Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Paolo_Prigione
Paolo_Prigione
Builder
Member since:
03-30-2010
06-05-2020
Community Statistics
| Posts | 203 |
| Solutions | 46 |
| Karma Given | 52 |
| Karma Received | 224 |
| Member Since | 03-30-2010 |
Activity Feed
- Got Karma for Re: How Can I Verify that All Forwarders Received a Deployed Update?. 09-04-2024 07:36 AM
- Got Karma for Re: current user in search?. 04-05-2024 08:50 AM
- Got Karma for Re: Changing timestamp and sourcetype based on record type. 03-20-2024 02:07 PM
- Got Karma for Re: Can a subsearch return only the value (without the fieldname)?. 07-13-2023 06:02 AM
- Got Karma for Re: Difference between 'show default-hostname' and 'show servername'. 05-16-2023 04:18 AM
- Got Karma for Re: Difference between 'show default-hostname' and 'show servername'. 05-31-2022 08:05 PM
- Got Karma for Re: How to use a field in SingleValue label?. 09-23-2021 03:54 PM
- Got Karma for Re: Difference between 'show default-hostname' and 'show servername'. 05-17-2021 05:30 AM
- Got Karma for Re: How Can I Verify that All Forwarders Received a Deployed Update?. 05-11-2021 05:22 PM
- Got Karma for Re: How can you do OR statements in rex?. 01-27-2021 06:10 AM
- Got Karma for Re: get latest value and timestamp. 09-21-2020 08:19 AM
- Got Karma for Integration of Imperva Database Activity Monitor (DAM)?. 08-10-2020 09:28 AM
- Got Karma for Re: How to remove empty buckets in timechart. 07-16-2020 04:27 PM
- Got Karma for Re: Difference between 'show default-hostname' and 'show servername'. 06-17-2020 05:59 PM
- Karma Re: After upgrading to 6.5.0, KV Store will not start for jcrabb_splunk. 06-05-2020 12:48 AM
- Karma Re: How to prevent Splunk DB Connect 2 from disabling a database connection if the database goes offline briefly? for sni_splunk. 06-05-2020 12:48 AM
- Karma Re: Method to rename field to value of another field for acharlieh. 06-05-2020 12:47 AM
- Got Karma for Re: How to configure Splunk to access and parse AWS GovCloud Cloudtrail logs?. 06-05-2020 12:47 AM
- Got Karma for Re: How to configure Splunk to access and parse AWS GovCloud Cloudtrail logs?. 06-05-2020 12:47 AM
- Got Karma for Re: How to configure Splunk to access and parse AWS GovCloud Cloudtrail logs?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 |
12-20-2011
02:46 AM
Aside of this, in case you will have lookups updated by scheduled searches with the outputlookup command, keep the filename and transforms stanza name consistent (i.e. the same, except for the .csv extensions). I experienced some misbehaviour when the names were not identical
... View more
12-19-2011
02:17 AM
You can't use lookups or tags to INDEX a new field. You can, however, index the segment of the source that is going to be used in lookups.
(I use lookups straight on source for a use case similar to yours and they work very well. I also generate the lookup dinamycally every 15 minutes through a search.)
Back on topic... You'll need props, transforms and fields.conf
props.conf
[your source type]
TRANSFORMS-site = iss_site_code
LOOKUP-site = iss_site_code_lookup site_code OUTPUT site
transforms.conf
[iss_site_code]
SOURCE_KEY = MetaData:Source
REGEX = ...whathever regex applies...W3SVC(\d+)
FORMAT = site_code::$1
WRITE_META = true
[iss_site_code_lookup]
filename = mysites.csv
default_match = n.a.
max_matches = 1
fields.conf
[site_code]
INDEXED = true
... View more
12-19-2011
01:43 AM
8 Karma
Splunk performs field optimization in the hiddenSearch, so the fields you do not explicitly ask for are not carried on to the post processes. Try to add an esplicit | fields ... a t the end of the hiddensearch
<param name="search">NOT platformtype=MOT CALL_END | eval duration=round(callLength/1000) | fields + _time _raw duration appID ...</param>
... View more
12-16-2011
07:44 AM
You have to invoke macros enclosed in backtics `.
index=myapp |timechart count
| `lineartrend(_time, count)`
| `extendtrend(newY, 7)`
| eval low_threshold=5000
| eval high_threshold=50000
| timechart values(count) as events values(newY) as linear_trend values(low_threshold) as low_threshold values(high_threshold) as high_threshold
... View more
12-14-2011
02:47 AM
You could do this only with a scripted, python-based, lookup command. More infos here. But I suggest you to reformat the file, if possible.
