About Glenn

Glenn · ‎02-22-2012

This looks good...

Glenn · ‎02-21-2012

Great! It works perfectly, when combined with bins=300 or similar. I'm glad I asked now. It doesn't seem to be mentioned in the 4.3 documentation anywhere for timechart though... You know what, I actually had tried minspan in the random hope it existed, but our production instance is 4.1.5 and I guess minspan doesn't exist on that version. It works on our test 4.3 instance.

Glenn · ‎02-21-2012

Thanks, but this doesn't work because for a short time period, such as "last 60 mins", you just get a single point in the chart.

Glenn · ‎02-21-2012

Is there any way to force the client to initiate a poll? Say your check in period was 1 day, but you don't want to wait for it to check in for an urgent change.

Glenn · ‎02-21-2012

I also would like this functionality. We should both raise enhancement requests for it.

Glenn · ‎02-21-2012

I also would like this functionality. We should both raise enhancement requests for it.

Glenn · ‎02-20-2012

No. It looks like a do-it-ourselves job. I haven't done it myself yet due to other priorities.

Glenn · ‎02-20-2012

I have summary search creating summarised data (number of accesses in an access log) once per minute (we are specifying span=1m in the sitimechart command). My users will want to be able to view a timechart for this data covering data periods between last 60 minutes and last 30 days, or even longer. It would be nice to be able to provide a chart that is as granular as possible - but no more granular than 1 minute, or else you get the spikes/valleys in the time chart. For example, specifying bins=300 is great for all time ranges above "last 60 minutes", you get good granularity in the chart. If the user selects "last 60 mins" from the time range, timechart decides to use a 30 second span, so every second point has no data and the chart "breaks". Using a smaller "bins" value like 150 fixes the "last 60 mins" time period, but means that longer time period, such as "last 7 days" reverts to a 1 point per day, which is pretty useless. Being able to set the minimum granularity (ie. to the equivalent span of the summary search) would be an excellent feature when it comes to summary dashboards. PS. The documentation's claim that bins=300 is the default option for timechart appears to be wrong. You get much fewer bins by default, and if you specify bins=300 the span/chart changes. Test 4.1.5 and 4.3. It looks like someone spotted this a long time ago at http://splunk-base.splunk.com/answers/22499/timechart-using-too-few-bins

Glenn · ‎02-17-2012

I know nothing about how to create desktop widgets, but all it needs to do is be able to display an iFrame which must be fairly basic functionality. Then it can just load the Splunk view for display, either without authenticating, or using SSO. See http://docs.splunk.com/Documentation/Splunk/4.3/Developer/3rdParty

Glenn · ‎02-17-2012

Hi, I am using a props/transforms TRANSFORM to add the source (log file) name to the _raw log event line. props.conf: [GC_throughput] TRANSFORMS-GC_throughput = GC_add_source transforms.conf [GC_add_source] SOURCE_KEY = MetaData:Source REGEX = ^source::(.*)$ FORMAT = $1 $0 DEST_KEY = _raw For some reason an "extra", event is being created on the Splunk server which is empty apart from the added source field. It doesn't even have a timestamp or anything, so is given a timestamp at the time it was indexed. Ie. when not using the props/transforms, there are two events: 2012-02-17T13:19:43.101+0000: 1906587.847: [GC [PSYoungGen: 261184K->608K(261440K)] 422309K->161797K(1047872K), 0.0133890 secs] 2012-02-17T12:45:13.623+0000: 1904518.369: [GC [PSYoungGen: 261024K->384K(261504K)] 422093K->161509K(1047936K), 0.0166770 secs] [Times: user=0.01 sys=0.00, real=0.01 secs] When I use the props/transform: /tmp/verboseSunGC.log /tmp/verboseSunGC.log 2012-02-17T13:19:43.101+0000: 1906587.847: [GC [PSYoungGen: 261184K->608K(261440K)] 422309K->161797K(1047872K), 0.0133890 secs] /tmp/verboseSunGC.log 2012-02-17T12:45:13.623+0000: 1904518.369: [GC [PSYoungGen: 261024K->384K(261504K)] 422093K->161509K(1047936K), 0.0166770 secs] [Times: user=0.01 sys=0.00, real=0.01 secs] Why is this, and/or what am I doing wrong?

