Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About robertlynch2020
robertlynch2020
Influencer
Member since:
11-05-2015
02-11-2026
Community Statistics
| Posts | 656 |
| Solutions | 34 |
| Karma Given | 100 |
| Karma Received | 66 |
| Member Since | 11-05-2015 |
Activity Feed
- Posted Re: How to Graph white space before and after my data in a stats graph on Splunk Enterprise. 11-18-2025 02:00 AM
- Karma Re: How to Graph white space before and after my data in a stats graph for bowesmana. 11-18-2025 01:31 AM
- Karma Re: How to Graph white space before and after my data in a stats graph for ITWhisperer. 11-18-2025 01:31 AM
- Posted How to Graph white space before and after my data in a stats graph on Splunk Enterprise. 11-14-2025 07:57 AM
- Got Karma for Re: Can i create trellis with overlays, when the overlap can be dynamic.. 11-05-2025 10:53 AM
- Posted Re: Can i create trellis with overlays, when the overlap can be dynamic. on Dashboards & Visualizations. 11-05-2025 08:57 AM
- Karma Re: Can i create trellis with overlays, when the overlap can be dynamic. for tscroggins. 11-05-2025 08:56 AM
- Karma Re: Can i create trellis with overlays, when the overlap can be dynamic. for tscroggins. 11-05-2025 08:26 AM
- Got Karma for Re: Is it possible to Monitor Splunk User activity?. 11-05-2025 02:56 AM
- Posted Re: Can i create trellies wiht overlays, when the overlap can by dynamic. on Dashboards & Visualizations. 11-04-2025 02:46 AM
- Karma Re: Can i create trellies wiht overlays, when the overlap can by dynamic. for livehybrid. 11-03-2025 02:30 AM
- Posted Can i create trellis with overlays, when the overlap can be dynamic. on Dashboards & Visualizations. 10-31-2025 05:53 AM
- Karma Re: Can i have overlap on a Multi-series graph for livehybrid. 10-09-2025 06:52 AM
- Posted Re: Can i have overlap on a Multi-series graph on Splunk Enterprise. 10-08-2025 09:40 AM
- Posted Can i have overlap on a Multi-series graph on Splunk Enterprise. 10-08-2025 09:02 AM
- Posted Re: Search for a path the might not exist on Splunk Search. 05-28-2025 01:39 AM
- Karma Re: Search for a path the might not exist for livehybrid. 05-28-2025 01:39 AM
- Karma Re: Search for a path the might not exist for yuanliu. 05-28-2025 01:38 AM
- Posted Re: Search for a path the might not exist on Splunk Search. 05-22-2025 08:46 AM
- Posted Re: Search for a path the might not exist on Splunk Search. 05-22-2025 08:39 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-11-2017
05:40 AM
cheers that worked @niketn 🙂
| search File_location = "/net/dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/"
... View more
04-11-2017
04:44 AM
hi
I have the following files
/net/dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/
/net/dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/logs/traces/
/net/dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/logs/traces/
/net/dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/XXX/YYY
when i run the below search i get all the directories back, in this case i just want the one /net/dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/. Not the other 3
| search File_location = */net/dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/*
Cheers for you help 🙂
... View more
04-07-2017
04:27 AM
Hi - I tried this, but it only give me the subdirectories and not the main directory.
So it looks like i need to lines in my inputs.conf to get the main directory and all its subdirectories
[monitor:///net/dell425srv/dell425srv/apps/SPLUNK_BACK_UP_LIVE/MXTIMING_MEDIUM5/*.log]
disabled = false
recursive = true
host = MXTIMING_LIVE_TEST5
index = mlc_live
whitelist = mxtiming_(?<ppp>\d*_[^_]*_\d*)\.log
crcSalt = <SOURCE>
sourcetype = MX_TIMING
[monitor:///net/dell425srv/dell425srv/apps/SPLUNK_BACK_UP_LIVE/MXTIMING_MEDIUM5/.../*.log]
disabled = false
recursive = true
host = MXTIMING_LIVE_TEST5
index = mlc_live
whitelist = mxtiming_(?<ppp>\d*_[^_]*_\d*)\.log
crcSalt = <SOURCE>
sourcetype = MX_TIMING
... View more
04-07-2017
04:23 AM
Hi - This worked thanks 🙂
... View more
04-07-2017
04:21 AM
Hi
I have a directory
/net/dell425srv/dell425srv/apps/SPLUNK_BACK_UP_LIVE/MXTIMING_MEDIUM3
However it looks like i have to add two lines into my forwarder to do monitor the original directory and all the sub-directories, is there one line that i can use?
