Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About wegscd
wegscd
Contributor
Member since:
02-26-2014
06-05-2020
Community Statistics
| Posts | 114 |
| Solutions | 5 |
| Karma Given | 12 |
| Karma Received | 20 |
| Member Since | 02-26-2014 |
Activity Feed
- Got Karma for Re: Why am I getting duplicate values for all fields from JSON events?. 03-30-2021 12:37 AM
- Got Karma for How can I use reduce to avoid previewing a report from a slow search until it's done?. 06-05-2020 12:49 AM
- Karma Re: How to programmatically add an application to a server class in deployment server? for ryanoconnor. 06-05-2020 12:48 AM
- Karma Re: Has anyone seen the word 'null' in SEP logs rather than a delimiter? for gjanders. 06-05-2020 12:48 AM
- Karma Re: Why am I getting duplicate values for all fields from JSON events? for woodcock. 06-05-2020 12:48 AM
- Karma Re: Why am I getting duplicate values for all fields from JSON events? for satishsdange. 06-05-2020 12:48 AM
- Got Karma for Re: Unable to manipulate serverclass whitelist via REST. 06-05-2020 12:48 AM
- Got Karma for Re: Unable to manipulate serverclass whitelist via REST. 06-05-2020 12:48 AM
- Got Karma for Re: Unable to manipulate serverclass whitelist via REST. 06-05-2020 12:48 AM
- Got Karma for More DB Connect timestamp parsing trouble. 06-05-2020 12:48 AM
- Got Karma for Re: easy way to change _TCP_ROUTING = * ?????. 06-05-2020 12:48 AM
- Got Karma for easy way to change _TCP_ROUTING = * ?????. 06-05-2020 12:48 AM
- Got Karma for Re: Why am I getting duplicate values for all fields from JSON events?. 06-05-2020 12:48 AM
- Got Karma for Re: Why am I getting duplicate values for all fields from JSON events?. 06-05-2020 12:48 AM
- Got Karma for Re: Why am I getting duplicate values for all fields from JSON events?. 06-05-2020 12:48 AM
- Got Karma for Re: Why am I getting duplicate values for all fields from JSON events?. 06-05-2020 12:48 AM
- Karma Re: Why is the default.xml of my app picking up saved searches from other applications and how do I fix this? for MuS. 06-05-2020 12:47 AM
- Karma Re: DB Connect configuration: Unable to save database inputs and slow search query for gcoles. 06-05-2020 12:47 AM
- Karma Feature Request: How to embed a dashboard (not a report) that is updated every hour in a webpage? for lquinn. 06-05-2020 12:47 AM
- Karma Re: What index(es) should the Splunk App for ServiceNow place its data in? for rpille_splunk. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 |
02-27-2018
05:43 AM
there is nothing in local/ to override default/commands,conf, and nothing there got overwritten in the upgrade. The btool says that the local = true in default is being used.
/opt/splunk/etc/apps/whirlpool_netbotz/default/commands.conf [netbotzextract]
/opt/splunk/etc/system/default/commands.conf changes_colorder = true
/opt/splunk/etc/apps/whirlpool_netbotz/default/commands.conf enableheader = true
/opt/splunk/etc/apps/whirlpool_netbotz/default/commands.conf filename = netbotzextract.py
/opt/splunk/etc/system/default/commands.conf generates_timeorder = false
/opt/splunk/etc/system/default/commands.conf generating = false
/opt/splunk/etc/system/default/commands.conf is_risky = false
/opt/splunk/etc/apps/whirlpool_netbotz/default/commands.conf local = true
/opt/splunk/etc/system/default/commands.conf maxinputs = 50000
/opt/splunk/etc/apps/whirlpool_netbotz/default/commands.conf outputheader = true
/opt/splunk/etc/apps/whirlpool_netbotz/default/commands.conf overrides_timeorder = true
/opt/splunk/etc/system/default/commands.conf passauth = false
/opt/splunk/etc/system/default/commands.conf perf_warn_limit = 0
/opt/splunk/etc/system/default/commands.conf required_fields = *
/opt/splunk/etc/system/default/commands.conf requires_preop = false
/opt/splunk/etc/apps/whirlpool_netbotz/default/commands.conf requires_srinfo = true
/opt/splunk/etc/system/default/commands.conf retainsevents = false
/opt/splunk/etc/apps/whirlpool_netbotz/default/commands.conf stderr_dest = message
/opt/splunk/etc/apps/whirlpool_netbotz/default/commands.conf streaming = true
/opt/splunk/etc/apps/whirlpool_netbotz/default/commands.conf supports_getinfo = true
/opt/splunk/etc/apps/whirlpool_netbotz/default/commands.conf supports_multivalues = true