Glenn · ‎02-17-2012

ALSO it is not actually necessary for me to add the host value to the _raw log line for my use case, because the syslog forwarding part of Splunk includes the original hostname (where the log was read from) in the syslog headers. I just need the source path.

Glenn · ‎02-16-2012

I got it working. I had misread the documentation and didn't realise that the $0 variable applied to DEST_KEYs other than _meta. These are the props.conf and transforms.conf entries that turn this: 2012-02-16T17:24:20.535+0000: 546116.043: [GC [PSYoungGen: 516768K->3008K(519104K)] 610387K->97883K(2091968K), 0.0173060 secs] Into this: vrtstspk001.iggroup.local /tmp/gc_throughput.log3 2012-02-16T17:24:20.535+0000: 546116.043: [GC [PSYoungGen: 516768K->3008K(519104K)] 610387K->97883K(2091968K), 0.0173060 secs] props.conf: [GC_throughput] TRANSFORMS-GC_throughput = GC_add_source, GC_add_host transforms.conf: [GC_add_host] SOURCE_KEY = MetaData:Host REGEX = ^host::(.*)$ FORMAT = $1 $0 DEST_KEY = _raw [GC_add_source] SOURCE_KEY = MetaData:Source REGEX = ^source::(.*)$ FORMAT = $1 $0 DEST_KEY = _raw It would be even better if I could do both the source and host within the same transform...

Glenn · ‎02-16-2012

I've managed to see what I think is the entire contents of _meta by writing it to a field with this transform: [GC_add_host] SOURCE_KEY = _meta REGEX = (.*) FORMAT = $0 testinghost::"$1" DEST_KEY = _meta It looks like this: testinghost=timestartpos::0 timeendpos::28 _subsecond::.842 date_second::24 date_hour::15 date_minute::43 date_year::2012 date_month::february date_mday::16 date_wday::thursday date_zone::0 Which doesnt even include the _raw field. So it looks like my idea to rewrite _raw within _meta will not work, as _raw is not there to rewrite.

Glenn · ‎02-16-2012

I need to be able to add some information from the Splunk metadata (host and source) into the raw log. I'm looking at using a props/transforms to prepend the host and source from metadata) to the _raw log line (which is hopefully what is forwarded when using splunk to forward to syslog). eg. Transforming _raw from: 2012-02-08T05:59:02.783+0000: 357044.868: [GC [PSYoungGen: 517888K->1904K(521088K)] 616370K->100386K(2093952K), 0.0038650 secs] [Times: user=0.04 sys=0.00, real=0.00 secs] To: myhostname.domain /var/log/gc_throughput.log 2012-02-08T05:59:02.783+0000: 357044.868: [GC [PSYoungGen: 517888K->1904K(521088K)] 616370K->100386K(2093952K), 0.0038650 secs] [Times: user=0.04 sys=0.00, real=0.00 secs] I can see how to add info to the start of _raw, but as far as I can tell I can only work off a single source field. If I use a SOURCE_KEY of MetaData:Host and DEST_KEY of _raw, I have no record of the original contents of _raw to prepend to. If I use SOURCE_KEY of _raw, obviously I can't capture the hostname. eg. This will just overwrite _raw with the hostname, losing the rest of the log line, unless I can reference the existing value of _raw somehow. [GC_add_host_source] SOURCE_KEY = MetaData:Host REGEX = (?m)^(.*)$ FORMAT = $1 DEST_KEY = _raw One idea is to use a SOURCE_KEY and DEST_KEY of _meta and rewrite the whole meta line, which afaik includes the _raw field, but then I need to know what the original meta line looks like, especially the ordering of the meta fields. Does anyone know how to do this? Background, if you are interested: Splunk has been tasked with forwarding certain logs to a syslog-ng receiver, where a custom reporting tool runs. However, the syslog-ng server needs to be able to filter the forwarded logs somehow in order to put them into different files on the filesystem. I have managed to get splunk to forward the logs in raw syslog format, but the raw logs do not contain any information with which to filter on. I want to add identifying info to the log line for the syslog-ng receiver to work with.

