About mikeely

mikeely · ‎04-17-2012

Clever. I like it. Thanks!

blebit · ‎11-26-2014

hi MW, i see that Asset Discovery on my Splunk is scanning only the host on the same subnet where splunk server is. do i have to make any configuration? Thanks

woodcock · ‎06-01-2015

The short answer is: do not use followTail=1 : http://answers.splunk.com/answers/57819/when-is-it-appropriate-to-set-followtail-to-true.html

mikeely · ‎01-10-2012

Thanks, that looks like the way forward. Now I have more info also on the file not being read, but it's different enough to warrant a different thread.

dwaddle · ‎12-29-2011

Yes, your first example is incorrect. Only one of the blacklists will take effect. And, yes, using the regex | should be valid as well..

mikeely · ‎12-29-2011

One would think I could have tried that myself but I've apparently got too many hats on today to be any good at one thing. Thanks!

mikeely · ‎12-30-2011

Genti, thanks - when I looked there were my custom fields!

gkanapathy · ‎12-22-2011

Seems to me that you'd want to change the chart to use a real-time search, rather than a historical search. Starting with 4.3 (and actually in 4.2.3+ if you want to change the default settings in limits.conf), you can have a real-time search backfill with historical data (e.g., if you start it up for a 1-hour window, it will fill in the past 1 hour, then start updating going forward.)

mikeely · ‎12-22-2011

Self-answering: sourcetype="my_custom_sourcetype" | timechart sum("Critical"),sum("Error"),sum("Warning") by time

eashwar · ‎01-05-2013

change the time range to All time in beta by default the results shown are past 24 hours.

mikeely · ‎08-19-2011

Ah, perhaps I didn't make things clear. The file looks something like this: <process> <id>12345</id> <when>Wed Aug 17 17:11:54 +0000 2011</when> ...stuff... <fbar>6743</fbar> </process> <process> <id>12346</id> <when>Wed Aug 17 19:32:26 +0000 2011</when> ...stuff... <fbar>3238</fbar> </process> So xmlkv seems to be parsing all this just fine. What I am wanting is simply a chart that plots the value of "fbar" each time it appears. Since this will always be a numeric value, it should be possible to do, right?

mikelanghorst · ‎08-12-2011

I would recommend removing the "sourcetype=syslog" from your monitor stanza. Many logs under that path may not be syslog format. Telling it to treat all of these logs as a syslog file, which will extract the 4th field of the line to be the hostname. Then if you have specific file sources, add them to props.conf entries and assign them to sourcetype=syslog.

mikelanghorst · ‎07-13-2011

A deployment server would make the process of getting the configs to the individual servers easier. You'll be best off by using a single windows host to configure manually first: http://www.splunk.com/base/Documentation/4.2.2/Data/MonitorWMIdata create a directory under that forwarders etc/apps. Then once you have it working on that host copy the directory you have to a deployment server then push it out from there.

Posts	29
Solutions	1
Karma Given	10
Karma Received	6
Member Since	‎07-12-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Any way to alert when source sends too many events...

Asset Discovery app not returning OS signatures

Simple text file suddenly (but thoroughly) being i...

Weirdness with timechart, rolling averages, all I ...

Multiple blacklist paths in one stanza

Simple stats conditional for alert

Any way to get dashboard charts to "crawl" rather ...

How do I parse single-line entries for stacked tim...

Why is everything "No results found" in Web Intell...

How do I display value of extracted numeric field ...

Re: Any way to alert when source sends too many ev...

Re: Asset Discovery app not returning OS signature...

Re: Simple text file suddenly (but thoroughly) bei...

Re: Weirdness with timechart, rolling averages, al...

Re: Multiple blacklist paths in one stanza

Re: Simple stats conditional for alert

Re: Saving a custom field extraction throws a pyth...

Re: Any way to get dashboard charts to "crawl" rat...

Re: How do I parse single-line entries for stacked...

Re: Why is everything "No results found" in Web In...

Re: How do I display value of extracted numeric fi...

Re: How do I get the Hosts list in Search to not s...

Re: Splunk cannot find "admin/win-event-log-collec...

Join the Conversation