Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About joy76
joy76
Path Finder
Member since:
11-08-2010
06-05-2020
Community Statistics
| Posts | 35 |
| Solutions | 0 |
| Karma Given | 8 |
| Karma Received | 15 |
| Member Since | 11-08-2010 |
Activity Feed
- Karma Re: Can I reload savedsearches.conf without restarting after modifying options ? for Ayn. 06-05-2020 12:46 AM
- Karma Re: Running Saved Searches with Default Index _internal for kristian_kolb. 06-05-2020 12:46 AM
- Karma Re: Running Saved Searches with Default Index _internal for piebob. 06-05-2020 12:46 AM
- Karma Re: Running Saved Searches with Default Index _internal for kristian_kolb. 06-05-2020 12:46 AM
- Karma Re: Running Saved Searches with Default Index _internal for kristian_kolb. 06-05-2020 12:46 AM
- Karma Re: Running Saved Searches with Default Index _internal for kristian_kolb. 06-05-2020 12:46 AM
- Karma Re: Running Saved Searches with Default Index _internal for kristian_kolb. 06-05-2020 12:46 AM
- Karma Re: How to check the current number of my Scheduled Searches having queued up ? for Simon. 06-05-2020 12:46 AM
- Got Karma for SavedSplunker - Max alive instance count=1 reached for saved search_id. 06-05-2020 12:46 AM
- Got Karma for Converting from multiline field in table of result by stats values() to one line results after geoip... why?. 06-05-2020 12:46 AM
- Got Karma for Re: java sdk example run error. 06-05-2020 12:46 AM
- Got Karma for Splunk could not update permissions for resource data/transforms/lookups. 06-05-2020 12:46 AM
- Got Karma for Splunk could not update permissions for resource data/transforms/lookups. 06-05-2020 12:46 AM
- Got Karma for Splunk could not update permissions for resource data/transforms/lookups. 06-05-2020 12:46 AM
- Got Karma for Splunk could not update permissions for resource data/transforms/lookups. 06-05-2020 12:46 AM
- Got Karma for Splunk could not update permissions for resource data/transforms/lookups. 06-05-2020 12:46 AM
- Got Karma for Splunk could not update permissions for resource data/transforms/lookups. 06-05-2020 12:46 AM
- Got Karma for How can i convert SQL query to Splunk search?. 06-05-2020 12:46 AM
- Got Karma for How can i convert String Type Time field(a) to a human readable Date Type Time field(#)?. 06-05-2020 12:46 AM
- Got Karma for APPEND is not UNION?. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 6 | |||
| 1 | |||
| 0 |
01-06-2016
01:38 AM
Hi
I tried it. But failed. Im using splunk 6.1.9.
Is Splunk version wrong?
... View more
01-21-2015
12:36 AM
look at
Settings > DATA > Indexes menu.
There are earliest and last event time by Index.
... View more
03-20-2014
07:35 PM
Hi all.
I have a crashlog in my slpunk.(4.3)
Recently, my splunk server has shutdown very often.
Below is a part of crashlog.
Received fatal signal 6...
......
Crashing thread: HTTPDispatch
......
Terminate called after...
What() : HTTPDispatch : about to throw a Treadexception : pthread_create : Resource temporarily unavailable;42 threads active.
......
terminating...
What is a HTTPDispatch?
What's mean "Resource temporarily unavailable;42 threads active." ?
Thanks All.
... View more
08-07-2013
09:17 PM
1 Karma
Splunk Version : 4.3.4
OS : Redhat
Message : SavedSplunker - Max alive instance count=1 reached for saved search_id=...
What's this message mean?
... View more
08-06-2013
05:54 PM
OS : Linux Redhat Enterprise
Install software : Splunk 4.3.4, Oracle 11g, Weblogic10.1
select data from Splunk by Splunk SDK for java. and insert into Oracle.
