Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About imrago
imrago
Contributor
Member since:
04-07-2010
03-02-2023
Community Statistics
| Posts | 115 |
| Solutions | 22 |
| Karma Given | 159 |
| Karma Received | 67 |
| Member Since | 04-07-2010 |
Activity Feed
- Got Karma for Re: How to create a report that shows max indexed volume per day by month per index?. 04-13-2023 11:05 AM
- Karma Re: kvstore certificate renewal is not working... for vinod94. 03-02-2023 11:08 AM
- Got Karma for udp input json to metrics - The metric event is not properly structured. 10-06-2022 08:39 AM
- Got Karma for Re: Universal fowarder and WMI. 12-27-2021 05:03 PM
- Got Karma for udp input json to metrics - The metric event is not properly structured. 11-22-2021 03:16 PM
- Posted udp input json to metrics - The metric event is not properly structured on Getting Data In. 10-03-2021 01:35 PM
- Tagged udp input json to metrics - The metric event is not properly structured on Getting Data In. 10-03-2021 01:35 PM
- Posted fill_summary_index metrics index , duplicates on Knowledge Management. 03-25-2021 03:37 PM
- Karma Re: How do you fix the font size of each single value display panel? for sdchakraborty. 01-13-2021 03:13 PM
- Karma Re: Why is the dropdown input width not increasing? for vnravikumar. 01-13-2021 11:14 AM
- Karma Re: How to change the width of panels in xml? for niketn. 12-31-2020 12:22 AM
- Posted Re: AppInspect v2.2.0 wrongly reports that there is no named capturing group in Extract in props.con on All Apps and Add-ons. 07-23-2020 01:48 PM
- Posted AppInspect v2.2.0 wrongly reports that there is no named capturing group in Extract in props.conf on All Apps and Add-ons. 07-23-2020 10:22 AM
- Posted Developer Guidance - Setup View Example For Splunk - not working as expected in Firefox on Building for the Splunk Platform. 07-19-2020 07:08 AM
- Got Karma for Re: When creating an app, how to configure it that after the install, "Restart Required" dialog would be displayed?. 06-05-2020 12:49 AM
- Karma How to do DNS lookup for event-time for mirkokorn. 06-05-2020 12:48 AM
- Karma Are there any plans for data signing in splunk since this functionality was removed in 6.2? for jmallorquin. 06-05-2020 12:47 AM
- Karma Re: How to send back to old data to new server in forwarder for jrodman. 06-05-2020 12:47 AM
- Karma Re: How to get rid of warning sign "search is waiting for input ..." and display the data in dashboard panel? for bwheelock. 06-05-2020 12:47 AM
- Karma How to dynamically remove components (eg. SingleView) from a dashboard created with javascript. for cchitten. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-03-2021
01:35 PM
2 Karma
Hi, I am ingesting json data using log2metrics_json source type into a metrics index. Everything is working fine when the json is ingested from a file, but when the json is received over udp, I am getting errors like this: INFO MetricSchemaProcessor [665036 typing] - channel confkey=source::udp:5514|host::1.1.1.1|log2metrics_json| has an event with no measure, will be skipped. WARN IndexProcessor [664977 indexerPipe] - The metric event is not properly structured, source=5514, sourcetype=log2metrics_json, host=1.1.1.1, index=j2m. Metric event data without a metric name and preoperly formated numerical values are invalid and cannot be indexed. Ensure the input metric data is not malformed, have one or more keys of the form "metric_name:<metric>" (e.g..."metric_name:cpu.idle") with corresponding floating point values. raw= What could be the root cause? Why is there this error when the source is udp, but works fine when read from file?
... View more
Labels
- Labels:
-
JSON
03-25-2021
03:37 PM
We are trying to use the fill_summary_index.py script to backfill times when the data isn't populated in a metrics based index. The script is not detecting gaps, it is re-running the searches for the defined time range. I would assume that the issue might be with the default dedupsearch: dedupsearch = 'search splunk_server=local index=$index$ $namefield$="$name$" | stats count by $timefield$' which is not compatible with metrics based indexes. Any recommendations?
... View more
Labels
- Labels:
-
summary indexing
07-23-2020
01:48 PM
I had found out that it is a bug which will be fixed in the future.
