Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mjones414
mjones414
Contributor
Member since:
05-27-2011
2 weeks ago
Community Statistics
| Posts | 150 |
| Solutions | 6 |
| Karma Given | 6 |
| Karma Received | 22 |
| Member Since | 05-27-2011 |
Activity Feed
- Posted I'd like to format the Notable Event Description with spaces, bolding, and italics on Splunk Enterprise Security. 2 weeks ago
- Posted Re: Fuzzy Logic match with multi word value on Knowledge Management. 11-01-2023 04:20 PM
- Karma Re: Fuzzy Logic match with multi word value for ITWhisperer. 11-01-2023 04:20 PM
- Posted Re: Fuzzy Logic match with multi word value on Knowledge Management. 11-01-2023 04:09 PM
- Posted Fuzzy Logic match with multi word value on Knowledge Management. 11-01-2023 01:38 PM
- Posted Setting Tokens from Single Value Panel Results to manipulate another single panel (Why is this still so hard in studio?) on Dashboards & Visualizations. 08-21-2023 02:15 PM
- Posted How to generate an accumulating total bucketed by day per user? on Splunk Search. 04-12-2023 03:49 PM
- Posted Re: Need help splitting a single fields values into multiple chunks based on the length. on Splunk Search. 02-23-2023 10:21 AM
- Karma Re: Need help splitting a single fields values into multiple chunks based on the length. for ITWhisperer. 02-23-2023 10:21 AM
- Posted Need help splitting a single fields values into multiple chunks based on the length. on Splunk Search. 02-23-2023 07:46 AM
- Posted Splitting a large multivalue field into multiple multivalue fields based on character count? on Splunk Enterprise. 09-07-2022 02:19 PM
- Tagged Splitting a large multivalue field into multiple multivalue fields based on character count? on Splunk Enterprise. 09-07-2022 02:19 PM
- Tagged Splitting a large multivalue field into multiple multivalue fields based on character count? on Splunk Enterprise. 09-07-2022 02:19 PM
- Posted Re: How to achieve conditional eval/searchmatch or subsearch result based on the value of another field? on Splunk Search. 07-14-2022 02:02 PM
- Posted How to achieve conditional eval/searchmatch or subsearch result based on the value of another field? on Splunk Search. 07-06-2022 07:38 AM
- Got Karma for Re: How to create a kvpair from two automatically extracted JSON arrays?. 06-07-2022 03:36 PM
- Posted Re: How to create a kvpair from two automatically extracted JSON arrays? on Splunk Search. 06-06-2022 07:32 AM
- Karma Re: How to create a kvpair from two automatically extracted JSON arrays? for rymundo_splunk. 06-06-2022 07:30 AM
- Posted How to create a kvpair from two automatically extracted JSON arrays? on Splunk Search. 06-02-2022 02:55 PM
- Posted Trying to set default disposition of a notable correlation search on Splunk Enterprise Security. 05-03-2022 02:36 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-29-2019
08:57 AM
sure.
I'm actually running this on the splunk distributed search head in an app context. The props.conf should be ina distribution bundle that goes to the indexers. The splunk distributed search head does output to an output queue of indexers. Is there something else missing from that config that I need?
First few lines from a file:
Admins:NISG:123123:jim,bob,joe
Users:NISG:456456:alpha,whiskey,tango
... View more
03-29-2019
08:54 AM
I'm actually running this on the splunk distributed search head in an app context. The props.conf should be ina distribution bundle that goes to the indexers. The splunk distributed search head does output to an output queue of indexers. Is there something else missing from that config that I need?
