About paulstout

paulstout · ‎01-22-2018

David, I agree that it's likely a conflict between the globe's stylesheet and your dashboard stylesheet. The only thing that stands out to me is the .panel-body class being set to text-align:center. This is apparent knowing this property is not set by Splunk default, the globe seems to be half cut off meaning the entire webgl canvas may be centered and the overflow-x obscured, and the legend entries are centered and this is not usually how they render. Can you disable this in the CSS, hit the _bump endpoint, and let me know if that clears up the alignment issue? If that does work, it may make sense to use another or more specific selector than .panel-body Otherwise I will reconstruct a dashboard with the CSS you've provided and troubleshoot from there.

paulstout · ‎01-18-2018

Thank you, David. I'll look into this and get back to you by Monday.

paulstout · ‎01-18-2018

David, I will look into this. I have an idea of what may be causing this issue. Could you post a screenshot of your issue for me? Thank you!

paulstout · ‎08-23-2017

Have you set up outputs.conf on your components? Splunk requires outputs.conf to be configured -- same as the universal forwarders -- before these components will send their logs to your index cluster. You can find more information in this documentation link: https://docs.splunk.com/Documentation/Splunk/6.6.2/DistSearch/Forwardsearchheaddata

paulstout · ‎07-11-2017

Joe, Because we know this timezone offset is incorrect in the source data as it is annotating the time in which the device is deployed rather than the timezone in which the event occurred, I used SED to strip it out in props.conf and kept the rest of your configuration. It worked on my local Splunk with your line of test data. I added this just before TIME_PREFIX: SEDCMD-notz = s/\-[0-9][0-9]:[0-9][0-9]\]/]/

paulstout · ‎06-07-2017

If you add an ID to the panel "bubblechart", then add this as a script to the dashboard, it'll re-write the epoch time strings to a date format. Verified working on Splunk 6.4.4. require(['jquery', 'splunkjs/mvc/simplexml/ready!'], function($) { setTimeout(function(){ $('#bubblechart').find('.highcharts-xaxis-labels').children('text').each(function(){ var epochtime = parseInt($(this).html().replace(/\,/g,''),10); var objDate = new Date(epochtime*1000); $(this).html(objDate.toLocaleDateString('en-US')); }); }, 1000); });

paulstout · ‎04-26-2017

csprice, we are actively looking to migrate this scenario as well and running into similar challenges. We've engaged Splunk support/PS to help; I'll be happy to let you know what we find out! If you learn anything new in the meantime, can you please let me know? Thank you!

paulstout · ‎02-24-2017

Would it be possible to assign a different sourcetype to events matching MyRegexA and MyRegexB? Example: Let: SourcetypeA = the incoming sourcetype SourcetypeB = the new sourcetype that we do not want to discard props.conf [sourcetypeA] TRANSFORMS-checkAB=checkAB, discardB transforms.conf [checkAB] REGEX = YOUR_A_AND_B_REGEX DEST_KEY = MetaData:Sourcetype FORMAT = SourcetypeB [discardB] REGEX = YOUR_B_REGEX DEST_KEY = queue FORMAT=nullQueue

paulstout · ‎02-17-2017

I was afraid of that. The events are quite infrequent and we run at a pretty low mem% so this may be the only option for now. Thanks! I just found it odd that Splunk would process the event through the entire pipeline just to throw it away at the end. Seems it would make more sense to pick up that the event was destined for the nullQueue and drop it first before applying additional processing.

paulstout · ‎02-17-2017

The challenge is that we want most of the events in the log, so blacklisting the file will not work for us. It's only certain junk lines within the file we are indexing that we want to discard. If there's a way to filter only certain events within a log file we need this at the UF layer, please share! example.log TIMESTAMP INFO INFO StuffWeWant TIMESTAMP INFO INFO StuffWeWant TIMESTAMP INFO INFO StuffWeWant TIMESTAMP INFO INFO StuffWeWant TIMESTAMP ABSOLUTE JUNK THAT MAKES NO SENSE AND JUST CONFUSES SEARCHES TIMESTAMP INFO INFO StuffWeWant TIMESTAMP INFO INFO StuffWeWant TIMESTAMP INFO INFO StuffWeWant TIMESTAMP INFO INFO StuffWeWant TIMESTAMP INFO INFO StuffWeWant

