Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About Drainy
Drainy
Champion
Member since:
06-01-2011
06-05-2020
Community Statistics
| Posts | 975 |
| Solutions | 127 |
| Karma Given | 499 |
| Karma Received | 988 |
| Member Since | 06-01-2011 |
Activity Feed
- Got Karma for Re: REST API Logs. 09-03-2025 11:24 PM
- Got Karma for Re: splunk: command not found. 09-27-2024 09:03 AM
- Got Karma for Re: Sourcetype -too_small. 10-17-2023 10:36 AM
- Got Karma for Re: Previous business / week day. 01-29-2023 05:20 PM
- Got Karma for Re: Clustering: Can a cluster master also act as a search head?. 10-07-2022 12:56 PM
- Got Karma for Re: Can Splunk 5 modules like Converttodrilldownsearch be used in 4.3?. 09-29-2022 01:31 AM
- Got Karma for Field results as table column headings. 12-14-2021 08:29 PM
- Got Karma for Re: The sort command is truncating output to 10000 rows. 06-16-2021 02:32 AM
- Got Karma for Field results as table column headings. 02-25-2021 11:06 AM
- Got Karma for Re: lookup table to show values that do not match. 11-30-2020 09:38 AM
- Karma Re: Passing search time restrictions from main search to subsearch and modifying it for somesoni2. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk Forwarder fail over configurations. 06-05-2020 12:47 AM
- Got Karma for Re: How to convert a timestamp field to epoch format?. 06-05-2020 12:47 AM
- Karma Re: Good unix way check if splunkd and splunkweb are running for MHibbin. 06-05-2020 12:46 AM
- Karma Re: Updated Splunk Visio Stencil or Deployment Icons for ChrisG. 06-05-2020 12:46 AM
- Karma Re: Updated Splunk Visio Stencil or Deployment Icons for ChrisG. 06-05-2020 12:46 AM
- Karma Re: Splunk v5 Forwarder for DaveSavage. 06-05-2020 12:46 AM
- Karma Re: Chrome 18 causes high CPU for jbsplunk. 06-05-2020 12:46 AM
- Karma Re: Encryption in distributed search for dwaddle. 06-05-2020 12:46 AM
- Karma metadata command giving different answers on different search heads for dwaddle. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 4 | |||
| 12 | |||
| 3 | |||
| 10 | |||
| 2 | |||
| 10 | |||
| 2 | |||
| 2 | |||
| 2 |
11-26-2012
11:03 AM
My bad, had a special moment when I wrote this. Try the edited version
... View more
11-26-2012
01:43 AM
4 Karma
So its fairly well known that the new PDF generation is limited to Simple XML and specifically not form elements. Thats all fine and dandy, however I gave it a whirl last week and the outcome was less than pretty.
I've attached screenshots below but I'd love to hear if anyone has any experience on improving the output or if there are plans to improve the quality of the report? As it stands, I think the PDF Server provides a better report (yes, I appreciate it does still have its limitations). For printing timecharts with a table it looks fine but everything feels like it should be landscape and singlevalue modules are butchered..
EDIT: Also, if you using grouping in Simple XML then the PDF only renders the range class names instead of the values
EDIT: Shameless bump, just in case..
Dashboard;
PDF Generation;
... View more
- Tags:
11-23-2012
01:53 PM
1 Karma
Not quite. Basically the difference is that EXTRACT allows you to put an inline regular expression into your props stanzas. REPORT just references a stanza inside transforms. In this case you could do EXTRACT-rule1 = ([^\d+]), EXTRACT-rule2 = ([^\d+]) on different lines. With REPORT you would just put REPORT-rules = rule1,rule2 and inside transforms you would define a rule1 and rule2 stanza. Either approach would work
... View more
11-23-2012
02:47 AM
1 Karma
Ah, in that case you will just need to delete the fishbucket manually, use an rm -rf on the var/lib/splunk/fishbucket directory within the forwarder directory. Make a backup first but this should do the job
... View more
11-23-2012
02:27 AM
1 Karma
right, that isn't a predictable field, you'd need to do an AS rename to change it to something like count or dur_count to then run predict on
... View more
11-23-2012
02:21 AM
try running ./splunk help clean and see what it says 🙂 The docs seem to match what I've pasted but its clearly not happy.