... View more
03-29-2019
07:26 AM
1 Karma
I've a few different automated pulls of data into directories of files I want splunk to index. These files get completely overwritten every night at least, but sometimes more often than that depending on different operational conditions out of my control. I need splunk to reindex these files every time the datestamp changes and that doesn't appear to be working. current props configurations:
[source:: /data/ridiculi/all_group/ridiculi.*]
CHECK_METHOD = modtime
[ridiculi:group]
DATETIME_CONFIG = CURRENT
FIELD_DELIMITER = ":"
FIELD_NAMES = gid,status,gidnumber,members
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Operating System
description = Ridiculi
disabled = false
pulldown_type = true
inputs.conf:
[monitor:///data/ridiculi/all_group/ridiculi.wanker]
disabled = false
sourcetype = ridiculi:group
index=ridiculi
... View more
03-01-2019
04:05 PM
I'm trying to convert a timestamp where my hour will go beyone 24 hours: for example: 305:44:03 The ctime and dur2sec don't seem to be handling this timeformat properly with either "%H:%M:%S or %H%H%H:%M:%S or %k:%M:%S. and so on...
... View more
- Tags:
- splunk-enterprise
02-19-2019
02:23 PM
Trying to stand up a new heavy forwarder to remove splunk db connect from our primary search head and when I grabbed the most recent versions of the application, it does not seem to have dbxquery.py in the tarball at all. It does not appear to have been deprecated because the SQL explorer still relies on it. Please let me know what I need to do to get this back. It's core to our environment.
... View more
- Tags:
- Splunk DB Connect
12-10-2018
02:24 PM
I've made no progress on this thus far. just a bump to see if anyone else has?
... View more
09-14-2018
11:24 AM
I've seen a lot of guides on how to index data inside of Azure Blob Storage, and how to have remote indexes for s3:// but I've not seen the option for a remote index for Azure Blob Storage like wasb:// or wasbs:// . I'd like to roll all of my colddb indexes over to Azure Blob Storage. Is this possible, and are there any configuration examples someone can share where they've successfully done this?
... View more
05-10-2018
02:08 PM
I'm trying to add more specific data to a particular field by replacing it with another value when other conditions exist:
I've tried if(match(, case(match( and if(searchmatch( and I've not yet found the right function that accepts these conditions.
... | inputlookup inventory.csv | fields WORKGROUP,ASSETNAME,SERIALNUMBER,ASSETTYPE,CONTACT,CONTACTNAME,HARDWARE,OS,SERIALNUMBER | fields - _raw | search WORKGROUP=MYTEAM | eval ASSETTYPE=if(searchmatch("HARDWARE=*MODEL1* OR HARDWARE=*MODEL2*") AND case(OS,"Windows*") AND case(WORKGROUP="MYTEAM"),"Windows Technical Workstation",ASSETTYPE)
Functionally what I want to accomplish is to replace the value of "Desktop" with "Windows Technical Workstation" in all entries where the HARDWARE matches MODEL1 OR MODEL 2, AND its running a Windows OS managed my MYTEAM.
... View more
03-16-2018
12:59 PM
I have a set of fixed fields that define a maximum threshold with the naming convention of "resources_available_[[convention]]"
and I have a variable set of fields which define a process consumption that will reference the naming convention like "resources_listed_[[convention]]"
The convention portion of the field names matches, but while one is fixed, the other will be based on whatever work is going on at the time. I'm trying to figure out how to calculate an evaluated percentage in time per convention (resources_listed_[[convention]])*(resources_available_[[convention]])/100 and the SPL to do this is just not coming to me...
Scenario example is I can get 30 events in, each with different values:
_time=now
resource_listed_a=23
resource_listed_b=9839
resource_listed_a=102
resource_listed_b=1
resource_listed_cde=1200
While I have a static condition of
resources_available_a=9201
resources_available_b=50
resources_available_cde=1
I want based on the event indexed: eval percent_consumed_[[convention]]=resource_listed_[[convention]]*resources_available_[[convention]]/100
Is this even possible?
