Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About Dark_Ichigo
Dark_Ichigo
Builder
Member since:
06-02-2011
06-05-2020
Community Statistics
| Posts | 190 |
| Solutions | 10 |
| Karma Given | 109 |
| Karma Received | 41 |
| Member Since | 06-02-2011 |
Activity Feed
- Karma Getting rid of "other" in pie chart for Nicholas_Key. 06-05-2020 12:46 AM
- Karma the specified span would result in too many (>50000) rows for perlish. 06-05-2020 12:46 AM
- Karma Re: the specified span would result in too many (>50000) rows for bmacias84. 06-05-2020 12:46 AM
- Karma Re: How to format results in Splunk to columns instead of rows for gfuente. 06-05-2020 12:46 AM
- Karma Re: Splunk Encountered the following unkown module: for bodhicrane. 06-05-2020 12:46 AM
- Karma Re: inputlookup in a macro for sideview. 06-05-2020 12:46 AM
- Karma Re: Multiple warning which lead to License Violation for a Slave for lukejadamec. 06-05-2020 12:46 AM
- Karma Re: Deleting an Index from the fish bucket for Jason. 06-05-2020 12:46 AM
- Karma Re: Convert Splunk default time to human readable format for jaceknykis. 06-05-2020 12:46 AM
- Karma Re: Splunk randomly extracts 2 types of timestamp formats! for kristian_kolb. 06-05-2020 12:46 AM
- Karma Re: dd/mm/yyyy is being returned as mm/dd/yyyy for kristian_kolb. 06-05-2020 12:46 AM
- Karma Re: Combined chart types in a single chart display for jonuwz. 06-05-2020 12:46 AM
- Karma Re: How to round decimal places? for yannK. 06-05-2020 12:46 AM
- Karma Re: A great Charting Problem! for Takajian. 06-05-2020 12:46 AM
- Karma Re: Moving Index stanza from one app to another within the same Splunk Instance for abhutiani. 06-05-2020 12:46 AM
- Karma Re: Getting time stamps correctly. for Lucas_K. 06-05-2020 12:46 AM
- Karma Re: Best approach for speeding up Splunk Searches for kristian_kolb. 06-05-2020 12:46 AM
- Karma Re: Best approach for speeding up Splunk Searches for dwaddle. 06-05-2020 12:46 AM
- Karma How do you add dummy events to a search result? for Marinus. 06-05-2020 12:46 AM
- Karma Re: How do you add dummy events to a search result? for ziegfried. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
03-15-2012
09:50 PM
Thanks guys, its going to be a good journey studying TCP/IP connections with those references, ill be sure to get the ebook version for both.
Although there are so many different tools out there that pretty much snoop different varieties of TCP Dump outputs, question is which one would be best to Splunk in the future?
... View more
03-15-2012
08:13 PM
Using the transaction command, I want to group a number of events to obviously make up a transaction but each contains the same field value for example, Field=334334 all events with this field number should be grouped into one trnasaction but with 2 other startswith and endswith events added to it, how can this be done?
... View more
03-15-2012
12:16 AM
I see, so what I can see in the TCP dumps is that the TCP Transport layer as the 'Source' is sending a request to the HTTP session layer as the destination to actually begin handling the data?
... View more
03-15-2012
12:02 AM
Thanks, so basically the first Ack is a Get and the next two Acks are the Responses but the first three are only the 3-way handshake Acks for the connection creation.
One more question though, is this "HTTP HTTP/1.1 200 OK" considered to be a GET request?, as in a response GET from the POST before it?
... View more
03-14-2012
08:56 PM
1 Karma
I have noticed that reading an output of a TCP dump is as follows:
The requesting Host sends a synchronization flag (SYN) in a TCP segment to create a connection.
The receiving Host 192.168.2.165 receives the SYN flag and returns an acknowledgment flag (ACK).
The requesting Host 192.168.2.10 receives the SYN flag and returns it's own ACK flag.
But only 104 of my the network transactions are [SYN] or [SYN,ACK], the rest of the 14,711 are mostly just [ACK], which makes it even more confusing.
Whats this about and for what reason, how does I read it then?
I just want to create a splunk search that can basically group up each start and end transaction, How can this be done?
... View more
- Tags:
- tcpdump
03-05-2012
09:52 PM
A while back I posted this question: http://splunk-base.splunk.com/answers/29015/dotted-line-chart
The answer gave me exactly what I wanted, which was to be able to customize the lines I have on a chart, I was able to create dotted Lines and change Line Thickness...etc successfully.
Now I have more than 7 Lines on the same chart, when adding the necessary steps to customise a Line or two, nothing seems to take effect not matter what I do.
I assume the cause would be having too many Lines on one chart?
Note: My chart also has two Yaxis
Requested XML
Although, I do think that when having two Yaxis on a chart, customizing the Lines doesnt seem possible, that could be the reason.