Glenn · ‎02-15-2012

Hi, We need to calculate mean, median, perc95 and stdev statistics for multiple fields from a huge log every day. Each search takes a long time, and we plan to use summary indexing to record the stats. We have encountered a problem when trying to come up with the summary search syntax. We originally tried to use a search like this: eventtype="Livehosts" sourcetype="WLSDealStats" dealToConfirm confirm NOT manualDealResponse | ua2os | geoip client_address | strcat lsHwPlatform "_" lsOperatingSystem "_" lsMaxDelayMillis lsConfigType | stats mean(totalTime) median(totalTime) perc95(totalTime) stdev(totalTime) mean(initialDealResponse) median(initialDealResponse) perc95(initialDealResponse) stdev(initialDealResponse) by lsConfigType web_site_id browser client_address_countryname However, this produces quite a large table, containing a stats entry for each possible combination of all of the by clauses, eg. lsConfigType web_site_id browser client_address_countryname mean(totalTime) … G5_RH5_50 aum Chrome Europe 556 … G5_RH5_50 aum Chrome France 637.8 … G5_RH5_50 aum Chrome Netherlands 732.4 … G5_RH5_50 aum Chrome United Kingdom 677.653846 … G5_RH5_50 aum Firefox 1 Europe 2493.333333 … G5_RH5_50 aum Firefox 1 France 616.857143 … G5_RH5_50 aum Firefox 1 Netherlands 889 … G5_RH5_50 aum Firefox 1 United Kingdom 1252.6 … G5_RH5_50 aum Firefox 3 Netherlands 526.5 … G5_RH5_50 aum Firefox 3 United Kingdom 571.75 … It is not actually possible to work out the overall mean(totalTime) for say, the Chrome browser type from this information. What we really need is a table containing only the overall stats for each of the specified fields, not each combination of all possible fields OR a way to run different post-processing over a data set multiple times (I know post processing is available within a dashboard, but remember this is for summary searching, not to mention it is limited to 10k results). An example could be this, which is like four separate tables merged together: mean(totalTime) median(totalTime) web_site_id aum 123 234 web_site_id sgx 345 456 client_address_countryname Europe etc … client_address_countryname France … … client_address_countryname United Kingdom … … browser Chrome … … browser Firefox 1 … … browser Firefox 3 … … We can run the search four times, each time specifying a single by clause only, but this seems inefficient as we have to search over the same (large) data set four times just to do different stats calculations. Also it is not scalable - every time someone wants to report on a new field, we have to create new searches for it rather than just add the field to a single search.

Glenn · ‎12-08-2011

Justin Azoff has posted a very useful user agent translator script/custom splunk command here: https://github.com/JustinAzoff/splunk-scripts/blob/master/ua2os.py Translates the horrible useragent string into browser, os type and architecture. It works very well.

Glenn · ‎12-02-2011

Yes, you are correct. Sorry!

Glenn · ‎12-02-2011

Try using the <html> tag in your xml above your chart (works in basic xml), and add your text to it. The html tag is just a way to imbed html into the dashboard, which is fine for adding instructions or descriptions. eg. <row> <html><p><strong>Your bold text here.</strong> Your normal text here.</p><html> </row>

Glenn · ‎12-02-2011

...or do I need to raise an enhancement request? Allowing only horizontal text labels only on x-axis point labels means that more often than not for the kinds of things I am charting, labels are compressed to a useless "start...end" name. A common example is when creating distribution graphs with buckets named like "0-100", "1000-2000" etc. When you have more than a few of these, the number (and length) of the labels required means that the labels are unreadably truncated to "0...00" or "10...0", and you have to mouse over a data point on the chart to see what the value is. Having a vertical label option would solve all of these problems as you then have a very small fixed width for all x-axis labels (ie. the height of one character).

