Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About twinspop
twinspop
Influencer
Member since:
06-09-2010
04-07-2021
Community Statistics
| Posts | 609 |
| Solutions | 72 |
| Karma Given | 384 |
| Karma Received | 232 |
| Member Since | 06-09-2010 |
Activity Feed
- Got Karma for Re: Why aren't defined field transformations showing in the GUI?. 09-09-2025 04:40 AM
- Got Karma for Re: Why is my log file sometimes ignored?. 05-19-2025 02:49 PM
- Got Karma for Re: How can I show the time of the last event in a stats by count table?. 12-11-2024 08:35 PM
- Got Karma for Re: Search to Identify when a host stops sending logs to Splunk. 10-09-2024 12:04 AM
- Got Karma for Re: Logging multiple sources from Docker with HEC: Are multiple sourcetypes possible?. 04-09-2024 06:41 AM
- Got Karma for Logging multiple sources from Docker with HEC: Are multiple sourcetypes possible?. 04-09-2024 06:41 AM
- Got Karma for Re: Logging multiple sources from Docker with HEC: Are multiple sourcetypes possible?. 04-09-2024 06:41 AM
- Got Karma for Re: How do I remove a dash (-) from the Account_Name field?. 02-22-2024 08:53 AM
- Got Karma for Re: How to configure props.conf for a Unix timestamp in a JSON log file?. 01-20-2024 09:06 AM
- Got Karma for Re: Why is my search head cluster captain logging KV Store replication errors?. 06-08-2023 12:21 PM
- Got Karma for Is there a way to convert a scheduled report to an alert? (6.6.3). 05-04-2023 03:51 PM
- Got Karma for Re: WinEventLog inputs: Why does current_only=1 skip server reboot events?. 03-15-2023 12:41 PM
- Got Karma for Re: How to change '_time'? _time is by default picking first alphabetical date column (Assigned) and doing +05:30. 09-30-2022 04:56 AM
- Posted Kafka add-on: Unable to initialize modular input on All Apps and Add-ons. 04-07-2021 07:52 AM
- Got Karma for Re: Is there any way to monitor CPU on Mac OS?. 03-20-2021 07:11 AM
- Got Karma for Re: With 8.1.2 or later should we still use an HEC tier on HWFs?. 03-08-2021 07:40 AM
- Posted Re: With 8.1.2 or later should we still use an HEC tier on HWFs? on Getting Data In. 03-05-2021 05:20 PM
- Posted With 8.1.2 or later should we still use an HEC tier on HWFs? on Getting Data In. 03-05-2021 05:19 PM
- Got Karma for Is there a way to convert a scheduled report to an alert? (6.6.3). 02-16-2021 11:23 PM
- Karma Re: Can you create/modify a lookup file via REST API? for 4n0m4l1. 12-15-2020 07:26 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-22-2016
04:09 PM
1 Karma
sourcetype=example* | stats values(ex1_type) as ext1_type values(ext2_name) as ext2_name values(ext3_kind) as ext3_kind by ID
Assumptions:
You have a field extraction for ID Field as ID
You have field extractions for ex1_type, ext2_name and ext3_kind
... View more
09-20-2016
07:59 AM
If you're seeing no internal logs from the host, it's not connected to the INDEXER. Connecting to the DS is only half the battle. Can you telnet to the indexer from the forwarder on the port you're using for splunktcp?
... View more
09-19-2016
05:49 PM
HEADER_MODE? I'm not familiar with it, but the docs show:
Determines whether to use the inline ***SPLUNK*** directive to rewrite index-time fields.
I don't think this is what you want. Instead maybe this:
HEADER_FIELD_LINE_NUMBER = <integer>
* Tells Splunk the line number of the line within the file that contains the
header fields. If set to 0, Splunk attempts to locate the header fields
within the file automatically.
And if you use a header line, I don't think you want to list FIELD_NAMES.
Finally, I'd ditch the PREAMBLE_REGEX as well.
... View more
09-19-2016
05:38 PM
Exhibit A for why RT searches are terrible. I've banned them entirely from my environment. A dashboard with a panel that refreshes every 30s (or even 10s) is preferable IMO.
authorize.conf:
[default]
rtsearch = disabled
... View more
09-19-2016
05:33 PM
3 Karma
A standalone server with enough resources to meet your concurrent search needs will be faster than a cluster in all cases without exception
Exception: 🙂 VMs have many, many variables that can degrade performance. In my experience VM SHs are terribly slow in comparison to physical servers. YMMV. (ESXi running on recent Xeons and fairly substantial SAN infrastructure. I believe IO was the bottleneck.)
SHC also adds a lot of complexity and incompatibilities to your environment. If you feel that moving to an SHC someday is inevitable, maybe now's a good time. If not, avoid that extra complexity.
My 2 cents.
... View more
09-19-2016
03:18 PM
I'd recommend defining outputs.conf in a new app on your deployment server.