The below is what you need:
<module name="HiddenPostProcess" group="Single Value">
<param name="search">SEARCH</param>
<module name="HiddenChartFormatter" group="Chart">
<param name="chart">line</param>
<param name="chart.nullValueMode">gaps</param>
<param name="charting.primaryAxisTitle.text">Time</param>
<param name="charting.primaryAxisTitle.visibility">collapsed</param>
<param name="charting.legend.minimumWidth">200</param>
<param name="charting.legend.maximumWidth">200</param>
<param name="charting.legend.labelStyle.wordWrap">true</param>
<param name="charting.axisLabelsY.majorLabelStyle.wordWrap">true</param>
<param name="charting.legend.placement">right</param>
<param name="charting.legend.minimumWidth">150</param>
<param name="charting.legend.wordWrap">true</param>
<param name="charting.OneBrush">dashedStroke</param>
<param name="charting.OneBrush.color">0x000000</param>
<param name="charting.OneBrush.thickness">2</param>
<param name="charting.TwoBrush">dashedStroke</param>
<param name="charting.TwoBrush.color">0x3D3D3D</param>
<param name="charting.TwoBrush.thickness">2</param>
<param name="charting.ThreeBrush">dashedStroke</param>
<param name="charting.ThreeBrush.color">0x66CC00</param>
<param name="charting.ThreeBrush.thickness">2</param>
<param name="charting.FourBrush">dashedStroke</param>
<param name="charting.FourBrush.dashSize">10</param>
<param name="charting.FourBrush.dashSpacing">10</param>
<param name="charting.FourBrush.color">0x66BBDD</param>
<param name="charting.FourBrush.thickness">10</param>
<param name="charting.FiveBrush">dashedStroke</param>
<param name="charting.FiveBrush.dashSize">10</param>
<param name="charting.FiveBrush.dashSpacing">10</param>
<param name="charting.FiveBrush.color">0x66BBDD</param>
<param name="charting.FiveBrush.thickness">15</param>
<param name="charting.SixgBrush">solidStroke</param>
<param name="charting.SixBrush.color">0x247FA3</param>
<param name="charting.SixBrush.thickness">2</param>
<param name="charting.SevenBrush">dashedStroke</param>
<param name="charting.SevenBrush.dashSize">2</param>
<param name="charting.SevenBrush.dashSpacing">3</param>
<param name="charting.SevenBrush.color">0x00CC66</param>
<param name="charting.SevenBrush.thickness">2</param>
<param name="charting.EightBrush">dashedStroke</param>
<param name="charting.EightBrush.dashSize">2</param>
<param name="charting.EightBrush.dashSpacing">4</param>
<param name="charting.EightBrush.color">0x243FA3</param>
<param name="charting.EightBrush.thickness">20</param>
<param name="charting.NumberBrushPalette">field</param>
<param name="charting.chart.lineBrushPalette">@myBrushPalette</param>
<param name="charting.myBrushPalette">field</param>
<param name="charting.myBrushPalette.fieldBrushes">{One:@OneBrush,Two:@aTwoBrush,Three:@ThreeBrush,Four:@FourBrush,Five:@FiveBrush,Six:@SixBrush,Seven:@SevenBrush,Eight:@EightBrush}</param>
<param name="charting.axisX">time</param>
<param name="charting.axisY">numeric</param>
<param name="charting.axisY2">numeric</param>
<param name="charting.axisTitleX.text">Time</param>
<param name="charting.axisTitleX.visibility">collapsed</param>
<param name="charting.axisTitleY.text">VALUE</param>
<param name="charting.axisTitleY2">#axisTitleY</param>
<param name="charting.axisTitleY2.text">VALUE1</param>
<param name="charting.axisTitleY2.placement">right</param>
<param name="charting.axisY.minimumNumber">0</param>
<param name="charting.axisY2.minimumNumber">0</param>
<!--param name="charting.axisY2.maximumNumber">100</param-->
<param name="charting.axisLabelsY2">#axisLabelsY</param>
<param name="charting.axisLabelsY2.axis">@axisY2</param>
<param name="charting.axisLabelsY2.placement">right</param>
<param name="charting.data0">results</param>
<param name="charting.data0.jobID">@data.jobID</param>
<param name="charting.data1">view</param>
<param name="charting.data1.table">@data0</param>
<param name="charting.data1.columns">[0,1:3]</param>
<param name="charting.data2">view</param>
<param name="charting.data2.table">@data0</param>
<param name="charting.data2.columns">[0,12:16]</param>
<param name="charting.chart1.data">@data1</param>
<param name="charting.chart1">line</param>
<param name="charting.chart1.axisY">@axisY</param>
<param name="charting.chart2.data">@data2</param>
<param name="charting.chart2">line</param>
<param name="charting.chart2.axisY">@axisY2</param>
<param name="charting.layout.margin">(0,0,-5,-15)</param>
<param name="charting.layout.charts">[@chart1,@chart2]</param>
<param name="charting.layout.axisTitles">[@axisTitleX,@axisTitleY,@axisTitleY2]</param>
<param name="charting.layout.axisLabels">[@axisLabelsX,@axisLabelsY,@axisLabelsY2]</param>
<module name="FlashChart">
<param name="width">100%</param>
<param name="height">360px</param>
<param name="enableResize">False</param>
</module>
</module>
</module>
... View more
02-23-2012
04:02 PM
Found the issue, apparently there was a Single value Module that was in the way of the above "ConvertToIntention" modules, this led to some values of a number of fields, were not successfully delivered to the search Macro to generate the desired chart.
