About David

David · ‎02-25-2011

Take a look at this Splunk Answers: http://answers.splunk.com/questions/1829/splunk-searches-to-be-multithreaded-in-a-single-box The short answer is that Splunk as a system is multi-threaded, but there are some Splunk processes that are not. Notably: indexing is multi-threaded, searches aren't. As gkanapathy mentions below, each search will use a single process and thread, so if you have 12 simultaneous searches, and a high indexing load, Splunk itself could use 16 threads. Perhaps an engineer can provide guidance if there is anything particular to SPARC systems, but I believe that link is representative.

David · ‎02-25-2011

The first one is easy. You can schedule a search for eventtype=xy and then send an email if that happens. The second one you might need to explain a bit more on, but it sounds like you should be able to do something with localize. Check out the following link, and if that doesn't get you where you need to be, can you give an example of the initial event and the follow-up event? http://answers.splunk.com/questions/2602/can-splunk-filter-match-events-and-bring-back-neighbouring-events-like-gnu-grep

David · ‎02-25-2011

If you've gotten this far, I would extract out just the Fan Number, and then concatenate things through. E.g., YourSearch | rex field=FAN "(?<FanNum>\d*)$" | eval FanName = "Fan" . FanNum | stats first(Status) by FanName, YourHostField This would pull out the most recent status, and should give you a table with the three columns you're looking for. Looking again at your question, this would give you three columns, instead of three rows, but that should even make it scalable for more devices. Note that you need to extract the host somehow -- you should have that via another extracted field, or the host field, or the IP in the log, or what have you. Let me know if that works for you.

David · ‎02-24-2011

With the current setup, search heads are totally independent. I believe it's in the roadmap to do more of a clustering setup, but for now, you just need to mirror your authentication.conf (and authorization.conf as appropriate). I'm not sure when the "cluster-esque" setup will arrive, though. And yes, I don't think there should be any issues setting up different search heads to use totally different authentication schemes. It's probably best to test this out before investing too much time / money though 😉

David · ‎02-24-2011

Absolutely. I'd try the instructions provided here: http://answers.splunk.com/questions/397/how-to-configure-ssl-for-forwarding-and-receiving-data

David · ‎02-22-2011

The only suggestion I can offer, having played a little bit with the app, is that potentially it's not the Username and Password, but the IP, firewall, or etc., that's causing the problem. It says that it can't log in with that username and password -- not necessarily that the username and password is the problem. I think it would normally respond with a better error message if it is a connection difficulty, but who knows. Have you tried running a packet capture to see exactly what's being sent over the wire, and compare that to what happens from Thunderbird? Hope you get it sorted out.

David · ‎02-18-2011

I think the following should give you what you want. host="SOURCE1" PROCESSFLAG=SUCCESS | timechart span="1h" count by PROCESSFLAG | join _time [search host="SOURCE2" NOT ORDER_STATUS ORDER_STATUS="Entered" OR ORDER_STATUS="Booked" | timechart span="1h" count by ORDER_STATUS ] Let me know if that works out.

David · ‎02-18-2011

You can always use a rex to pull out a subset of the field. For example, if you just want to pull the contents of the useragent field before the /, you could do the following: YourSearch | rex field=useragent "^(?<GeneralAgent>.*?)/" | stats count by GeneralAgent If you don't have the useragent already pulled out, you could expand that: YourSearch | rex field=_raw "UserAgent=(?<GeneralAgent>.*?)/" | stats count by GeneralAgent You can then move that extraction into your props.conf to make it permanent.

David · ‎02-17-2011

I think the best place to start would be the UI Examples app: http://splunkbase.splunk.com/apps/All/4.x/Add-On/app:Splunk+UI+examples+app+for+4.1%2B That should have plenty of examples of how to work intentions for this type of a situation. Specifically, I'd take a look at form3 (/en-US/app/ui_examples/form3) which is labeled "inverted flow, panel-defined search" in the nav, and "Multi-panel linked form search" on the actual page. That sounds like what you want to do. Hope that's helpful.

David · ‎02-17-2011

I would probably put this into a dashboard so you could run the following search: YourSearch | eval Match=if(var1=var2,"Match","No Match") And then do post processing for the number of matches and mismatches: | timechart count by Match and for the variations of Var1: | timechart distinct_count(var1) I was trying to find a way to put it all into one search, but couldn't see an easy way to allow it to chart over time. For a one time result, you could use the following: YourSearch | eval Match=if(var1=var2,"Match","No Match") | eventstats distinct_count(var1) as Var1Count | stats count, first(Var1Count) by Match It's a bit hokey, though. Perhaps someone will take it the rest of the way.