[monitor:///net/dell425srv/dell425srv/apps/SPLUNK_BACK_UP_LIVE/MXTIMING_MEDIUM3/*.log]
disabled = false
recursive = true
host = MXTIMING_LIVE_TEST2
index = mlc_live
whitelist = mxtiming_(?<ppp>\d*_[^_]*_\d*)\.log
crcSalt = <SOURCE>
sourcetype = MX_TIMING
[monitor:///net/dell425srv/dell425srv/apps/SPLUNK_BACK_UP_LIVE/MXTIMING_MEDIUM3/.../*.log]
disabled = false
recursive = true
host = MXTIMING_LIVE_TEST2
index = mlc_live
whitelist = mxtiming_(?<ppp>\d*_[^_]*_\d*)\.log
crcSalt = <SOURCE>
sourcetype = MX_TIMING
... View more
04-07-2017
04:15 AM
Hi
So it looks like i get this to work, with the regex - thanks.
whitelist = mxtiming_(?\d*[^]_\d).log
... View more
04-07-2017
02:30 AM
Thanks for your help on this , I think we are close.
To explain the issues more.
Wanted Files
Any sub directory of the main
[dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART]
dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/X/Y/A/mxtiming_730010_dell427srv_121.log
Or
dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/A/X/mxtiming_730018_dell427srv_504.log
Or.
Etc..
mxtiming_730010_dell427srv_121.log
mxtiming_730018_dell427srv_504.log
mxtiming_730022_dell427srv_531.log
Unwanted Files
The files I don’t want are below and again they can also come into any subdirectory
mxtiming_commoditynearbyonindexhistoricaldata_20170306-093752167_1294331273_6902.log
mxtiming_commoditynearbyonindextofutures_20170306-093752167_1718781102_6902.log
mxtiming_datamartdatasetlabelstransfer_20170306-093752167_1714912538_6902.log
mxtiming_fillcommoditytimeunits_20170306-093752167_1066971732_6902.log
mxtiming_obsolete_typology_cleanup_in_stp_rights_20170306-093752167_1206801397_6902.log
mxtiming_new_stp_rights_migration_20170306-093752167_252516786_6902.log
mxtiming_adapt_warehouse_rebuild_20170306-093752167_1385637444_6902.log
mxtiming_updatepricingbookingpretraderouters_20170306-093752167_904493553_6902.log
mxtiming_collateralinterestopsobjectupgrade_20170306-093752167_1527129704_6902.log
mxtiming_refreshaccountssidata_20170306-093752167_421251909_6902.log
dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/X/Y/A/mxtiming_adaptposnbstoredpltables_20170306-093752167_44364646_6902.log
Or
dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/A/Z/A/mxtiming_removecommodityfuturesindexplinstruments_20170306-093752167_222279393_6902.log
OR .
... View more
04-07-2017
02:00 AM
Thanks for your help on this , I think we are close.
To explain the issues more.
Wanted Files
Any sub directory of the main
[dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART]
dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/X/Y/A/mxtiming_730010_dell427srv_121.log
Or
dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/A/X/mxtiming_730018_dell427srv_504.log
Or.
Etc..
mxtiming_730010_dell427srv_121.log
mxtiming_730018_dell427srv_504.log
mxtiming_730022_dell427srv_531.log
Unwanted Files
The files I don’t want are below and again they can also come into any subdirectory
mxtiming_commoditynearbyonindexhistoricaldata_20170306-093752167_1294331273_6902.log
mxtiming_commoditynearbyonindextofutures_20170306-093752167_1718781102_6902.log
mxtiming_datamartdatasetlabelstransfer_20170306-093752167_1714912538_6902.log
mxtiming_fillcommoditytimeunits_20170306-093752167_1066971732_6902.log
mxtiming_obsolete_typology_cleanup_in_stp_rights_20170306-093752167_1206801397_6902.log
mxtiming_new_stp_rights_migration_20170306-093752167_252516786_6902.log
mxtiming_adapt_warehouse_rebuild_20170306-093752167_1385637444_6902.log
mxtiming_updatepricingbookingpretraderouters_20170306-093752167_904493553_6902.log
mxtiming_collateralinterestopsobjectupgrade_20170306-093752167_1527129704_6902.log
mxtiming_refreshaccountssidata_20170306-093752167_421251909_6902.log
dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/X/Y/A/mxtiming_adaptposnbstoredpltables_20170306-093752167_44364646_6902.log
Or
dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/A/Z/A/mxtiming_removecommodityfuturesindexplinstruments_20170306-093752167_222279393_6902.log
OR .
