Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jsburt
jsburt
New Member
Member since:
04-10-2014
06-05-2020
Community Statistics
| Posts | 10 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 04-10-2014 |
Activity Feed
- Posted How do I create a table lookup to have multi line columns on Splunk Search. 07-09-2018 09:08 AM
- Tagged How do I create a table lookup to have multi line columns on Splunk Search. 07-09-2018 09:08 AM
- Tagged How do I create a table lookup to have multi line columns on Splunk Search. 07-09-2018 09:08 AM
- Posted Re: How do I configure collectd to send to the collectd Splunk app? on All Apps and Add-ons. 03-19-2018 03:51 AM
- Posted How do I configure collectd to send to the collectd Splunk app? on All Apps and Add-ons. 03-14-2018 08:28 AM
- Tagged How do I configure collectd to send to the collectd Splunk app? on All Apps and Add-ons. 03-14-2018 08:28 AM
- Tagged How do I configure collectd to send to the collectd Splunk app? on All Apps and Add-ons. 03-14-2018 08:28 AM
- Posted Re: Sorting timewrap output on Splunk Search. 01-24-2018 05:58 AM
- Posted Re: How do I edit my timechart search to get the expected visualization? on Splunk Search. 01-24-2018 04:50 AM
- Posted Re: Sorting timewrap output on Splunk Search. 01-24-2018 04:41 AM
- Posted Sorting timewrap output on Splunk Search. 01-23-2018 10:40 AM
- Tagged Sorting timewrap output on Splunk Search. 01-23-2018 10:40 AM
- Tagged Sorting timewrap output on Splunk Search. 01-23-2018 10:40 AM
- Posted Re: how does the attribute "maxHotIdleSecs" work? on Splunk Search. 04-21-2017 06:55 AM
- Posted Re: How do I configure my indexes so that hot buckets to roll to warm at least daily for effective backups? on Deployment Architecture. 08-07-2015 08:37 AM
- Posted Re: roll all hot buckets on Deployment Architecture. 08-07-2015 08:32 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
07-09-2018
09:08 AM
I have a table lookup to map product numbers to more-readable and usable names.
I would like to be able to map number 272829 to "Joes Widget (round blue)" - where the parenthesized part shows underneath "Joes Widget" in the resultant table.
Is this doable?
What would the string in the CSV file look like?
Thanks
... View more
03-19-2018
03:51 AM
I guess i wasn't clear about my question.
I know the data is getting to the Splunk server and is being ingested by Splunk (since I get data if a query index=collectd).
However, I don't get any results if I use the collectd app.
Jeff
... View more
03-14-2018
08:28 AM
I'm trying to use the write_http plugin for collectd to send the metrics to Splunk so that I can use the Splunk collectd app to view the results.
I can see the data in Splunk by querying index=collectd and that's fine.
The collectd index is in my default list of searchable indices.
My write_http stanza looks like:
Plugin write_http
Node "node-http-1"
URL "https://xxx..xxx.xxx.xxx:9989/services/collector/raw?channel=f3d00af7-d987-49a8-be4d-f3c605b0dda5"
Header "Authorization: Splunk f3d00af7-d987-49a8-be4d-f3c605b0dda5"
Format "JSON"
Metrics true
StoreRates true
VerifyPeer false
VerifyHost false
LogHttpError true
Node
Plugin
How can I confirm that collectd is sending to the Splunk server on port 9989?
And I do have iptables turned off.
Both machines are Linux servers:
Linux nfldevspc01 2.6.32-696.18.7.el6.x86_64 #1 SMP Thu Dec 28 20:15:47 EST 2017 x86_64 x86_64 x86_64 GNU/Linux
... View more
01-24-2018
05:58 AM
This worked like a champ - thank you.
And since I don't know all the column names, I was able to use "fields _time, *" and the columns sort correctly.
... View more
01-24-2018
04:50 AM
Can you share the script you run? Sounds like this would be very useful to have in place.
... View more
01-24-2018
04:41 AM
Thank you for this suggestion.
It seems as though this solution sorts the resultant rows in time order.
I really want to change the sort order of the columns themselves so all the "bob" columns appear next to each other (as opposed to the default order where each time period is next to each other).
... View more
01-23-2018
10:40 AM
I doing a search and timecharting the results which I then stream into timewrap.
My timechart contains (for instance) bob.com, charlie.com and delta.com
After I pipe this into timewrap, I get the following ordering:
bob.com.2018_01_02, charlie.com_2018_01_02, delta.com_2018_01_02, bob.com_2018_01_09, charlie.com_2018_01_09, delta.com_2018_01_09
Why aren't I seeing results from "today" 2018_01_23?
And how can I sort the columns so the "bob"s, "charlie"s, and "delta"s are adjacent to each other?
My SPL is as follows:
... | eval lc_domain = lower(metadata_recipient_email_domain) | timechart limit=0 span=1d count by metadata_recipient_email_domain | timewrap 1week | sort metadata_recipient_email_domain
... View more
04-21-2017
06:55 AM
Would setting both parameters to 24 hours force each bucket to contain exactly (more or less) 24 hours worth of data for that particular index?
maxHotIdleSecs = 86400
maxHotSpanSecs = 86400
... View more
08-07-2015
08:37 AM
I tried running your script but get the following errors:
[splunk@nfldevspc01 ~]$ splunk search '| debug cmd=roll index=secure'
Couldn't complete HTTP request: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
[
... View more
08-07-2015
08:32 AM
I tried running this command and get the following errors:
QUERYING: 'https://127.0.0.1:8089/services/data/indexes/main/roll-hot-buckets'
FAILED: '502 Couldn't complete HTTP request: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert hadshake failure'
Content:
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