In Linux console
>top
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
77433 splunk 20 0 6471m 6.1g 13m S 5.5 9.7 1371:48 splunkd
29038 wasadmin 20 0 31.1g 4.7g 55m S 16.8 7.4 2383:36 java
34778 wasadmin 20 0 20.2g 1.9g 4284 S 0.0 3.0 50:01.81 java
27980 wasadmin 20 0 19.5g 1.3g 4652 S 1.9 2.1 2278:11 java
8083 oracle 20 0 10.2g 1.0g 1.0g S 0.0 1.6 27:19.32 oracle
10917 wasadmin 20 0 19.9g 1.0g 4408 S 0.0 1.6 314:21.03 java
8085 oracle 20 0 10.2g 838m 838m S 0.0 1.3 21:58.72 oracle
16963 wasadmin 20 0 20.2g 782m 9760 S 0.0 1.2 75:27.21 java
12443 wasadmin 20 0 20.2g 767m 9772 S 6.2 1.2 68:46.57 java
8091 oracle 20 0 10.2g 706m 703m S 0.0 1.1 14:35.62 oracle
30196 oracle 20 0 10.2g 684m 679m S 0.0 1.1 29:52.10 oracle
8087 oracle 20 0 10.2g 673m 673m S 0.0 1.0 15:56.39 oracle
70603 splunk 20 0 2363m 659m 5892 S 13.3 1.0 6:58.62 python
72847 splunk 20 0 885m 649m 12m S 49.2 1.0 102:05.00 splunkd
30176 oracle 20 0 10.2g 644m 638m S 0.0 1.0 29:52.83 oracle
30180 oracle 20 0 10.2g 629m 624m S 0.0 1.0 21:24.10 oracle
8093 oracle 20 0 10.2g 622m 620m S 0.0 1.0 15:50.37 oracle
30194 oracle 20 0 10.2g 620m 614m S 0.0 1.0 25:27.24 oracle
30202 oracle 20 0 10.2g 609m 604m S 0.0 0.9 23:10.29 oracle
8089 oracle 20 0 10.2g 600m 600m S 0.0 0.9 14:34.05 oracle
30174 oracle 20 0 10.2g 593m 588m S 0.0 0.9 25:13.98 oracle
8107 oracle 20 0 10.2g 551m 548m S 0.0 0.9 32:22.71 oracle
78059 splunk 20 0 2668m 544m 5988 S 0.3 0.8 85:03.83 python
30166 oracle 20 0 10.2g 525m 520m S 0.0 0.8 17:08.34 oracle
30186 oracle 20 0 10.2g 523m 518m S 0.0 0.8 13:36.58 oracle
8101 oracle 20 0 10.2g 517m 514m S 0.0 0.8 14:08.17 oracle
8095 oracle 20 0 10.2g 509m 507m S 0.0 0.8 14:26.82 oracle
8097 oracle 20 0 10.2g 507m 506m S 0.0 0.8 13:49.56 oracle
45047 oracle 20 0 10.2g 502m 497m S 1.0 0.8 12:24.69 oracle
8099 oracle 20 0 10.2g 484m 484m S 0.0 0.8 13:45.68 oracle
39988 oracle 20 0 10.2g 474m 469m S 0.0 0.7 11:21.72 oracle
13097 oracle 20 0 10.2g 461m 456m S 0.6 0.7 10:57.31 oracle
30162 oracle 20 0 10.2g 442m 437m S 0.0 0.7 12:52.23 oracle
29736 oracle 20 0 10.2g 418m 413m S 0.0 0.6 11:16.12 oracle
29943 oracle 20 0 10.2g 409m 404m S 0.0 0.6 9:20.15 oracle
67560 oracle 20 0 10.2g 394m 389m S 1.6 0.6 6:50.41 oracle
29945 oracle 20 0 10.2g 379m 374m S 0.0 0.6 8:18.52 oracle
40485 oracle 20 0 10.2g 333m 328m S 0.0 0.5 5:34.44 oracle
45202 oracle 20 0 10.2g 333m 328m S 3.2 0.5 1:51.99 oracle
8105 oracle 20 0 10.2g 313m 312m S 0.0 0.5 152:09.27 oracle
40011 oracle 20 0 10.2g 288m 282m S 0.0 0.4 2:16.93 oracle
57361 oracle 20 0 10.2g 283m 279m S 0.0 0.4 3:21.32 oracle
29556 oracle 20 0 10.2g 267m 265m S 0.0 0.4 6:25.10 oracle
