About bwooden

bwooden · ‎02-21-2012

props.conf: [source::...splunkd.log] TRANSFORMS-indexRouting = route_all_to_ok_index, route_errors_to_errors_index transforms.conf: [route_all_to_ok_index] REGEX = . DEST_KEY = _MetaData:Index FORMAT = splunk_ok [route_errors_to_errors_index] REGEX = log_level=ERROR DEST_KEY = _MetaData:Index FORMAT = splunk_errors In this case, you could actually eliminate need for 'route_all_to_ok_index' by sending that source to splunk_ok index at inputs level and override just for log_level=ERROR

bwooden · ‎02-20-2012

That functionality is not presently available. The only way to accomplish this presently would be to reserve specific indexers for explicit indexes and get the correct data to its respective indexer. marking answer as relevant to versions 4.2 & 4.3, for posterity

bwooden · ‎02-20-2012

There is a sneaky way this can be accomplished out of box using macros. I can explain that further if needed. I've also just uploaded an app called 'whoami'. Let me know how it works for you or if you have any feature requests or improvement ideas.

bwooden · ‎02-20-2012

You would perform routing via props wherever parsing occurs (generally heavy forwarders or indexers). Universal forwarders do not parse but indexes and sourcetypes may still be set at input time, which is more efficient. For more information on 'where in Splunk' to configure something, check out this Wiki article: http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F

bwooden · ‎02-20-2012

It is best practice to specify index during input phase (inputs.conf) If only one source needs to be routed to a specific index, it would be best to do this at input time... E.g. inputs.conf [monitor:///var/log] index=main sourcetype=syslog [monitor://.../my_secure_app/secure.log] index=secure sourcetype=secure_log If my_secure_app has many logs but only one needs to go to a different index, we may still do this at inputs.conf [monitor://.../my_secure_app/*] blacklist=secure.log$ index=main sourcetype=log4j [monitor://.../my_secure_app/secure.log] index=secure sourcetype=secure_log Failing that, if there are too many stanzas required, we can route later, downstream, based on sourcetype, host, and source, per: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad. This is not as efficient and generally not as easy to 'see what is happening' but may be used when configuration at input level is not practical.

bwooden · ‎02-20-2012

Are you trying to use the custom command from the Search app? If so, this is likely a permissions issue. You can update from the GUI: You'll need to go to Manager » Apps and click 'permissions' in Sharing column for 'myapp'. Change radio button for "Sharing for config file-only objects" from "This app only" to "All Apps". Or you can update from CLI: Create a file called /opt/splunk/etc/apps/myapp/metadata/local.meta that contains this [] access = read : [ * ], write : [ admin ] export = system After this is complete, you should be able to: sourcetype=p5_reports | dedup _time, REGIONID | table _time REGIONID RRP | trendlines sma1000(RRP) If you'd like to share specific pieces of your app and not others, check out the docs on Splunk meta files.

bwooden · ‎12-20-2011

There may be a slight variation in what is in the event and what is being described in the regex. You can validate that by eliminating the 'prefix' and just look for a match on the interesting text: "corp--ips0" | rex field=_raw "(? corp-(tok|tok)-tmo03)" | timechart count by NIDS

