About David

David · ‎08-10-2011

I would hazard a guess that if you looked at your inputs in the manager ( http://YourServer:8000/en-US/manager/RTB/data/inputs ) you would see that Splunk is configured to listen on port 514, so that it can listen to syslog data itself. You can change that there -- keep in mind though, that you may lose the data that Splunk would normally be getting through syslog, so you should find another way of getting that data (either change the sending port, have your application toss it in a log file, or etc.)

David · ‎08-10-2011

Is it possible to set up a dashboard that lets a user kick off a very long search, walk away, and have Splunk send an email once the search completes? Background: I'm writing an internal business facing app. I set up a report builder (select all the fields that you want, how do you want to split the data, how do you want to filter the data, etc.). But one of the options for what they can report on will increase the amount of time required to run the search by about 250X. I'd like to give them the option, should they so desire, of making a search that's going to take 40 minutes to complete, and getting an email once it is complete. I understand the implication of letting users DOS the server -- but is this technically possible?

David · ‎08-09-2011

I have a Sideview based report builder, and I want to provide users the ability to export results, link to results, save reports, and all the wonder that's provided by ResultsActionButtons. The export and save work, and GetLink gives me an ostensibly acceptable url, with the SID, but it doesn't get populated into the SimpleResultsTable. It appears that my first pulldown-populating search is grabbing the search (which it then fails to use). I've tried using ValueSetter to set the SID to empty, set the search to empty, and set the search to , but I can't seem to get it to line up correctly. How should I proceed with this? (Is the answer that there is a less-ugly Sideview version of the ResultsActionButtons?)

David · ‎08-01-2011

Sure. Try this out: index=MyApp earliest=-30d@d latest=@d | timechart span=1d count You could even look at the same time window for each 'day': index=MyApp earliest=-30d@d-1h latest=-1d@d+11h | bucket _time span=24h | stats sum(eval(if((date_hour>=23) OR (date_hour<11),1,0) as TimeWindowCount by _time You could take a step further if you wanted, and compare the current to that time window and toss it in a graph, which would give you a nice line across showing today's data, giving you a point of comparison against the historical: index=MyApp earliest=-30d@d-1h latest=-1d@d+11h | bucket _time span=24h | stats sum(eval(if((date_hour>=23) OR (date_hour<11),1,0))) as TimeWindowCount by _time | appendcols [search index=MyApp earliest="@d-1h" latest="@d+11h" | stats count as RecentWindow] | eventstats max(RecentWindow) as RecentWindow | rename TimeWindowCount as "Historical Count During Window" | rename RecentWindow as "Most Recent Time Window Count" Or you could just use the first one, if that's all you're looking for.

David · ‎08-01-2011

What I would probably do is, in a search string, add: | rex field=_raw "Latency: (?<Field1>\d*) (?<Field2>\d*) (?<Field3>\d*) (?<Field4>\d*) (?<Field5>\d*) (?<Field6>\d*) (?<Field7>\d*) (?<Field8>\d*) (?<Field9>\d*) (?<Field10>\d*) (?<Field11>\d*) (?<Field12>\d*) (?<Field13>\d*) (?<Field14>\d*) (?<Field15>\d*) (?<Field16>\d*)" | table Field1 Field2 Field3 Field4 Field5 Field6 Field7 Field8 Field9 Field10 Field11 Field12 Field13 Field14 Field15 Field16 You can also put the first part in your props.conf, via: [SourceType] EXTRACT-SixteenFields = Latency: (?<Field1>\d*) (?<Field2>\d*) (?<Field3>\d*) (?<Field4>\d*) (?<Field5>\d*) (?<Field6>\d*) (?<Field7>\d*) (?<Field8>\d*) (?<Field9>\d*) (?<Field10>\d*) (?<Field11>\d*) (?<Field12>\d*) (?<Field13>\d*) (?<Field14>\d*) (?<Field15>\d*) (?<Field16>\d*) And then it will be automatically extracted for you.