…etc..
... View more
04-06-2017
10:18 AM
Hi No Luck, i tried this but nothing come out
[monitor://net/dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/.../*.log]
disabled = false
host = RSAT_Campaign
index = mlc_live
whitelist = mxtiming_[^]+[^]+[^.]+.log$
sourcetype = MX_TIMING
... View more
04-06-2017
09:52 AM
Hi, Thanks, but these files could be multiple levels down from the main directory
... View more
04-06-2017
09:51 AM
Hi
I have files like below that i don't want to take in.
mxtiming_adaptposnbstoredpltables_20170306-093752167_44364646_6902.log
mxtiming_removecommodityfuturesindexplinstruments_20170306-093752167_222279393_6902.log
Cheers for you help
... View more
04-06-2017
09:20 AM
Hi
I have the following file in multiple sub directories. I am trying to pick them up but the below is not working and i can't crack it.
The regex is good, but it just won't take them it... any help would be super... I am thinking something very small is wrong here.
-rw-rw-r-- 1 autoengine murex 4772 Apr 6 17:24 mxtiming_730010_dell427srv_121.log
-rw-rw-r-- 1 autoengine murex 4772 Apr 6 17:26 mxtiming_730018_dell427srv_504.log
-rw-rw-r-- 1 autoengine murex 4772 Apr 6 17:27 mxtiming_730022_dell427srv_531.log
[monitor:///net/dell427srv//data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/.../*.log]
disabled = false
host = RSAT_Campaign
index = mlc_live
whitelist = mxtiming_\d+_\w+_\d+.*\.log$
sourcetype = MX_TIMING
... View more
04-05-2017
08:05 AM
2 Karma
Hi
I had the following issues, i had two address on two different machines configured on one forwarder. I access via /net/.
One machine was shut down hp589srv(so not accessible anymore), but both HOST stopped forwarding data dell439srv as well.
I got no errors, but just spent the day figuring this out.
Is there a way to tell the forwarder that if an address it not reachable ignore it and move on.
[monitor:///net/hp589srv/hp589srv3/apps/TX_ORA_3691008//logs/monitoring/db_rowcounts/*]
disabled = false
host = TX_TST_ndjelveh
index = mlc_live
sourcetype = row_counts
initCrcLength = 4096
[monitor:///net/dell439srv/data1/apps/__COLLAT_BENCH//mlc/timings/*]
disabled = false
host = COLLAT-COMPL-PAC_tkoch
index = mlc_live
sourcetype = lts_timings
whitelist = timings.csv$
Cheers for any help on this 🙂
... View more
04-04-2017
06:41 AM
1 Karma
Thanks for this.
I put this in but the performance was a bit slow over Millions of lines as i was doing a lot of calculations after the datamodel.
In fact you gave me a great idea.
Soooooo. I changed the datamodel to have Context=if(isnull(Context),"NULL",Context). This worked great as now it has NULL at the datamodel level and i can now get all the data i need with the original query.
... View more
03-30-2017
06:02 AM
1 Karma
Hi
I have data that looks like below, as you can see some parts have blanks.
Date | Time | UserName |iD | Context | Command
20161209|17:28:55.238|MUREXFO | 1 |LOGIN |SPBActUserLogin
20161209|17:29:02.456|MUREXFO | 1 | |Login
20161209|17:29:28.555|MUREXFO | 2 |Report Selection |
20161209|17:29:32.344|MUREXFO | 3 |Report Selection NAME |&Open
20161209|17:29:33.404|MUREXFO | 4 |Creation INFO |&Open
20161209|17:29:35.966|MUREXFO | 5 |ADT_OBJDSP |
20161209|17:29:38.907|MUREXFO | 6 |Scenario details |Open
I am able to work whit these with a normal Query, however when i use Data Models i cant.