2382 splunk 20 0 5579m 262m 9.9m S 1.0 0.4 45:28.60 java
35937 wasadmin 20 0 20.2g 236m 4472 S 0.3 0.4 843:18.23 java
8275 oracle 20 0 10.2g 218m 207m S 0.0 0.3 53:29.81 oracle
8111 oracle 20 0 10.2g 203m 200m S 0.3 0.3 108:31.94 oracle
44711 oracle 20 0 10.2g 198m 197m S 0.0 0.3 69:30.79 oracle
8113 oracle 20 0 10.3g 178m 175m S 0.0 0.3 256:58.10 oracle
69169 oracle 20 0 10.2g 131m 127m S 0.0 0.2 0:02.30 oracle
8081 oracle 20 0 10.2g 127m 127m S 0.0 0.2 8:26.73 oracle
57548 splunk 20 0 160m 111m 10m S 100.1 0.2 0:40.49 splunkd
76615 splunk 20 0 198m 102m 10m S 98.8 0.2 24:56.05 splunkd
8103 oracle 20 0 10.2g 82m 82m S 0.3 0.1 567:40.18 oracle
34021 oracle 20 0 10.2g 75m 72m S 0.0 0.1 0:00.25 oracle
10115 oracle 20 0 10.2g 58m 54m S 0.0 0.1 0:02.63 oracle
43546 sms 20 0 4523m 55m 3136 S 0.0 0.1 282:57.24 java
52674 oracle 20 0 10.2g 52m 50m S 0.3 0.1 0:03.83 oracle
61026 splunk 20 0 102m 52m 11m S 60.6 0.1 0:08.38 splunkd
78837 oracle 20 0 10.2g 51m 47m S 0.0 0.1 0:00.43 oracle
67318 oracle 20 0 10.2g 47m 43m S 0.0 0.1 0:00.65 oracle
>ps -ef | grep oracle
oracle 8056 1 0 Feb22 ? 01:10:30 ora_pmon_SPLUNK
oracle 8058 1 0 Feb22 ? 00:35:44 ora_psp0_SPLUNK
oracle 8069 1 1 Feb22 ? 1-17:10:47 ora_vktm_SPLUNK
oracle 8073 1 0 Feb22 ? 00:07:39 ora_gen0_SPLUNK
oracle 8075 1 0 Feb22 ? 00:11:45 ora_diag_SPLUNK
oracle 8077 1 0 Feb22 ? 00:10:32 ora_dbrm_SPLUNK
oracle 8079 1 0 Feb22 ? 11:20:10 ora_dia0_SPLUNK
oracle 8081 1 0 Feb22 ? 00:08:26 ora_mman_SPLUNK
oracle 8083 1 0 Feb22 ? 00:27:19 ora_dbw0_SPLUNK
oracle 8085 1 0 Feb22 ? 00:21:58 ora_dbw1_SPLUNK
oracle 8087 1 0 Feb22 ? 00:15:56 ora_dbw2_SPLUNK
oracle 8089 1 0 Feb22 ? 00:14:34 ora_dbw3_SPLUNK
oracle 8091 1 0 Feb22 ? 00:14:35 ora_dbw4_SPLUNK
oracle 8093 1 0 Feb22 ? 00:15:50 ora_dbw5_SPLUNK
oracle 8095 1 0 Feb22 ? 00:14:26 ora_dbw6_SPLUNK
oracle 8097 1 0 Feb22 ? 00:13:49 ora_dbw7_SPLUNK
oracle 8099 1 0 Feb22 ? 00:13:45 ora_dbw8_SPLUNK
oracle 8101 1 0 Feb22 ? 00:14:08 ora_dbw9_SPLUNK
oracle 8103 1 0 Feb22 ? 09:27:42 ora_lgwr_SPLUNK
oracle 8105 1 0 Feb22 ? 02:32:09 ora_ckpt_SPLUNK
oracle 8107 1 0 Feb22 ? 00:32:22 ora_smon_SPLUNK
oracle 8109 1 0 Feb22 ? 00:03:09 ora_reco_SPLUNK
oracle 8111 1 0 Feb22 ? 01:48:32 ora_mmon_SPLUNK
oracle 8113 1 0 Feb22 ? 04:16:59 ora_mmnl_SPLUNK
oracle 8115 1 0 Feb22 ? 00:03:17 ora_d000_SPLUNK
oracle 8117 1 0 Feb22 ? 00:03:06 ora_s000_SPLUNK
oracle 8245 1 0 Feb22 ? 00:04:03 ora_qmnc_SPLUNK
oracle 8275 1 0 Feb22 ? 00:53:29 ora_cjq0_SPLUNK
oracle 8336 1 0 Feb22 ? 00:04:21 ora_q000_SPLUNK
oracle 8338 1 0 Feb22 ? 00:03:04 ora_q001_SPLUNK
oracle 10235 1 0 Feb22 ? 22:24:37 /oracle/app/oracle/product/11.2.0/dbhome_1/bin/tnslsnr LISTENER -inherit
