Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About htkhtk
htkhtk
Path Finder
Member since:
09-09-2010
06-01-2026
Community Statistics
| Posts | 19 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 6 |
| Member Since | 09-09-2010 |
Activity Feed
- Karma Re: Using a subsearch in an eval line for Stephen_Sorkin. 06-05-2020 12:45 AM
- Karma How to expand 500 limits event for Transaction command? for TheGU. 06-05-2020 12:45 AM
- Got Karma for HiddenChartFormatter and showMarkers. 06-05-2020 12:45 AM
- Got Karma for Using a subsearch in an eval line. 06-05-2020 12:45 AM
- Got Karma for Using a subsearch in an eval line. 06-05-2020 12:45 AM
- Got Karma for Can splunk Index data from an HTTP address. 06-05-2020 12:45 AM
- Got Karma for Can splunk Index data from an HTTP address. 06-05-2020 12:45 AM
- Got Karma for Two earliest queries - want search to pick based upon newest. 06-05-2020 12:45 AM
- Posted Unviersal Forwarder without an app on Getting Data In. 06-01-2011 08:43 AM
- Tagged Unviersal Forwarder without an app on Getting Data In. 06-01-2011 08:43 AM
- Posted Re: Search using Stats, String Dates, Counts and Sorting on Splunk Search. 01-11-2011 04:38 PM
- Posted Re: Search using Stats, String Dates, Counts and Sorting on Splunk Search. 01-11-2011 04:35 PM
- Posted Search using Stats, String Dates, Counts and Sorting on Splunk Search. 01-11-2011 04:12 PM
- Tagged Search using Stats, String Dates, Counts and Sorting on Splunk Search. 01-11-2011 04:12 PM
- Tagged Search using Stats, String Dates, Counts and Sorting on Splunk Search. 01-11-2011 04:12 PM
- Tagged Search using Stats, String Dates, Counts and Sorting on Splunk Search. 01-11-2011 04:12 PM
- Tagged Search using Stats, String Dates, Counts and Sorting on Splunk Search. 01-11-2011 04:12 PM
- Posted Re: Certain Number of Results from a Certain Section of Results on Splunk Search. 12-17-2010 05:01 PM
- Posted Re: Certain Number of Results from a Certain Section of Results on Splunk Search. 12-16-2010 05:17 PM
- Posted Certain Number of Results from a Certain Section of Results on Splunk Search. 12-16-2010 02:41 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 2 | |||
| 2 | |||
| 1 | |||
| 0 |
06-01-2011
08:43 AM
Basically I want to be able to send JBoss server logs from one linux machine to another using the Splunk Universal Forwarder.
What do i need to configure?
I installed the splunk universal forwarder on the linux machine with JBoss.
I set up the receiving machine to listen on port 9997.
I also want the logs to go to a particular index.
Do I set up the monitor? Which side do monitors get set up? Which side does inputs.conf need updated?
... View more
- Tags:
- universal-forwarder
01-11-2011
04:38 PM
This helped me solve my problem though! I didn't know about bin and span. See this:
sourcetype="server_log" complete* | bin span=1d _time | dedup requestid | stats count by _time | sort _time desc
... View more
01-11-2011
04:35 PM
I wrote this question wrong.. I don't need the latest 7 days. I need the last 7 days that logs were written. So for example, it could be 11-27, 11-28, 12-02, 01-03
... View more
01-11-2011
04:12 PM
What I am trying to do is to get a listing of the last 7 days (that logs were entered - not necessarily the last 7 calendar days) and how many completed requests the logs have seen during those days.
Here is the query I am using:
sourcetype="server_log" complete* |
convert timeformat="%m-%d"
ctime(_time) as compact_date | stats
dc(requestid) as "NumRequests" by
compact_date | rename compact_date as
RequestDate | tail 7
The problem I am seeing is that the compact_date values are not sorted correctly. I am assuming this is because they are strings.
How can I sort the days correctly?
... View more
12-17-2010
05:01 PM
This doesn't quite do what I want. I updated the question above. Thanks.
... View more
12-16-2010
05:17 PM
I can't get that page to work... Is there another URL?
... View more
12-16-2010
02:41 PM
I am working on creating queries to pull a specific number of results from a certain index in the resultset.
An example is for MySQL, you can use LIMIT
Limit is used to limit your MySQL
query results to those that fall
within a specified range. You can use
it to show the first X number of
results, or to show a range from X - Y
results. It is phrased as Limit X, Y
and included at the end of your query.
