About bwooden

bwooden · ‎05-27-2010

gkanapathy raises good questions. If the below search works for case A then perhaps the field extraction may need to be tweaked to remove leading/trailing spaces or tabs. my_field="*text2search*" | eval my_field=trim(my_field) | search my_field="*text2search"

bwooden · ‎05-21-2010

What is the lookup command you're using to generate this error. Do you have somedata.csv stored in $SPLUNK_HOME/etc/system/lookups/ (or in an applicaton's lookups folder) and referenced in transforms.conf... [somelookuptable] filename = somedata.csv You're right that CSV files used in lookups may have values with commas, provided those values are double quoted (e.g. "last, first" as a value for a field fullName).

bwooden · ‎05-21-2010

There are a few places the host value may be set. Is your inputs.conf on the indexer? Beyond inputs.conf, host values can also be set using props.conf & transforms.conf. You can extract the host value from the syslog message too.

bwooden · ‎05-18-2010

First, craft the search and make sure it returns the desired results: sourcetype=syslog After confirming, pipe that to outputcsv: sourcetype=syslog | outputcsv results.csv Finally, drop down the Actions menu and select Save search... After filling in the desired name, time range, etc. check the Schedule this search checkbox and select a recurrence before saving. Your file should automatically be generated here at your scheduled interval: $SPLUNK_HOME/var/run/splunk/results.csv

bwooden · ‎05-14-2010

Hi smisplunk. If you're seeing top report 25% for each of these values clean 61234 cleaned 22 infected 173 spam 87134 then you may be piping to top after another summary operation. If I perform a search * | stats count by sourcetype | top sourcetype It will show me that each sourcetype has an equal share (due to summary operation rolling-up the count for all sourcetypes to 1) sourcetype count percent test-too_small 1 33.333333 new-too_small 1 33.333333 fs_notification 1 33.333333 We need to drop the previous summary operation to let top work its magic * | top sourcetype That will return the percentage value pre-aggregation (notice the counts for each are now 8, 3, and 1 instead of ones) sourcetype count percent fs_notification 8 66.666667 new-too_small 3 25.000000 test-too_small 1 8.333333 Nick's (above) suggestion, 4TW: * | stats count by sourcetype | eventstats sum(count) as total | eval percent=100*count/total | strcat percent "%" percent sourcetype count percent total fs_notification 8 66.666667% 12 new-too_small 3 25% 12 test-too_small 1 8.333333% 12

bwooden · ‎05-14-2010

Q1: From the command prompt of your deployment client, are you able to connect to your deployment server via a telnet deploymentserver.local 8089 where deploymentserver.local = your Splunk deployment server and 8089 = the port on which its splunkd is listening? You're correct regrading SSL agreement Note: The deployment server and its deployment clients must agree in the SSL setting for their splunkd management ports. They must all have SSL enabled, or they must all have SSL disabled. To configure SSL on a Splunk instance, set the enableSplunkdSSL attribute in server.conf to "true" or "false". Q2: Are both your deployment client & deployment server in SSL agreement? What are the results of this command on each: ./splunk cmd btool server list | grep enableSplunkdSSL

bwooden · ‎05-13-2010

Similar thread: http://answers.splunk.com/questions/303/whats-max-events-i-can-have-timestamped-with-a-particular-second-millisecond

bwooden · ‎05-13-2010

I think you're on the right path. Hopefully we can get you closer. The $SPLUNK_HOME/etc/apps/lookups/ path is ignored. Either of the other two directories should work though. The two files will not merge - one will triumph. Step 1 We can first check the inputlookup is working by verifying Splunk uses it okay. We can enter this search as a test. |inputlookup mal_domains.csv Let us say it returns a results table having names domain and status per your example. If not, the CSV is not being found or read appropriately. Step 2 From your example & comment, I don't think you have any fields that relate to "bad" so let's get rid of that column |inputlookup mal_domains.csv | fields + domain Hopefully this is returning a results table having just the domain field. Step 3 Let's say your Splunk data doesn't have a field called domain though. Instead, what if it is URL? Let's prepare to work against the URL field |inputlookup mal_domains.csv | rename domain as URL | fields + URL Hopefully the results table now looks like it did in Step 2, except with a URL field instead of domain field. Step 4 Try to find Splunk data having a URL value matching a domain value from the mal_domains.csv file * [|inputlookup mal_domains.csv | rename domain as URL | fields + URL]

bwooden · ‎05-12-2010

If I want to find all events with a field named foo * | where isnotnull(foo) If I want to find all events without a field named foo * | where isnull(foo)

bwooden · ‎05-12-2010

If that search doesn't return results, what Splunk & OS version are you using?

bwooden · ‎05-12-2010

Are you searching for something like this? index=os source="fschangemonitor" path=*hosts*

bwooden · ‎05-12-2010

A double quoted search name within a single quoted search command worked for me... $SPLUNK_HOME/bin/splunk search '|savedsearch "Splunk errors last 24 hours"'

bwooden · ‎05-11-2010

If they are in the same log file - are they both comma separated or does only the 2nd event have its fields separated by commas? I ask because if all values in the log file are separated by commas it may be even easier to do your field extractions. I strongly encourage field extractions first so you'll be setup for future successes. If you're only trying to show the grouping is possible, even before you learn about the field extractions, you could do this 976122186 items-list-main-count_advanced | eval glue="fragileSolution" | transaction glue ...with the understanding that it is a fragile solution.

bwooden · ‎05-08-2010

What search command are you running? Does "sourcetype=lsof index=os earliest=-1d" return any events?