... View more
07-23-2020
10:22 AM
Hi,
while checking our app with AppInspect v2.2.0 an extract in props.conf was flagged with this error :
xxxxx
check_props_conf_extract_option_has_named_capturing_group
[EXTRACT-nfo_hostname] setting in props.conf specified a regex without any named capturing group. This is an incorrect usage. Please include at least one named capturing group. File: default/props.conf Line Number: 19
xxxxx
Line 19 is :
EXTRACT-nfo_hostname = ((\w{3}\s+\d{1,2}\s\d{2}:\d{2}:\d{2})|(1\s\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.{1}\d{2}:\d{2}))\s+(?P<nfo_hostname>[^ ]+)\s+(nfc_id|NFO)
It has a named capturing group : (?P<nfo_hostname>[^ ]+)
What could be wrong? The error is not present when checking the built spl file with the CLI version of AppInspect v2.2.0
In my opinion it might be a bug in AppInspect. Attempted to email appinspect@splunk.com, but it is bouncing back. Is there some other channel to reach the AppInspect team?
... View more
07-19-2020
07:08 AM
Found an issue with "Developer Guidance - Setup View Example For Splunk", after clicking on "Perform Setup" button I am returned to the "App configuration" in Firefox. The app.conf is correctly updated in local, but still restart is needed to not see the "App configuration". In Chrome everything is working as expected. Any advice on what should be changed in js so that it would work fine also in Firefox.
... View more
Labels
- Labels:
-
app
12-31-2019
02:07 PM
Is it possible to prevent a dashboard to autorun all the searches in it when the dashboard is opened? Ideally the searches should run only when the user had selected all the desired parameters in the fields and Submit is pressed.
... View more
11-05-2019
01:15 AM
Im having an issue with the Force Directed App. Nothing is loaded in the component when it is not in the first tab of the Link Switcher component. Changing the time range and clicking Submit loads it again. Is there a solution that it would load initially when I switch over to that.
Sample code to reproduce the issue, it is present both in Splunk v7.0 and v8.0 :
<form>
<fieldset submitButton="true" autoRun="true">
<input type="time">
<label>Time Range</label>
<default>Last 60 minutes</default>
</input>
</fieldset>
<row>
<panel>
<input type="link">
<label>Choose a view</label>
<choice value="chart">Chart</choice>
<choice value="topology">Topology</choice>
<default>Chart</default>
<change>
<condition value="chart">
<set token="showChart">true</set>
<unset token="showTopology"></unset>
</condition>
<condition value="topology">
<set token="showTopology">true</set>
<unset token="showChart"></unset>
</condition>
</change>
</input>
</panel>
</row>
<row depends="$showChart$">
<panel>
<chart>
<title>Chart</title>
<search>
<query>
index=_internal | timechart count by host
</query>
</search>
<option name="charting.drilldown">none</option>
<option name="charting.legend.placement">right</option>
<option name="height">216</option>
</chart>
</panel>
</row>
<row depends="$showTopology$">
<panel>
<viz type="force_directed_viz.force_directed">
<title>Topology</title>
<search>
<query>
index=_internal | stats count by host
</query>
</search>
<option name="drilldown">none</option>
<option name="force_directed_viz.force_directed.AttractDistanceMax">200</option>
<option name="force_directed_viz.force_directed.AttractDistanceMin">60</option>
<option name="force_directed_viz.force_directed.AttractForceStrength">-300</option>
<option name="force_directed_viz.force_directed.CollisionIterations">1</option>
<option name="force_directed_viz.force_directed.CollisionRadius">40</option>
<option name="force_directed_viz.force_directed.CollisionStrength">0.7</option>
<option name="force_directed_viz.force_directed.ColorRange1">100</option>
<option name="force_directed_viz.force_directed.ColorRange1Code">#65a637</option>
<option name="force_directed_viz.force_directed.ColorRange2">500</option>
<option name="force_directed_viz.force_directed.ColorRange2Code">#6db7c6</option>
<option name="force_directed_viz.force_directed.ColorRange3">1000</option>
<option name="force_directed_viz.force_directed.ColorRange3Code">#f7bc38</option>
<option name="force_directed_viz.force_directed.ColorRange4">10000</option>
<option name="force_directed_viz.force_directed.ColorRange4Code">#f58f39</option>
<option name="force_directed_viz.force_directed.ColorRange5">1000000</option>
<option name="force_directed_viz.force_directed.ColorRange5Code">#d93f3c</option>
<option name="force_directed_viz.force_directed.ForceCollision">20</option>
<option name="force_directed_viz.force_directed.LineColor">disabled</option>
<option name="force_directed_viz.force_directed.LinkLength">1</option>
<option name="force_directed_viz.force_directed.RepelDistanceMax">50</option>
<option name="force_directed_viz.force_directed.RepelDistanceMin">10</option>
<option name="force_directed_viz.force_directed.RepelForceStrength">-140</option>
<option name="force_directed_viz.force_directed.StrokeWidth">1</option>
<option name="force_directed_viz.force_directed.arrows">enabled</option>
<option name="force_directed_viz.force_directed.theme">dark</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</viz>
</panel>
</row>
</form>
... View more
09-25-2019
11:06 PM
If you are using MaxMind for GeoIP of NetFlow/sFlow/IPFIX, NetFlow Optimizer solution from NetFlow Logic (https://www.netflowlogic.com) has a cron setting to update it as often as you'd like. In addition, GeoIP enrichment is performed at the time when NetFlow record is processed, not at query time in Splunk.