David · ‎07-27-2011

This should get you what you need: MySearch NOT myField=*

David · ‎07-27-2011

Fortunately, if you need to grab the newest events after running a concurrency (or either way want to wrest control of your search's fate out from the hands of concurrency), you can work around this by creating another time field. I was able to do: MySearch | eval MyTime = _time | concurrency duration=duration output=concurrentevents | dedup MyField sortby -MyTime Without the same issue. Likewise, +MyTime works. Does that get you where you need to be?

David · ‎07-27-2011

I just tried that, and can definitely confirm what you found. If you toss a concurrency before the dedup, it does return the same results as if you had done a sortby +_time. You should be able to override this by doing a sortby -_time, but that search failed for me ("job ... is a zombie and is no longer with us"). This appears to be a bug, where concurrency is doing some sort of work on _time, and breaking dedup.

David · ‎07-26-2011

I think you will find the sortby parameter to do this for you. YourSearch | dedup session_id sortby +_time Check out the docs for more ways you can tweak dedup: http://www.splunk.com/base/Documentation/latest/SearchReference/Dedup

David · ‎07-26-2011

Absolutely. The most unobtrusive way to do this might be with a select box, and setting intentions. (Perhaps someone else can jump in to verify that?) Alternatively, you could add it to the context by overriding something in application.js (which is more complex). A third way would be to use Sideview Utils, which contains the ValueSetter module that makes this process exceedingly easy. Switching to sideview is a relatively large project if you already have a lot of advanced XML out there, but relatively minor if you're just starting into the world of Advanced XML. (And it will significantly increase the functionality offered by Splunk overall, to boot).

David · ‎07-22-2011

Alright. Looks like I've got some fun times ahead of me!

David · ‎07-22-2011

I think you can't drilldown from a SingleValue module in the way you're looking for. Take a look at this question: http://splunk-base.splunk.com/answers/11152/drilldown-link-in-dashboard It might be a long road to walk, but you can probably get what you need by crafting your search into a simpleresultstable with the columns CPU, Disk, etc., so you can drilldown that way. It's much less visually attractive, though, obviously. This might also help you get where you need to go (though it uses Sideview Utils, which is very valuable, but takes some time to learn): http://splunk-base.splunk.com/answers/25761/how-to-use-redirector-with-singlevalue

David · ‎07-22-2011

I traditionally set the color of a line on a FlashChart via the charting.fieldColors option. But in this scenario, I'm setting the name of the field being charted dynamically via a PullDown. I could hard-code all possible results, but it would be 62 field/color pairings for this use case. Is it possible to set this dynamically? I tried tossing a $PullDown.label$ into the charting.fieldColors, but to no avail. Any other way?

David · ‎07-22-2011

Of course, that doesn't answer the part of your question for separating the example from the com, or the example from the co.uk, or any other random gtlds. I think at this point, that requires an enormous, enormous list of possible gtlds.

David · ‎07-22-2011

Excellent! I'm glad to hear that.

David · ‎07-20-2011

You should be able to use eval and relative_time to sort this one out: status=Finished | stats sum(eval(if(_time > relative_time(now(), "-5m"),1,0))) as 5mins, sum(eval(if(_time > relative_time(now(), "-30m"),1,0))) as 30mins, sum(eval(if(_time > relative_time(now(), "-60m"),1,0))) as 60mins, sum(eval(if(_time > relative_time(now(), "-24h"),1,0))) as 24hrs by JobType Let me know if that works.

David · ‎07-20-2011

Excellent! I'm glad to hear it.

David · ‎07-14-2011

With an overnight of waiting, it turns out the answer is just that the 100% is not necessarily 100% for big jobs. The jobs ended up processing for another two and a half hours after they showed Running (100%) , and then finally completing. The Job size here was 782 mb, with ~91 million events, so I would guess that's just a facet of big jobs being challenging to finish.

