Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About twinspop
twinspop
Influencer
Member since:
06-09-2010
04-07-2021
Community Statistics
| Posts | 609 |
| Solutions | 72 |
| Karma Given | 384 |
| Karma Received | 232 |
| Member Since | 06-09-2010 |
Activity Feed
- Got Karma for Re: Why aren't defined field transformations showing in the GUI?. 09-09-2025 04:40 AM
- Got Karma for Re: Why is my log file sometimes ignored?. 05-19-2025 02:49 PM
- Got Karma for Re: How can I show the time of the last event in a stats by count table?. 12-11-2024 08:35 PM
- Got Karma for Re: Search to Identify when a host stops sending logs to Splunk. 10-09-2024 12:04 AM
- Got Karma for Re: Logging multiple sources from Docker with HEC: Are multiple sourcetypes possible?. 04-09-2024 06:41 AM
- Got Karma for Logging multiple sources from Docker with HEC: Are multiple sourcetypes possible?. 04-09-2024 06:41 AM
- Got Karma for Re: Logging multiple sources from Docker with HEC: Are multiple sourcetypes possible?. 04-09-2024 06:41 AM
- Got Karma for Re: How do I remove a dash (-) from the Account_Name field?. 02-22-2024 08:53 AM
- Got Karma for Re: How to configure props.conf for a Unix timestamp in a JSON log file?. 01-20-2024 09:06 AM
- Got Karma for Re: Why is my search head cluster captain logging KV Store replication errors?. 06-08-2023 12:21 PM
- Got Karma for Is there a way to convert a scheduled report to an alert? (6.6.3). 05-04-2023 03:51 PM
- Got Karma for Re: WinEventLog inputs: Why does current_only=1 skip server reboot events?. 03-15-2023 12:41 PM
- Got Karma for Re: How to change '_time'? _time is by default picking first alphabetical date column (Assigned) and doing +05:30. 09-30-2022 04:56 AM
- Posted Kafka add-on: Unable to initialize modular input on All Apps and Add-ons. 04-07-2021 07:52 AM
- Got Karma for Re: Is there any way to monitor CPU on Mac OS?. 03-20-2021 07:11 AM
- Got Karma for Re: With 8.1.2 or later should we still use an HEC tier on HWFs?. 03-08-2021 07:40 AM
- Posted Re: With 8.1.2 or later should we still use an HEC tier on HWFs? on Getting Data In. 03-05-2021 05:20 PM
- Posted With 8.1.2 or later should we still use an HEC tier on HWFs? on Getting Data In. 03-05-2021 05:19 PM
- Got Karma for Is there a way to convert a scheduled report to an alert? (6.6.3). 02-16-2021 11:23 PM
- Karma Re: Can you create/modify a lookup file via REST API? for 4n0m4l1. 12-15-2020 07:26 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-11-2015
05:32 PM
For any one search id, there are many, sometimes hundreds, of log entries in introspection. Not all of these have CPU entries. Why are some missing? And what does each reading tell me? Since the last time, the CPU was in use X%? What does the normalized reading tell me?
... View more
11-06-2015
10:55 AM
1 Karma
Did you find a solution?
... View more
10-27-2015
03:03 PM
1 Karma
Lesson of the day: Be sure the supporting apps are up to date. In this case, SA_nix was an older version. I removed it, cleanly installed it from the install dir included with the Splunk for UNIX and Linux app... everything works.
... View more
10-23-2015
05:15 PM
Error in internal: 2015-10-23 20:10:55,315 DEBUG [562acc8f0a7f3f40e654d0] _cplogging:55 - [23/Oct/2015:20:10:55] HTTP Traceback (most recent call last):
File "/opt/splunk/lib/python2.7/site-packages/cherrypy/_cprequest.py", line 606, in respond
cherrypy.response.body = self.handler()
File "/opt/splunk/lib/python2.7/site-packages/cherrypy/_cpdispatch.py", line 25, in __call_
return self.callable(*self.args, **self.kwargs)
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/routes.py", line 366, in default
return route.target(self, **kw)
File "", line 1, in
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 38, in rundecs
return fn(*a, **kw)
File "", line 1, in
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 122, in check
return fn(self, *a, **kw)
File "", line 1, in
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 171, in validate_ip
return fn(self, *a, **kw)
File "", line 1, in
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 339, in preform_sso_check
return fn(self, *a, **kw)
File "", line 1, in
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 391, in check_login
return fn(self, *a, **kw)
File "", line 1, in
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 411, in handle_exceptions
return fn(self, *a, **kw)
File "", line 291, in get_hosts
File "/opt/splunk/lib/python2.7/site-packages/splunk/search/init.py", line 302, in dispatch
raise splunk.SearchException, msg['text']
SearchException: metadata_index
... View more
10-23-2015
05:14 PM
Checking the JS Console in chrome, I see: Failed to load resource: the server responded with a status of 500 (Internal Server Error) on URL http://tlmcpdlog.es.ad.adp.com/en-US/custom/splunk_app_for_nix/unixsetup/SA-nix/get_hosts Failed to load resource: the server responded with a status of 500 (Internal Server Error). Digging further
... View more
10-23-2015
04:36 PM
I'm finally giving up on my home built, mediocre performance dashboards and reports, and moving on to the official Splunk for Unix app. Awesome! I can't wait. But wait i must cuz the settings screen is stuck.
