About sondradotcom

sondradotcom · ‎11-10-2013

Hey there! I'm trying to change the logo in the upper left hand corner in my 6.0 instance. The 5.0 instructions no longer seem to apply, and the documentation doesn't appear to have been updated. Any suggestions?

sondradotcom · ‎05-21-2013

Team, This isn't so much a question as a question AND answer: Q: I love to make forms in Splunk but if I had a cheat sheet, it would be so much easier! A: You're in luck! There's one available here: http://blogs.splunk.com/wp-content/uploads/2013/05/form_cheatsheet.pdf Q: Great! Also, where'd you get your shoes? I love them! -S.

sondradotcom · ‎05-14-2013

Team, Editing simple xml in the Splunk GUI is awesome, but making the "Submit" button work via quick key, rather than making the user switch from keyboard to mouse with each submit, would be even more awesome. Thoughts on that? Is it out there and I just don't know it? -S.

sondradotcom · ‎03-14-2013

Team! I'm used to working with summary indexes and tonight I thought I'd noodle with accelerated searches. My first search looked like this: sourcetype="cisco_ips_syslog" | stats count by dest_ip If a subsequent search is: sourcetype="cisco_ips_syslog" dest_ip="10.1.15.2" | stats count by dest_ip Will it pull from the accelerated search or will it pull from the raw data? Secondly, if my search is: sourcetype="cisco_ips_syslog" dest_ip="10.1.15.2" | timechart span=1d count by dest_ip Will THAT pull from the accelerated search or from the raw data? Thanks! -S.

sondradotcom · ‎06-27-2012

I can't seem to get it to not parse some of this, but hopefully you get the right idea. <form> <label>Live Stream Form</label> <fieldset> <input type="dropdown" token="Streamname"> <choice value="*">All Streams</choice> <populatingSearch fieldForValue="Streamname" fieldForLabel="Streamname">| inputlookup Streams | dedup Streamname | sort Streamname</populatingSearch> </input> <input type="time"> <default>Last 7 days</default> </input> </fieldset> <row> <single> <searchTemplate>index=summary search_name="si_flashlive_filename" Streamname="$Streamname$" | stats count | eval count = tostring(count,"commas")</searchTemplate> <title>Total Requests</title> </single> </form>

sondradotcom · ‎06-27-2012

I'm using <input type="time"> in my form, but I can't figure out how to make the subsequent tables actually "hear" the time range. They seem to default to looking at the entire set of data regardless of what the time pulldown is set to. Any thoughts? -S.

sondradotcom · ‎06-25-2011

Splunkers, I'm trying to get splunk to help me with the analysis of survey responses. I have the command: * | stats count(eval(Gender="Male")) as Male count(eval(Gender="Female")) as Female by Easy_to_Understand Which results in a nice table breaking down responses to a question by gender: Easy_to_Understand Male Female Below Expectations 10 4 Exceeds Expectations 25 22 Meets Expectations 70 36 The problem is that an uneven number of Males and Females responded to the survey. So, instead of a table with count, I'd like a table with each cell showing a % of total male responses and female responses respectively, so something like: Easy_to_Understand Male Female Below Expectations 9% 6% Exceeds Expectations 23% 35% Meets Expectations 67% 58% Any thoughts? Thanks! -S.

sondradotcom · ‎06-24-2011

Team, I have a dashboard that I'd like to schedule to be emailed once a week. The dashboard takes about 30 seconds to fully render when I load it in my browser. However, when I schedule it for email delivery, the PDF looks like it was generated before the dashboard had a chance to fully render. Some of the reports are empty, some are only partially generated. Any thoughts? Thanks! -S.

sondradotcom · ‎05-23-2011

Color me impressed zpavic... Feel like sharing your approach?

sondradotcom · ‎05-23-2011

Team, I'm cobbling together a Splunk app that monitors twitter and facebook data available through their APIs, and I was wondering if there are any well-worn paths for plugging this data in. On my own, I'd probably create a php script that ran every minute or so, threw the data into a log file, and had splunk monitor that log file. Is that the easiest? Is there something even easier? -S.

sondradotcom · ‎05-05-2011

Ah, perfect! Thanks! -S.

sondradotcom · ‎05-05-2011

Team, I'm trying to better understand the under-the-hood part of splunk. I thought that when you set the permissions to global of, say, a field extraction that the system actually moved those lines from the "etc/apps/search/local/props.conf" file to the "etc/default/local/props.conf" file. Am I wrong about that? As it stands, I have some field extractions that are set to "global" but that still live in "etc/apps/search/local/props.conf" Thanks! -S.

sondradotcom · ‎05-03-2011

Okay, follow up: what if you want a list of distinct values. My lookup has some values that show up more than once in the same column -- how do I filter it down to one time?

sondradotcom · ‎05-03-2011

I had a feeling. You splunk people are AWESOME! Truly.