... View more
09-06-2019
08:46 AM
Agreed, that would work in regular indexes, but I need it for metrics based indexes.
... View more
09-06-2019
08:13 AM
In the data source I am ingesting it can happen that one of the fields is not present from time to time. The issue is when I am running a search on it and if I add that dimension to the query that event is not part of the calculation.
Is it possible to somehow add a field to metrics with a default value if it is not present in the raw event?
... View more
05-17-2019
07:03 AM
used csv just an example, when I send directly to a metrics index then everything is working fine
... View more
05-17-2019
05:50 AM
I have created a setup where from an input based on a regex some of the events are sent to a specific index with changed source type. It is working nicely with regular indexes, but I can not get it working with metrics based indexes. What could be wrong?
props.conf
[csv]
TRANSFORMS-indst = change_index,change_sourcetype
inputs.conf
[udp://514]
connection_host = ip
sourcetype = csv
transforms.conf
[change_index]
REGEX = (?i) error
DEST_KEY = _MetaData:Index
WRITE_META = true
FORMAT = metrics_index
[change_sourcetype]
REGEX = (?i) error
DEST_KEY = _MetaData:
WRITE_META = true
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::metrics_sourcetype
... View more
02-26-2019
10:38 AM
Good point, that is ideal to change the hight, but I would like to control other parameters also, like
<option name="charting.chart">area</option>
<option name="charting.chart.nullValueMode">zero</option>
<option name="charting.legend.placement">right</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="height">200</option>
in a chart.
... View more
02-26-2019
08:59 AM
My plan is to make certain chart variables configurable on app level, so that the end user would not have to change each dashboard manually. For example the height of the charts.
What would be the optimal solution? To put it in a lookup file, get it from there on the dashboard in a search and add it as a token? Is there a nicer method?
... View more
- Tags:
- splunk-enterprise
10-18-2018
08:32 PM
What kind of network devices you have that generate layer 7 flows?
... View more
08-22-2018
04:01 PM
Hi,
NetFlow Logic removed “enable” button in App version 3.8.8, so I suggest to upgrade to the latest version.
some configuration changes I made to the visualizations dont seem to be replicating to the other SH's.
What kind of visualization changes were made?
Please note that in the latest version of the App the menu was made editable by placing your changes in …/local folder (in v3.7.81 the menu was built dynamically based on config options)
... View more
05-13-2018
12:21 AM
1 Karma
Thank you, it was not obvious for me from the documentation. It is working nicely.
... View more
05-12-2018
03:00 PM
I am creating an app which is using a lookup file. That lookup file is populated by a saved search with this setting :
run_on_startup = true
To assure that the lookup is populated, restart of splunk is needed.
Is there a config setting which would trigger this dialog after the installation?
"Restart Required
You must restart Splunk Enterprise to complete the update."
... View more
03-27-2018
03:32 PM
Please try to use some other port than 10514, for example 10515 :
[udp://10515]
sourcetype = flowintegrator
disabled = 0
and configure the Optimizer to send to 10515.
... View more
03-27-2018
03:30 PM
As the problem is resolved, I am moving this solution to Answers. Please accept.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-02-2023
02:28 PM
|
Karma given to