/opt/splunk/etc/apps/whirlpool_netbotz/default/commands.conf supports_rawargs = true
/opt/splunk/etc/system/default/commands.conf type = python
/opt/splunk/etc/apps/whirlpool_netbotz/default/commands.conf [netbotzreport]
/opt/splunk/etc/system/default/commands.conf changes_colorder = true
/opt/splunk/etc/apps/whirlpool_netbotz/default/commands.conf enableheader = true
/opt/splunk/etc/apps/whirlpool_netbotz/default/commands.conf filename = netbotzreport.py
/opt/splunk/etc/system/default/commands.conf generates_timeorder = false
/opt/splunk/etc/system/default/commands.conf generating = false
/opt/splunk/etc/system/default/commands.conf is_risky = false
/opt/splunk/etc/apps/whirlpool_netbotz/default/commands.conf local = true
/opt/splunk/etc/system/default/commands.conf maxinputs = 50000
/opt/splunk/etc/apps/whirlpool_netbotz/default/commands.conf outputheader = true
/opt/splunk/etc/apps/whirlpool_netbotz/default/commands.conf overrides_timeorder = true
/opt/splunk/etc/system/default/commands.conf passauth = false
/opt/splunk/etc/system/default/commands.conf perf_warn_limit = 0
/opt/splunk/etc/apps/whirlpool_netbotz/default/commands.conf required_fields = mib,oid,snmp_index,value
/opt/splunk/etc/system/default/commands.conf requires_preop = false
/opt/splunk/etc/apps/whirlpool_netbotz/default/commands.conf requires_srinfo = true
/opt/splunk/etc/system/default/commands.conf retainsevents = false
/opt/splunk/etc/apps/whirlpool_netbotz/default/commands.conf stderr_dest = message
/opt/splunk/etc/apps/whirlpool_netbotz/default/commands.conf streaming = true
/opt/splunk/etc/apps/whirlpool_netbotz/default/commands.conf supports_getinfo = true
/opt/splunk/etc/apps/whirlpool_netbotz/default/commands.conf supports_multivalues = true
/opt/splunk/etc/apps/whirlpool_netbotz/default/commands.conf supports_rawargs = true
/opt/splunk/etc/system/default/commands.conf type = python
... View more
02-26-2018
10:29 AM
We've had some custom commands defined on our indexers for years. Here is /opt/splunk/etc/apps/whirlpool_netbotz/default/commands.conf:
[netbotzreport]
filename = netbotzreport.py
enableheader = true
outputheader = true
requires_srinfo = true
stderr_dest = message
supports_getinfo = true
supports_rawargs = true
supports_multivalues = true
local = true
streaming = true
# this should not be necessary
overrides_timeorder = true
required_fields=mib,oid,snmp_index,value
[netbotzextract]
filename = netbotzextract.py
enableheader = true
outputheader = true
requires_srinfo = true
stderr_dest = message
supports_getinfo = true
supports_rawargs = true
supports_multivalues = true
local = true
streaming = true
# this should not be necessary
overrides_timeorder = true
[pipesniff]
filename = pipesniff.py
enableheader = true
outputheader = true
requires_srinfo = true
stderr_dest = message
supports_getinfo = true
supports_rawargs = true
supports_multivalues = true
local = true
streaming = true
Sometime in the last month, searches using these commands have started failing with these messages from the indexers:
[awnulsplunkp1] Search Factory: Unknown search command 'netbotzextract'.
We did a 6.5 -> 7.0 last week, which I suspect is what changed.
Why are the indexers trying to execute these command if they are defined as 'local = true'?
... View more
01-22-2018
05:35 AM
The data has been parsed correctly. This is a display side issue.
... View more
01-05-2018
05:39 AM
The data is apparently being parsed correctly (remember, it displays correctly when syntax is highlighted). Will charset = auto affect parsing or display?
... View more
01-04-2018
02:05 PM
I have a JSON data source with data like this:
{"download.doc_title": "GCP-7 R\u00f3znorodnosc, R\u00f3wne Szanse Oraz Szacunek W Miejscu Pracy.pdf"}
If I look at the event syntax highlighted, it renders as I would expect:
{ [-]
download.doc_title: GCP-7 Róznorodnosc, Równe Szanse Oraz Szacunek W Miejscu Pracy.pdf
}
...but when I run any reports against, it shows up in the browser with the unicode escapes, instead of the unicode characters:
<searchcriteria> | table download.doc_title
shows
GCP-7 R\u00f3znorodnosc, R\u00f3wne Szanse Oraz Szacunek W Miejscu Pracy.pdf
how do I get it to show the Polish rendition?