Glenn · ‎12-02-2011

You're a lifesaver!

Glenn · ‎11-23-2011

What about if it is a form, not a view (no view tag)?

Glenn · ‎11-15-2011

Hi, I don't think this works. It gives me the same kind of picture as before - empty buckets before the first one (ie. 0-100, 100-200 if first result is in 200-300 bucket) are not created or charted.

Glenn · ‎11-14-2011

I am trying to create a histogram/distribution graph of deal durations, for comparison between where the user is accessing a website from. This search works more or less OK: "search that returns reults with deal durations in field totalTime" | chart count(_raw) as "Num Deals" by totalTime span=100 totalTime is returned as an integer 0-3000, meaning ideally I would have 30 buckets. My problem is that some locations are very slow, and there are no durations below 800. The chart command does not create any rows for durations lower than 800 (ie. 0-100, 100-200, 200-300 etc up to 700-800 are all missing). This makes direct comparisons between graphs difficult, as they do not show the same scale. Is there any way to force Splunk to create empty buckets (starting from zero) for charting as per my requirement? Splunk version 4.1.5. Cheers, Glenn

Glenn · ‎11-04-2011

We have new Cisco UCS kit and would like to process its syslogs in Splunk. Has anyone already established a set of field extractions or dashboards that they would like to share? Are there any plans for Splunk to provide any within the product? I think this is likely to be a hardware options that will grow significantly in popularity over time. Example (scrubbed) logs: Oct 26 16:33:02 pgce0-su-0j-b.tia.sn.local : 1001 Oct 26 16:33:02 LON: %OTIS-6-EVENT: [G2140204][054002][transition][internal][] [REX:STAGE:STALE-SUCCESS]: MARY profile configuration on peer fabric(REX-STAGE:rea:bev:OrrgYfpxhgnFowZerley:Peer) Oct 26 16:32:52 pgce0-su-1w-a.tia.sn.local : 1001 Oct 26 15:32:52 VAN: %OTIS-3-PORT_FAILED: [D0047][cleared][port-failed][sys/switch-B/slot-1/switch-ether/port-3] ether port 3 on fabric interconnect B gwyn state: link-up, reason: Link failure or not-connected Oct 26 16:32:52 pgce0-su-1w-a.tia.sn.local : 1001 Oct 26 15:32:52 VAN: %OTIS-3-PORT_FAILED: [D0047][cleared][port-failed][sys/switch-B/slot-1/switch-ether/port-1] ether port 1 on fabric interconnect B gwyn state: link-up, reason: Link failure or not-connected Oct 26 16:32:51 tpr0-su-0j-b.tia.sn.local : 1001 Oct 26 16:32:51 LON: %USER-6-SYSTEM_EVE: checking user:svc_rhonda,!!!!!!!!!!!,03030.000000,01263.000000 - jefferson Oct 26 16:32:51 tpr0-su-0j-b.tia.sn.local : 1001 Oct 26 16:32:51 LON: %USER-6-SYSTEM_EVE: checking user:max-dorinda,$1$K1jNUXPu$1bpsCt0/xDbsWSwrfHXi//,-1.000000,01263.000000 - jefferson Oct 26 16:32:51 tpr0-su-0j-b.tia.sn.local : 1001 Oct 26 16:32:51 LON: %USER-6-SYSTEM_EVE: checking user:admin,$1$lnRiXnQe$VQ0qXvmM0CfaJBU36ZLMk/,-1.000000,01263.000000 - jefferson Oct 26 16:32:51 tpr0-su-0j-b.tia.sn.local : 1001 Oct 26 16:32:51 LON: %USER-6-SYSTEM_EVE: checking user:ronnie,!,-1.000000,01263.000000 - jefferson Oct 26 16:32:51 pgce0-su-0j-b.tia.sn.local : 1001 Oct 26 16:32:51 LON: %OTIS-3-OPERATIONAL_STATE_DOWN: [Y0231][major][operational-state-down][fabric/hal/A/tp-100] hal port-channel 100 on fabric interconnect A gwyn state: failed, reason: No operational members Oct 26 16:32:46 pgce0-su-1w-a.tia.sn.local : 1001 Oct 26 15:32:46 VAN: %OTIS-3-MEMBERSHIP_DOWN: [T0025][cleared][membership-down][fabric/hal/A/tp-101/ai-slot-1-port-3] hal Member 1/3 of Port-Channel 101 on fabric interconnect A is down, membership: down Oct 26 16:32:46 pgce0-su-1w-a.tia.sn.local : 1001 Oct 26 15:32:46 VAN: %OTIS-3-MEMBERSHIP_DOWN: [T0025][cleared][membership-down][fabric/hal/A/tp-101/ai-slot-1-port-1] hal Member 1/1 of Port-Channel 101 on fabric interconnect A is down, membership: down Oct 26 16:32:30 pgce0-su-1w-a.tia.sn.local : 1001 Oct 26 15:32:30 VAN: %OTIS-3-LINK_DOWN: [Y0035][major][link-down][sys/switch-B/slot-1/switch-ether/port-3] ether port 3 on fabric interconnect B gwyn state: link-down, reason: Link failure or not-connected Oct 26 16:32:30 pgce0-su-1w-a.tia.sn.local : 1001 Oct 26 15:32:30 VAN: %OTIS-3-PORT_FAILED: [D0047][major][port-failed][sys/switch-B/slot-1/switch-ether/port-3] ether port 3 on fabric interconnect B gwyn state: link-up, reason: Link failure or not-connected