... View more
01-08-2018
04:25 AM
I have some scripted inputs running on a few servers that will occasionally have very high system loads. The problem is I have holes in my scripted intervals during this time, when I need them the most. The forwarder doesn't die, it just seems to block sending due to limited system resources. I'd like for it NOT to do that, and fight for cycles so I can get a better glimpse into what is happening at this time from my scripted input. Any ideas on how to accomplish this?
... View more
11-10-2017
01:47 PM
Click for a list
<option name="linkFields">result</option>
<option name="linkSearch">sourcetype=pbs:status $STATE$ tag=$PBSSERVER$ earliest=-15m | rex "(?i) comment = (?P<comment>.+)" |eval host=resources_available_host| table host,state comment |dedup host, state</option>
<option name="linkView">search</option>
<option name="drilldown">none</option>
<option name="afterLabel">hosts in this state.</option>
<option name="beforeLabel">There are</option>
I had a single digit panel on a dashboard that I used to have a linkSearch option set for which no longer works:
I'm getting an error in the dashboard source saying these options are deprecated. What are the replacement options so that I can return functionality to this dashboard?
... View more
11-09-2017
10:32 AM
I have several hundred files that have been read into Splunk that change very infrequently, but there are times I want to do keyword search across all my file sources without a time context. Is there any way to do this without the all time performance penalty?
... View more
09-14-2017
12:26 PM
Unfortunately that didn't quite get it, but I had to modify it a little as it didn't account for the Ratio. Not sure what I am missing...
convert dur2sec(resources_used_walltime) as resources_used_wallseconds | eval PWR=resources_used_wallseconds/(end-start) | eval PBSAWallTime=(end-start)*PWR | eval PBSAWallTotal=if(isnull(resources_used_walltime) OR resources_used_wallseconds<0 OR resources_used_wallseconds>runtime, runtime, PBSAWallTime)
... View more
09-13-2017
11:13 AM
Sample Data:
09/12/2017 23:58:35;E;957690.hostname user=NameHere group=GroupHere project=_pbs_project_default jobname=SomeNameHere queue=SomeQueueNameHere ctime=1505271803 qtime=1505271803 etime=1505271803 start=1505272298 exec_host=NodeName/0*24 Resource_List.walltime=720:00:00 session=22656 end=1505278715 Exit_status=0 resources_used.cpupercent=2398 resources_used.cput=40:19:50 resources_used.mem=58593416kb resources_used.ncpus=24 resources_used.vmem=80526996kb resources_used.walltime=01:46:56 run_count=1
This is a sample event of some data that I need to abstract total runtime in hours over 90 days worth of events. There are some qualifying conditions that will change the formula needed, but each event may or may not fit the condition and there are almost a million of events in a 90 day period of time.
The basic result I'm looking for is in the field I'm creating below, PBSAWallTime. The eval for this field can be found below.. However, there are conditions where this isn't doable. When resources_used.walltime :
- List item
is a negative number
is > (end-start)
is not present
Then I need to use the runtime eval field I created as the correct time field for the given event. I haven't been able to form the correct if eval syntax which would cover all three scenarios and am hoping someone can help me out?
Current Search Parameters:
sourcetype=pbs_accounting host=ServerName E
| eval runtime=end-start
| convert dur2sec(resources_used_walltime) as resources_used_wallseconds
| eval PWR=resources_used_wallseconds/(end-start)
| eval PBSAWallTime=(end-start)*PWR
... View more
07-08-2016
04:07 PM
1 Karma
sourcetype=pbs:rg OR (sourcetype=pbs:status state!=free AND state!=job-* tag=sasl0002)
| foreach resources_available_* [eval temp="<>" | rex field=temp "\_n(?\d+)\_" | eval <> = '<>'/n ] | stats values(resources_available_jg*) as resources_available_jg* | rename resources_available_jg_* as *
This gives me something like this:
Now I want to append a search like this:
sourcetype=pbs:status state!=free AND state!=job-* | dedup Mom state| table resources_available_vnode resource_group comment | stats count by resource_group
which gives me something like this:
so that the fields from the first search are a column chart and the fields from the second search are a line graph overlaying the column chart.
