I am trying to approximate the distance between two points. Each point has a latitude, longitude, and elevation. Unfortunately Splunk can't do sines and cosines out of the box, so I had to use a Taylor polynomial in my function: | eval lat0=$lat0$*pi()/180 | eval lat1=$lat1$*pi()/180 | eval lon0=$lon0$*pi()/180 | eval lon1=$lon1$*pi()/180 | eval coslat0=1-pow(lat0,2)/(2*1)+pow(lat0,4)/(4*3*2*1)-pow(lat0,6)/(6*5*4*3*2*1) | eval coslon0=1-pow(lon0,2)/(2*1)+pow(lon0,4)/(4*3*2*1)-pow(lon0,6)/(6*5*4*3*2*1) | eval sinlat0=lat0-pow(lat0,3)/(3*2*1)+pow(lat0,5)/(5*4*3*2*1)-pow(lat0,7)/(7*6*5*4*3*2*1) | eval sinlon0=lon0-pow(lon0,3)/(3*2*1)+pow(lon0,5)/(5*4*3*2*1)-pow(lon0,7)/(7*6*5*4*3*2*1) | eval coslat1=1-pow(lat1,2)/(2*1)+pow(lat1,4)/(4*3*2*1)-pow(lat1,6)/(6*5*4*3*2*1) | eval coslon1=1-pow(lon1,2)/(2*1)+pow(lon1,4)/(4*3*2*1)-pow(lon1,6)/(6*5*4*3*2*1) | eval sinlat1=lat1-pow(lat1,3)/(3*2*1)+pow(lat1,5)/(5*4*3*2*1)-pow(lat1,7)/(7*6*5*4*3*2*1) | eval sinlon1=lon1-pow(lon1,3)/(3*2*1)+pow(lon1,5)/(5*4*3*2*1)-pow(lon1,7)/(7*6*5*4*3*2*1) | eval x0=$ele0$*coslat0*sinlon0 | eval x1=$ele1$*coslat1*sinlon1 | eval y0=$ele0$*sinlat0 | eval y1=$ele1$*sinlat1 | eval z0=$ele0$*coslat0*coslon0+6370 | eval z1=$ele1$*coslat1*coslon1+6370 | eval distance=sqrt(pow(x1-x0,2)+pow(y1-y0,2)+pow(z1-z0,2)) I would call this macro distance(6) with the 6 variables: lat0 , lon0 , ele0 , lat1 , lon1 , ele1 . How do I create/use this macro so I can use it in a search like this: index="gpx" source="/home/hobbes3/strava/a_nice_ride.gpx" | ... | eval distance=`distance(lat0, lon0, ele0, lat1, lon1, ele1)` ... View more

I have a full Splunk instance that indexes and forwards ( indexAndForward = true ). I also installed the *NIX app on the forwarder instance. Now the forwarder is trying to send all of the *NIX app inputs with index = os to my indexer and my search head/indexer is giving the following warning: Search peer splunk-id1 has the following message: received event for unconfigured/disabled/deleted index='os' with source='source::netstat' host='host::hobbes3-server' sourcetype='sourcetype::netstat' (1 missing total) I believe the indexer is confused because there is no os index on the indexer. Beside, I don't want to forward my *NIX app inputs to the indexer anyway. Is there a way to selectively not forward the os index? I know this answer shows how to selectively index and forward, but it's by source. The *NIX app has about 25 inputs and I don't want to type _TCP_ROUTING 25 times in inputs.conf . Here is my outputs.conf if that's useful for anyone: root@hobbes3-server /opt/splunk/bin # ./splunk cmd btool outputs list --debug /opt/splunk/etc/system/local/outputs.conf [tcpout] /opt/splunk/etc/system/local/outputs.conf autoLB = true /opt/splunk/etc/system/default/outputs.conf autoLBFrequency = 30 /opt/splunk/etc/system/default/outputs.conf blockOnCloning = true /opt/splunk/etc/system/default/outputs.conf compressed = false /opt/splunk/etc/system/default/outputs.conf connectionTimeout = 20 /opt/splunk/etc/system/local/outputs.conf defaultGroup = ec2_indexers /opt/splunk/etc/system/default/outputs.conf disabled = false /opt/splunk/etc/system/default/outputs.conf dropClonedEventsOnQueueFull = 5 /opt/splunk/etc/system/default/outputs.conf dropEventsOnQueueFull = -1 /opt/splunk/etc/system/default/outputs.conf forceTimebasedAutoLB = false /opt/splunk/etc/system/default/outputs.conf forwardedindex.0.whitelist = .* /opt/splunk/etc/system/default/outputs.conf forwardedindex.1.blacklist = _.* /opt/splunk/etc/system/default/outputs.conf forwardedindex.2.whitelist = (_audit|_internal) /opt/splunk/etc/system/default/outputs.conf forwardedindex.filter.disable = false /opt/splunk/etc/system/default/outputs.conf heartbeatFrequency = 30 /opt/splunk/etc/system/local/outputs.conf indexAndForward = true /opt/splunk/etc/system/default/outputs.conf maxConnectionsPerIndexer = 2 /opt/splunk/etc/system/default/outputs.conf maxFailuresPerInterval = 2 /opt/splunk/etc/system/local/outputs.conf maxQueueSize = 7MB /opt/splunk/etc/system/default/outputs.conf readTimeout = 300 /opt/splunk/etc/system/default/outputs.conf secsInFailureInterval = 1 /opt/splunk/etc/system/default/outputs.conf sendCookedData = true /opt/splunk/etc/system/local/outputs.conf useACK = true /opt/splunk/etc/system/default/outputs.conf writeTimeout = 300 /opt/splunk/etc/system/local/outputs.conf [tcpout:ec2_indexers] /opt/splunk/etc/system/local/outputs.conf server = aa.aa.aa.aa:9997, bb.bb.bb.bb:9997, cc.cc.cc.cc:9997, dd.dd.dd.dd:9997 ... View more

I'm playing with the Splunk tutorial data and I have this query that shows the top 5 customer per purchased product and how many the customer bought as such sourcetype="access_combined_wcookie" action="purchase" | top clientip limit=5 by product_name However, this is repeating the product_name 5 times. How do I group this so that product_name to only appears once? Actually what I also want to know is how much that customer has spent on that particular product total. So far I tried sourcetype="access_combined_wcookie" action="purchase" | stats values(price) as Price, values(clientip) by product_name But this lists all the customers (not just the top 5). I also don't know how many purchase count per customer. I know the purchase count when I used top , but at the same time I couldn't extract the product price. ... View more