If you were to index your lookup file, then you could use a search to "parse" it into key=value pairs, but you would need a way to identify header rows. In the next sample, the file lup.txt is the following:
header1,header2
value1,value2
header3,header4,header5
value3,value4,value5
and this search:
| file /opt/splunkbeta/etc/apps/search/lookups/lup.txt | eval values=_raw | streamstats first(_raw) as header window=1 current=f | search header="head*" | mappy _raw="; ".join(["=".join(t) for t in zip(header.split(","),values.split(","))]) | extract pairdelim="; " kvdelim="="
produces key-value pairs from that file. It assumes headers start with "head*". You could use this to join with your search, or elaborate on that. Note: you need to assign the use_file_operator privilege to take advantage of the file command.
Another way could be to use the multikv command with the multitable option on. But you will have to reformat the file in any case.
... View more
12-14-2011
02:42 AM
Mappy has disappeared from the latest 4.3Beta (out Dec 13th, build 114250). It was in $SPLUNK_HOME/etc/apps/search/bin/mappy.py in the september beta, and is present in the beta docs.
... View more
12-14-2011
01:31 AM
I guess any line is a separate event for you. Try this one, which should extract all the numbers in the row, giving them a name as line, second_number, modaco.
(?i)^[^\[]+\s+\[(?<line>[^\]]+)\]\s+\[(?<second_number>[^\]]+)\]\s+\[(?<modaco>[^\]]+)\]
Edit: if all events are grouped in chunks, and multikv does not to what you want (values might end up being enclosed in square brackets...) then you might want to split them in multiple events first:
| rex max_match=100 "(?m)^(?<rows>.+)$" | mvexpand rows | eval _raw=rows | rex field=rows "(?i)^[^\[]+\s+\[(?<line>[^\]]+)\]\s+\[(?<second_number>[^\]]+)\]\s+\[(?<modaco>[^\]]+)\]"
The | eval _raw=rows is just for ease of reading, but unneeded.
... View more
12-06-2011
03:19 AM
Just wondering: is it possible to forward CEF data to splunk from Logger itself to Splunk? This would limit the effort on the connectors as, I'm told, you need quite a number of them even for small environments
... View more
11-16-2011
04:03 AM
Hi gooza. So, it is possible to configure an Arcsight Connector to send data to a 3rd party receiver in CEF over Syslog format. Thank you very much
... View more
11-16-2011
03:38 AM
Hi, thanks for the reply. Yes, I meant how to configure the Connectors.
... View more
11-16-2011
03:01 AM
The integrating Splunk with Arcsight document, states it is possible to feed Splunk with data coming straight from a Connector. Do you have any idea how this is possible?
The ArcSight website is not as full of infos as Splunk's...
And, yes, I know this might not be the right community, but it's the one I happen to trust.
Paolo
... View more
11-08-2011
02:17 AM
Limits.conf seems to be the reason:
[search]
max_count = <integer>
* The number of events that can be accessible in any given status bucket.
* The last accessible event in a call that takes a base and bounds.
* Defaults to 10000.
In facts, by inspecting the search job, I find :
eventAvailableCount 10000
eventCount 10714
statusBuckets 0
However, I see no easy way to circumvent this, other than disrupting limits.conf with an unreasonably high setting....
... View more
11-07-2011
03:20 PM
I have a form-view (that feeds many panels out of the same searchTemplate) which only displays about 10k to 16k results while the same search, run in the flashtimeline over the same time period shows > 100k....
My search is as simple as this:
tag::eventtype=perform_monitoring | fields + host sourcetype eventtype
Is there any limit to the results returned by a search performed into a view looking only at tag::eventtype?
I am using eventtypes to classify some notable events. Something like:
user login success
user login failure
user provisioning success
user provisioning failure
... and so on.
These eventtypes all have a tag: "perform_monitoring". I created a form view which has a single search to feed all its panels:
<searchTempate>tag::eventtype=perform_monitoring | fields + ...all the necessary fields</searchTempate>
Every single panel has its own:
<searchPostProcess>search eventtype="user login *" | rex field=eventtype "user login (?<result>\w+)" | timechart count by result </searchPostProcess>
However, if I execute this search, say, on the last 24 hours, the results will only show about 2 hours of data, and will always be between 10k and 15k. But if I run the same search on the flashtimeline view, I get > 100k results for the same time period (and same user), and they span over the full 24 hours.