oracle 11340 1 0 Feb22 ? 00:11:43 ora_smco_SPLUNK
oracle 13097 1 0 Aug05 ? 00:11:02 oracleSPLUNK (LOCAL=NO)
oracle 26117 1 0 08:59 ? 00:00:00 oracleSPLUNK (LOCAL=NO)
oracle 26237 1 0 09:41 ? 00:00:00 ora_w000_SPLUNK
oracle 29556 1 0 Feb22 ? 00:06:25 oracleSPLUNK (LOCAL=NO)
oracle 29736 1 0 Aug05 ? 00:11:16 oracleSPLUNK (LOCAL=NO)
oracle 29943 1 0 Aug05 ? 00:09:20 oracleSPLUNK (LOCAL=NO)
oracle 29945 1 0 Aug05 ? 00:08:18 oracleSPLUNK (LOCAL=NO)
oracle 30162 1 0 Jul30 ? 00:12:52 oracleSPLUNK (LOCAL=NO)
oracle 30166 1 0 Jul30 ? 00:17:08 oracleSPLUNK (LOCAL=NO)
oracle 30174 1 0 Jul30 ? 00:25:18 oracleSPLUNK (LOCAL=NO)
oracle 30176 1 0 Jul30 ? 00:29:52 oracleSPLUNK (LOCAL=NO)
oracle 30180 1 0 Jul30 ? 00:21:28 oracleSPLUNK (LOCAL=NO)
oracle 30186 1 0 Jul30 ? 00:13:36 oracleSPLUNK (LOCAL=NO)
oracle 30194 1 0 Jul30 ? 00:25:27 oracleSPLUNK (LOCAL=NO)
oracle 30196 1 0 Jul30 ? 00:29:52 oracleSPLUNK (LOCAL=NO)
oracle 30202 1 0 Jul30 ? 00:23:10 oracleSPLUNK (LOCAL=NO)
oracle 34021 1 0 Aug05 ? 00:00:00 oracleSPLUNK (LOCAL=NO)
oracle 38092 1 0 00:15 ? 00:00:13 oracleSPLUNK (LOCAL=NO)
oracle 39988 1 0 Aug05 ? 00:11:21 oracleSPLUNK (LOCAL=NO)
oracle 40011 1 0 Aug05 ? 00:02:17 oracleSPLUNK (LOCAL=NO)
oracle 40233 1 2 09:44 ? 00:00:02 oracleSPLUNK (LOCAL=NO)
oracle 40485 1 0 Aug05 ? 00:05:35 oracleSPLUNK (LOCAL=NO)
oracle 42419 1 0 08:15 ? 00:00:18 oracleSPLUNK (LOCAL=NO)
oracle 44711 1 0 Mar19 ? 01:09:31 oracleSPLUNK (LOCAL=NO)
oracle 44944 1 0 09:45 ? 00:00:00 oracleSPLUNK (LOCAL=NO)
oracle 44951 1 1 09:45 ? 00:00:00 oracleSPLUNK (LOCAL=NO)
oracle 44956 1 0 09:45 ? 00:00:00 oracleSPLUNK (LOCAL=NO)
oracle 45047 1 0 Aug05 ? 00:12:29 oracleSPLUNK (LOCAL=NO)
oracle 45202 1 0 02:12 ? 00:01:58 oracleSPLUNK (LOCAL=NO)
oracle 46328 1 1 09:45 ? 00:00:00 oracleSPLUNK (LOCAL=NO)
oracle 46364 1 0 09:45 ? 00:00:00 oracleSPLUNK (LOCAL=NO)
oracle 46453 1 3 09:45 ? 00:00:01 oracleSPLUNK (LOCAL=NO)
oracle 47240 1 2 09:45 ? 00:00:01 oracleSPLUNK (LOCAL=NO)
oracle 51404 1 0 09:46 ? 00:00:00 oracleSPLUNK (LOCAL=NO)
splunk 51407 57826 0 09:46 pts/2 00:00:00 grep oracle
oracle 51409 1 0 09:46 ? 00:00:00 oracleSPLUNK (LOCAL=NO)
oracle 57361 1 0 Aug06 ? 00:03:21 oracleSPLUNK (LOCAL=NO)
oracle 58805 1 0 Aug06 ? 00:00:00 oracleSPLUNK (LOCAL=NO)
oracle 66695 1 0 08:52 ? 00:00:00 oracleSPLUNK (LOCAL=NO)
oracle 67318 1 0 Aug06 ? 00:00:00 oracleSPLUNK (LOCAL=NO)
oracle 67560 1 0 Aug05 ? 00:06:56 oracleSPLUNK (LOCAL=NO)
oracle 68566 1 0 09:35 ? 00:00:04 oracleSPLUNK (LOCAL=NO)
oracle 68571 1 0 09:35 ? 00:00:02 oracleSPLUNK (LOCAL=NO)
oracle 69169 1 0 Jul30 ? 00:00:02 oracleSPLUNK (LOCAL=NO)
oracle 78837 1 0 Aug05 ? 00:00:00 oracleSPLUNK (LOCAL=NO)
Thanks for your help.
