Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About kurdbahr
kurdbahr
Path Finder
Member since:
06-26-2013
06-05-2020
Community Statistics
| Posts | 16 |
| Solutions | 6 |
| Karma Given | 11 |
| Karma Received | 19 |
| Member Since | 06-26-2013 |
Activity Feed
- Karma How can we create Tabs using Link List in Splunk with only CSS Override NO SplunkXML JS Extension? for niketn. 06-05-2020 12:51 AM
- Karma Re: How can we create Tabs using Link List in Splunk with only CSS Override NO SplunkXML JS Extension? for niketn. 06-05-2020 12:51 AM
- Got Karma for Re: How can we create Tabs using Link List in Splunk with only CSS Override NO SplunkXML JS Extension?. 06-05-2020 12:51 AM
- Karma Splunk 6.6.0 not working with IE11 and DNS Name for jlucius. 06-05-2020 12:48 AM
- Karma Re: Splunk 6.6.0 not working with IE11 and DNS Name for runner724. 06-05-2020 12:48 AM
- Karma Re: Why am I unable to search previously indexed data? for woodcock. 06-05-2020 12:47 AM
- Karma Re: Is it possible to perform bitwise operations on values in the eval function? for javiergn. 06-05-2020 12:47 AM
- Karma Do unused search-time field extractions significantly impact performance if the extracted fields are not used? for wegscd. 06-05-2020 12:47 AM
- Got Karma for How to set command line parameters that splunkd passes to mongod?. 06-05-2020 12:47 AM
- Got Karma for Re: How do I convert "3 days 5 hrs 40 min 11 sec" to seconds?. 06-05-2020 12:47 AM
- Got Karma for Re: How do I convert "3 days 5 hrs 40 min 11 sec" to seconds?. 06-05-2020 12:47 AM
- Got Karma for Re: How do I convert "3 days 5 hrs 40 min 11 sec" to seconds?. 06-05-2020 12:47 AM
- Got Karma for Re: How do I convert "3 days 5 hrs 40 min 11 sec" to seconds?. 06-05-2020 12:47 AM
- Got Karma for Re: Cannot put a date string into outputcsv filename argument. 06-05-2020 12:47 AM
- Got Karma for Re: Is it possible to retrieve the timerange (earliest and latest) in a search to use as a value for eval later?. 06-05-2020 12:47 AM
- Got Karma for Re: Is it possible to retrieve the timerange (earliest and latest) in a search to use as a value for eval later?. 06-05-2020 12:47 AM
- Got Karma for Re: How to set command line parameters that splunkd passes to mongod?. 06-05-2020 12:47 AM
- Got Karma for How to set command line parameters that splunkd passes to mongod?. 06-05-2020 12:47 AM
- Got Karma for Re: How to extract events from simple Scripted Input stdout?. 06-05-2020 12:47 AM
- Got Karma for Re: How to mirror a summary index without cluster or distributed search?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 2 | |||
| 2 |
05-02-2020
12:56 PM
1 Karma
Thanks! Great job!
... View more
02-15-2019
09:23 AM
I had the same problem with my modular alert action and the best solution I could find so far is to add a second block for changing the existing stored credentials:
<block title="Change credentials" endpoint="storage/passwords" entity="*" mode="iter">
<input field="password">
<label>Password for $name$</label>
<type>password</type>
</input>
</block>
See also: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Setup.xmlconf
... View more
02-11-2016
09:22 AM
2 Karma
Did you check the addinfo command?
... View more
01-14-2016
06:22 AM
1 Karma
The result of your subsearch is formatted as ( ( FILENAME="swf_download_14_01_2016" ) ) .
Try return $FILENAME instead of fields FILENAME .
See also:
https://answers.splunk.com/answers/85395/earliest-or-latest-time-in-outputcsv-filename.html#answer-92839
Or add | format "" "" "" "" "" "" after fields FILENAME .
... View more
01-05-2016
07:47 AM
According to http://docs.splunk.com/Documentation/CIM/4.3.1/User/ApplicationState the field "cpu_time" is of data type "string".
Are there any recommendations regarding the format of this string?
For example tasklist.exe (on Windows) shows the CPU Time as "0:12:34" and ps (on Linux) shows "01:23:45".
This is not a very useful format to do any calculations with.
I could add a calculated numeric field named "cpu_time_seconds" but in a future version of the CIM this field may be defined to mean something completely different.
What are your best practices?
Are there any naming conventions for local CIM extensions?
What are the plans for the future of the CIM?
(And by the way: Does anybody really use the field "cpu_load_mhz" to measure the CPU load per process in Megahertz?)
