Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Javo222
Javo222
Path Finder
Member since:
04-16-2014
06-05-2020
Community Statistics
| Posts | 27 |
| Solutions | 0 |
| Karma Given | 5 |
| Karma Received | 3 |
| Member Since | 04-16-2014 |
Activity Feed
- Karma Re: sum two fileds count on linechart for cpetterborg. 06-05-2020 12:47 AM
- Karma Re: sum two fileds count on linechart for cpetterborg. 06-05-2020 12:47 AM
- Karma Re: refresh from batch file and authenticating at the same time for MuS. 06-05-2020 12:47 AM
- Karma Re: refresh from batch file and authenticating at the same time for MuS. 06-05-2020 12:47 AM
- Got Karma for How to get the last 15 days of logs relative to the latest event, not to now?. 06-05-2020 12:47 AM
- Got Karma for Re: How to get the last 15 days of logs relative to the latest event, not to now?. 06-05-2020 12:47 AM
- Got Karma for Re: Why am I getting an authentication error trying to add oneshot via CLI from a remote computer?. 06-05-2020 12:47 AM
- Karma Re: Manually Trigger Scheduled Saved Search for matthieu_araman. 06-05-2020 12:45 AM
- Posted Why do saved searches take too much time in dashboards? on Dashboards & Visualizations. 03-17-2017 07:29 AM
- Tagged Why do saved searches take too much time in dashboards? on Dashboards & Visualizations. 03-17-2017 07:29 AM
- Tagged Why do saved searches take too much time in dashboards? on Dashboards & Visualizations. 03-17-2017 07:29 AM
- Tagged Why do saved searches take too much time in dashboards? on Dashboards & Visualizations. 03-17-2017 07:29 AM
- Tagged Why do saved searches take too much time in dashboards? on Dashboards & Visualizations. 03-17-2017 07:29 AM
- Posted Re: How to change the frequency of search jobs scheduled to run from configuration files to prevent 100% CPU usage? on Splunk Search. 08-09-2016 05:13 AM
- Posted How to change the frequency of search jobs scheduled to run from configuration files to prevent 100% CPU usage? on Splunk Search. 08-08-2016 04:40 AM
- Tagged How to change the frequency of search jobs scheduled to run from configuration files to prevent 100% CPU usage? on Splunk Search. 08-08-2016 04:40 AM
- Tagged How to change the frequency of search jobs scheduled to run from configuration files to prevent 100% CPU usage? on Splunk Search. 08-08-2016 04:40 AM
- Tagged How to change the frequency of search jobs scheduled to run from configuration files to prevent 100% CPU usage? on Splunk Search. 08-08-2016 04:40 AM
- Posted How to group search results based on values? on Splunk Search. 10-15-2015 05:22 AM
- Tagged How to group search results based on values? on Splunk Search. 10-15-2015 05:22 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
03-17-2017
07:29 AM
I have several dashboards with 8 to 15 graphs/saved searches each and when I try to display them I get "The maximum number of historical concurrent system-wide searches has been reached. current=6 maximum=6 SearchId=admin_admin_search..." I understand why and I tried increasing base_max_searches = 2 but my CPU maxes out at 100% and my PC freezes.
What I would like to do is to run maybe 6 concurrent searches and when these are do, run the next batch of 6.
Other solution I thought of could be to used cache data/searches but I wonder about the following points:
- How can I cache a saved search so it's not executed each time I open the dashboard?
- I stop my Splunk service whenever I'm done with looking at the dashboard. Some weeks later, I will need to look at them again and will start Splunk. Can the saved searches be preserved?
- My saved searches have a cron schedule in savedsearches.conf, similar to cron_schedule = 30 20 1-31 * * with different time of the day.
I barely need to refresh my data, so I don't mind having to use the data cached even if it's 1 month old...
Which parameter can allow me to implement one of these solutions? Or can you think of a better way?
I got this Splunk setup from someone else so I'm not exactly sure about the entire configuration.
I'm using Splunk Enterprise 6.3.0
... View more
08-09-2016
05:13 AM
Thanks! Found it under C:\Program Files\Splunk\etc\users\admin\search\local
... View more
08-08-2016
04:40 AM
I've messed my Splunk system up a bit and some jobs or searches (I don't remember) are continuously running (every minute I think). This causes my CPU to rise to 100% a few seconds after splunkd starts. Unfortunately, I don't have time to stop them or edit them from Splunk Web.
Are the jobs stored in any config file? I would like to edit them so I can change the frequency to 24h or so.
Right now I'm stuck and can't do anything.
... View more
10-15-2015
05:22 AM
I need to filter some search results. Today I have the following search:
search index="test" series_name=* | stats count(series_name) AS "#" by series_name | rename series_name AS "series"
and it returns the following:
A10 > 8
T35 > 10
D22 > 2
211 > 4
H20 > 9
240 > 6
213 > 16
And would like to group the results starting with 2xx:
A10 > 8
T35 > 10
D22 > 2
2xx > 26
H20 > 9
Didn't find a way to do so.
... View more
ahah at least now I know why it didn't work! thanks guys!
... View more
03-05-2015
11:46 AM
Is there a way to:
- reset all default permissions in splunk? Maybe it's stored in a specific file?
- restore all default permissions under the installation files? Without the need to uninstall/reinstall?