Glenn · ‎10-24-2011

Does anyone have any experience or opinions about running Splunk with its indexes running over iSCSI? Is iSCSI compatible with Splunk at all? We are talking about 400gb/day across four indexers (which replicate to four standby indexers). We have a 10GBit Cisco Nexus network available, which should allow for quite low latency access. Our iSCSI volumes would be provided by a NetApp filer. Even if performance would not be good enough for the hot or warm buckets, would it be reasonable to store historical data (cold buckets) there?

Posts	156
Solutions	10
Karma Given	101
Karma Received	159
Member Since	‎03-10-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Definitions of the route keys and queueNames for s...

How can I programmatically monitor data model acce...

What impact and level of data availability is expe...

Why is the "Edit" button in the "Indexer Clusterin...

How to configure and distribute KVstore in a Splun...

How does indexer acknowledgement work with indexer...

REST lookup functionality

tsidxstats files created by tscollect - can they j...

Is there a way to set JSON syntax highlighting by ...

Process flow tracing, point to point latency calcu...

Re: Does anyone have Cisco UCS field extractions a...

Re: Is there a way to specify a minimum span for t...

Re: Is there a way to specify a minimum span for t...

Re: Force deployment to clients?

Re: License pools for Indexes rather than Indexers

Re: License pools for Indexes rather than Indexers

Re: Does anyone have Cisco UCS field extractions a...

Is there a way to specify a minimum span for timec...

Re: Splunk widget for desktop environments?

Props/transforms rewrite of _raw is adding a blank...

Re: How can I rewrite/add info from metadata to th...

Re: How can I rewrite/add info from metadata to th...

Re: How can I rewrite/add info from metadata to th...

How can I rewrite/add info from metadata to the co...

Is there a way to produce overall stats "by" multi...

Re: Browser Usage Statistics

Re: adding descriptive text to a chart on a dashbo...

Re: adding descriptive text to a chart on a dashbo...

Is it possible to have vertical text labels on cha...

Re: Charting percentage of a total over time?

Re: How do I get TimeRangePicker to revert to the ...

Re: How can I include zero/empty count buckets in ...

How can I include zero/empty count buckets in tabl...

Does anyone have Cisco UCS field extractions and/o...

Is running Splunk indexes over iSCSI a good idea?

Join the Conversation