bwooden · ‎12-20-2011

There is a way to do this - but I would not encourage its use as it may unintentionally impact search performance. It is typically more performant to tell Splunk how much storage it may use per volume (or per index where different types of data have different retention requirements). Splunk does a good job figuring out what data to put in which bucket based on time. It is not usually beneficial to purge data in an index based on its age because we must first force Splunk to bucket this data based on our calculations (which are not usually optimal). Further attempt at persuasion: It is generally okay to have more data than required. If only 6 months of data is needed but 9 months is available, Splunk will still return data quickly based on its underlying time series index. I say this to further discourage anyone from aging by time without careful consideration and planning. If an index must be manipulated to discard data by age to meet a requirement, the maxHotIdleSecs setting would be used. Let us say a business rule demands we drop data older than 2 months and your maxHotBuckets is set to 1. First, set maxHotIdleSecs to one day. Important: In this example, ensure only one bucket per day by size (max) is created or less than 2 months of data will be retained. Next, set maxWarmDBCount to 59. This configuration will create a new hot bucket each day and keep 59 warm buckets (each ostensibly having a day's data). Splunk will then roll data older than 60 days to cold. Now set frozenTimePeriodInSecs to 60 days so that data rolled to cold is frozen. Note: While these settings were described in days but are represented as seconds in the .conf NB: While creating a new index with this configuration is one thing, applying these settings to an existing index is something more serious. Please be careful if considering these settings for a production environment. Consulting Support before implementing an impactful configuration is strongly encouraged.

bwooden · ‎12-19-2011

There are a few ways to do this using the search language, one is via the rex command to extract only numbers (everything left of the decimal) in your example: ... | rex field=DAT_Version "(?<DAT_Version>\d+)" Another way is via eval to replace the decimal and all numbers to the right of it with nothing: ... | eval DAT_Version=replace(DAT_Version,"\.\d+","") You may also choose to write a props to have this format extracted automatically. MTA: You can also return the floor value, via eval: ... | eval DAT_Version=floor(DAT_Version)

bwooden · ‎11-28-2011

Correct. If the searchheads are not in a pool, they will each run all searches which are enabled and scheduled. They are independent and unaware of each other. In searchhead pooling, the first searchhead that receives a lock will run that specific search at that scheduled time. Each scheduled time is up for grabs by any searchhead participating in a pool.

bwooden · ‎10-03-2011

Red banner message in GUI (below) regarding sentinel.txt file lock is preventing updates from the GUI. Error fixing dangling data: Failed to lock /mnt/search_head_pool/etc/apps/sentinel.txt with return code 1: Success I do not presently have access to the logs of the system (Splunk 4.2.2 101277 on RHEL). Can sentinel.txt and sentinel.txt.lock safely be deleted? Are there known causes/resolutions for this error? What is the scope/impact of this state?

bwooden · ‎09-29-2011

Yeah, I misread the problem/question

bwooden · ‎09-29-2011

I think you'll want to switch your top & your where so that you are getting a top of ERRORs instead of subset of ERRORs from whatever topped. from <param name="search">top responseStatus | where match(responseStatus,"ERROR") | gauge percent 0 5 10 100</param> to <param name="search">where match(responseStatus,"ERROR") | top responseStatus | gauge percent 0 5 10 100</param>