paulstout · ‎02-17-2017

Here's the setup: We have a sourcetype that we exclude certain events by routing them to the nullQueue based on a REGEX with a props/transforms stanza duo. This action works as we would expect; the events we do not want are not indexed. What we've come to learn is that some of these lines are more than 10,000 characters. We have not updated the TRUNCATE setting for these events because we drop them and to our knowledge no other events in the file exceed this length. We didn't realize that LineBreakingProcessor would still complain about truncating the events. If I understand Splunk data correctly, the nullQueue routing occurs at the index pipeline which is downstream from the parsing pipeline. In an effort to clear up our _internal and reduce the amount of time Splunk spends on the parsing pipeline, is there any way to catch these events before they hit the parsing queue? Perhaps at the forwarder layer? If not, what are the performance implications of continually raising the TRUNCATE setting? We've done this for several data sources that we need and are actually really long (splunkd_remote_searches, itsi_internal_log, various structured XML/JSON data sources) and I would like to be confident we are not setting ourselves up for more issues. We index multiple terabytes a day. Thank you!

paulstout · ‎02-17-2017

What would the performance impact of this be? I'd like to do the same thing, and assumed it was not possible. In one of our services, we have 765 entities and I worry that creating 765 services with one entity and assigning KPIs against all of these services would overwhelm our environment.

paulstout · ‎02-17-2017

Yikes, thanks for the answer! I actually found what was going on in our environment -- someone or something (could have been a CSV import) had configured entities in our ITSI environment that had different names, but host=xxx for one of the alias fields overlapped with the entities I'd configured. Once I removed the duplicate entities, data began reporting against all 104 hosts. Kinda stupid of me not to check, but I just didn't think that would happen and our entities were 15,000 strong at that point. Lesson learned and great tips for investigating future issues, thank you!

paulstout · ‎02-13-2017

We have 104 entities configured under a specific service in Splunk IT Service Intelligence (ITSI). This service also has 21 KPIs assigned (including Service Health Score). When in the Service Detail view, only 46 entities show when selecting the individual KPIs -- for all 21 KPIs. All 104 entities show on the Service Editor view. I investigated the generated search for one of the KPIs and found that all 104 hosts were represented in the generated search. This is the same for KPIs generated from a base search or ad-hoc search. We do not use data models for this service. Why could this happen? My concern is that the aggregate KPIs are not accounting for all 104 entities and our service visibility may be hindered. Any help would be greatly appreciated.

paulstout · ‎02-13-2017

Hi there! I work on ITSI as well as from my understanding you can only have one entity split by field when configuring the KPI. I have a few situations where I have entities as "hosts" and entities as processors/queues within Splunk (name=x, group=x, etc) but do not have KPIs that reference both a host and a process. I checked up on the documentation and all of the language when describing the entity lookup field is singular and does not mention multiple split-by fields: http://docs.splunk.com/Documentation/ITSI/latest/Configure/HowtocreateKPIsearches#Split_by_Entity Whereas in correlation searches, the documentation specifies that multiple fields can be used for throttling: http://docs.splunk.com/Documentation/ITSI/latest/User/CreateCorrelationSearch What are you trying to monitor by splitting your KPI by process and entity? Although it doesn't seem possible to configure this in the ITSI KPI search, there may be other ways to achieve your monitoring goals.

paulstout · ‎02-09-2017

What you're asking do to sounds a lot like this question: https://answers.splunk.com/answers/11617/route-unwanted-logs-to-a-null-queue.html You'd want to use this REGEX in transforms.conf: REGEX=Type=Information That should filter for the WinEventLog:* sourcetypes

paulstout · ‎02-09-2017

Yikes, that's about the end of my experience and you're right; I realized that those attributes applied to the GeneratingCommand class yesterday evening... The command I built recently wouldn't get off the indexers until I changed the stream to 'reporting' and I did not want it distributed since it calls back to our ITSI kvstore. I looked through generating_command.py and it looks like declaring your command as a GeneratingCommand that is configured to operate in the streams pipeline may work? If that's not possible or doesn't work I got nothing 😕

paulstout · ‎02-08-2017

Thank you! Yes, our platform services team is responsible for care and feeding of Splunk as well as some of the ES notable events. My question was from a desire to create a single pane of glass -- ideally filtered views for different teams -- for a better user experience, easier to manage, etc etc. I can appreciate the difficulty in integrating these -- maybe moving the notable events to the kvstore would make this easier in future releases? Thanks again, this answered my question.

