Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About fblau
fblau
Explorer
Member since:
03-06-2014
06-05-2020
Community Statistics
| Posts | 19 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 03-06-2014 |
Activity Feed
- Got Karma for How does the user:group get set for a deployed app to the universal forwarder?. 06-05-2020 12:47 AM
- Posted Will there be a version of Hunk for MacOS anytime soon? on Installation. 04-06-2015 10:19 AM
- Tagged Will there be a version of Hunk for MacOS anytime soon? on Installation. 04-06-2015 10:19 AM
- Tagged Will there be a version of Hunk for MacOS anytime soon? on Installation. 04-06-2015 10:19 AM
- Tagged Will there be a version of Hunk for MacOS anytime soon? on Installation. 04-06-2015 10:19 AM
- Posted DBConnect on Macos on All Apps and Add-ons. 04-01-2015 06:49 AM
- Tagged DBConnect on Macos on All Apps and Add-ons. 04-01-2015 06:49 AM
- Posted How does the user:group get set for a deployed app to the universal forwarder? on Getting Data In. 03-30-2015 08:50 PM
- Tagged How does the user:group get set for a deployed app to the universal forwarder? on Getting Data In. 03-30-2015 08:50 PM
- Tagged How does the user:group get set for a deployed app to the universal forwarder? on Getting Data In. 03-30-2015 08:50 PM
- Tagged How does the user:group get set for a deployed app to the universal forwarder? on Getting Data In. 03-30-2015 08:50 PM
- Tagged How does the user:group get set for a deployed app to the universal forwarder? on Getting Data In. 03-30-2015 08:50 PM
- Posted Re: How to count only the first event spike in my data for a window of time? on Splunk Search. 02-17-2015 09:48 PM
- Posted How to count only the first event spike in my data for a window of time? on Splunk Search. 02-17-2015 09:07 PM
- Tagged How to count only the first event spike in my data for a window of time? on Splunk Search. 02-17-2015 09:07 PM
- Posted Re: Could Splunk make an EKG Stripchart? on All Apps and Add-ons. 02-05-2015 11:52 AM
- Posted Re: Could Splunk make an EKG Stripchart? on All Apps and Add-ons. 02-05-2015 11:35 AM
- Posted Could Splunk make an EKG Stripchart? on All Apps and Add-ons. 02-04-2015 08:53 PM
- Tagged Could Splunk make an EKG Stripchart? on All Apps and Add-ons. 02-04-2015 08:53 PM
- Posted Re: Hunk Tutorial - No Results Found on All Apps and Add-ons. 03-11-2014 11:25 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
04-06-2015
10:19 AM
04-01-2015
06:49 AM
I am getting the following error when configuring Splunk DBConnect on MacOS:
Encountered the following error while trying to update: In handler 'localapps': Error while posting to url=/servicesNS/nobody/dbx/dbx/install/java
I have installed the JRE (1.8) but I am reading that it might require the Server version, which does not appear to be available for Mac OS.
Is anyone using DBConnect on a Mac OS (Yosemite) that could shed some light on this?
Frank
... View more
- Tags:
- dbconnect
03-30-2015
08:50 PM
1 Karma
When I deploy an app to my universal forwarder, it has root:root ownership. Is there any way to set that to another user that is better suited to running on the forwarder?
... View more
02-17-2015
09:48 PM
That only gets the first record in the series. I want to repeat that spike after a delay or something.
... View more
02-17-2015
09:07 PM
I am bringing in signal data and counting spikes using the following search:
ekg| head 6000 | table ekg, _time | sort _time | trendline wma200(ekg) as ma | eval spike=if(ekg > 1.75 * ma, 5 , 0)
It works pretty well, but when the data spikes, I get about 4 spikes counted for each rise:
2.702835 2015-02-17T06:37:00.850+0000 1.836020976 0
1.505376 2015-02-17T06:37:00.850+0000 1.832955897 0
3.054741 2015-02-17T06:37:00.851+0000 1.845338754 0
3.387097 2015-02-17T06:37:00.853+0000 1.860977085 5
3.68524 2015-02-17T06:37:00.855+0000 1.8795149 5
3.743891 2015-02-17T06:37:00.856+0000 1.898542445 5
3.782991 2015-02-17T06:37:00.858+0000 1.91784865 5
3.646139 2015-02-17T06:37:00.860+0000 1.935670102 5
3.333333 2015-02-17T06:37:00.861+0000 1.950263797 0
2.917889 2015-02-17T06:37:00.863+0000 1.96063375 0
What I want is way to only count the first spike and then reset it after a time period (in milliseconds) so that I can accurately count the spikes as only one per rise.