... View more
11-14-2015
06:50 AM
4 Karma
How about this?
* | head 1
| eval str="3 days 5 hrs 40 min 11 sec"
| eval duration_in_seconds=tonumber(replace(str, ".*?(\d+) sec", "\1"))
+ 60 * coalesce(tonumber(replace(str, ".*?(\d+) min.*", "\1")), 0)
+ 3600 * coalesce(tonumber(replace(str, ".*?(\d+) hrs.*", "\1")),0)
+ 86400 * coalesce(tonumber(replace(str, ".*?(\d+) days.*", "\1")),0)
| table str,duration_in_seconds
The eval duration_... could be used in the definition of a calculated field.
EDIT:
The solution above may not be optimal with regard to performance, because the string has to be parsed four times.
The idea behind this was to do it in a single eval expression.
If you don't mind to create additional fields, it may be better to do it in two steps:
1st step: field extraction:
... | rex field=str "^((?<days>\d+) days )?((?<hours>\d+) hrs )?((?<minutes>\d+) min )?(?<seconds>\d+) sec"
2nd step: field calculation:
... | eval duration_in_second=if(isnull(days),0,86400*days)
+ if(isnull(hours),0,3600*hours)
+ if(isnull(minutes),0,60*minutes)
+ seconds
... View more
06-06-2015
10:30 AM
1 Karma
Are there any errors in splunkd.log?
You probably need a wrapper script (.cmd) to execute the python code, because the ".py" extension may not be registered to execute python directly.
The recommended way to execute a python script from Splunk is:
$SPLUNK_HOME/bin/splunk cmd python <your_script>.py
http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptWriting
... View more
06-06-2015
10:12 AM
"Search is waiting for input." - So the search is not executed yet.
If the search was run without results the message would say "Waiting for results" or "No results found".
Maybe you need to add the attribute searchWhenChanged="true" to the input element or add autoRun="true" to the fieldset element or change the attribute submitButton of the fieldset element from "false" to "true" to execute the search manually.
Maybe there is something wrong with the latestTime element. The opening and closing angle brackets are escaped in your code.
... View more
06-06-2015
12:01 AM
2 Karma
As @justinatpnnl pointed out, your Javascript is probably not included in the web page because the Splunk server has not yet noticed your new Javascript file.
To make a new Javascript file available without a full server restart:
$SPLUNK_HOME/bin/splunk restartss
To force a reload of a changed Javascript file:
http(s)://localhost:8000/en-US/_bump
and click the button there to increment the version number.
... View more
06-05-2015
03:42 PM
1 Karma
After some hours of digging through the docs this seems to be a working configuration:
etc/system/local/props.conf:
[stash_new]
TRANSFORMS-my_routing_class=my_summary_routing
etc/system/local/transforms.conf:
[my_summary_routing]
SOURCE_KEY=_MetaData:Index
DEST_KEY=_TCP_ROUTING
REGEX=my_summary_index
FORMAT=my_remote_group
etc/system/local/outputs.conf:
[tcpout]
defaultGroup=my_non_existing_group
indexAndForward=true
[tcpout:my_remote_group]
server=192.168.178.31:9996
... View more
06-05-2015
02:47 AM
2 Karma
I have a standalone server (6.1.x) running some scheduled searches to consolidate data from multiple large sources into one summary index.
Now I would like to make this summary data simultaneously available on an other standalone server (6.2.x) without setting up a cluster or distributed search.
My current idea is to set up a script action for the scheduled searches that copies the stash files to a network share where it is then read by the other indexer.
Any better ideas?
Is it possible to forward the summary data to the other server?
Maybe by configuring TCP_ROUTING for the "stash" sourcetype in inputs.conf?
... View more
02-17-2015
10:44 AM
1 Karma
I would like to change the bind address of the mongod process only, not that of the splunkd process.
... View more
02-17-2015
08:09 AM
2 Karma
How do I configure the command line parameters that splunkd passes to mongod?
Especially I would like to set the --bind_ip parameter so that mongod listens on localhost only.
By default it listens on all available interfaces.
... View more
07-30-2013
01:54 AM
Using the same interface in a Splunk search:
| rest /services/authentication/httpauth-tokens splunk_server=local | stats max(updated) by userName
... View more
07-30-2013
01:39 AM
1 Karma
You can make it into a search like this:
| rest /services/authentication/httpauth-tokens splunk_server=local | stats max(updated) by userName
... View more
06-26-2013
04:17 AM
1 Karma
How about this?
| outputcsv [ | stats count | addinfo | eval filename=strftime(info_min_time, "filename_%d_%m_%y_%H_%M_%S") | return $filename]
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma from