Something like this:
Is it possible given one is a series of single fields and values, and one is a number of multiple values in a field?
... View more
07-08-2016
08:48 AM
All these lines are part of one avent and yes that would be the full field name with splunk graciously changing .'s to _s's because it hates .'s in field names 🙂
... View more
07-08-2016
08:45 AM
1 Karma
If we ever meet, I will buy you a beer! This is EXACTLY what I was looking for!!
... View more
07-08-2016
08:02 AM
Sample data:
I have several field values in one sourcetype that are variable limits that can change week by week. The need I have is to always take the value of the field which can change, and divide it by the n# value in the field name. So for example, in the first line, I need to take 512 and divide that by 16 and have the solution be the new value of that field, and I need to do this for each field. So far, I've come up empty on how to appropriately do this. Any ideas?
resources_available.jg_n16_128_none_FDR1_rd_a = 512
resources_available.jg_n16_128_none_FEX_gsu_a = 1584
resources_available.jg_n16_128_none_FEX_gsu_b = 3200
resources_available.jg_n16_128_none_FEX_gsu_c = 1600
resources_available.jg_n16_128_none_FEX_gsu_d = 0
resources_available.jg_n16_128_none_FEX_gsu_e = 0
resources_available.jg_n16_128_none_FEX_gsu_f = 0
resources_available.jg_n16_128_none_FEX_rd_a = 0
resources_available.jg_n16_128_none_FEX_rd_b = 0
resources_available.jg_n16_128_none_FEX_rd_c = 0
resources_available.jg_n16_128_none_FEX_rd_d = 0
resources_available.jg_n16_128_none_FEX_rd_e = 0
resources_available.jg_n16_128_none_FEX_rd_f = 0
resources_available.jg_n24_256_kepler_FEX_gsu_a = 4920
resources_available.jg_n24_256_kepler_FEX_gsu_b = 0
resources_available.jg_n24_256_kepler_FEX_gsu_c = 0
resources_available.jg_n24_256_kepler_FEX_rd_a = 720
resources_available.jg_n24_256_kepler_FEX_rd_b = 0
resources_available.jg_n24_256_kepler_FEX_rd_c = 0
resources_available.jg_n24_256_none_FDR2_rd_a = 4320
resources_available.jg_n24_256_none_FEX_Q1_a = 2400
resources_available.jg_n24_256_none_FEX_gsu_a = 12000
resources_available.jg_n24_256_none_FEX_gsu_b = 0
resources_available.jg_n24_256_none_FEX_gsu_c = 0
resources_available.jg_n24_256_none_FEX_gsu_d = 0
resources_available.jg_n24_256_none_FEX_gsu_e = 0
resources_available.jg_n24_256_none_FEX_gsu_f = 0
resources_available.jg_n24_256_none_FEX_rd_a = 2400
resources_available.jg_n24_256_none_FEX_rd_b = 14928
resources_available.jg_n24_256_none_FEX_rd_c = 0
resources_available.jg_n24_256_none_FEX_rd_d = 0
resources_available.jg_n24_256_none_FEX_rd_e = 0
resources_available.jg_n24_256_none_FEX_rd_f = 0
resources_available.jg_n24_256_pdd_FEX_sco_a = 48
resources_available.jg_n24_256_testa_FEX_gsu_a = 24
resources_available.jg_n24_256_testb_FEX_gsu_a = 24
resources_available.jg_n24_512_k80_FDR3_rd_a = 936
resources_available.jg_n24_512_k80_FDR3_rd_b = 0
resources_available.jg_ntape16_128_none_FEX_sco_a = 96
resources_available.jg_t24_256_none_FDR2_rd_a = 96
resources_available.jg_t24_256_none_FEX_rd_a = 480
resources_available.jg_test = 240
... View more
06-16-2016
02:42 PM
I have data that has a watermark percentage, and a consumed percentage in a timechart. I want to determine how much time is spent above the watermark in a given window of time. How can I do this?
example:
.. | timechart span=4h avg(percent) as PercentUsed | eval "75th Percentile"=75 | ???transaction PerentUsed>"75th Percentile"???