GCP-7 Róznorodnosc, Równe Szanse Oraz Szacunek W Miejscu Pracy.pdf
... View more
08-23-2017
10:40 AM
It seems to behave using scp v1. I am putting together a test case; I'm getting very strange results.....
... View more
08-23-2017
07:33 AM
not sure, but I need to clear it out. If I put run_in_preview=False in map, I get
08-23-2017 10:29:38.001 INFO ChunkedExternProcessor - Running process: /opt/splunk/bin/python /opt/splunk/etc/apps/wegscd_command_test/bin/sap_abap_summarize.py
08-23-2017 10:29:38.104 WARN ChunkedExternProcessor - Unsupported metadata field sent by custom search command: run_in_preview
08-23-2017 10:29:38.104 INFO SearchParser - PARSING: sapabapsummarize phase="map"
... View more
08-23-2017
05:27 AM
That is the SCP V1 version of SCP V2's @Configuration(run_in_preview=False), which is already been done.
The extra runs I am seeing are during preview.
... View more
08-22-2017
11:58 AM
1 Karma
I have a ReportingCommand written in Python, and the SPL that feeds it is slowish.
To minimize visual churn on the screen, I don't want my command to provide intermediate results: I just want the reduce() method to get run once when all the data is ready to process.
I am using SCP 2, and I have my command annotated with run_in_preview=False, but reduce() is still getting run multiple times (with more and more input records, and preview=True is in self.metadata).
The SPL:
sourcetype=whr:sap:abap:audit | stats count, values(sourcetype) as sourcetype by sid | append [ | inputlookup whirlpool_sap_instances ] | sapabapsummarize
The command
@Configuration(requires_preop=True, run_in_preview=False)
class SapAbapSummarizeCommand(ReportingCommand):
@Configuration()
def map(self, records):
self.logger.info('SapAbapSummarizeCommand.map, phase = %s', self.phase)
r_count = 0
for record in records:
r_count = r_count + 1
yield record
self.logger.info('SapAbapSummarizeCommand.map done: %d', r_count)
@Configuration(run_in_preview=False)
def reduce(self, records):
self.logger.info('SapAbapSummarizeCommand.reduce, phase = %s', self.phase)
self.logger.info('SapAbapSummarizeCommand.reduce, metadata = %s', self.metadata)
r_count = 0
for record in records:
r_count = r_count + 1
# (other processing)
self.logger.info('SapAbapSummarizeCommand.reduce done: %d', r_count)
commands.conf:
[sapabapsummarize]
filename = sap_abap_summarize.py
chunked = true
How do I get reduce to know that all the results are in? The 'Preview' flag in the metadata is always True.
... View more
07-24-2017
05:59 AM
Another really good solution! I was thinking:
| streamstats count as _c1 | sort - _c1 | streamstats count as _c2 | where _c1=1 OR _c2=1 | sort c1
but I really wasn't aware of eventstats.
Repost this as an answer and I'll throw it some points!
... View more
07-24-2017
05:56 AM
cool; don't need to run preceding searches twice!
...now if Splunk would just document multireport! That command is an interesting solution to a number of problems.....
... View more
07-21-2017
02:17 PM
does this run search index=_internal sourcetype=splunkd log_level="INFO" component="Metrics" average_kbps=* twice?
... View more
07-21-2017
10:29 AM
I have a search yielding a series of events:
2017-05-15 68.222609
2017-05-16 68.243478
2017-05-17 68.276522
2017-05-18 68.292174
2017-05-19 68.326957
2017-05-20 68.333913
2017-05-21 68.333913
2017-05-22 68.356522
2017-05-23 68.382609
2017-05-24 68.419130
2017-05-25 68.436522
2017-05-26 68.448696
2017-05-27 68.450435
2017-05-28 68.448696
2017-05-29 68.457391
2017-05-30 68.570435
2017-05-31 68.593043
2017-06-01 67.612174
2017-06-02 67.622609
2017-06-03 67.626087
I want to transform it down to just the first and last
2017-05-15 68.222609
2017-06-03 67.626087
I can use earliest and latest to get everything down to a single event, like this
e_t e_v l_t l_v
05/15/2017 00:00:00 68.222609 06/03/2017 00:00:00 67.626087
and can probably figure out how to blow it into 2 events,
I can also use transaction and mvextract to get the first and last values out: How do I refer to the first, nth or last value of a multivalue field? , but I still have the "how do I turn this into 2 events" problem then
is there a better way than either of the above to do this?