David · ‎07-13-2011

I've set up an EC2 cluster with 19 indexers and 1 Search Head. I've loaded a large amount of data on the indexers, and I'm now backfilling a summary index. I executed the following command: nohup ./splunk cmd python fill_summary_index.py -app MyApp -name "summary_data_daily" -et -6w@d -lt @d -j 2 -auth admin:mycredentials -owner admin & ... 4 hours ago. The job report shows the searches at status Running (100%) , with runtimes around 1 hour 40 minutes. It hasn't completed the search, and it hasn't started searches for any of the following days. I looked through the _internal logs, and didn't see any signs of why it's happening. Any ideas?

David · ‎07-13-2011

Perhaps try "Host:\s(?<web_host>[^\<]*" ? [^ABC]* will find match any string until it hits either an A, B or C, and I've found it works very well for Splunk Regexs. I would assume you have to escape a <, but potentially you can try "Host:\s(?<web_host>[^<]*" as well.

David · ‎07-12-2011

I have gone with Option 1, myself. The biggest problem with option 2 is that when users are looking at the raw event data (e.g., if they will ever have any sort of raw search capability), they will be totally lost when they try to do any field manipulations. As it came about in my app, I have ridiculously unusable field names (very long to type). When I wrote my summary indexing, I shortened the names significantly (numberOfUnresolvedCountersInLastHour -> NumUnresolvedCounters). I then added aliases to for the raw data, so that users could search either by the field names they put in there, or by the names in my summary indexing. A valid critique of this is that maintaining two sets of field names can confuse users no matter what -- if they build search terms on the long field names from the raw data, then try to apply that to the summary indexed data, they'll have problems lest I alias my summary data in the other direction, as well. In my particular scenario, using raw data is nigh suicidal for anyone not fully aware of the intricacies of Splunk, so it's a pretty minimal risk. Obviously, the only "real" solution is to alter the _raw field (impossible) or alter the source data. My two cents.

David · ‎07-05-2011

I usually opt for one-shotting the input back into the database after issuing a delete. See here for more: http://splunk-base.splunk.com/answers/919/what-is-the-best-way-to-load-archived-logs If you're in the scenario I recently was, of needing to bring in a very large number of individual files, you can also use xargs find /path/to/YourLogDirectory/ | xargs -n 1 -I xxx /opt/splunk/bin/splunk add oneshot xxx -index main -sourcetype YourSourceType -auth admin:changeme

David · ‎05-31-2011

I feel like there should be an easy answer for this, but that my brain isn't finding it, so hopefully someone can reprieve me. Suppose I have a log with the processing time for a number of URLs, across a number of servers. I want to toss into a summary index the top 10 longest running URLs per server, so I can later use it in a subsearch for host=foo. In essence, this could work if top supported it: MySearch earliest=-1d@d latest=@d | bucket _time span=1d | stats sum(ProcessTime) as ProcessTime by URL, host | top limit=10 labelField=URL ProcessTime by host | stats values(URL) by host This also feels like something that could work if stats supported it: MySearch earliest=-1d@d latest=@d | bucket _time span=1d | stats limit=10 sum(ProcessTime) as ProcessTime by URL, host | stats values(URL) by host How can I do what I'm trying to do?

David · ‎05-20-2011

Hmmm. Interesting. This seems to be timing out after just a minute and a half or so. I'm sure that subsearches have been done longer than that, before! Would splunkd be returning status before the search completes, but it's just hanging on that process? As for the search, there are many better ways, and most of them we do regularly. What I'm trying to do is provide the end users an ability to run exactly the search they normally do with summary indexes off the raw data, if they need to. (i.e., "It'll take 15 minutes, but you know it will be authoritatively accurate.")