... View more
- Tags:
- oracle
05-06-2013
07:32 PM
Hi, I am just catching up on you your answers followed by comments...
What does "psrsvd" as in psrsvd_* stand for here ?
... View more
05-03-2013
12:57 AM
Thank you very much.
... View more
05-02-2013
10:03 PM
Hi, I am just wondering if I can reload the configuration of savedsearches.conf without restarting splunkd and/or splunkweb in CLI mode after modifying option values of properties in that file.
If YES, how can it be done ?
... View more
04-23-2013
01:19 AM
Kristian, regarding setting "dispatch_time" in relation with "scheduled_time".., when scheduled searches (e.g. S0~S24) are scheduled to be run at the same time, some of them are queued up.
So, some scheduled searches(e.g. S20~S24) which have not been dispatched on their scheduled times will go into QUEUE list, waiting. Then, how will I check to see if how many number of searches are currently being queued up in the list and in what order are they queued up in the list OR which saved search(es) are they in the list ??
... View more
04-22-2013
11:03 PM
Simon, I converted my comments into new question as in the following title:
http://splunk-base.splunk.com/answers/84740/search-concurrency-and-search-scheduler
In that link you'll see my follow-up question on your comments above 🙂
... View more
04-22-2013
03:27 AM
Hi, gkanapathy.
I am just wondering...
What do you mean by "you create summary searches in the GUI" and
"you create a search through the GUI" ?
... View more
04-21-2013
06:08 PM
Hi, Simon. Thanks for your clarifying comment to my question.
Due to the log results that I performed your suggested strings, I post the log results in Answer thread. So please, refer to my answer below. Sorry for confusion.
... View more
04-19-2013
02:46 AM
Let me put the original question in the following way:
How can I check the current number of queued-up "summary indexing populating searches" that have so far been run ?
Here is the situation:
1. There is one Search Head.
2. There are two different indexers: Indexer 1 and Indexer 2.
3. Summary indexing is happening on Search Head.
Considered the above background, I hope that this changed question might be much clearer to answer to from happy splunkers.
... View more
Hi, I posted this new thread to be separately dealt with previous post of mine titled as follows:
"Running Saved Searches with Default Index _internal."
(Click on the following link: http://splunk-base.splunk.com/answers/83946/running-saved-searches-with-default-index-_internal?openid.op_endpoint=https%3A%2F%2Fwww.splunk.com%2Foid&openid.sig=85je3AP5AxB0Hxp8nFrFHKL2YgY%3D&openid.return_to=http%3A%2F%2Fsplunk-base.splunk.com%2Faccount%2Fsplunk%2Fdone%2F%3Fjanrain_nonce%3D2013-04-17T04%253A30%253A30ZsEMSS4&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&janrain_nonce=2013-04-17T04%3A30%3A30ZsEMSS4&openid.response_nonce=2013-04-17T04%3A30%3A31Zec7oda&openid.sreg.fullname=bai%40+chung-yeol&openid.claimed_id=https%3A%2F%2Fwww.splunk.com%2Foid%2Fu%3Fu%3Djoy76&openid.ns.sreg=http%3A%2F%2Fopenid.net%2Fextensions%2Fsreg%2F1.1&openid.sreg.nickname=joy76&openid.signed=assoc_handle%2Cclaimed_id%2Cidentity%2Cmode%2Cns%2Cns.sreg%2Cop_endpoint%2Cresponse_nonce%2Creturn_to%2Csigned%2Csreg.email%2Csreg.fullname%2Csreg.nickname&openid.assoc_handle=%7BHMAC-SHA1%7D%7B516c7435%7D%7BEgwEgw%3D%3D%7D&openid.mode=id_res&openid.identity=https%3A%2F%2Fwww.splunk.com%2Foid%2Fu%3Fu%3Djoy76&openid.sreg.email=dabar76%40gmail.com&after_login=true)
And now I want to ask a new question as follows:
After I have my saved searches scheduled and executed them, then how can I check the current number of my scheduled searches being queued up since start of their execution ? Any suggestion ?