... View more
06-01-2017
08:20 AM
The data would look like:
time=2017-03-31 message="Horriblosity occurred" count=14
... View more
06-01-2017
07:31 AM
This works for this use case. I have a similar one that may have embedded spaces in the field values, but that's another day (I'll probably just move to json as a file format...)
... View more
05-31-2017
01:58 PM
I have input data that looks like:
time=2017-05-29 calendar:num_1day_active_users=10437 gplus:num_1day_active_users=1 docs:num_1day_active_users=0 gmail:num_1day_active_users=24594 drive:num_1day_active_users=15787
I have done minimal work to props.conf, mostly to set up timestamp parsing.
The problem is that all the field names are being extracted as num_1day_active_users, and I am only getting the first value in the event (I get num_1day_active_users=10437).
If the colon were a period, then Splunk would auto-convert it to an underscore, and the fields would extract with names calendar_num_1day_active_users, gplus_num_1day_active_users, docs_num_1day_active_users, gmail_num_1day_active_users, and drive_num_1day_active_users.
How can I get Splunk to do the same for field names that contain colons?
... View more
04-17-2017
05:47 AM
python -V
Python 2.6.9
... View more
04-12-2017
07:02 AM
I had already restarted splunk and stopped the nmon processes before I received this. I will follow these instructions and post the results if the problem recurs.
I did notice two sets of nmon processes running when I was cleaning things up....
... View more
04-11-2017
10:22 AM
Trying out TA-nmon (1.3.13). I have it deployed on 3 Linux machines, two UFs (Universal Forwarders), and one SH (Search Head).
After one day of operation, one of the UFs stopped reporting some data. We're seeing messages like this from sourcetype nmon_processing (the exact section change from minute to minute)
CONFIG section: will not be extracted (time delta of 240 seconds is inferior to 1 hour)
CPUnn section: Wrote 2 lines
ERROR: hostname: kzoldapd3 :CPU_ALL section is not consistent: Detected anomalies in events timestamp, dropping this section to prevent data inconsistency
WARN: hostname: kzoldapd3 :PROC section data is not consistent: the data header could not be identified, dropping the section to prevent data inconsistency
VM section: Wrote 1 lines
UPTIME section: Wrote 1 lines
WARN: hostname: kzoldapd3 :PROCCOUNT section data is not consistent: the data header could not be identified, dropping the section to prevent data inconsistency
WARN: hostname: kzoldapd3 :TOP section data is not consistent: the data header could not be identified, dropping the section to prevent data inconsistency
Any idea of the cause?
What is the workaround?
... View more
10-12-2016
10:12 AM
why is it better than files?
... View more
10-12-2016
08:51 AM
We're having to write some custom scripts to read/tail binary data, format them into something Splunk-able (k1=v1 k2=v2 k3=v3), and get them into Splunk. This will be running on a machine that will have a UF....
At this point, I see three options for the "get them into Splunk" end:
write a scratch file into a directory that Splunk is monitoring
write against one of the SDKs to push the events into Splunk
use the HTTP Event Collector
I know that #1 performs well (and is easy to troubleshoot and test), but leaves me with a small scratch file management problem (which is very manageable). Since I am so lazy that I don't even want to solve that problem, I was wondering if anyone had any experience as to how well #2 and #3 hold up when looking at 7 million events/1.1 Gb a day...
... View more
09-22-2016
04:33 AM
This was the fix we needed!
... View more
08-16-2016
11:37 AM
1 Karma
make sense that this wouldn't work. The _TCP_ROUTING in a [default] stanza would only be used if _TCP_ROUTING was not specified elsewhere, and _TCP_ROUTING is specified elsewhere, so the [default] one gets ignored.
... View more
08-16-2016
05:01 AM
I hadn't receive gfuente's suggestion yet. which looks promising, I will have to see if it can be adapted to a deployment server fed environment (system/local/inputs.conf is not something that can be distributed via DS). That may be the way to go.
Right now, I just added overrides to the _TCP_ROUTING for guilty [monitor://] stanzas in a deployed inputs.conf:
[monitor://C:\Program Files\SplunkUniversalForwarder\etc\splunk.version]
_TCP_ROUTING = default-autolb-group
[monitor://C:\Program Files\SplunkUniversalForwarder\var\log\splunk\metrics.log]
_TCP_ROUTING = default-autolb-group
[monitor://C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log]
_TCP_ROUTING = default-autolb-group
It's ugly and a little brittle (will need to watch future versions to see if they add monitor: stanzas, and someone will break me sooner or later by deploying Splunk onto the 😧 drive), but it works.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
