About yiguanghu

yiguanghu · ‎08-08-2012

Thanks for the answers. From the answers, looks like I have to use distributed search? Make one as search head and the other one forward only the performace data to the search head? If I do that, can the non-search-head indexer instance still able to do search?

yiguanghu · ‎08-08-2012

I have SOS installed on two splunk indexer boxes (4.3.2). They are independent to each other now. One is a dev and one is a uat. I can look SOS report on each. How can I look at the SOS report on one instance from the remote/peer instance? I know SOS page mentions it can. But How to do it? Thanks

yiguanghu · ‎07-25-2012

I have a directory on the splunk server. There are xml files in the directory. I have setup a sourcetype for the xml files and setup the splunk to load data from the directory continuously. But somehow, it just don't work. I can load individual files from the directory with the same sourcetype without any problem. I have another directory with different xml files and sourcetype and setup load data continuously and it works fine. Any idea? Thanks

yiguanghu · ‎07-19-2012

thanks for the answer. But it didn't make any difference. This is my test data. Try it. It will recognize the second item timestamp. But it does not work for '2006-01-02 09:45'. It recognize the time part, but the date is not working. Is it because the date is too old? I changed the date from 2006 to 2008, it works immediately. What am I missing? tegory='Test-QA ' relType='DATABASE' Rel_id='1' preview_conf_time='2006-01-02 09:42' request_time='' LU='' Rolback='' preview_sent_time='' release_trigger_time='' uatECMS='NA' /> preview_sent_time='' release_trigger_time='' uatECMS='NA' />

yiguanghu · ‎07-18-2012

I have a xml file source as below. I use <item to signature for event and it works. But the timestamp simply refuse to work. I used the regex to identify the timestamp: %Y-%m-%d %HH:%MM Any help is appreciated. Thx It is odd enough. It recognize this. The only different is the time. But the time has exactly the same format as above.

yiguanghu · ‎06-28-2012

Is there any update on Splunk for Jira app? Installing this app is straight forward. But to make it work is quite different. The app depends on a chain of python packages to run. It is difficulty to install all the dependencies since they are out of sync or not clear which version suppose to go with which version of dependencies. The app was written in 2008. Kind of long time ago. please advice. Thanks

yiguanghu · ‎05-02-2012

Looks like drilldown works ok on single source searches. My situation is the search contains two sources joined together throgh different columns using eval and sub search as following: source="sample1.csv"| eval joinid=if(isnotnull(key), key, "Incident") | join joinid [search source="sample2.csv"| eval joinid=if(isnotnull(Key), Key, "Jira")] | bucket _time span=1h | stats count as incidents, count(Key) as jiras, count(Issue_Links) as clonedjira by _time Anyway can drill down from on this search?

yiguanghu · ‎05-02-2012

I have a stats that shows count of several columns by _time. It shows the timeline and table correctly. But when I clicked the green bar to drill down, It always show 0 results. Please let me know what am I missing?

Posts	8
Solutions	0
Karma Given	0
Karma Received	4
Member Since	‎04-06-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to pull performance data from splunk peers

Data input from a directory not working sometimes

Simple Timestamp not recognized

Any update on Splunk for Jira app

Does Splunk Drilldown actually work?

Re: How to pull performance data from splunk peers

How to pull performance data from splunk peers

Data input from a directory not working sometimes

Re: Simple Timestamp not recognized

Simple Timestamp not recognized

Any update on Splunk for Jira app

Re: Does Splunk Drilldown actually work?

Does Splunk Drilldown actually work?