About Ayn

Ayn · ‎02-07-2014

In that case something else is going on in your setup. Splunk does not require a restart to pick up new files. One good start for your troubleshooting is using the script found here: http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/

Ayn · ‎02-07-2014

Just monitor the whole folder instead of pointing out specific files in that folder.

Ayn · ‎02-07-2014

... | rex "\"?(?<myvalue>[\d.]+)\"?$" | table myvalue

Ayn · ‎02-06-2014

If you want to match the last field the best approach imho is to anchor your match against the end of the line, not against how many fields are before the last one. This regex should work: "?([\d.]+)"?$

Ayn · ‎02-06-2014

First of all it sounds like you need to take the Splunk tutorial (http://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/WelcometotheSearchTutorial ). It equips you with the knowledge you need for knowing where to look for solutions. Secondly, the join command docs are here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Join

Ayn · ‎02-06-2014

Where exactly are you running into problems? I guess you found the "join" command but ran into some kind of issues with it?

Ayn · ‎02-06-2014

I just want to add that this query is pretty inefficient considering you have this kind of stats at your disposal in the internal metrics. There's per_sourcetype_thruput , per_host_thruput among other things, so you can very quickly grab data like event count and volume of indexed data split by these parameters. Probably MUCH faster than the approach you're using right now.

Ayn · ‎02-06-2014

Yes, it is possible. Dashboards are typically possible to make highly dynamic, but it's hard to say more than that without knowing more about what more exactly you want to accomplish and what your scenario looks like.

Ayn · ‎02-06-2014

Docs on getting data in: http://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/AboutgettingdataintoSplunk _time as when Splunk reads the file: set DATETIME_CONFIG = CURRENT in props.conf. http://docs.splunk.com/Documentation/Splunk/latest/Data/HowSplunkextractstimestamps http://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf

Ayn · ‎02-06-2014

Wasn't that supposed to be "MWGaccesslog"?

Ayn · ‎02-05-2014

Docs are your friend! 🙂 http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction mvlist=<bool> | <field-list> Description: Flag controlling whether the multivalued fields of the transaction are (mvlist=t) a list of the original events ordered in arrival order or (mvlist=f) a set of unique field values ordered lexigraphically. If a comma/space delimited list of fields is provided only those fields are rendered as lists. Defaults to f.

Ayn · ‎02-05-2014

Can you show what your search string when you tried to use fieldformat looked like?

Ayn · ‎02-05-2014

Splunk needs to be restarted before the monitor settings can take place. There is a setting in serverclass.conf called restartSplunk that controls whether the client will be asked to restart after changes have been deployed. If this only happens for a subset of servers in your environment I suspect these don't have restartSplunk set.

Ayn · ‎02-04-2014

http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Introducingtheuniversalforwarder

Ayn · ‎02-04-2014

If you export data out of Cassandra somehow and get Splunk to ingest that data, sure. But, Splunk cannot itself read anything out of Cassandra in the way that you seem to want.

Ayn · ‎02-03-2014

You cannot use Cassandra as a backend, no.

Ayn · ‎02-03-2014

Subsearches always run before the outer searches, as for the order in which subsearches themselves run I don't think there's a guaranteed order for that. Please tell us more about exactly what you want to accomplish, with examples.

Ayn · ‎02-03-2014

I usually define my own key/value extraction for this. As long as there's a good way of specifying what the key and what the value is this works fine. Something like this: [my_kv_extract] REGEX = ([^=]+)="([^"]+) FORMAT = $1::$2

Ayn · ‎02-02-2014

Docs: http://docs.splunk.com/Documentation/Splunk/6.0.1/installation/Capacityplanningforalargersplunkdeployment http://docs.splunk.com/Documentation/Splunk/6.0.1/Deploy/HardwarecapacityplanningforadistributedSplunkdeployment http://docs.splunk.com/Documentation/Splunk/6.0.1/Installation/Performancechecklist

Ayn · ‎02-02-2014

I think you should be looking at this? http://docs.splunk.com/Documentation/Splunk/6.0.1/Data/MonitorWMIdata

Ayn · ‎02-01-2014

The credentials are for the local Splunk forwarder, not your Splunk server. If you didn't change these the default values are "admin" with the password "changeme".

Ayn · ‎01-30-2014

My Loglogic knowledge is a bit rusty, but isn't Lasso the actual Loglogic agents that you deploy on systems? So that would be the equivalent to Splunk's Universal Forwarders? Remote retrieval of event logs can be achieved by polling them via WMI. This method has its fair share of caveats so consider carefully whether you want to go down that path before you choose what to do. But, yes, Splunk can do this as well. Here goes. http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWMIdata

Ayn · ‎01-30-2014

Sorry, my brain is working poorly. That should be count() , not dc() (because the distinct filter is done in the eval). Changing my answer to reflect this.

Ayn · ‎01-29-2014

Another approach: index="indexname" source="sourceName" | eval uniqueString=field01.field02 | eventstats earliest(_time) as earliest_event by uniqueString | timechart span=15m count(eval(_time==earliest_event)) kristian's suggestion is much cleaner imho but this might yield better performance. EDIT: dc --> count

Ayn · ‎01-29-2014

Right, so wouldn't this be solved by actually using this search but wrapping it inside some kind of form search view that lets users enter the login without having to worry about what goes on behind the scenes?

Posts	3370
Solutions	730
Karma Given	1392
Karma Received	3245
Member Since	‎02-28-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Backslashes being doubled

How to show events per second in timechart regardl...

How to have a results table always display newest ...

Using host tags (or similar) when searching on fie...

How can i change the time format in Splunk web?

Re: Taking CSV files automatically from folder

Re: Taking CSV files automatically from folder

Re: extract a field from csv file

Re: extract a field from csv file

Re: Joing data from 2 data

Re: Joing data from 2 data

Re: Displaying full list of server names

Re: Dashboard Creation

Re: Reading CSV files from folder

Re: McAfee App: MWGaccesslog not available as sour...

Re: Transaction command help

Re: Adding commas to "stats sum"

Re: Some Splunk client doesnt' see/load deployed a...

Re: forwarder Or universal forwarder

Re: What is the backend used in splunk?

Re: What is the backend used in splunk?

Re: How to add inputlookup and outputlookup in sam...

Re: Dealing with spaces in fields

Re: [Splunk Log Management] Is there a performance...

Re: EventLog by Powershell

Re: Splunk forwarder on OSX

Re: Central Windows logs pulling point

Re: Timechart count roll up

Re: Timechart count roll up

Re: dynamic lookup based upon dynamic token

Join the Conversation