David · ‎05-20-2011

I have a particular use that requires very long subsearches, running potentially for 15 minutes. Of course, my subsearch normally auto-finalizes after 60 seconds. I modified my limits.conf as such: [subsearch] # maximum number of results to return from a subsearch maxout = 100000 # maximum number of seconds to run a subsearch before finalizing maxtime = 1500 # time to cache a given subsearch's results ttl = 75000 But now, whenever I run my search, it times out with the following error: Timed out waiting for status to become available on job=1305920559.2 When I remove the lines from $SPLUNK_HOME/etc/system/local/limits.conf, it goes back to autofinalizing. Any ideas? I'm running 4.2.0. Further reading: 2011-05-20 15:42:33,256 INFO [4dd6c429401c37450] utility:59 - name=javascript, class=Splunk.Session, language=en-US, product=Gecko, appVersion=5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24, platform=Win32, vendor=Google Inc., appCodeName=Mozilla, appName=Netscape, productSub=20030107, userAgent=Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24, availTop=0, pixelDepth=32, availHeight=994, height=1024, width=1280, colorDepth=32, availWidth=1280, availLeft=0, documentURL=http://myServer:8000/en-US/app/MyApp/flashtimeline, documentReferrer=http://MyServer:8000/en-US/account/login?return_to=%2Fen US%2Fapp%2FMyApp%2Fflashtimeline, flash=10.2.154, Splunk.Session.START_EVENT fired @Fri May 20 2011 12:42:32 GMT-0700 (Pacific Daylight Time) 2011-05-20 15:44:10,003 ERROR [4dd6c42fad20eaf90] search:167 - Timed out waiting for status to become available on job=1305920559.2 Traceback (most recent call last): File "/opt/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/controllers/search.py", line 160, in dispatchJob job = splunk.search.dispatch(q, sessionKey=cherrypy.session['sessionKey'], **options) File "/opt/splunk/lib/python2.6/site-packages/splunk/search/__init__.py", line 287, in dispatch result = SearchJob(sid, hostPath, sessionKey, namespace, owner, dispatchArgs=args) File "/opt/splunk/lib/python2.6/site-packages/splunk/search/__init__.py", line 486, in __init__ self._getStatus(True) File "/opt/splunk/lib/python2.6/site-packages/splunk/search/__init__.py", line 829, in _getStatus raise splunk.SplunkdException, 'Timed out waiting for status to become available on job=%s' % self.id SplunkdException: Timed out waiting for status to become available on job=1305920559.2 2011-05-20 15:44:10,011 ERROR [4dd6c4693fc62bd0] utility:59 - name=javascript, class=Splunk.Error, lineNumber=13051, message=Uncaught Error: INVALID_STATE_ERR: DOM Exception 11, fileName=http://MyServer:8000/en-US/static/@96430.174/js/common.min.js

Posts	472
Solutions	109
Karma Given	283
Karma Received	351
Member Since	‎07-15-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

kvstore query via Python SDK on Windows is slow

How To Run Python On App Install

How Do I Map Splunk Security Content to MITRE ATT&...

sqlite3 required in NLTK Wrapper - Sentiment Analy...

Splunk Security Essentials looks weird / broken / ...

How do I know which token in a dashboard is not se...

Adjust ES Urgency based on Risk

Has anyone Splunked Trello data?

What's the Simplest Modal Pop-Up in Splunk?

SplunkJS with SimpleXML Dashboard: How to get a se...

Re: how to change SplunkD port since it has utilis...

Sending Link Once Search Completes

Using ResultsActionButtons with Sideview

Re: query daily event count for past 30 days

Re: Can't Extract Multiple Custom Fields

Re: Field value not assigned

Re: Using dedup to keep the oldest events

Re: Using dedup to keep the oldest events

Re: Using dedup to keep the oldest events

Re: Can you add a constant variable to advanced xm...

Re: Setting FlashChart Line Color Based on Pulldow...

Re: Cant figure out how to make a singleValue dril...

Setting FlashChart Line Color Based on Pulldown La...

Re: Regex: Issue with domain name extraction from ...

Re: Display count for multiple time increments

Re: Display count for multiple time increments

Re: regex and rex issue advise for extraction of h...

Re: Summary Index Backfill Jobs Stuck

Summary Index Backfill Jobs Stuck

Re: regex and rex issue advise for extraction of h...

Re: Best practice for using the Common Information...

Re: What is the best method to reindex the file af...

Using top with Multiple Fields

Re: Timed out waiting for status to become availab...

Timed out waiting for status to become available

Join the Conversation