Any ideas?
... View more
- Tags:
- count
02-05-2015
11:52 AM
Hmm... I thought Splunk put the timestamp on when it was received, but I suppose I can too... just needs to be at the sub-second level.
... View more
02-05-2015
11:35 AM
The log is just a file of one line per reading, between 0 and 5.. eg:
1.798631
1.446725
1.368524
1.446725
1.70088
2.057673
2.42913
2.683285
2.702835
2.487781
2.135875
1.798631
1.524927
1.368524
1.388074
1.568915
1.88172
2.253177
2.585533
2.722385
2.585533
2.272727
1.901271
1.608016
1.427175
1.388074
1.524927
1.798631
2.174976
2.546432
2.781036
2.722385
... View more
02-04-2015
08:53 PM
I have a raspberry pi with a heart sensor on it for generating EKG data. My program spits out about 1000 points per second, which I can run a 10 point simple moving average on to get a decent picture of the EKG signal. I export the data to a file and can plot it in Excel and it looks just like it should.
I was wondering if Splunk could show a realtime EKG like a strip chart... so I set up a TCP listener and pump the data out to it... but for some reason, I can't figure out a search/chart pattern that displays anything vaguely resembling the signal data.
Is this too much data, too fast, for Splunk to handle?
Any ideas?
... View more
- Tags:
- RAW Charts
03-11-2014
11:00 AM
file is too large to post. Here is the error section:
03-11-2014 10:43:04.242 ERROR SearchOperator:stdin - Cannot consume data with unset stream_type
03-11-2014 10:43:04.242 ERROR ResultProvider - Error in 'SearchOperator:stdin': Cannot consume data with unset stream_type
0
... View more
03-11-2014
10:39 AM
[ponyindex]
vix.input.1.accept = .gz$
vix.input.1.path = /data/...
vix.provider = PonyProvider
[cloudera@localhost local]$ cat indexes.conf
[provider:PonyProvider]
vix.env.HADOOP_HOME = /usr/lib/hadoop
vix.env.JAVA_HOME = /usr/java/jdk1.6.0_32
vix.family = hadoop
vix.fs.default.name = hdfs://localhost:8020
vix.mapred.job.tracker = localhost:8021
vix.splunk.home.hdfs = /user/root/splunkmr
[ponyindex]
vix.input.1.accept = .gz$
vix.input.1.path = /data/...
vix.provider = PonyProvider
... View more
03-11-2014
10:23 AM
ps: there is a backslash before the .gz that somehow this webpage doesn't show.
... View more
03-11-2014
10:21 AM
Here you go:
[provider:PonyProvider]
vix.env.HADOOP_HOME = /usr/lib/hadoop
vix.env.JAVA_HOME = /usr/java/jdk1.6.0_32
vix.family = hadoop
vix.fs.default.name = hdfs://localhost/8020
vix.mapred.job.tracker = localhost:8021
vix.splunk.home.hdfs = /user/root/splunkmr
[ponyindex]
vix.input.1.accept = .gz$
vix.input.1.path = /data/...
vix.provider = PonyProvider
... View more
03-11-2014
10:10 AM
I am using the Cloudera Quickstart VM.
There are several indexes.conf files... which one do you want?
/home/cloudera/splunk/etc/apps/sample_app/default/indexes.conf
/home/cloudera/splunk/etc/apps/SplunkLightForwarder/default/indexes.conf
/home/cloudera/splunk/etc/apps/search/local/indexes.conf
/home/cloudera/splunk/etc/system/default/indexes.conf
/home/cloudera/splunk/etc/master-apps/_cluster/default/indexes.conf
... View more
03-11-2014
09:00 AM
I am getting this error in Hunk:
03-11-2014 08:45:08.354 ERROR SearchOperator:stdin - Cannot consume data with unset stream_type
03-11-2014 08:45:08.355 ERROR ResultProvider - Error in 'SearchOperator:stdin': Cannot consume data with unset stream_type
And no results are returning.
This is using the Hunk Tutorial settings.
... View more