... View more
04-25-2016
03:13 PM
1 Karma
Unfortunately I was not able to make spath do what I needed to do, BUT I have learned what was causing xmlkv and xpath to fail.
Looks like one of my colleagues set:
[replicationBlacklist]
noBinDir = (.../bin/*)
in /opt/splunk/etc/system/local/distsearch.conf
Loosening this up enabled the replication bundle to push the .py scripts to the search peers and allowed the search to complete.
... View more
04-18-2016
12:57 PM
I've tried a few different ways to upload a complete xml sample but the webpage will not submit it... 😞
... View more
04-18-2016
12:49 PM
yep that is correct. but like i said this is one block of a 500 line event, this block is what I want to trigger off of for an alert, the rest of the block, which I'd want included in the alert, will have the lower level details. like, error code, temperature, firmware revision, etc etc. so specifically anything not OK or Redundant in the health_at_a_glance level
... View more
04-14-2016
04:35 PM
This led me down an interesting little rabbit hole! So spath did actually break the XML the way I'd hoped, but it doesn't appear to know how to deal with wildcards in the field name. This led me to xpath, but when I tried to use xpath it broke in the exact same fashion xmlkv did!
Here's an example block I'm trying to parse:
<GET_EMBEDDED_HEALTH_DATA>
<HEALTH_AT_A_GLANCE>
<BIOS_HARDWARE STATUS= "Failed"/>
<FANS STATUS= "OK"/>
<TEMPERATURE STATUS= "OK"/>
<POWER_SUPPLIES STATUS= "OK"/>
<PROCESSOR STATUS= "OK"/>
<MEMORY STATUS= "OK"/>
<NETWORK STATUS= "OK"/>
<STORAGE STATUS= "OK"/>
</HEALTH_AT_A_GLANCE>
</GET_EMBEDDED_HEALTH_DATA>
So I was trying to use a search string like this:
sourcetype=ilo:systemhealth | spath | search "GET_EMBEDDED_HEALTH_DATA.HEALTH_AT_A_GLANCE.*" NOT "OK"
the whole event is in the neighborhood of 500 lines of nested xml, because below this it captures more detail about the hardware component tests. The idea is to filter within this xml block in the search and table out the offending hardware component and specific details later.
... View more
04-14-2016
12:45 PM
running splunk 6.3.1 on search head and on all indexers.
... View more
04-14-2016
12:38 PM
1 Karma
I'm trying to run a very basic search against XML formatted events:
sourcetype=ilo:events | xmlkv
I'm getting the following error back from my search head:
9 errors occurred while the search was executing. Therefore, search results might be incomplete. Hide errors.
•[SearchPeer1] Streamed search execute failed because: Error in 'xmlkv' command: Cannot find program 'xmlkv' or script 'xmlkv'.
•[SearchPeer2] Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info.
•[Searchpeer2] Streamed search execute failed because: Error in 'xmlkv' command: Cannot find program 'xmlkv' or script 'xmlkv'.
•[SearchPeer3] Search process did not exit cleanly, exit_code=-1, description="exited with code -1". Please look in search.log for this peer in the Job Inspector for more info.
•[Searchpeer3] Streamed search execute failed because: Error in 'xmlkv' command: Cannot find program 'xmlkv' or script 'xmlkv'.
•[Searchpeer4] Streamed search execute failed because: Error in 'xmlkv' command: Cannot find program 'xmlkv' or script 'xmlkv'.
so on and so on..
But I can check each of these indexers and xmlkv is indeed there and enabled with global read permissions..
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
2 weeks ago
|
Karma from