$splunk/etc/deployment-apps/fwd_outputs/local/outputs.conf
Edit the app in the DS GUI to "restart splunkd" and include this new app in your server class. That way you'll be able to update it easily if needed in the future.
... View more
09-16-2016
07:53 PM
Add the double-quote to your exclusion class:
rex "en-US/app/(?<app>[^/]+)/(?<dashboard>[^?\s\"]+)"
... View more
09-15-2016
01:16 PM
Try this to find transactions missing a step:
(sourcetype=TICKET_OPENED OR sourcetype=TICKET_ACTIVITY OR sourcetype=TICKET_CLOSED) |
stats count list(SOURCETYPE) as Types by TICKET_NUMBER | where count<3
Or, specific to your question:
(sourcetype=TICKET_OPENED OR sourcetype=TICKET_ACTIVITY OR sourcetype=TICKET_CLOSED) |
stats dc(TICKET_NUMBER) as TICKET_NUMBERS by sourcetype
... View more
09-15-2016
10:00 AM
Assuming your duration field is processing_time :
... | bin processing_time bins=10 | chart count over processing_time
The bin command has many more options to tweak this as required.
http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Bin
... View more
09-15-2016
08:57 AM
... | rex "<?[fF]ail[eu][dr]?e?[:;,. ](?<failure_code>.*)"
... View more
09-14-2016
03:42 PM
A few things:
Your timestamp has no timezone. Your log could be interpreted either in the past, or out in the future depending on how the indexer's timezone is set. Or how the TZ is set in props.conf for this source(type). I would expand my search time frame to include at least 24 hours on either side of the expected.
Along those same lines, I can't tell for sure from your timestamp if it's %Y-%m-%d or %Y-%d-%m. Be sure your props.conf explicitly sets your TIME_FORMAT properly for this source(type).
Your timestamp is far in the past. Splunk has a setting to ignore events older than specified time period. I would check the MAX_DAYS_AGO setting on the indexer to be sure it isn't so low as to exclude these events. (Default is 2000, but worth checking anyway.)
EDIT: I don't think the inclusion exclusion of the pipe is making any difference to parsing.
... View more
09-14-2016
03:00 PM
2 Karma
top gives you the top occurrences of a field value. So if your duration field had "1" as a value more times than values of "100000", "1" would be the top entry. Probably not what you wanted! 🙂
... View more
09-14-2016
12:41 PM
2 Karma
... | stats c as Count latest(_time) as _time by Host_Name
... View more
09-14-2016
08:08 AM
1 Karma
The extraction works. And the transforms are in the conf and meta files. If there was a problem creating, I don't think either of those things would be true. Ticket opened.
... View more
09-14-2016
07:48 AM
I'm familiar. I'm also accustomed to seeing the objects in the GUI regardless of permissions. These transforms aren't found in the GUI, so permissions can't be adjusted there. Changing object permissions via conf files on the filesystem in a Search Head Cluster is not awesome.
... View more
09-14-2016
07:29 AM
A user created a field transform/extraction through the wizard in the GUI. The field extraction works for him, but he wants to share it. Changing the permissions for the field extraction worked as expected. But when he visits the field transformation screen (Settings -> Fields -> Field transformations), it's empty. As admin user, I cannot see his transforms either. Based on the GUI, they don't exist except as a reference in the Field extraction screen.
On the file system, in $splunk/etc/users/hisusername/app/local/transforms.conf, I see his transforms. I also see them referenced in $splunk/etc/users/hisusername/app/metadata/local.meta.
Splunk 6.4.1
SHC on, 4 members
... View more
09-13-2016
07:57 AM
1 Karma
Good answer. (Missing a double quote in the first eval .)
... View more
09-12-2016
12:55 PM
Can you share the case #?
... View more
09-12-2016
10:39 AM
interesting. It worked on 6.2.5 at least. But it appears to no longer work with 6.4.1. (Having just made the jump from 6.2.5 to 6.4.1 and seeing this break.)
... View more
09-12-2016
09:52 AM
1 Karma
Assuming you were in a good state at some point in the last 4 hours, using the _internal index as an example:
| tstats latest(_time) as _time where sourcetype=splunkd and index=_internal by host sourcetype | where (now()-_time)>600
This will show hosts and sourcetypes that had sent internal splunkd logs, but have not for 10 minutes or more.
... View more
09-12-2016
09:20 AM
Summary indexing doesn't count against your license. Yes, it could be done automatically, but will probably require non-trivial care and feeding.
... View more
09-12-2016
08:56 AM
1 Karma
... | rex "Time Consumed - (?<time_spent>\d+)\sms"
... View more
09-08-2016
02:30 PM
How do distributedSearch groups work with SHC? DO they work with SHC?
... View more
09-08-2016
01:45 PM
... | rex "responseMessage=\s+HTTP/\d+\.\d+\s+(?<status>[^\]]+)\s*\]"
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-07-2021
02:44 PM
|
