, I would recommend trying to create files as the user Splunk will be running as, just to make sure that the permissions you set are taking effect properly.
... View more
08-24-2011
09:43 AM
1 Karma
Sounds like a permissions issue. Does Splunk have permission to write files in the index directory?
... View more
08-23-2011
03:11 AM
I think you'll need to state your problem more clearly. In what way do you need to 'save' the user parameter? How are you planning to use this search? Should it be user-independent and used in a search form somehow where Splunk users can specify the value for this field?
... View more
08-18-2011
09:09 AM
4 Karma
You can concatenate strings together to a new field holding the concatenated string using the eval command and then output that using table or however you want to output the field.
<yourbasesearch>
| eval userfriendlydesc="For server ".A." service ".B." is in state".C
| table userfriendlydesc
If for some reason you don't want to use table you could change the raw message at search time.
<yourbasesearch>
| eval _raw="For server ".A." service ".B." is in state".C
... View more
08-18-2011
01:48 AM
2 Karma
On a related note, this tool could come in handy: http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/
It lists the state of each input along with descriptions on why some inputs aren't indexed (if any) etc. Really useful!
... View more
08-17-2011
12:34 PM
Yes, that should work fine.
... View more
08-17-2011
09:13 AM
See the added info. You'll get a total count either by stacking the chart or using addtotals. Or did I misunderstand your question?
... View more
08-17-2011
08:59 AM
There are several ways in which you can achieve this, for instance you could use a stacked area graph. Let's say that your web logs have the sourcetype weblogs and that the field httpResponseCode is being extracted from all the log events. In this case, you'd do:
sourcetype="weblogs" | timechart count by httpResponseCode
This gives you a count of each response code over time. By going into the report builder and choosing an area chart with stacked areas, the total height of the area over time will be equivalent to the total amount of requests, and you can see how much each response code contributes to that total.
Edit: additionally, if you prefer to solve it another way and want a method to get the total count in addition to the count for each individual response code, add | addtotals to your search command. It will add a "Total" column to your chart containing the total count.
... View more
08-17-2011
08:07 AM
2 Karma
Use the stats operator dc (an alias for distinct_count ). Let's say you have the fields httpResponseCode and user . To get a count of how many users got an httpResponseCode of 404, regardless of how many times each user got it, you'd do:
httpResponseCode=404 | stats dc(user)
More information on the dc stats function, along with others, is available here: http://docs.splunk.com/Documentation/Splunk/4.2.2/SearchReference/CommonStatsFunctions
... View more
08-17-2011
05:32 AM
2 Karma
Unfortunately there is currently no functionality for including search results in the RSS feed. This would be a great feature, so you should consider filing an ER for it.
... View more
08-16-2011
07:31 AM
How do you mean "sort by"? Do you want to join disparate events into one event based on the productName? Or do you want to create statistics based on productName? It's much easier to answer if you can provide us with a clear and concise description of a specific goal you want to achieve, preferrably also with sample log events.
... View more
08-16-2011
06:36 AM
So, to get this straight - do you have a field with the value ".1" in it, but it's not treated as a numerical field?
... View more
08-16-2011
06:06 AM
3 Karma
Yes and no. You can specify which index metadata is to operate on, but not by specifying index=<index> before metadata (it needs to the first command of a search). Rather you need to specify the index as a parameter to metadata :
| metadata index=<index> type=sources
More information on the metadata command is available here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Metadata
... View more
08-15-2011
12:18 AM
1 Karma
Use convert . It is used for this very purpose, converting field values into numerical values.
<yoursearch> | convert auto(<yourfield>)
More information on the convert command is available here: http://docs.splunk.com/Documentation/Splunk/4.2.2/SearchReference/Convert
... View more
08-13-2011
02:27 PM
2 Karma
All stats command supports splitting up stats by values like this using the by operator:
sourcetype=test.log | stats count by ACTION
... View more
08-13-2011
02:25 PM
2 Karma
Layout settings for your application are defined in /appserver/static/application.css. The application logo is defined in the .appLogo section:
background: url(appLogo.png) no-repeat 0 0;
So, either switch out $SPLUNK_HOME/etc/apps/ /appserver/static/appLogo.png (and appLogo.gif for IE compatibility) for your own one, or modify the css so it points to your logo instead.
... View more
08-12-2011
10:32 AM
Sounds like a firewall issue. Do you use iptables or similar? Can you connect to port 8000 locally on the Splunk server?
... View more
08-11-2011
10:30 PM
Please clarify. Do you mean which field in the sample event? Syslog is just the means of transporting the event from the source host to a log server.
... View more
08-11-2011
12:00 AM
Correcting myself here - while there is no 'shortcut' to doing this using the CLI, what you can do is issue REST requests using the CLI. See this blog post: http://blogs.splunk.com/2009/12/10/poke-at-our-api/
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:02 AM
|