David · ‎02-17-2011

Have you tried using the /quiet flag? http://www.splunk.com/base/Documentation/latest/installation/installonWindowsviathecommandline Alternatively, I would try with this. Not sure if it works on Windows like it does on Linux, though: %SPLUNK_HOME%/bin/splunk start --accept-license --answer-yes

David · ‎02-17-2011

Holding down ctrl while clicking on an entry in your search window should open a new window/tab. I just verified that it works in Chrome, Firefox and IE on Windows 7. I should have included this initially, but on a Mac, you hold the Apple button and click to open the link in a new tab. This is a feature of the browser, rather than Splunk, so it can be turned off, if the browser allows it. You can test that it works by clicking on a link from Google, or what have you.

David · ‎02-16-2011

I'm running Splunk on a VPS, so I am reverse proxying behind Apache. My web.conf shows the following: [settings] root_endpoint = /splunk tools.proxy.on = True I have configured my imap app appropriately (from bin/getimap.py --debug): DEBUG:root:splunkHostPath=http://localhost:8000/splunk/ But I get errors from the debug: DEBUG:root:decrypted splunk password DEBUG:root:invalid literal for int() with base 10: '8000/splunk' Traceback (most recent call last): File "getimap.py", line 405, in getMailbox latestTime = self.getCacheIDForMailbox(box) File "getimap.py", line 253, in getCacheIDForMailbox splunk.mergeHostPath(self.splunkHostPath, True) File "/opt/splunk/lib/python2.6/site-packages/splunk/__init__.py", line 128, in mergeHostPath setDefault('port', int(port)) ValueError: invalid literal for int() with base 10: '8000/splunk' None I've played around a fair amount with the splunkHostPath setting -- leaving off the /splunk/, leaving off the trailing /, etc., but it doesn't work (there is a 404 error if I leave it off entirely). Is there a way to make this work when a root_endpoint is specified?

David · ‎02-16-2011

I don't believe you can have this automatically happen, natively in Splunk. The user should be able to trigger this with a Ctrl+Click or you can build it into your app with something like sideview_utils (which is a more significant undertaking, albeit rewarding if you're going to build a Splunk app). http://splunkbase.splunk.com/apps/All/4.x/App/app:Sideview+Utils

David · ‎02-15-2011

Ah, I was flipping first and last. Good to know.

David · ‎02-15-2011

You should only get one entry per time period, per host. Maybe some events have the database name capitalized or not? If that's the case, then you could add an | eval EXDB = upper(EXDB) before the timechart. If I'm misreading and you only want a single value overall (e.g., "the most recent free space"), you could always replace the timechart with just | stats last(FreeMB) by EXDB (or avg(), etc.) That would summarize all the values to one number per EXDB, but wouldn't let you see trends. If you're still seeing duplicates, you can paste the results and the query, and I can take a look.

David · ‎02-15-2011

What I gather you're looking to do is track your free exchange database space over time, per database. What I do for this report is run the following search: SearchCriteria | rex field=_raw "The database \"(?<EXDB>.*?)\" has (?<FreeMB>\d*) megabytes of free" | timechart last(FreeMB) by EXDB Doing a timechart last(FreeMB) You need to provide some function for Timechart to run on FreeMB, in the event it has to summarize. (E.g., if you were running it over the last 7 days, it wouldn't summarize at all. But if you were running it over 2 years, it would probably summarize it into months, or two month periods, or what have you.) Depending on your needs, you might want to go with avg() or min() or max() -- last() just shows the most recent event, which is fine since I run this report over a relatively small period of time, and I have a pretty small amount of change in my databases. Notably, with this approach, it doesn't matter how many events you get per day. It will automatically summarize the number of events per database, and only show you a single value. Does that all make sense?

David · ‎02-10-2011

When troubleshooting configuration changes that don't seem to apply, I'm a big fan of frequent restarts and (on linux) "cd /opt/splunk/etc && grep -R sub_business" or (on windows) "cd c:\Program Files\Splunk\etc && findstr /snip sub_business ."

David · ‎02-10-2011

What is the full path to the files you're modifying? Certainly at upgrade, any changes made to files in the "default" directories would be overridden, so maybe that's what's triggering it? Anything in "local" directories shouldn't be overwritten, though.