paulstout · ‎02-08-2017

Is it possible to merge the notable events from Splunk IT Service Intelligence (ITSI) and Splunk Enterprise Security (ES)? Ideally, I'd like to create a single location where our analysts can review incidents. ITSI is not in production at this time, but it would be possible to install that on an ES search head if that would help. Any insight would be appreciate, thanks!

paulstout · ‎02-08-2017

To meet the original 3 second requirement, | where duration_s>3 or | search duration_s>3 should suffice.

paulstout · ‎02-08-2017

Could you try this search? host=name | rex field=_raw "Duration\:\s(?<duration_s>\d+)\ss\.\s+(?<duration_ms>\d+)\sms" | eval duration=duration_s+(duration_ms/1000) | search duration_s="*" ? This would give you a float with the actual duration in duration and separate fields for the second and millisecond component to use your original filtering.

paulstout · ‎02-08-2017

Could this possibly be the reason: @Configuration(distributed=True, local=False) I built a custom GeneratingCommand recently; perhaps try the following configuration? @Configuration(type='streaming', distributed=True) or @Configuration(streaming=True, local=False) These are different configurations for the same outcome on different SCP versions -- more on this documentation page: http://docs.splunk.com/DocumentationStatic/PythonSDK/1.6.0/searchcommands.html#splunklib.searchcommands.StreamingCommand

paulstout · ‎02-08-2017

This documentation page covers everything you need (in far more depth than I could rattle off): http://docs.splunk.com/Documentation/Splunk/6.5.2/Updating/Aboutdeploymentserver

paulstout · ‎02-07-2017

From my understanding and assuming the file is in the same location, inputs.conf does not need any special treatment. I presume you're using a deployment server so you'll want to create an app containing the inputs.conf, define a serverclass for the 64 machines, then add a stanza to push that app to the defined serverclass.

paulstout · ‎02-07-2017

I am testing throttling/suppression on ITSI and would like to clear out the notables generated so far. Is this as simple as clearing them from index=itsi_tracked_alerts, or are there other cleanup tasks I should complete as well? If there's a published method I'm happy to read up on it myself, and thank you!

Posts	26
Solutions	3
Karma Given	0
Karma Received	7
Member Since	‎07-27-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How do we keep Splunk from complaining about an ev...

Why is Splunk IT Service Intelligence (ITSI) not s...

Can we merge notable events from Splunk IT Service...

What's a safe way to clear all ITSI notable events...

Re: Not centering when in a panel

Re: Not centering when in a panel

Re: Not centering when in a panel

Re: How can I monitor Splunk instances (deployment...

Re: How to edit props.conf to ignore timezone info...

Re: How to edit my search to create a bubble chart...

Re: Is there a concise guide for migrating an ITSI...

Re: Regex for nullQueue, conditional regex. Can so...

Re: How do we keep Splunk from complaining about a...

Re: How do we keep Splunk from complaining about a...

How do we keep Splunk from complaining about an ev...

Re: Splunk IT Service Intelligence: Can I show a K...

Re: Why is Splunk IT Service Intelligence (ITSI) n...

Why is Splunk IT Service Intelligence (ITSI) not s...

Re: Splunk ITSI - using different types of entitie...

Re: How to filter or blacklist all event type/leve...

Re: Custom Streaming Command Won't Distribute to I...

Re: Can we merge notable events from Splunk IT Ser...

Can we merge notable events from Splunk IT Service...

Re: How to extract fields with a value greater tha...

Re: How to extract fields with a value greater tha...

Re: Custom Streaming Command Won't Distribute to I...

Re: What configurations would be made to inputs.co...

Re: What configurations would be made to inputs.co...

What's a safe way to clear all ITSI notable events...

Are you a member of the Splunk Community?