sondradotcom · ‎05-03-2011

This may sound odd, but I wonder if there's a query that will just return your lookup table. Basically, I want to create a pulldown-driven form in Splunk, and I want to populate the pulldown with the contents of specific lookup table. I could just paste the values in, I suppose, but I don't want to maintain that list in two places. Alternatively, I could run a splunk query that would likely return all the results of that lookup table, but that seems like a lot of overhead. Any thoughts? Thanks! -S.

sondradotcom · ‎04-27-2011

I'd like to switch to LDAP but, since my corner of the organization doesn't have control over those groups, I'd like to make sure I have a plan B in case I want to give a specific user some specific capabilities. Can I add and modify users in Splunk's built in system AFTER I've converted to LDAP? Thanks! -S.

sondradotcom · ‎01-28-2011

Ah! Helpful. So, if I salt the CRC with, say, , will it go back and re-index everything, including the files that are already indexed perfectly well? -S.

sondradotcom · ‎01-28-2011

Splunk is monitoring several folders, but upon careful inspection I've noticed that it seems to be "skipping" files here and there. What's the easiest way to "make" Splunk go back and read in those files? Thanks, -S.

sondradotcom · ‎12-02-2010

I have tried that, but it doesn't seem to save this manually triggered search in such a way that it overwrites the most recent scheduled run of the same report (and therefore show up in the dashboards that refer to it...).

sondradotcom · ‎12-01-2010

I'm building some dashboards with panels that refer to scheduled saved searches. To be prudent, I'm scheduling the search to run once an hour. However, as I'm building the dashboard and tweaking the syntax for the saved search, I'd like to be able to manually run the saved search and have the results show up in the dashboard immediately. Right now the panel in the dashboard will only show the most recent scheduled saved search. So, for example: 1) I design a search, save it, schedule it to run hourly, create a dashbhoard, add it as a panel. It shows up -- great. 2) I go back and modify the saved search. Go back to dashboard. Panel still only shows first version of saved search. Must wait 1 hour to see changes. So, I know I can just temporarily schedule the saved search to run every minute, but that seems inelegant. Is there a more elegant way to manually run a scheduled save search and see the results propagate across the dashboard panels that refer to that saved search? Thanks! -S.

sondradotcom · ‎08-30-2010

Okay, my summary index looks like this: sourcetype="blah" | sistats count by email I'd like to run a query against the index to determine the distinct number of email addresses that appear during a specific time period, as in: index="summary" search_name="" earliest="-1d@d" latest="0d@d" | stats dc(email) But it's coming up blank. Any thoughts? Thanks! -S.

sondradotcom · ‎08-27-2010

So, I'm searching against a summary index. In an effort to keep the summary index multi-purpose, I created it as a sistats (run hourly), as in: sourcetype="blah" earliest="-2h@h" latest="-1h@h" | sistats count by email So if I used "top" for a query on the summary index, and a certain email showed up 100 times each hour, "top" would only count the number of times the email showed up in the summary index (a maximum of one per hour). So, is it possible to imitate "top" in this circumstance? Am I just making this too hard on myself?

sondradotcom · ‎08-27-2010

I'm trying to figure out how to calculate a percent of total such that: search string | stats count percent by email Would spit out: EMAIL COUNT PERCENT email@blah.com 5 10% otheremail@blah.com 10 20% Thanks! -S.

sondradotcom · ‎08-17-2010

I'm using the API via the php sdk. Things are going well except for one thing -- I can never get more than 100 results. When I'm running a timechart query, for example, for a period of a week and a span of 1 hour, I should get 168 results but it stops at 100. Any thoughts? Thanks! -S.

Posts	24
Solutions	0
Karma Given	1
Karma Received	35
Member Since	‎08-17-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Change Logo in 6.0

Splunk Simple XML Form Cheat Sheet

Quick Key for Simple XML editing form?

Report Acceleration Repurposing?

input type="time"

Percent of Subtotals

Scheduled PDFs End Up Blank

Easiest way to get REST API data INTO SPLUNK?

What happens when I set the permissions to "Global...

Can you just search your lookup table?

Change Logo in 6.0

Splunk Simple XML Form Cheat Sheet

Quick Key for Simple XML editing form?

Report Acceleration Repurposing?

Re: input type="time"

input type="time"

Percent of Subtotals

Scheduled PDFs End Up Blank

Re: Easiest way to get REST API data INTO SPLUNK?

Easiest way to get REST API data INTO SPLUNK?

Re: What happens when I set the permissions to "Gl...

What happens when I set the permissions to "Global...

Re: Can you just search your lookup table?

Re: Can you just search your lookup table?

Can you just search your lookup table?

Can you add users with Splunk's built in authentic...

Re: Monitoring Folders

Monitoring Folders

Re: Manually Trigger Scheduled Saved Search

Manually Trigger Scheduled Saved Search

Distinct Count on Summary Index

Re: Percent of Total

Percent of Total

API limits to 100 results