I go to Settings -> Categories. I create a new category, double-click it to change the name, and click in whitespace to save it per the instrux. Then I add a group doing the same thing. Now when i click on the new group ("test1"), the "hosts in test1" column is empty as expected. The "hosts not in test1" column says "loading" ... forever. I've tried Safari and Chrome. With ad blockers dropped. In/out of incognito mode.
Splunk for Unix app: 5.0.3 (latest I think)
Search Head: 6.2.4 (single)
indexers: 6.2.4 (just search peers, not clustered)
Splunk TA UNIX: 5.2.0
The other panels work as far as I can tell, but I need the category and group feature.
... View more
09-14-2015
06:13 PM
1 Karma
I'm happy you found a solution. Be careful, by setting the TZ at host level, you are saying that any log that comes from there will be UTC. That very well could be accurate -- just remember it. 🙂
... View more
09-11-2015
08:00 AM
If all your logs of this type are logging in UTC, you should set the TZ option in a props.conf file on the indexer(s), using the sourcetype as the stanza opening. Example
[yoursourcetype]
TZ = GMT
If you have an indexer app, put it in props.conf in that app bundle. Otherwise, you can put in $splunkhome/etc/system/local/props.conf. You'll need to restart the indexer after the change.
... View more
09-10-2015
12:44 PM
1 Karma
Use another stats command with an eventstats thrown in for extra spice:
index=* month=august (day=1 OR day=2) | stats count as Logs by index day month | eventstats sum(Logs) as TotalToolLogs by index day month | stats sum(Logs) AS "Total Logs", list(index) as Tool list(TotalToolLogs) as "Tool Count" by month, day
The first stats does not do any multivalue trickery. The eventstats gets you the totals we'll be referring to briefly, the 2nd stats command uses list() which does not dedup and presents the lists in the order seen.
... View more
09-10-2015
09:05 AM
I would change the regex to match only numbers. As it stands it would match where a hashed card number happens to be 16 chars long.
... View more
09-09-2015
05:19 PM
I've found that the Universal Forwarders are pretty forgiving on version differences. I have 6.1.x indexers receiving data from 6.2.x UFs, as well as 6.2.x indexers receiving from as old as 5.x UFs. Neither show any problems. Downloads are here: http://www.splunk.com/en_us/download/universal-forwarder.html
... View more
09-09-2015
01:28 PM
32-bit forwarders work just fine with 64-bit indexers. (Speaking from experience.)
... View more
09-09-2015
01:24 PM
Is your forwarder talking to a deployment server? Which copy of inputs.conf are you changing?
If you're on a DS, the DS will override your changes as you describe. Best to talk to your Splunk admin. but if you want to get creative, save a fresh inputs.conf file at $splunkhome\etc\apps\MYCUSTOMAPP\local\inputs.conf and put your changes there. Change MYCUSTOMAPP whatever you want as long as it's unique. The DS will not touch apps it doesn't know about.
... View more
09-09-2015
09:27 AM
1 Karma
With the default windows event log sourcetype, it should auto-extract those values into MV fields. Using mvzip , create a single MV field with all the values concatenated within. Then mvexpand on that new field to create 1 event for each combination. Finally, break apart the zipped field and report on the values with stats or similar. Something like this (untested):
... | eval TempMV=mvzip(Name,Description,"|") | eval TempMV=mvzip(TempMV,Boot_Time__Milliseconds_,"|") |
mvexpand TempMV |
rex field=TempMV "(?<AIname>[^\|]+)\|(?<AIdesc>[^\|]+)\|(?<AItime>\d+)" |
table _time SourceName ComputerName AIname AIdesc AItime
EDIT: failed to backslash one of the pipes
... View more
09-09-2015
08:48 AM
1 Karma
Without more info, I'm going to bet it's a timezone issue. Or possibly your servers' time is off? You can check your events' timestamps vs index time by comparing the _time and _indextime fields.
<some search> | eval diff=_time-_indextime | stats max(diff) as max min(diff) as min by host source
Anything more than a few seconds of difference should be concerning. Most often I see multihour differences skewing to the future when a server is logging in UTC, but Splunk is interpreting the time as local (EDT or similar).