Below Query works as i can replace blank with NULL and that is fine - I get 10 entries and it displays NULL
index=mlc_log_drop host="mxtiming_qc3" source="/net/dell425srv/dell425srv/apps/SPLUNK_FILES/MXTIMING_QC3/Resources/logs/MXTIMING/mxtiming_small.log" | fillnull value=NULL |dedup Context |table Context
However i cant seem to do this with DataModels, I only get 9 entries as NULL is not displayed. I am not sure how to add this at the DataModel level.
| tstats count(MXTIMING.CPU) AS count FROM datamodel=MXTIMING where source="/net/dell425srv/dell425srv/apps/SPLUNK_FILES/MXTIMING_QC3/Resources/logs/MXTIMING/mxtiming_small.log" groupby MXTIMING.Context
We can see in the image i get 9 results in the tstats and 10 in the normal with NULL
... View more
03-22-2017
01:19 PM
Thanks for this...
... View more
03-22-2017
01:18 PM
This worked cheers.
... View more
03-22-2017
08:14 AM
I have a file call /net/dell569srv/dell569srv2/apps/qa10157_TPK0002437_24367887/TestRunner/logs/20170321-184649.17336.50.cmd.51.archive-and-report.sh.log
In this there are many events in this file, however i want to display all of them in a cell, is it possible to merge them?
I want all _raw events in one cell and to dedup the source.
... View more
03-21-2017
10:32 AM
great cheers - thanks 🙂
... View more
03-20-2017
10:45 AM
Is it possible to extract the duration from a graph in a drilldown, even though the duration has not been displayed in the chart (it is in the table behind the chart)? If not, how do i access referencing the "start" or "stop" seen in the image below?
<viz type="timeline_app.timeline">
<search>
<query>eventtype=mlc sourcetype=lts_timings host=$host_token$ | eval duration_seconds=duration_seconds*1000 | table _time task_name task_name2 duration_seconds start end | sort $Name_or_Duration2$ | rename task_name as Event_Name | rename task_name2 as Event_Name2 | search Event_Name=*$Task_Search$*</query>
<earliest>$tps_selection.earliest$</earliest>
<latest>$tps_selection.latest$</latest>
</search>
<option name="height">399</option>
<option name="timeline_app.timeline.axisTimeFormat">SECONDS</option>
<option name="timeline_app.timeline.colorMode">categorical</option>
<option name="timeline_app.timeline.maxColor">#DA5C5C</option>
<option name="timeline_app.timeline.minColor">#FFE8E8</option>
<option name="timeline_app.timeline.numOfBins">6</option>
<option name="timeline_app.timeline.tooltipTimeFormat">SECONDS</option>
<option name="timeline_app.timeline.useColors">1</option>
<drilldown>
<set token="TEST_GANTT_VALUE">$row.Event_Name$</set>
<set token="TEST_GANTT_VALUE2">$row.Event_Name2$</set>
<set token="TEST_GANTT_duration">$row.duration_seconds$</set>
<eval token="TEST_GANTT_start">$row._time$ - 3600</eval>
<eval token="TEST_GANTT_end">$row._time$ - 3500</eval>
</drilldown>
</viz>
... View more
03-09-2017
09:14 AM
cheers 🙂
... View more
03-09-2017
08:48 AM
I need to display _time field1 field1 where field 1 and field 1 are the same, however if you try to do this it wont display the second field.
so renaming wont work.
so i need
_time field1 field1_copy
however i cant seem to find a copy command.
I have tried autoregress task_name AS task_name_n p=1, but i lose one value
... View more
03-08-2017
03:25 AM
Hi
I am using Timeline app (its great :))..but i my information is getting chopped off.
Can i make it shift right?
... View more
03-06-2017
05:03 AM
Got this working with help from @niketnilay answer
eventtype=mlc sourcetype=tps host=TimeSeries | eval foo="ON" | eval foo1="true" | eval foo2="ON" | eval duration = endTime - startTime | search name = "" operationIdentity=* | eval fullyQualifiedMethod = name."#".operationIdentity |sort - duration | eval fullyQualifiedMethod2 = name."#".operationIdentity | table _time fullyQualifiedMethod fullyQualifiedMethod2 duration
... View more
03-06-2017
04:51 AM
Will do. Thanks for your help 🙂
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-11-2026
08:22 AM
|
Karma given to
