About Drainy

Drainy · ‎12-21-2012

Don't include the space, so "| rest

Drainy · ‎12-21-2012

Could you paste some example log data? it sounds like the regex is pulling in some extra characters you can't see

Drainy · ‎12-21-2012

I'm slightly confused as neither of those searches actually have the rex command included, anyway. At a guess you aren't extracting the identifier before you try to search for it so maybe do something like; sourcetype="Mydata" | rex"_Arm(?<identifier>[a-zA-Z]*)<?" | search identifier="Start" | top identifier Remember that fieldnames are case sensitive so you need to use a little i as that is what you used in your rex command. This search now pulls all Mydata events, creates an identifier field where it can, filters the list down to just the events with the identifier start and then pulls the top.

Drainy · ‎12-21-2012

add another | convert ctime(time) to the end 🙂

Drainy · ‎12-21-2012

I think the point was that this is the part where you need to go out and research alternatives, this is a Splunk Q&A forum..

Drainy · ‎12-21-2012

Just add a |rename _time as time to the end of your search string

Drainy · ‎12-21-2012

Well you can't do that, but you would push it as you drilldown to other views which is why I linked in those questions 🙂 You can't have it so they make a selection and it impacts every view within an app, what you would do in this case is either have a very clever dashboard with switcher modules and tabs to avoid having multiple dashboards or have the pulldown initiate a drilldown to another dashboard.

Drainy · ‎12-20-2012

Isn't this just the same question you've asked already? Its the same principle, pass the value and use sideviews to read it in.... http://splunk-base.splunk.com/answers/69705/passing-a-variabletoken-through-link-search http://splunk-base.splunk.com/answers/68727/url-loader-in-sideview http://splunk-base.splunk.com/answers/68691/passing-a-field_value-through-drilldown-search-other-than-clickvalue

Drainy · ‎12-20-2012

If its a static list of items you're checking you could always use the Sideviews HTML module to create your own custom single values or perhaps just use a list of singlevalue modules? This would achieve the same thing, otherwise just upgrade Sideview Utils! Prove to the company that there will be no impact on service 🙂 Have a look at; http://splunk-base.splunk.com/answers/56263/singlevalue-drilldown-search-containing-value-displayed-on-singlevalue Or have a look at the HTML examples in the sideviews app for examples on how to replace singlevalues

Drainy · ‎12-20-2012

Another alternative, splunkd won't log a massive amount (in comparison). You could reduce the size of the _internal index instead to reduce how much Splunk logs of itself (which can cause a lot of disk usage). Also, its worth pointing out that the other answer that mentions changing logging levels, the UI will only change it for that instance of Splunk running - when you restart it will reset the logging levels (its just for debugging really). There are ways to permenantly change the logging levels but you really don't want to, I've always found Splunk to log just the right amount (you may not think so now, but just wait until something breaks 😉 ) and I usually end up increasing the log level if anything. If you do want to make permenant changes then have a look at; http://docs.splunk.com/Documentation/Splunk/5.0.1/Troubleshooting/Enabledebuglogging

Drainy · ‎12-19-2012

Oh and it might be an idea to remove the can delete role and only add it as and when you need it. No need to keep it on all the time, especially if accidents like this happen 🙂

Drainy · ‎12-19-2012

Have a full read of the link I pasted above, it covers this 🙂

Drainy · ‎12-19-2012

The best way to look into what is causing long load times is to use the Jobs link in the top right. Here you can inspect your searches, even ones that are embedded into dashboards, and look at the overall times they take to execute. It also provides a breakdown of the different parts that take the longest - this way you can identify if its transaction that is taking the time. Also, another major cause of slowdown like you describe is if a timerange isn't being appended to your search correctly, this can result in searches in your jobs window as showing as earliest=1970 sometime 😉 This can take a while to run.. Search Job Inspector; http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/SearchJobInspector

Drainy · ‎12-19-2012

I love how it "suddenly applied this command" 😉 Splunk is well known for adding the can delete role to a user and then appending the delete command to the end of a search string! Seriously though, what MuS says below is right. You'll need to do some fishbucket cleaning to get the data back again. EDIT: Read here for more detail on the fishbucket; http://splunk-base.splunk.com/answers/66927/no-longer-seeing-all-logs-after-clearing-index

Drainy · ‎12-18-2012

Also, what do you think you are referencing with capacity:performance. I don't believe they will be actually pointing at any data in that form.