bwooden · ‎08-30-2011

Hello, I am trying to center a label on the x-axis, specifically for results that return only one column and have small label lengths. I have used some text and axis formatting options per The Docs in various attempts. Below is one such attempt that should be able to be copied and pasted into your favorite Splunk instance to play along at home. Is there some technique I could use to center the label "a" relative to its column? <?xml version='1.0' encoding='utf-8'?> <dashboard> <label>deleteme - chart's "majorLabelAlignment" sandbox</label> <row> <chart> <searchString>| stats count | eval charted = "a,b,c,d,e,f,g,h" | makemv delim="," charted | mvexpand charted | stats count by charted</searchString> <title>beforeTick</title> <earliestTime></earliestTime> <latestTime></latestTime> <option name="charting.chart">column</option> <option name="charting.axisLabelsX.majorLabelAlignment">beforeTick</option> </chart> <chart> <searchString>| stats count | eval charted = "a,a,a,a,a,a,a,a" | makemv delim="," charted | mvexpand charted | stats count by charted</searchString> <title>beforeTick</title> <earliestTime></earliestTime> <latestTime></latestTime> <option name="charting.chart">column</option> <option name="charting.axisLabelsX.majorLabelAlignment">beforeTick</option> </chart> </row> <row> <chart> <searchString>| stats count | eval charted = "a,b,c,d,e,f,g,h" | makemv delim="," charted | mvexpand charted | stats count by charted</searchString> <title>atTick</title> <earliestTime></earliestTime> <latestTime></latestTime> <option name="charting.chart">column</option> <option name="charting.axisLabelsX.majorLabelAlignment">atTick</option> </chart> <chart> <searchString>| stats count | eval charted = "a,a,a,a,a,a,a,a" | makemv delim="," charted | mvexpand charted | stats count by charted</searchString> <title>atTick</title> <earliestTime></earliestTime> <latestTime></latestTime> <option name="charting.chart">column</option> <option name="charting.axisLabelsX.majorLabelAlignment">atTick</option> </chart> </row> <row> <chart> <searchString>| stats count | eval charted = "a,b,c,d,e,f,g,h" | makemv delim="," charted | mvexpand charted | stats count by charted</searchString> <title>afterTick</title> <earliestTime></earliestTime> <latestTime></latestTime> <option name="charting.chart">column</option> <option name="charting.axisLabelsX.majorLabelAlignment">afterTick</option> </chart> <chart> <searchString>| stats count | eval charted = "a,a,a,a,a,a,a,a" | makemv delim="," charted | mvexpand charted | stats count by charted</searchString> <title>afterTick</title> <earliestTime></earliestTime> <latestTime></latestTime> <option name="charting.chart">column</option> <option name="charting.axisLabelsX.majorLabelAlignment">afterTick</option> </chart> </row> </dashboard>

bwooden · ‎08-23-2011

You can't name a source in oneshot (as it is already named as the file to add). Fortunately, a workaround discussion already exists: how-do-you-override-source-on-a-oneshot

bwooden · ‎05-27-2011

The field list in a transaction command does not require an identifier. It may be any field listed that is not part of an accepted parameter. For example: source=*.log |transaction maxspan=10s maxpause=2 UserID src_ip OR source=*.log |transaction UserID src_ip maxspan=10s maxpause=2 If you choose to use an identifier, I have found (as have you) that one field works well - but two produces an error. You may quote the field list to remove that error, like this: source=*.log |transaction maxspan=10s maxpause=2 fields="UserID,src_ip"

bwooden · ‎05-27-2011

I had ... | fillnull value=0 'Los Angeles' 'New York' 'Boston' 'Washington D.C.' | eval x='New York'+'Boston'+'Washington D.C'

bwooden · ‎05-26-2011

I think you may do it all in one search for this use case: index="test" sourcetype="power_test" | chart max(Power) as max_power first(Power) as recent_power over host | sort 10 -max(Power)

bwooden · ‎05-25-2011

Correct, in props.conf, you could use something like: [your_sourcetype] EXTRACT-duration = (?<duration>\d+)ms$ EXTRACT-size = file\ssize\s\=\s(?<files_size>\d+) and in the search language, you would just use your eval command: ... | eval thruput = file_size / duration

bwooden · ‎05-25-2011

The fill summary script will run each search as it was scheduled to run. If there is one search that would have created 10 summary points - the script will report it as 10 searches. Let us say there is a search called summarize_daily that runs once each day. If we try to fill its summary using the script for one week ( -et -1w@w -lt @w ), it will run 7 searches. The a -dedup true setting will have it skip over summaries that have already been performed. In the above example, if the intended summaries already exist and the dedup flag is used, then 0 searches will be performed. Next steps: Run against one search explicitly (versus the asterik) for troubleshooting purposes. If that returns 0, manually check the summary data to see if it already exists for the time specified. If no summary data is found - verify summary indexing is enabled for that search.