... View more
02-22-2012
09:32 PM
when writing a search to create a chart, We all then tend to integrate it into a dashboard as a report.
My problem is that when I click "Show Chart" I get what I want, but when I add it to the dashboard as a report I dont get the same result even though my Advanced XML code only contains code for charting and no other extras added to not complicate things even more because of this issue.
... View more
02-09-2012
09:58 PM
Bingo!.....Thanks!
... View more
01-30-2012
10:48 PM
1 Karma
I have created a transaction that may contain one or more of these three log level types logLevels i.e. METRIC/INFO/WARN
For Example: Assume that one transaction holds three events, each event has its own logLevel type.
My Question is, How Can I pick up the final LogLevel type for the last event at the end of a Transaction?
... View more
12-15-2011
05:10 PM
1 Karma
I do not understand why Im currently having this problem, I have never had this problem before when creating charts with splunk!
The problem is when using the follwing search to create a chart with span=5m within a Timestamp of a whole Month:
index="INDEX" GET* | timechart bins=50000 span=5m count
I only get three days, and the rest of the days seem to shift to the right of the chart and disappear as it loads!
This is a very weird behaviour, I dont understand why its behaving like this, the flashtime search works fine with all the results for that month, but when creating the chart it doesn't seem to work normally
... View more
12-06-2011
07:54 PM
This is What I need, although I do not want to delete the whole fishbucket, would it be possible to use this following command to remove a particular index from the Fishbucket:
./splunk clean eventdata _fishbucket -index
If there was, this would defiantly solve a great number of issues im having!
... View more
12-06-2011
07:41 PM
Nope this isnt useful, I do need to mention that when clearing event data, I cannot re-index the same files to that index, unless I change the index name!
What I want is to Completely remove the index from Splunk!.....basically from the Fishbucket in order to re-index my logs.
So how can I do this?
... View more
12-06-2011
05:30 PM
1 Karma
I want to find an index I created and remove it completely from Splunk, so I can re-use the same name, How can this be done?
... View more
12-04-2011
03:58 PM
If I were to increase the linear trend Line to a future date, like another month, basically what I want is to have the flexibility to choose a specified future date for the trend Line
... View more
11-27-2011
04:36 PM
1 Karma
I solved the problem by shutting down Splunkd, then deleting the _audit index manually from the CLI, after a Restart, the _audit Index was enabled again.
BTW... mmather67 you do have a point.
... View more
11-22-2011
05:23 PM
The problem with the Append Join Command, is that your search needs to be based on "stats,timechart,chart" command to do so.....I have tried using Inner Join to group transaction from multiple indexes, but it doesn't seem to work.
... View more
11-13-2011
04:37 PM
The Error message Im getting is: You are banned from this server- Temporary D-line 1440 min. - Blacklisted Proxy found. Visit http://www.spamhaus.org/query/bl?ip= for info. ( )
... View more
11-10-2011
03:55 PM
For some reason, Splunk IRC considers me to be a Spam?
No matter what I do it seems to be going back to this conclusion, How can I fix this issue?
... View more
- Tags:
- chat
11-02-2011
04:40 PM
Is there a way where I can modify the Schema for the way Splunk Generates the XML output when exporting Results?
Its fantastic the way Splunk Exports the results to an awesome looking XML, but it would be good If I had control of the XML Schema.
... View more
11-01-2011
11:52 PM
This looks like a Splunk Bug to me, there has to be a fix for this, a Sub-search timing OUT! We can do so much with Sub-Searches, we cant just let Splunk ignore this issue, there were soo Many Times I would've liked to use Sub-searches in Splunk to create Summary Indexes, But They keep timing out!
... View more
11-01-2011
11:48 PM
Ok, I have found out that there is an automated feature in splunk that allows you to export your results at a Click of a Button ( Basically the Action Menu 😛 ).
I also discovered with Damien's help that I can play around with it using the REST API, via a Python Script so that I may Modify the XML to the way I want it to look.
But Im not exactly %100 sure that if you can Modify the OutPut XML to your requirements?, can this be done?, has anyone ever tried this?, again the only person I found that actually engaged in performing this the way I want to is MW with his question: http://splunk-base.splunk.com/answers/13739/output-xml-via-a-custom-search-command
... View more
11-01-2011
10:50 PM
So I can extract the events and arrange them by there field names using a python script to do so?
... View more