David · ‎02-10-2011

I'm glad it works. I should improve my point by saying that a "better" approach would probably be to have the Description be something actually useful. For example, in your Lookup table, you could have: ABC,"ABC - Transaction successful" DEF,"DEF - Database Deadlock, Contact Support Immediately!" And then the rest would work just fine. You might change the last query to ...| search Description=* | stats count by FieldA to maintain statistics about FieldA, from from a methodology perspective, if we're adding data we should add useful data. Anyway -- Food for Thought.

David · ‎02-10-2011

That sounds like a good solution. For my use case, we had a relatively small number of events (45 or so) with fairly unique descriptors. Having a specific event type to each error message also allows me to toss up a dashboard with the daily average over the last month for each event type, compared with the last 24 hours. That way I can catch changes in known errors. Food for thought 😉

David · ‎02-09-2011

The way I did this was to set up eventtypes.conf so that each event has an eventtype. You can then run a query: YourSearch NOT eventtype=* And that will show all the events that aren't on your pre-defined list. You can toss that in a scheduled search no problem. http://www.splunk.com/base/Documentation/latest/Admin/eventtypesconf

David · ‎02-09-2011

This may not be the best approach, but I think it should get you there. Assuming the keywords (DEF) and field A (ABC-DEF-ZYL) are going to be exactly that format (e.g., Field A will have a series of keywords separated by hyphens), I would probably take the following approach: YourSearch | makemv delim="-" FieldA | lookup MyTable FieldA OUTPUT Description | search Description=* Where your lookup table is: FieldA,Description ABC,ABC DEF,DEF ZYL,ZYL You could then do stats based off that, such as: YourSearch | makemv delim="-" FieldA | Lookup MyTable FieldA OUTPUT Description | search Description=* | stats count by Description http://www.splunk.com/base/Documentation/latest/SearchReference/Makemv http://www.splunk.com/base/Documentation/latest/SearchReference/Lookup

David · ‎02-02-2011

You can find out how many simultaneous searches are running from the command line by doing a ps aux | grep splunkd | grep search | wc -l (for linux). You could always do this as a scripted lookup, or custom search command, or it might be easier to just have it run on a crontab every minute and output to a log file, and index that log file. Maybe there's an even easier splunk-internal way, though.

David · ‎02-02-2011

The easiest way if you think it's working is to do a search for host="ClientPC*" and see if any results come up. Alternatively, you can go into the indexing volume report ( http://YourHost:8000/en-US/app/search/indexing_volume ), split by host and look for the client. There's also an app in the splunkbase that will help you monitor forwarders: http://splunkbase.splunk.com/apps/All/4.x/App/app:Splunk+Monitoring (I've never used it, but I know it is intended to help monitor forwarders on an ongoing basis). You can also look at the splunkd.log at $SPLUNK_HOME/var/log/splunk/splunkd.log which should provide some error messages, if nothing is coming through.

Posts	472
Solutions	109
Karma Given	283
Karma Received	351
Member Since	‎07-15-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

kvstore query via Python SDK on Windows is slow

How To Run Python On App Install

How Do I Map Splunk Security Content to MITRE ATT&...

sqlite3 required in NLTK Wrapper - Sentiment Analy...

Splunk Security Essentials looks weird / broken / ...

How do I know which token in a dashboard is not se...

Adjust ES Urgency based on Risk

Has anyone Splunked Trello data?

What's the Simplest Modal Pop-Up in Splunk?

SplunkJS with SimpleXML Dashboard: How to get a se...

Re: Single/Multi Threading CPU

Re: Event Correlation

Re: SNMP Fan Status

Re: Search Head and LDAP

Re: LWF and SSL outputs

Re: can't get IMAP app to work with credentials

Re: 2 searches 2 sources one chart???

Re: Grouping similar fields using search syntax?

Re: Extended field search ordering

Re: Comparaing strings of different key

Re: Scripted install thrown by upgrade prompt

Re: Start Search in a new window

Using IMAP App with Non-Standard Root Endpoint

Re: Start Search in a new window

Re: Tracking exchange white space values over time...

Re: Tracking exchange white space values over time...

Re: Tracking exchange white space values over time...

Re: Edit an Automatic Lookup

Re: Splunk overwrites outputs.conf and inputs.conf...

Re: Match substring in list to event

Re: Setting alerts on exceptions

Re: Setting alerts on exceptions

Re: Match substring in list to event

Re: Splunk search to get number of concurrent sear...

Re: check a forwarder is working.

Join the Conversation