About ruman

ruman · ‎10-11-2014

and even better, setting the time picker to the exact day the events start, makes the buckets start on that day, e.g. i can make sure the buckets start on mondays by having the timepicker set earliest to -3w@w1.

ruman · ‎10-11-2014

yup, ding. setting the time picker to all time makes very normal buckets. thanks everyone.

ruman · ‎10-11-2014

no, the time picker was definitely not set to 'all time', and the external command i'm running completely ignores the time picke.r

ruman · ‎10-11-2014

oh, that's really interesting. so maybe i need to match the time picker to range of the events that hit timechart in order to make the buckets happy? i've got lots to experiment with now, thank you!

ruman · ‎10-11-2014

in this case the events are coming from an external command, then i'm removing older events with a where clause. i don't know what that means "earliest" is. And I don't quite get what's going on with your gist, but I'll experiment with it and write back...if span=w, then why does earliest need be -40d or earlier? | foo bar bas | eval earliest_ts=relative_time(now(), "-3w@w0") | where _time > earliest_ts | timechart span=1w count by bat

ruman · ‎10-11-2014

okay, i tried!

ruman · ‎10-10-2014

I have 26 days of events (Monday 9/15 through Friday 10/10) piped to a timechart span=7d. I'd like to have 3 buckets of 7 days each, and one bucket with the 5 remainder days. It doesn't matter to me if the remainder bucket is at the beginning or end but it would be nice if Splunk was consistent about it. Instead, my buckets begin at 9/15, 9/22, 9/29 (Mondays), 10/3, 10/10 (Fridays) which means I have 5 buckets, instead of 4, with 7, 7, 4, 7, and 1 day in them. How can I make timechart behave reasonably? I'm running Splunk 6.1.2

ruman · ‎05-27-2014

How are you viewing the CSV file? Assuming the output is UTF-8 (which should be the case unless you've instructed Splunk to use a different character set for this source), you might need to tell Excel to use UTF-8 when you open the CSV. http://stackoverflow.com/a/6488070 has some instructions for this. If you are opening it with another application, make sure that it supports and recognizes the character set that the data is in.

ruman · ‎01-03-2014

hmm. this doesn't work for me in splunk 6.0. even with a default.meta that exports everything. according to http://wiki.splunk.com/Community:TroubleshootingAlertScripts, the script in the app will only be accessible by saved searches in the app's context. i wonder if this used to work but was broken in 6.0? December 16 2011 would have been splunk 4.2 IIRC...maybe i'll downgrade and see if it works there...

ruman · ‎11-26-2013

There are a couple of good answers here for deduping a multivalue field in a search, but how can I dedupe a multivalue field with a props or transforms (or whatever) configuration so that it happens automatically?

ruman · ‎11-05-2013

Wonderful! I'm so happy it's working. Please let me know if you run into any other issues, or have any ideas for new features.

ruman · ‎11-05-2013

Did you restart splunk after editing config.ini. I was able to reproduce, and also confirm that a restart is required.

ruman · ‎11-05-2013

There were some new config.ini fields added in issue #13. Please try adding these defaults to your config.ini: jira_protocol = https jira_port = 443 soap_protocol = https soap_port = 8080

ruman · ‎11-05-2013

I just pushed a fix to github. Please pull, or apply these changes: https://github.com/firebus/splunk-jira/commit/bad727cc88b8dca2b2263be1a000de072dc9027a

ruman · ‎11-05-2013

This sounds like an issue with time_keys being empty that was reported in https://github.com/firebus/splunk-jira/issues/13 which I haven't had a chance to verify yet. You can try the workaround suggested by enthusiast near the end of the thread. I will verify, open a new issue, and fix ASAP.

ruman · ‎06-05-2013

Thanks! I updated the link above as well - apparently we need to use splunk-base hostname now for the friendly links...

ruman · ‎03-09-2013

Here you go! http://splunk-base.splunk.com/apps/JIRA

ruman · ‎02-14-2013

Wow! That's perfect. For my case, just a naked array instead of an array of objects, I was able to say foo=["","apples","oranges"] | eval foo="{\"foo\":" + foo + "}" | spath input=foo output=bar path=foo{} Thanks!

ruman · ‎10-25-2012

The fact that spath input=foo correctly creates a multiple value field, with correct data, suggests that the JSON is well-formed. As noted, the JSON in question is ["","apples","oranges"] - let me know if there's something wrong with that. Maybe I should provide the original event: [25-Oct-2012 13:37:38] INFO [test] foo="[\"\",\"apples\",\"oranges\"]" There's a transform that handles the escaped quotes gracefully.

ruman · ‎10-25-2012

The field value is ["","apples","oranges"] | spath input=foo creates a multi-value field named '{}'. which is a little weird. | spath input=foo output=bar fails. splunk complains Error in 'spath' command: You have not specified a path. Try using "path=mypath" as an argument to spath. I can't find a value for path that works, given that i want to address the root. A kludgey workaround is | spath input=foo | rename "{}" AS bar , but it would be nicer if this was possible with spath alone.

Posts	20
Solutions	0
Karma Given	16
Karma Received	9
Member Since	‎03-05-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

piping events from a custom generating command int...

How can i dedupe a multivalue field in props or tr...

How to handle simple JSON array with spath

Re: piping events from a custom generating command...

Re: piping events from a custom generating command...

Re: piping events from a custom generating command...

Re: piping events from a custom generating command...

Re: piping events from a custom generating command...

Re: piping events from a custom generating command...

piping events from a custom generating command int...

Re: Korean character is broken when I export the q...

Re: Change scripted alert script location?

How can i dedupe a multivalue field in props or tr...

Re: JIRA App for Splunk - Error: command="jira", I...

Re: JIRA App for Splunk - Error: command="jira", I...

Re: JIRA App for Splunk - Error: command="jira", I...

Re: JIRA App for Splunk - Error: command="jira", I...

Re: JIRA App for Splunk - Error: command="jira", I...

Re: Any update on Splunk for Jira app

Re: Any update on Splunk for Jira app

Re: How to handle simple JSON array with spath

Re: How to handle simple JSON array with spath

How to handle simple JSON array with spath