Drainy · ‎12-18-2012

You would just use a HTML module to include an image, if thats what you really want to do. If you could add more detail about the usecase then there might be better ways to do it, such as CSS. http://docs.splunk.com/Documentation/Splunk/5.0/Viz/PanelreferenceforSimplifiedXML#HTML_panel

Drainy · ‎12-18-2012

Are you talking about a drop down list with multiple options? If so, have a look at this docs page for details on how to use it in Splunk; http://docs.splunk.com/Documentation/Splunk/5.0/Viz/Exampleform#Create_a_dynamic_form_search_using_drop-downs

Drainy · ‎12-17-2012

Its a bit back to front here 🙂 Its the number of your answers that have been accepted

Drainy · ‎12-14-2012

You're now handling MV fields? when did they slip into the equation? You might want to start another question... Also, I second Ayn's question about why you use so many usernames on here... every so often I get an email that one user has commented, then you delete it and post as another user?

Drainy · ‎12-14-2012

Best. Feature. Request. Ever.

Drainy · ‎12-14-2012

You find the search which contains a timerange. Basically you have either a timerangepicker module or a timerange defined in XML but the search this is being applied to has a timerange included, e.g. index=_internal Error earliest=-4h@h The error does exactly what it says on the tin 🙂 Remove the timerange from the search and it will go away

Drainy · ‎12-14-2012

Good morning! I'm about to dive into the JS on this to discover how its rendered but in the meantime I thought I'd throw it out here to see if anyone else has come across this.. Imagine a pretty basic search, all I'm doing is pulling back blocked events, no transactions or any funny business.. then I have a brainwave and decide to append a sparkline of blocked events for the same queue. This way I get a timestamp of the most recent block event with a mini timeline of previous blockages... However, the sparkline is generated in a subsearch (within a join command) and when its passed back it isn't being rendered as a sparkline but instead as the markup for it. Screenshot below, if anyone has come across this I'd be interested to know, otherwise I guess its just a bug/limitation of sparkline at the moment. EDIT: Its worth pointing out that this does work if you reverse it and generate the sparkline first and then append the _time, but I'm interested in the problem now 🙂

Drainy · ‎12-14-2012

Fantastic question and answer

Drainy · ‎12-14-2012

...and that's one of the more descriptive error messages...

Drainy · ‎12-13-2012

Yeah, I feel like you have an idea to test something but really what you want to do is maybe run a data generator which outputs the same format data into another log?

Posts	975
Solutions	127
Karma Given	499
Karma Received	988
Member Since	‎06-01-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Appending Sparkline through a JOIN

New PDF Generation - Limitations?

Splunk v5 Clustering and HA

Updated Splunk Visio Stencil or Deployment Icons

Updating Splunk-Base Email

Writing Out to beforeLabel on SingleValue

Shared XML Between Dashboards

Multiple Canvas Flash Timelines within a view

Splunk Install Error on Windows

App Development - Setup.xml not found

Re: Get todays Indexing Volume using the cli

Re: Field Value is not picking in search interface...

Re: Field Value is not picking in search interface...

Re: How to replace label "_time" with "time" comin...

Re: Connecting more than one view

Re: How to replace label "_time" with "time" comin...

Re: Connecting more than one view

Re: Connecting more than one view

Re: Is it possible to add a image on a table ?

Re: Excessive logging activity

Re: Data not found after indexing

Re: Data not found after indexing

Re: performance of form

Re: Data not found after indexing

Re: Indexing not working on the data imported by ....

Re: figure in dashboard

Re: select bar using xml in dashboard

Re: Rest API Endpoint: receivers is not found

Re: Can we replace certain value in field ??

Re: splunkbase feature request

Re: # Your timerange was substituted based on your...

Appending Sparkline through a JOIN

Re: calculate concurrency of transactions

Re: Problem in Starting SPLUNK

Re: add data manually to license_audit.log - plaus...

Join the Conversation