Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About chrisboy68
chrisboy68
Contributor
Member since:
06-14-2013
a week ago
Community Statistics
| Posts | 102 |
| Solutions | 3 |
| Karma Given | 1 |
| Karma Received | 17 |
| Member Since | 06-14-2013 |
Activity Feed
- Posted Re: Workload Management - Admission Rules only working on Cluster Master on Splunk Search. a week ago
- Posted Workload Management - Admission Rules only working on Cluster Master on Splunk Search. a week ago
- Posted Scheduled Search Not Being Dispatched on Alerting. 02-24-2021 06:04 AM
- Posted Re: Search Marcro - Sending Results to Macro Variable. on Splunk Search. 02-04-2021 08:44 AM
- Posted Search Marcro - Sending Results to Macro Variable. on Splunk Search. 02-04-2021 06:49 AM
- Posted Workload Management - Admission Rules Message Cannot Add URL on Alerting. 01-22-2021 06:38 AM
- Got Karma for Re: Append Search Performance Slow. 11-18-2020 04:51 AM
- Got Karma for Append Search Performance Slow. 11-18-2020 04:51 AM
- Got Karma for Re: List all Splunk Servers with a REST search command. 09-10-2020 01:10 PM
- Posted Re: TA-webtools - CURLName or Service Not Known on All Apps and Add-ons. 08-27-2020 12:54 PM
- Posted TA-webtools - CURLName or Service Not Known on All Apps and Add-ons. 08-27-2020 12:30 PM
- Posted Re: Custom Email From Address for Alerts on Archive. 07-24-2020 07:32 AM
- Posted Re: savedsearch command replace with a literal string not working on Splunk Search. 07-23-2020 05:54 AM
- Posted Re: savedsearch command replace with a literal string not working on Splunk Search. 07-22-2020 07:53 AM
- Posted savedsearch command replace with a literal string not working on Splunk Search. 07-17-2020 11:51 AM
- Posted Re: List all Splunk Servers with a REST search command on Splunk Search. 07-02-2020 12:44 PM
- Posted Re: Lookup table help on Splunk Search. 07-02-2020 12:32 PM
- Posted Splunk REST Query Returns No Data for stats on Splunk Search. 07-02-2020 12:05 PM
- Karma Re: Join two queries by nearby event times for somesoni2. 06-05-2020 12:48 AM
- Got Karma for Join two queries by nearby event times. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
a week ago
Hi, The CM is the only node that is applying the Admission Rules. after my test. The MC, has a set of dashboards to monitoring Workload Management - Admission Rules. The admission rules are applied at the SH and yes they are clustered. Thanks! Chris
... View more
a week ago
Hi, Been struggling to get Workload Admission Rules working properly. After a bunch of testing and monitoring with the MC Workload Dashboards, I can see that only searches generated from the CM are applying the Admission Rule Filter. All other search heads ignore the filter. Anyone run into this issue? On 8.1.3 Splunk Enterprise. Thank you! Chris
... View more
- Tags:
- admission rules
Labels
- Labels:
-
other
02-24-2021
06:04 AM
Hi, I'm having random scheduled searches being missed (not skipped) and I don't know why. Below is a sample of an every 5 min search. The 7:05 run was not running. I can't find anything in the logs that tell me why. Any suggestions on what to look for and where? This is just from _internal scheduler scheduled_time dispatch_time endTime run_time status
2021-02-24 07:00:00 2021-02-24 07:00:37 2021-02-24 07:00:44 5.624 success
2021-02-24 07:00:00 2021-02-24 07:00:44 delegated_remote_completion
2021-02-24 07:00:00 2021-02-24 07:00:37 delegated_remote
2021-02-24 07:10:00 2021-02-24 07:11:31 2021-02-24 07:11:40 4.351 success
2021-02-24 07:10:00 2021-02-24 07:11:37 delegated_remote_completion
2021-02-24 07:10:00 2021-02-24 07:11:31 delegated_remote Thank you! Chris
... View more
Labels
- Labels:
-
alert action
-
cron
02-04-2021
08:44 AM
Neither work." test_macro($subject$)`", sends the literal string "$subject$" and the other fails to run.