... View more
04-16-2013
02:11 AM
HI, I did search query as follows:
index=_internal sourcetype=scheduler
And I get to see things in the resulting log that certain fields appears such as "run_time", "dispatch_time", and
"scheduled_time."
I want to know every nitty-gritty details in how those certain fields working inside and outside.
You could pinpoint where I can find those info or you could explain in your own words fully here.
Especially, I would like to understand completely in inner mechanism of "dispatch_time."
Thanks.
... View more
03-07-2013
08:40 PM
1 Karma
search 1 :
index=web_access_log
| stats values(src_ip) as web_src_ip, count by dst_ip
search1's results :
web_src_ip dst_ip
123.123.123.123 111.111.111.111
234.234.234.234
345.345.345.345
search 2 :
index=web_access_log
| stats values(src_ip) as web_src_ip, count by dst_ip
| geoip dst_ip
search2's results
web_src_ip dst_ip dst_ip_country_name
123.123.123.123 234.234.234.234 345.345.345.345 111.111.111.111 country_name
After applying geoip command, the result of search2 shows in single-line form.
However, what I really wanted to show is to use geoip to result in multi-line form.
So, any suggestion? How can that be done?
... View more
- Tags:
- multiline
I tried to change in permissions from private to Global of lookup table and definition- and automatic lookups- in 2 indexers and header server.
(There are 3 splunks(Linux Redhat 6.3). 2 indexers(2 servers physically) and 1 header(1 server physically).)
There show no problem in 2 indexers, but the header servers shows the following error messages:
"Splunk could not update permissions for resource data/transforms/lookups [HTTP 409][{'text':'Cannot overwrite existing app object','code':None, 'type':'ERROR'}] "
What would you suggest to solve this problem or error?
... View more
- Tags:
- permissions
03-30-2012
01:22 AM
1 Karma
Hi Everyone!
I have a question about displaying timeline on timechart.(chart option is column)
I want to use timechart to display '1 bar = 1 hour' during the period of 24 hours for search and if the period of time is changed from 24 hours to 30 days, the bar is also changed from 1 hour to 1 day (1 bar = 1 day) as the Search App does.
How should I do?
... View more
03-19-2012
02:15 AM
Splunk 4.3
Search :
index=server1 | table processName porcessCount
result A : search has a results.
processName processCount
java 14
vi 2
result B : search has no results.
No results found, inspector...
How can i display it below...
processName processCount
No Process
Thanks.
... View more
03-15-2012
03:20 PM
SPlunk version 4.3
in the Pulldown
host_select :
ALL *
WEBSERVER1 WEBSERVER1
WEBSERVER2 WEBSERVER2
WEBSERVER3 WEBSERVER3
search A : index=webserver1 OR index=webserver2 OR index=webserver3 | search index=$host_select$ | table serverName message method
search B : index=webserver1 | fields + serverName message method | JOIN type=inner message [search index=major_message earliest=-24h | fields + messageType ] OR index=webserver2 OR index=webserver3 | search index=$host_select$ | table serverName message method
search A is working.
search B is working, but its result is different i expected.
Thanks everyone.
... View more
- Tags:
- join
03-15-2012
03:18 PM
1 Karma
Splunk version 4.3
search A : index=webserver1 type=error | table serverName message method
search B : index=webserver2 type=error | table serverName message method
search C : index=webserver1 type=error | table serverName message method | APPEND [index=webserver2 type=error] | table serverName message method
search A results is 20.
search B results is 0.
search C results is 0. Why?
I expected results is 20+0=20.
Thanks. Everyone
... View more
- Tags:
- append
03-15-2012
03:17 PM
1 Karma
Splunk version 4.3
I want to sort human readable Time Field in Table results.
Date Type _time(timestamp) field is sorting well.
But String Type Time field is not sorting.
I tried to convert String Type Time to unixtime type, and convert unixtime type to human readable format.
but, I can't convert to human readable Date Time format.
Thanks. Everyone.
... View more
- Tags:
- convert
01-25-2012
12:51 AM
1 Karma
I got it the problum.
Maybe i think .splunkrc file configuration is wrong.
So, Below is run well.
java -jar dist/examples/search.jar --username "admin" --password "changeme" "search * | head 10" --output_mode=csv
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:02 AM
|