... View more
11-23-2012
02:03 AM
3 Karma
I've said this in a few questions, but please please read the docs. With that error the first thing you should do is read the docs;
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Predict
Nowhere does it say you can use stats commands, In this case you would rename you count and use;
| predict count as Durationf
... View more
11-23-2012
01:58 AM
In that case there isn't much you can do I'm afraid, thats imply how Splunk searches. stats last will be the best option if you're in a distributed environment.
... View more
11-23-2012
01:35 AM
hmm, perhaps ./splunk clean eventdata -index _fishbucket or if not, is there other data you need or could you reindex it all? (depends if this is prod or not really..) You could just run ./splunk clean eventdata (Warning, this deletes everything)
... View more
11-23-2012
01:31 AM
5 Karma
Right, I think I've grabbed all the relevant bits. In an application.css in SPLUNK_HOME/etc/apps/APPNAMEOFYOURCHOICE/appserver/static put the following;
.SingleValueHolder {
background-color: #CCCCCC;
background-image: url("/en-US/static/@128297/img/skins/default/overlay_gradient_50.png");
background-repeat: repeat-x;
border-radius: 4px 4px 4px 4px;
box-shadow: 0 0 5px rgba(0, 0, 0, 0.25) inset;
font-size: 14px;
font-weight: bold;
}
.SingleValue .severe {
background-color: #BB2121;
color: #FFFFFF;
}
.SingleValue .high {
background-color: #E67918;
color: #FFFFFF;
}
.SingleValue .elevated {
background-color: #E9DA34;
color: #000000;
}
.SingleValue .guarded {
background-color: #4DA6DF;
color: #FFFFFF;
}
.SingleValue .low {
background-color: #72C72D;
color: #FFFFFF;
}
.SingleValue .None {
background-color: #999999;
color: #FFFFFF;
}
.SingleValue .singleResult {
color: #FFFFFF !important;
font-size: 14px;
margin: 0px;
padding-left: 3px;
vertical-align:0px;
}
EDIT: Added CSS for singleResult, needed to override the new singleResult related CSS in v5
... View more
11-23-2012
01:05 AM
That looks like a dreadful regex, also we need some example data to help
... View more
11-23-2012
01:04 AM
Right, so you need to clear the fishbucket, only a clean all would hit the fishbucket too
... View more
11-23-2012
12:52 AM
1 Karma
What command did you use to clear the indexes? Splunk stores a record of what it has read in something called the fishbucket, these exist on forwarders too so you need to clear them on an indexer (if its reading local files) or a forwarder (if its reading local files on a remote server)
From memory I believe the command is;
./splunk clean eventdata _fishbucket
If you don't have anything else of importance in other indexes or want to do this on a forwarder then you can just do a clean all.
... View more
11-23-2012
12:50 AM
When you click on Google it is opening.. but it is not opening on the new browser? target=_blank? Could you try explaining again?
... View more
11-23-2012
12:49 AM
Why use stats, why not just use;
sourcetype=stats device_id=94 FileTime=* | tail 1
Also, if you're looking to do these sorts of searches over longer time periods then it would be worth looking at summary indexing to start taking summarisation data to save time in the future;
http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Usesummaryindexing
... View more
11-22-2012
03:54 AM
well, from; but why is _internal so big and what is it? I assumed you didn't know what it was. What are you currently indexing on the hosts? And how much space is free on C: atm?
... View more
11-22-2012
03:50 AM
Splunkpoornima, please please please stop reposting questions, let it flow and grow within the one question! http://splunk-base.splunk.com/answers/66695/timechart-errror It just confuses things if others search for answers in the future and people trying to help won't know what you've already been told!
... View more
11-21-2012
02:01 PM
1 Karma
and hopefully this is the part where you realise why I posted such a short answer... this is all stuff you need to provide in a question!
So in that case you use a Splunk Universal Forwarder or syslog to forward the logs back to your indexer, from there you have centralised logging and searching for all your data 🙂
... View more
11-21-2012
01:31 PM
Ok, so I just ran a single search on Google for php error log and it appears all PHP errors (if configured) are logged to an error_log file, you could index this within Splunk as you would any other log file
... View more
11-21-2012
12:55 PM
Since you haven't given it the full filename it will need to locate the files first. If it isn't tailing or saying that it has started to read at offset etc then it isn't reading the file.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma from
