Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About twinspop
twinspop
Influencer
Member since:
06-09-2010
04-07-2021
Community Statistics
| Posts | 609 |
| Solutions | 72 |
| Karma Given | 384 |
| Karma Received | 232 |
| Member Since | 06-09-2010 |
Activity Feed
- Got Karma for Re: Why aren't defined field transformations showing in the GUI?. 09-09-2025 04:40 AM
- Got Karma for Re: Why is my log file sometimes ignored?. 05-19-2025 02:49 PM
- Got Karma for Re: How can I show the time of the last event in a stats by count table?. 12-11-2024 08:35 PM
- Got Karma for Re: Search to Identify when a host stops sending logs to Splunk. 10-09-2024 12:04 AM
- Got Karma for Re: Logging multiple sources from Docker with HEC: Are multiple sourcetypes possible?. 04-09-2024 06:41 AM
- Got Karma for Logging multiple sources from Docker with HEC: Are multiple sourcetypes possible?. 04-09-2024 06:41 AM
- Got Karma for Re: Logging multiple sources from Docker with HEC: Are multiple sourcetypes possible?. 04-09-2024 06:41 AM
- Got Karma for Re: How do I remove a dash (-) from the Account_Name field?. 02-22-2024 08:53 AM
- Got Karma for Re: How to configure props.conf for a Unix timestamp in a JSON log file?. 01-20-2024 09:06 AM
- Got Karma for Re: Why is my search head cluster captain logging KV Store replication errors?. 06-08-2023 12:21 PM
- Got Karma for Is there a way to convert a scheduled report to an alert? (6.6.3). 05-04-2023 03:51 PM
- Got Karma for Re: WinEventLog inputs: Why does current_only=1 skip server reboot events?. 03-15-2023 12:41 PM
- Got Karma for Re: How to change '_time'? _time is by default picking first alphabetical date column (Assigned) and doing +05:30. 09-30-2022 04:56 AM
- Posted Kafka add-on: Unable to initialize modular input on All Apps and Add-ons. 04-07-2021 07:52 AM
- Got Karma for Re: Is there any way to monitor CPU on Mac OS?. 03-20-2021 07:11 AM
- Got Karma for Re: With 8.1.2 or later should we still use an HEC tier on HWFs?. 03-08-2021 07:40 AM
- Posted Re: With 8.1.2 or later should we still use an HEC tier on HWFs? on Getting Data In. 03-05-2021 05:20 PM
- Posted With 8.1.2 or later should we still use an HEC tier on HWFs? on Getting Data In. 03-05-2021 05:19 PM
- Got Karma for Is there a way to convert a scheduled report to an alert? (6.6.3). 02-16-2021 11:23 PM
- Karma Re: Can you create/modify a lookup file via REST API? for 4n0m4l1. 12-15-2020 07:26 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-31-2016
02:40 PM
Just a point of advice: Don't use wildcards unless absolutely necessary. In this case, it really isn't doing anything for you at all. Without specifying sourcetype=* it will return all sourcetypes. But it's a horrible habit to get into. Wildcards are evil and should be avoided whenever possible.
... View more
10-28-2016
02:01 PM
... | stats min(_time) as start max(_time) as end by some_key_in_your_events | eval span_seconds=end-start
... View more
10-28-2016
06:35 AM
1 Karma
Try this, adding indexers as required:
(host=your_indexer OR host=your_indexer2 OR host=your_indexer3) index=_internal metrics name=index_thruput sourcetype=splunkd |
timechart span=1m sum(eval(kb/1024)) as "MB/min"
If you run for more than a few hours, forcing a different span in the timechart, you'll need to do some extra math. This one has 5 minute buckets and therefore requires dividing the value by 5.
(host=your_indexer OR host=your_indexer2 OR host=your_indexer3) index=_internal metrics name=index_thruput sourcetype=splunkd |
timechart span=5m sum(eval(kb/1024/5)) as "MB/min"
This one by hour
(host=your_indexer OR host=your_indexer2 OR host=your_indexer3) index=_internal metrics name=index_thruput sourcetype=splunkd |
timechart span=1h sum(eval(kb/1024/60)) as "MB/min"
... View more
10-27-2016
06:27 PM
You have both BREAK_ONLY_BEFORE and LINE_BREAKER defined. Ditch BREAK_ONLY_BEFORE and change SHOULD_LINEMERGE to false.
... View more
10-27-2016
06:54 AM
Use a sub search to collect the top 5 users:
[search My search | top 5 users | fields users] My search |
stats values(field_1) as field_1 values(field_2) as field_2 by users
The results from that sub search are OR'd together, something like this:
(users=ABC OR users=DEF OR users=GHI OR users=JKL OR users=MNO) My search ...
... View more
10-26-2016
07:15 PM
1 Karma
Wow, this is old. Just for grins, i think this answers the question:
curl -sku admin 'https://localhost/services/pdfgen/render?input-dashboard=your_view&namespace=your_app&paper-size=a4-landscape' > your_report.pdf
... View more
I don't believe you can do this in the GUI, but with a simple curl command you can schedule it via cron:
curl -sku youruser:yourpass 'https://localhost:8089/services/pdfgen/render?input-dashboard=your_view_name&namespace=your_app_context&paper-size=a4-landscape' >> your_view.pdf
... View more
10-13-2016
06:24 AM
[ecapi_log4j_2]
TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N
MAX_TIMESTAMP_LOOKAHEAD = 40
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)[SMTWF][a-z]+\s+\d{4}-\d{2}-\d{2}
TRUNCATE = 100000
... View more
10-12-2016
06:56 AM
I chose the simply-stop-it method. The server was down for about 50 minutes. Restarted and just for grins ran splunk resync shcluster-replicated-config . It seems to be working okay.