X is the starting point (remember the
first record is 0) and Y is the
duration (how many records to
display).
How can you do this in splunk? Thanks!
I am going to add a little bit to the question.
If I have get 50 results back from a query. How do I return only results 11-20? I want a specific record number returned like the X (starting point) in MySQL. I need to use this for a data table (pagination) plug-in I am using. Head doesn't seem to work the way I need it to.
It is also similar to this:
Now suppose you wanted to show results
11-20. With the OFFSET keyword its
just as easy, the following query will
do:
SELECT column FROM table LIMIT 10
OFFSET 10
... View more
10-22-2010
06:16 PM
1 Karma
I have a query where I need to determine the earliest time I want events from.. It is either (1) The last time jboss started or (2) 30 minutes since the last event in the logs. (Whichever is closest to current time.)
How do i do that in a query most efficiently?
Here are the subsearches.
[search sourcetype="server_log"
| head 1
| eval test = relative_time(_time, "-30m@m")
| rename test as earliest
| fields earliest
]
[search sourcetype="server_log" "starting service(s)"
| head 1
| rename _time as earliest
| fields earliest
]
Thanks!
... View more
- Tags:
- subsearch
09-30-2010
02:32 AM
I got a transaction working to split out into 5 transaction statements for the 5 times jboss restarted and I can see the requestids in chunks.. is there a way to break those out?
... View more
09-30-2010
02:03 AM
The where does work as expected.. My main problem is getting a listing of all request ids with the message size (I am able to get one using the query above) I am trying the transaction approach to group everytime jboss was started but I don't think it is going to work for me
... View more
09-30-2010
01:03 AM
I have jboss logs that print a message size everytime jboss restarts. The message size is different everytime jboss starts and a message is displayed:
2010-09-28 02:52:04,992 INFO messageSize=4194304bytes
I have a field extraction for the messageSize.
What I want to do now is pull this kind of log and determine what the message size is based upon the last time jboss started since the log (in case this before 04:43)
2010-09-29 04:43:22,836 INFO Request information [requestid=364a05b7-2beb-4c68-8459-52e6fc4612b3]
I am able to pull one request and it's message size using the following splunk query: (Although I can't get the request id printed in the table)
sourcetype="server09282010" [search sourcetype="server09282010" 364a05b7-2beb-4c68-8459-52e6fc4612b3 | head 1 | rename _time as latest| fields latest] | WHERE MessageSizeBytes NOT NULL | head 1 | table _time MessageSizeBytes
What i really want is a table with requestid and Message size (based upon the time when jboss was started)
I hope this makes sense.. it is a complicated query.
Thanks!
... View more
- Tags:
- subsearch
09-29-2010
03:45 PM
2 Karma
I have a url that has a server.txt file on that that gets updated as the requests/responses are coming through.
Can splunk index that http://website.com/server.txt address?
If so, how? Thanks!
... View more
- Tags:
- http
09-24-2010
08:31 PM
2 Karma
I have some requests/responses going through my system. I want to get the size of each response.
The only information I have is a number of lines per request (each line is 4mb)
Currently i do the following:
eval ResponseSize=eventcount * 4
The 4mb might change so there is another place in the log file that prints what that size is.
Can I do a subsearch to pull this number and use it in the multiplication eval to get the ResponseSize?
... View more
09-21-2010
07:05 PM
Thanks worked perfectly!
... View more
09-21-2010
05:55 PM
1 Karma
I am trying to use the HiddenChartFormatter. It says that the markers should be defaulted to on, but that doesn't work. I added <param name="charting.showMarkers">true</param> to no avail. Any ideas?
... View more
09-10-2010
01:04 PM
This is exactly what i wanted.. thanks!
... View more
09-09-2010
09:29 PM
I have gotten that far but when I try to do the where _time > [that sub search here].. It doesn't work or sometimes i get an error that says the values aren't compatible
... View more
09-09-2010
08:56 PM
I am trying to:
Find a date/time of a certain event.
Take that date/time from number 1. and use it to search for events only from that date/time forward.
If the date/time from number 1 was September 1st at 1:45.. Then for number 2, I would only want to get back events from September 1st and forward (forgetting about events before that.)
I need this to be automatic in the searches because the date/time range from number 1 will change based upon different circumstances.
I tried subsearches to no avail.
I am using _time.
Thanks in advance!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-01-2026
02:41 PM
|