... View more
02-04-2021
06:49 AM
Hi, I'm having the hardest time trying to figure out how to pass an event field into a variable argument to be used in a macro. This is my test_macro accepting one argument. | eval $sub_arg$=subject | sendemail to="myemail address" format="html" server="myserver address" use_tls=1 subject= $sub_arg$ Test SPL : | makeresults
| eval subject = "Test Subject"
`test_macro(subject)` The subject comes into / validated to "subject" and not "Test Subject". What am I doing wrong? Thank you! Chris
... View more
- Tags:
- macro
Labels
- Labels:
-
other
01-22-2021
06:38 AM
Hi, Using Workload Management - Admission Rules, I cannot embed a URL or list a URL in the User Message since it does not accept "/" Is there a workaround? I want to provide users a link to an internal WIKI page if they encounter a rule. Thanks Chris
... View more
- Tags:
- Workload Management
Labels
- Labels:
-
other
08-27-2020
12:54 PM
I think I figured this out. This is an obscure error for not able to connect to the host.
... View more
08-27-2020
12:30 PM
Hi @jkat54 , I have a very simple health check that returns "ok" simple curl works fine with curl https://myhost:8041/local/check But through Splunk/App I get this error. HTTPSConnectionPool(host='myhost', port=8041): Max retries exceeded with url: /local/check (Caused by <class 'socket.gaierror'>: [Errno -2] Name or service not known) Doing | curl method=get uri=https://myhost:8041/local/check debug=t Any Ideas? Thanks Chris
... View more
- Tags:
- splunk curl
Labels
- Labels:
-
troubleshooting
07-24-2020
07:32 AM
I know this a bit old, but I agree it would be great to have this open. It could default to the system from or we can default to the alert owner. Managing bounced email for over thousands of email alerts is cumbersome. Sending the bounce back to the alert owner and they can handle it. Chris
... View more
07-23-2020
05:54 AM
Oh my, that was it. I needed to quote the token string in the Report/saved search! Thank you! Chris
... View more
07-22-2020
07:53 AM
HI, thanks for the reply. It is getting populated through the dashboard, but I'm trying to do it via the console and running into issues. | savedsearch "SavedSearches With Spaces" emailsubject_tok="Long Subject Name with + | and spaces" emailsubject_tok is in the report like. <base search > | search subject=$emailsubject_tok$ Maybe I'm messing up my quotes. Are you able to use the command with a search and token that contains spaces? Thanks!
... View more
07-17-2020
11:51 AM
Hi using a Report (cause I need to allow permissions to the data) in a dashboard passing tokens. Looking at the docs, I can use "savedsearch" command https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Savedsearch | savedsearch "MyReport" emailsubject_tok="Long Subject Name with + | and spaces" When I look at the job log, only the first word is being replaced. So for my example, the job log shows emailsubject_tok as "Long". How can I pass this in as a literal string? Trying not to modify the string itself as this will be a user cutting and pasting email subject text. Thank you! Chris
... View more
Labels
- Labels:
-
other
-
search job inspector
07-02-2020
12:44 PM
1 Karma
This is what the MC uses: | rest splunk_server_group=* splunk_server_group="*" /services/server/status you can remove the first two parms if not running on the MC and it will return everything. HTH Chris
... View more
07-02-2020
12:32 PM
Look a inputlookup https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Inputlookup You will want to match with your base search and perform logic on the fields returned from the lookup and base. HTH Chris
... View more
07-02-2020
12:05 PM
Hi, Given the below search: index="my_index" source="mysource" _index_earliest=-1h
| rex field=_raw "\:\sPT(?P<respt>\d+\.\d+)"
| fields response_time_ms respt| convert num(respt) as response_time_ms
| eval response_time_ms = response_time_ms*1000
| stats exactperc95(response_time_ms) as myPercent Works fine in the UI, but when I try to execute through the API i get no data back and an obscure message. myPercent Specified field(s) missing from results: 'response_time_ms' myPercent Can't figure out what is going on, I have listed the field in "rf" with no luck. I do have search API working for other info, so I know credentials and my POST is accurate. Is there a limitation on stats? Thanks Chris
... View more
Labels
- Labels:
-
search job inspector
-
stats
05-28-2020
12:01 PM
Maybe I'm not explaining it correctly. The events being returned are always within the time modifier on the search.