bwooden · ‎04-30-2010

Here is a similar thread that discusses how host names are assigned: http://answers.splunk.com/questions/1308/syslog-ng-logs-show-as-hostlocalserver-rather-than-remote

bwooden · ‎04-30-2010

There may not be a one size fits all answer. If you deploy a light weight forwarder it limits itself to 256 kilobytes / second by default. This is tunable in the limits.conf file [thruput] maxKBps = 256 If the forwarder is configured too low it may fall behind a bit during times of elevated event generations.

bwooden · ‎04-23-2010

You shouldn't have had to re-start Splunk as those are search time field extractions. You might try a "| evaluate reload=T" but I don't think that is the challenge. So you're seeing the results but when you choose "Pick Fields" those fields are not listed as options?

bwooden · ‎04-22-2010

An alternate solution would be to modify your props.conf & transforms.conf to explicitly specify the headers props.conf [source::/etl/issrdr/scripts/tst/splunk/input/updates.csv] REPORT-fields = updateFields transforms.conf [updateFields] FIELDS="TIME_STAMP","TRANSACTION_ID","ENTITY_NAME","ERROR_MESSAGE" DELIMS=","

bwooden · ‎04-22-2010

On what platform is the target server requiring authentication? Who has what access on the calling system? You can statically define an encoded ID & Password in the script (which is easily decoded by anyone who can view the script). Alternatively, you might place the ID & Password in a separate file and prevent access to it by those not running the script via local security. Depending on your setup, you may also be able to leverage a certificate based authentication avoiding some of the pitfalls with the first two solutions. Would you be able to do a push from the remote system instead of a pull?

bwooden · ‎04-15-2010

<param name="useHistory">False</param> http://www.splunk.com/base/Documentation/4.1/Developer/ModuleReference#HiddenSavedSearch useHistory = Auto | None | True | False * useHistory defines the savedSearch module's saved search dispatch method. The default useHistory method is None, which means that savedSearch first tries to find a previously run job if one exists in the saved search's history. If it can't find a previously run job, savedSearch dispatches a new job based on the saved search and returns that job's sid. If useHistory is set to True, savedSearch looks only for previously run jobs dispatched by the saved search. If useHistory is set to False, savedSearch dispatches a new job based on the saved search and returns that job's sid, regardless of the presence of jobs within the saved search's history. * defaults to: Auto Keep in mind that keeping this value at False over time may lengthen the load time of your panel.

bwooden · ‎04-15-2010

If you have extracted the field Books with a single value of 1,2,3,65,2,5 and want it to report as a multi-valued attribute, try this at search time: Books = * | makemv delim="," Books

bwooden · ‎04-14-2010

I was able to re-produce using Splunk 4.1 (build 77833). I created the below file (and restarted Splunk) as a work-around. $SPLUNK_HOME/etc/apps/SplunkforBlueCoat/local/viewstates.conf [*:fx3mgenj]

bwooden · ‎04-14-2010

...assuming you're an admin on that instance.

bwooden · ‎04-14-2010

One option may be to do this via transforms.conf To get started you could add or append these two files on your Splunk search instance. $SPLUNK_HOME/etc/system/local/props.conf [unknown-too_small] KV_MODE = none REPORT-foo = RecAuthz $SPLUNK_HOME/etc/system/local/transforms.conf [RecAuthz] REGEX = ([0-9]+/[0-9]+/[0-9]+)\s([0-9|:]+)\s(\S+)\s(\d+)\s(\d+) FORMAT = date::$1 time::$2 account::$3 received::$4 authorized::$5 --- Alternate transforms.conf (easier to read solution) [RecAuthz] DELIMS = " " FIELDS = "date", "time", "account", "received", "authorized"

bwooden · ‎04-08-2010

"these alternatives" = http://www.splunk.com/support/forum:SplunkAdministration/4191

Posts	308
Solutions	72
Karma Given	233
Karma Received	370
Member Since	‎03-02-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Can the Oracle Wallet be used for DBX authenticati...

How would someone set Splunk environment variables...

Time picker on form is not honored in "open in sea...

Do I need to escape a pipe character for TIME_FORM...

Error while configuring Check Point OPSEC LEA Linu...

Searchhead Pooling: Failed to lock sentinel.txt w...

May I center an x-axis label?

How to update FieldPicker for a SimpleResultsTable...

Checking http port [80]: already bound ERROR: The ...

Re: How do I make wildcard search work for begins ...

Re: Error 'Could not find all of the specified loo...

Re: Host name in inputs.conf file

Re: Exporting search results automatically

Re: Top percentage from stats output?

Re: Is there any way to tell deployment client tha...

Re: How can I tune the Splunk search process to ha...

Re: Inputlookup against a list of bad domains

Re: How can I search for events that do not contai...

Re: fschange, file system change detection not wor...

Re: fschange, file system change detection not wor...

Re: running a Saved Search from the Command Line I...

Re: How can I group log entries together when fiel...

Re: Why isn't lsof / open files working in *NIX?

Re: how do I change a host when seeing multiple ho...

Re: What is the minimum network bandwidth required...

Re: Extracted fields are not visible in the UI i.e...

Re: Extracted fields are not visible in the UI i.e...

Re: Safely storing credentials inside Splunk apps

Re: Is there a way to refresh a panel that has bee...

Re: Extracting multiple field values from a comma ...

Re: Error while modifying Splunk for BlueCoat dash...

Re: Field extraction with duplicate values in fiel...

Re: Field extraction with duplicate values in fiel...

Re: Checking http port [80]: already bound ERROR: ...

Join the Conversation