... View more
10-12-2016
06:33 AM
2 Karma
There is no benefit to searching for something, then re-running search in a new command (after a pipe). And bare asterisks serve no purpose at all.
index=main keyword12!="NULL"
| dedup host
| table keyword12, host
This will return the same results as your search and should be a lot more efficient.
EDIT: If at all possible avoid negated searching. In other words, try to turn the keyword12 NOT EQUAL term into a positive match, or a series of positive matches using OR. Negative matching is far less efficient than positive matching. keyword12=something OR keyword12=somethingelse OR keyword12=otherthing
... View more
10-11-2016
06:32 PM
Good tip!
... View more
10-11-2016
03:46 PM
So many 'shoulds' and 'coulds' in both answers. The uncertainty and finger crossing involved with SHC makes me very nervous. Some day this will improve, right? RIGHT?! 🙂
... View more
10-11-2016
03:26 PM
I need to perform some emergency maintenance on 1 member of my 4-member Search Head Cluster tonight. From the docs, it looks like I need to remove the target from the SHC, clean the Splunk install, perform my maintenance (including a reboot), then re-add the target member back to the cluster. This seems insane to me. Is that really the best practice?
Would it be easier to just take down the entire cluster while working on this one machine?
... View more
10-07-2016
06:13 PM
I don't ever trust date_hour. Lots of past discussion on this. Search the archives.
... View more
10-07-2016
04:48 PM
2 Karma
your search earliest=-60m@m latest=@m| stats min(_time) as _time count as Count | eval Day="Today" | fields Day, _time, Count | append [ search your search earliest=-1d@m-60m latest=-1d@m | stats min(_time) as _time count as Count | eval Day="Yesterday" | fields Day, _time, Count ]
... View more
10-07-2016
01:22 PM
I usually think changing sourcetype is evil and should be avoided. But this is nice. I like it.
... View more
10-03-2016
01:46 PM
I would search _internal for indications that pipelines are blocked or paused. In all likelihood, your indexer is not up to the indexing load being presented to it. Either slow disk or not enough CPU. If you have many cores, you could try adding pipelines. Otherwise, an additional indexer may be your answer. (1 extra pipeline will result in 10-12 CPUs being used, total, for indexing. Don't add a parallel pipeline unless you have many more cores than that still available for searching.)
... View more
10-03-2016
07:22 AM
List both styles? Splunk will ignore inputs that have paths that don't exist.
[monitor://C:\windows\Temp\logs.txt]
foo = bar
[monitor://E:\windows\Temp\logs.txt]
foo = bar
... View more
09-30-2016
05:02 PM
1 Karma
I asked the user for the first few lines of the files thinking maybe there was a header that an initCrcLength adjustment would fix. No, it was plain old syslog:
2016-09-30 00:00:00,836 WARN - [APPID: ] [TXID: ] [UID: ] [ORGOID: ] [AOID: ] [UA_MODE: ] - com.cs.services.ws.handlers.somehandler.handleMessage(): HTTP Header OrgOID is NOT present in the header
Then it hit me. I quickly searched for that exact log line:
index=problem_index earliest=@d latest=@d+1m "2016-09-30 00:00:00,836 WARN" orgoid is not present
And there it was. But in another source! The error from internal logs was legit. There was another log with IDENTICAL content. Turns out someone on the developer team added another appender to the log4j config.
... View more
09-30-2016
05:01 PM
Self-answered question follows. Perhaps it will help someone else in the same boat.
I have a file called portal-server.log on a log server (NFS mount from many machines) that periodically doesn't log after a roll. The internal logs show:
09-30-2016 18:26:33.435 -0400 ERROR TailingProcessor - File will not be read, seekptr checksum did not match (file=/var/logs/host1048/portal-server.log). Last time we saw this initcrc, filename was different. You may wish to use a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.
I tried changing the initCrcLength but problem returned. (And I steered clear of using CRCSalt.) Checking the number of files on the log server. Checking the health of the NFS mount. So many avenues all leading to dead ends.
What is going on? Answer below...
... View more
09-30-2016
06:52 AM
I want to have the following 3 levels of access:
User: "Belongs" to an app; can create private objects only; cannot schedule
App-Admin: "Belongs" to an app; can share objects to app level so other users can see/use them; can schedule
Admin: System level admin, i.e. Splunk's "root"
The idea is that Users shouldn't be able to change the app, only their view of it. App-Admins can modify basically anything in their app, but should not have any control of Splunk outside of this app. I don't want them to create indexes, inputs, etc. Critically, app-admins need to be able to promote User KOs they deem worthy, from private to app-level sharing.
The app-level admin is not working as intended. KOs created by Users cannot be seen or modified by app admins. Short of giving App-Admin "admin_all_objects" I don't see how to accomplish this. However, my understanding is that setting effectively makes them root.
Is this set-up possible? Any suggestions for alternative plans that effectively mimic the user < app-admin < system-admin design?
... View more
09-29-2016
06:22 AM
Without knowing anything about your data, it's hard to tune. I would suggest adding terms to the first part of the search that are inclusive of all your target logs. Perhaps just "sourcetype=juniper" is too broad.
... View more
09-28-2016
02:32 PM
it kinda depends on how you intend to get a full list of potential routers. I'll make the assumption that all routers are logging events, just maybe not all with the RPD_MPLS_LSP_DOWN value for EVENT_TYPE.
index=XYZ sourcetype=JUNIPER | stats count by ROUTER EVENT_TYPE | where EVENT_TYPE="RPD_MPLS_LSP_DOWN" and count=0
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-07-2021
02:44 PM
|