If I try to repair the install, it says the wizard ended prematurely because of an error and has not been notified. (version 6.2.2)
... View more
03-05-2015
03:25 AM
According to the documentation, I can create an XML file myself and place it in the appropriate folder.
As I mention in a comment below, it seems to be permission related but I can't see what is wrong. I gave access to basically everything to everyone.
... View more
03-05-2015
12:25 AM
A) works fine
B) Good tip! I can see ERROR ConfContentsCache - Cannot read: C:\Program Files\Splunk\etc\apps\acs\local\data\ui\views\q2.xml: Access is denied.
Need to figure out what's wrong with the rights now
... View more
03-04-2015
02:22 PM
I found another way to do it. copied the files to the remote server and use monitoring the folder. So I don't need the oneshot add anymore.
... View more
03-04-2015
02:21 PM
When creating a dashboard from Splunk Web it appears in the list, and also under \Splunk\etc\apps\myapp\default\data\ui\views or \Splunk\etc\apps\myapp\local\data\ui\views
When adding a xml file under one on these folders, the dashboard doesn't appear in Splunk Web. I tried copy/pasting the one created from Splunk Web to duplicate directly in the folder but same problem.
A refresh using http://localhost:8000/en-US/debug/refresh?entity=data/ui/views or complete refresh doesn't help. Restarting splunk Service either.
It was working before and I'm not sure what I changed ... Any idea?
... View more
03-04-2015
08:02 AM
I enabled remote access and changed to:
"C:\Program Files\Splunk\bin\splunk.exe" add oneshot "C:\Users\myuser\Documents\splunk_data\reports\name\Server.log" -uri http://172.25.30.30:8000
and I get "Not found" but I can't figure out what is not found. The path the the files is correct and tried to use remote path as well but no luck.
... View more
03-04-2015
02:44 AM
Trying to run a batch file to add a log file to splunk. Works fine if I run it locally but not from a remote computer.
This is the line I'm having trouble with:
\\172.25.30.30\Splunk\bin\splunk.exe" add oneshot "\\172.25.30.30\shared\splunk\reports\name\Server.log"
I tried to add:
-hostname localhost.localdomain
or:
-auth admin:pass
But I still get the same error:
In handler 'oneshotinput': unable to open file: path='\\172.25.30.30\shared\splunk\reports\name\Server.log' error='Logon failure: unknown user name or bad password.'
admin and pass are the correct credentials to Splunk.
Anything I am missing?
... View more
03-01-2015
03:19 AM
Your second solution works fine. I need the fancy stuff because I only want to see the last 15 days of event and the latest event is not always "now".
... View more
02-28-2015
09:08 AM
Ok, I almost got it. This works:
source="*0307.log*" trigger0=* OR trigger=* [ search trigger0=* | head 1 | eval earliest=relative_time(lastTime,"-15d") | eval latest=_time | fields earliest, latest | format "(" "(" "" ")" "OR" ")" ] | timechart span=1h eval(count(trigger)) as trigger01, eval(count(trigger0)) as trigger001| eval triggerMain = trigger01+ trigger001
But all three charts are displayed (trigger01,trigger001, triggerMain) and I would like to chart only triggerMain. I haven't managed so far
... View more
02-28-2015
08:22 AM
both are extracted fields and there are always present in different events.
an event looks like:
2015-02-22 23:59:35,255 INFO [0.809.1.31.] ......... Start executing rule with ID 304. Triggered by a MotionDetection at 05:59:35 (Utc).
... View more
02-28-2015
06:28 AM
I have two fields trigger0 and trigger that occur several times per hour and I would like the sum (number of occurrences) of both over a one-hour timespan. I tried a lot of things from the forum but I always get "no result found".
A few examples of what I've tried:
source="*0307.log*" trigger0=* trigger=* [ search trigger0=* | head 1 | eval earliest=relative_time(lastTime,"-15d") | eval latest=_time | fields earliest, latest | format "(" "(" "" ")" "OR" ")" ] | timechart span=1h sum( eval(count(trigger) + count(trigger0)) ) as totaltrigger
source="*0307.log*" trigger0=* trigger=* [ search trigger0=* | head 1 | eval earliest=relative_time(lastTime,"-15d") | eval latest=_time | fields earliest, latest | format "(" "(" "" ")" "OR" ")" ] | timechart span=1h count(trigger) count(trigger0)
It's the part after the last pipe that causes problem, I'm using the first part in other graphs.
... View more
01-23-2015
01:13 AM
I get "No results found" when using these lines. Do I need to change anything? The query from Chanfoli returns several hundred results (as it should).
... View more
01-22-2015
09:10 AM
1 Karma
That work with a few changes.
source="*test.log*" CPU_Usage=* [ search CPU_Usage=* | head 1 | eval earliest=relative_time(_time,"-15d") | eval latest=_time | fields earliest, latest | format "(" "(" "" ")" "OR" ")" ] | timechart span=20m max(CPU_Usage)
... View more
01-22-2015
08:24 AM
1 Karma
I can't find the correct syntax to search the last 15 days of logs, relative to the latest entry. My current search is as follow:
source="test.log" CPU_Usage=* | timechart span=20m max(CPU_Usage)
If I change the time range to "latest 15 days", it's relative to NOW, not the latest event.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