... View more
09-09-2015
08:40 AM
2 Karma
Does multikv not work for you?
| stats count | eval _raw="<your data above>" | multikv | fields - _raw count
Seems to work as expected.
... View more
08-06-2015
10:31 AM
1 Karma
I've got a search defined in a simple dashboard:
<search id="jenkins_search">
<query>index=scm sourcetype=jenkins_test_summary test summary| head 1</query>
</search>
And I reference that search further down in the panels. In one of them:
<search base="jenkins_search">
<query>stats last(failures) as Failures by tests</query>
</search>
That works. But if I modify this to include an appendcols command:
<search base="jenkins_search">
<query>stats last(failures) as Failures by tests | appendcols [search index=test | stats count as TOTAL | fields TOTAL]</query>
</search>
The panel fails with the error: "Error in appendcols command: You can only use appendcols after a reporting command (such as stats, chart or timechart)."
REALLY curious... if I click the magnifying glass, bottom left of the panel, to open in search, the entire search works as intended.
Am I missing something, or is this a bug with the postProcess feature? Running on Splunk Enterprise 6.2.4 Linux 64-bit.
Thanks,
Jon
... View more
08-06-2015
09:33 AM
1 Karma
My guess is you're delivering the data via syslog (or syslog-like) services at some point in the data flow. Splunk has the option to disable timestamp prefixing with UDP inputs if you're using Splunk for the UDP input (presumably on the UF):
no_appending_timestamp = [true|false]
jon
... View more
08-06-2015
09:29 AM
I would convert to time first:
some search | eval MyUNIXTime=strptime(Timestamp,"%Y-%m-%d-%H%M%S%6N") | eval MyTime=strftime(MyUNIXTime,"%T")
Where Timestamp is the field containing your original time string.
... View more
07-22-2015
05:31 PM
You are correct. I removed my comment re: SHC and DBXv1 not working together. Thanks!
... View more
05-06-2015
10:05 AM
Until a better solution arrives... Run 2 join subsearches: 1 for the first day and one for the last. Then fillnulls, then get the delta, and drop the now extra fields.
index=summary Uniques earliest=-7d@d latest=@d+10m|
eval Time=strftime(_time,"%m/%d") |
chart last(Uniques) over GUID by Time |
join type=outer GUID [ search index=summary Uniques earliest=-7d@d latest=-6d@d | stats last(Uniques) as FIRSTDAY ] |
join type=outer GUID [ search index=summary Uniques earliest=-1d@d latest=@d | stats last(Uniques) as LASTDAY ] |
fillnull |
eval Delta=LASTDAY-FIRSTDAY |
fields - LASTDAY FIRSTDAY
... View more
05-06-2015
09:47 AM
rex works on _raw by default. Once we create the chart _raw is null. So I don't think rex will work. (In any case, it doesn't work as presented.) Thanks for trying tho.
... View more
05-06-2015
07:41 AM
Negative, Ghostrider. Your delta is comparing times. I want a delta of the unique user count between the first column and the last column. (And your column names end up with "firstTime:dd/mm" and "last(Uniques):dd/mm" so the eval for the time-based Delta fails.)
... View more
05-06-2015
07:02 AM
Tried to draw some table action. Failed. See attached image of what it looks like before I hit submit.
... View more
05-05-2015
06:15 PM
alt textI've got daily searches dumping unique user counts by GUID into a summary index. My example search:
index=summary Uniques earliest=-7d@d latest=@d+10m|
eval Time=strftime(_time,"%m/%d") |
chart last(Uniques) over GUID by Time |
fillnull
This produces a table with 7 days ("mm/dd") across the top, GUIDs down the left, and unique user counts in the cells.
GUID 04/29 04/30 05/01 05/02 05/03 05/04 05/05
foobar 0 12 20 15 30 12 40
barfoo 10 11 24 11 38 22 52
I'd like to add a column to the far right for Delta, showing the change from the FIRST column (the earliest day) and the LAST column (the latest day).
GUID 04/29 04/30 05/01 05/02 05/03 05/04 05/05 Delta
foobar 0 12 20 15 30 12 40 40
barfoo 10 11 24 11 38 22 52 42
Using stats with earliest() and latest() earlier in the chain doesn't work because nulls are there for GUIDs that didn't exist, so the eval is comparing the first non-null value, not a zero like I want. Once I fill the nulls, the table is already made and the column names are dynamic. An outer join subsearch limited to the earliest days might do it? Seems like a messy solution, if it would even work. There's gotta be a better way... maybe?
Thanks,
Jon
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-07-2021
02:44 PM
|