bwooden · ‎05-25-2011

In simple XML, it would look like this: <dashboard> <label>My dashboard</label> <row> <chart> <searchName>My saved report</searchName> <option name="charting.legend.labels">[Error,Warning,Notice]</option> <option name="charting.seriesColors">[0xFF0000,0xF87217,0x0000FF]</option> </chart> </row> </dashboard> Whereas in the Advanced XML, you would update it like this: ... <module name="HiddenChartFormatter"> <param name="charting.legend.labels">[Error,Warning,Notice]</param> <param name="charting.seriesColors">[0xFF0000,0xF87217,0x0000FF]</param> ... Further reading: http://www.splunk.com/base/Documentation/latest/Developer/AdvancedCharting#Chart_colors

bwooden · ‎05-24-2011

You can either add to earliest or subtract from latest: Second half of previous hour... earliest=-1h@h+30m latest=@h First half of previous hour... earliest=-1h@h latest=@h-30m

bwooden · ‎05-24-2011

Great questions & observations Nick. I still use the shipped script and experience the challenges you mention. I get slightly quicker results by making the machine do as much work as it can by setting a concurrency flag (usually to 8). I leverage a text file when order is important. Most of my summaries have weeklies which are built on dailies which are built on hourlies. The dailies and weeklies are quick, but some time is definitely invested in the hourlies. I like your approach if it adds speed. I'm trying to think of how a dedup would work with that method as I rely on that flag to avoid re-summarizing what has been summarized. Basically, I run a command like this... $SPLUNK_HOME/bin/splunk cmd python $SPLUNK_HOME/bin/fill_summary_index.py -app test_app -namefile $SPLUNK_HOME/etc/apps/test_app/bin/summary.jobs -et -90d -lt now -j 8 -dedup true where summary.jobs looks like this: dashboard_a_base_summary-1h dashboard_b_base_summary-1h dashboard_c_base_summary-1h dashboard_d_base_summary-1h dashboard_a_base_summary-1d dashboard_b_base_summary-1d dashboard_c_base_summary-1d dashboard_d_base_summary-1d dashboard_a_base_summary-1w dashboard_b_base_summary-1w dashboard_c_base_summary-1w dashboard_d_base_summary-1w

bwooden · ‎05-24-2011

First convert the app_duration to a format convert can use. Then, use convert to store app_duration in seconds. Next, average all seconds by severity_type . Finally, re-format avg_app_duration for each severity_type in the human readable format of HH:MM:SS. eval app_duration=replace(replace(replace(app_duration,"d\s","+"),"h|m|s",""),"\s",":") | convert dur2sec(app_duration) | stats avg(app_duration) as avg_app_duration by severity_type | eval avg_app_duration=tostring(round(avg_app_duration,0),"duration")

bwooden · ‎05-24-2011

I'll have to edit my answer as the comment formatting keeps manipulating my reply...

Posts	308
Solutions	72
Karma Given	233
Karma Received	370
Member Since	‎03-02-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Can the Oracle Wallet be used for DBX authenticati...

How would someone set Splunk environment variables...

Time picker on form is not honored in "open in sea...

Do I need to escape a pipe character for TIME_FORM...

Error while configuring Check Point OPSEC LEA Linu...

Searchhead Pooling: Failed to lock sentinel.txt w...

May I center an x-axis label?

How to update FieldPicker for a SimpleResultsTable...

Checking http port [80]: already bound ERROR: The ...

Re: Filtering data into different indexes

Re: License pools for Indexes rather than Indexers

Re: search based on logged in user id

Re: Filtering data into different indexes

Re: Filtering data into different indexes

Re: Custom search example assistance

Re: matching issue with a regex in search

Re: Indexes tiering age-based (not depend from siz...

Re: How to strip out trailing 0's

Re: Scheduled Searches and Multiple Searchheads

Searchhead Pooling: Failed to lock sentinel.txt w...

Re: post-process not delivering all events to char...

Re: post-process not delivering all events to char...

May I center an x-axis label?

Re: help need with add oneshot CLI

Re: Error using fields in transaction

Re: Quick Question: eval

Re: How to write subquery in splunk

Re: Calculate transaction thruput

Re: Backfill command not finding searches

Re: how to change graph line color

Re: Snap to half hour?

Re: faster way to backfill summary indexes

Re: Average duration

Re: How do I search for the = character?

Join the Conversation