Try this(for those watching): index=main earliest=-30m for last 4 hours and look at the job inspector for earliestTime, then do the same for ALL Time. The earliestTime is the first event of the index, which tells me splunk is searching all the events and not limiting to a 30 min window based on _time. It takes much longer too, I usually kill it.
Tx
Chris
... View more
05-28-2020
10:05 AM
Hi,
I must be missing something. I have a simple search using a time modifier:
index=MyIndex earliest=-30m
My expectation is when I search, the results will be searched and returned only over the last 30 minutes of events. When I use the time picker and set to ALL TIME, it still only returns the last 30 minutes but searches over ALL EVENTS? Is this the correct behavior?
I looked at the job log and it did have the earliest event as the first event in the index (ALL TIME) with the time modifier. Read this a few times, https://docs.splunk.com/Documentation/Splunk/8.0.3/Search/Specifytimemodifiersinyoursearch and didn't see any verbiage to this behavior.
Thank you!
Chris
... View more
01-24-2020
01:37 PM
1 Karma
I see tstats, think you meant:
| tstats count where (host=hosta OR host=hostb OR host =hostc) by host
But that didn't help, it still takes over seconds (5-8) for the append. Even with a small time window, 15 min. dispatch.evaluate.append is where it is spending time.
Thanks
Chris
... View more
01-24-2020
05:53 AM
1 Karma
Hi, I'm trying to create a search that returns certain hosts that are NOT found returning data. I know I can do this with a lookup table, but I wanted to see if I could just embed the hosts in the SPL to prevent the need for a lookup (less maintenance). Below is what is working, but the append is taking a long time. Any suggestions on how I can get this to perform better?
Thank you!
Chris
| makeresults
| eval host="hosta hostb hostc" `comment("This uses a events that create an event for each host")`
| makemv delim=" " host
| mvexpand host
| append
[ search index=_internal sourcetype=splunkd component=Metrics (host=hosta OR host=hostb OR host=hostc)
| fields host ]
| stats count by host
| search count=1
| mvcombine host delim="name:"
| nomv host | eval hoststring= "name:" + host
| fields hoststring |`comment("This is evaluated against the search and if no host exists, a value of 1 event will be returned with a formated string")`
... View more
04-25-2019
12:55 PM
Ok I figured this out based on the tips. "TestName1, TestValue1, TestName2, TestValue2, TestName3, TestValue3" where the actual field names and not the data. Below are the real fields and I had to make up one large field, added delimiters and Regex to slice.
| eval myCritical =(
"Critical1:" + "MetricName:" + Crit1MetricName + "Name:" +Crit1Name + "Operator:" + Crit1Operator + "Value:" + Crit1Value + "," +
"Critical2:" + "MetricName:" + Crit2MetricName + "Name:" +Crit2Name + "Operator:" + Crit2Operator + "Value:" + Crit2Value + "," +
"Critical3:" + "MetricName:" + Crit3MetricName + "Name:" +Crit3Name + "Operator:" + Crit3Operator + "Value:" + Crit3Value + "," +
"Critical4:" + "MetricName:" + Crit4MetricName + "Name:" +Crit4Name + "Operator:" + Crit4Operator + "Value:" + Crit4Value + "," +
"Critical4:" + "MetricName:" + Crit5MetricName + "Name:" +Crit5Name + "Operator:" + Crit5Operator + "Value:" + Crit5Value + ","
) | rex max_match=0 field=myCritical "(?<Critical>[^,\n]+)"
| table Critical
Thank you!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
a week ago
|