The job manager is telling me the correct earliest time (i.e. 24h ago) and reporting a # of events coherent with what displayed on the form-view. Yet, same search on the flashtimeline shows 10x more results...
I really have no idea why this happens... Do you?
... View more
10-24-2011
03:51 AM
Hi you, viewmakers!
Has anybody had problems with the grouping param of the <row> element? It works on <dashboard> views, but it doesn't on <form>s.
It is mentioned in the docs. I am on Splunk 4.2.3 now.
AdvancedXML is not considered a workaround 🙂
... View more
10-15-2011
04:07 AM
4 Karma
You might have a conflict with the [syslog-host] rule in $SPLUNK_HOME/etc/system/default/transforms.conf, which is called by props.conf as:
[syslog]
....
TRANSFORMS = syslog-host
Maybe your rule is evaluated first, but then its results are overwritten by the default one.
You could try to force an order as:
[syslog]
...
TRANSFORMS =
TRANSFORMS-zz_fix_host = syslog-host, syslog_add_fqdn
Have you inspected your runtime configurations with btool?
splunk btool --debug props list
Other than that, I recall the "-" when used in character classes should be either escaped or at the end of the class itself, otherwise it means a range.
[syslog_add_fqdn]
REGEX = host::([A-Za-z][\w\-]*[A-Za-z0-9])$
FORMAT = host::$1.domain.local
DEST_KEY = MetaData:Host
SOURCE_KEY = MetaData:Host
The write_meta should not be necessary in this case.
... View more
10-10-2011
06:54 AM
ouch... I think Splunk doesn't provide a "| addRAM" command OOTB... 🙂
... View more
10-04-2011
03:50 AM
Hi Paul, we are going to integrate Splunk with a 3rd party product and an early access to the Java SDK would be just wonderful... May I get it as well? Thanks
... View more
09-13-2011
11:47 PM
Hi Nick,
have you tried running it from splunk's cmd line?
splunk cmd python <pathtoyourscript>
Still no luck? Isn't it possible to force your script's logging to happen somewhere else, something like:
import logging
LOG_FILENAME = '/tmp/mylookupscript.log'
LOG_FORMAT = "[%(asctime)s] %(name)s %(levelname)s: %(message)s"
logging.basicConfig(filename=LOG_FILENAME,level=logging.DEBUG,format=LOG_FORMAT)
logger = logging.getLogger('mylookupscript')
... View more
09-13-2011
09:01 AM
2 Karma
Nice tips, but you cannot modify IBM WebSphere's SystemOut that easily (case 2), or have cronjobs scan the log directory any minute to build symlinks for files that are rotated by size and not date (case 3).
... View more
09-01-2011
08:10 AM
You might want to further explore Nick's third suggestion before going this direction.
However, what if you try this search:
sourcetype=applogs error | search yourfield=an_existing_value | table _time yourfield
Does it return values? Do you see your field's column? I.e. is the field correctly extracted and still present in the search results?
In our experience the field picker sometimes does not show fields which apply to a limited subset of the returned events. Indeed, the fields are there and it is possible to use them from the search language.
We haven't tried this yet, but one workaround might be to modify the Flashtimeline view by altering the FieldPicker module's "fields" param like this:
<module name="TitleBar" layoutPanel="viewHeader"/>
<module name="FieldPicker" layoutPanel="sidebar">
<param name="fields">host sourcetype source YOURFIELD</param>
<param name="link">
Good luck
... View more
07-21-2011
02:14 AM
Update, we were able to install it on the C: drive. On 😧 it never worked.
During install, I modified the
$SPLUNK_HOME\etc\splunk-launch.conf
specifying the proper $SPLUNK_HOME and removing the trailing \ as per this bug reported in the 4.2.1 release notes.
Splunk Web fails to start if the SPLUNK_HOME path in splunk-launch.conf ends with a directory delimiter ("/" for Linux or "\" for Windows). (SPL-38054)
... View more
07-21-2011
01:47 AM
Update: Splunk 4.2.1 and 4.2.2 show the same problem. Splunk 4.2 does not even complete the installation as Windows reverts it...
... View more
07-21-2011
01:39 AM
good point....what about converting the timestamps to epoch through the "convert" command, then using them into the "mapped" search as starttimeu and endtimeu?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:02 AM
|
Karma from
Karma given to
