About jbouch03

jbouch03 · ‎10-02-2017

And I'm a huge idiot. The code works, it was a javascript caching issue on my browser.

jbouch03 · ‎10-02-2017

I'm trying to create an update an delete feature on my kvstore, but I'm having an issue where the button click doesn't recognize the code inside the click function. Can anyone please assist? My goal is to set the update_ tokens when the button is clicked so that the updateSearch will run, but it just refreshes the page instead of setting the tokens. Here is my code: crud.js require([ 'underscore', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/simplexml/ready!' ], function (_, $, mvc) { var tokens = mvc.Components.get('submitted'); /* --- Search Reference --- */ var updateSearch = mvc.Components.get('updateSearch'); var siteCollectionSearch = mvc.Components.get('siteCollectionSearch'); var siteCollectionTable = mvc.Components.get('siteCollectionTable'); /* --- Define the form inputs --- */ var src_ip_Input = $('[name="src_ip"]'); var region_Input = $('[name="region"]'); var sitename_Input = $('[name="sitename"]'); var _key_Input = $('[name="_key"]'); /* --- Reference to the input values --- */ var src_ip_Val, region_Val, sitename_Val, _key_Val; siteCollectionTable.on('click', function (e) { e.preventDefault(); if (e['field'] === 'Update') { /* --- Pull values from the current table row --- */ src_ip_Val = e.data['row.src_ip']; region_Val = e.data['row.region']; sitename_Val = e.data['row.sitename']; _key_Val = e.data['row._key']; /* --- Insert values from rows into input fields --- */ src_ip_Input.val(src_ip_Val); region_Input.val(region_Val); sitename_Input.val(sitename_Val); _key_Input.val(_key_Val); } }); $(document).on('click', '#submitButton', function (e) { e.preventDefault(); tokens.set('update_key_tok', _key_Val); tokens.set('update_src_ip_tok', src_ip_Input.val()); tokens.set('update_region_tok', region_Input.val()); tokens.set('update_sitename_tok', sitename_Input.val()); }); /* --- Search Jobs --- */ updateSearch.on('search:done', function () { siteCollectionSearch.startSearch(); $('form *').filter(':input').each(function () { $(this).val(''); }); }); }); My dashboard code: <dashboard script="crud.js" stylesheet="sitemap_style.css"> <label>Client Site Mapping</label> <search id="updateSearch" depends="$update_key_tok$,$update_src_ip_tok$, $update_region_tok$, $update_sitename_tok$"> <query> | inputlookup client_map | eval key=_key | WHERE key="$update_key_tok$" | eval src_ip="$update_src_ip_tok$" | eval region="$update_region_tok$" | eval sitename="$update_sitename_tok$" | outputlookup client_map append=t </query> </search> <row> <panel id="siteCollectionPanel"> <table id="siteCollectionTable"> <title>Client Site Collection</title> <search id="siteCollectionSearch"> <query>| inputlookup client_map | eval Update="Update" | eval Delete="Delete" | table *, Update, Delete </query> <earliest>0</earliest> <latest></latest> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="count">10</option> </table> </panel> <panel id="siteFormPanel"> <html> <form> <div> <label for="src_ip">CIDR Address (ex. 192.168.1.1/24)</label> <input style="width: 95%" type="text" name="src_ip"/> </div> <div> <label for="region">Region</label> <input style="width: 95%" type="text" name="region"/> </div> <div> <label for="sitename">Sitename</label> <input style="width: 95%" type="text" name="sitename"/> </div> <input type="hidden" name="_key"/> <div> <button id="submitButton">Save</button> </div> </form> </html> </panel> </row> </dashboard> NOTE: I've already tried setting $(document).on('click', '#submitButton', function (e) to something like $('#submitButton').click(function (e) as well, but it still doesn't create the tokens.

jbouch03 · ‎11-10-2016

Yes...and I'm finally reopening this project to create a full app for Fitbit data. It will be a separate from the TA, so it's more modular.

jbouch03 · ‎02-01-2016

Hi Everyone, I'm having a strange issue in my eventgen. I've created eventgens before, but it's been awhile so I'm probably missing something basic. The problem seems to be that it can't find my samples directory files. Nothing shows up inside of Splunk, so I'm trying to run it through the command line and I get the following output: WARNING module='config' sample='null': Sample 'hr_data.sample' in config but no matching files Here is the full output from the command line instance: python $SPLUNK_HOME/etc/apps/eventgen/bin/eventgen.py -v $SPLUNK_HOME/etc/apps/myapp/default/eventgen.conf 2016-02-01 08:24:43,945 INFO module='main' sample='null': Starting eventgen 2016-02-01 08:24:44,946 INFO module='config' sample='null': Retrieving eventgen configurations with ConfigParser() 2016-02-01 08:24:44,955 WARNING module='config' sample='null': Sample 'hr_data.sample' in config but no matching files 2016-02-01 08:24:44,958 INFO module='config' sample='null': Starting OutputWorker 0 2016-02-01 08:24:44,958 INFO module='config' sample='null': Starting GeneratorWorker 0 2016-02-01 08:24:45,052 INFO module='main' sample='null': OutputQueueDepth=0 GeneratorQueueDepth=0 GeneratorsPerSec=0 OutputtersPerSec=0 2016-02-01 08:24:45,052 INFO module='main' sample='null': GlobalEventsPerSec=0.0 KilobytesPerSec=0.000000 GigabytesPerDay=0.000000 2016-02-01 08:24:45,053 INFO module='config' sample='null': Caught kill, exiting... 2016-02-01 08:24:45,053 INFO module='OutputRealWorker' sample='null': Stopping OutputThreadWorker 0 2016-02-01 08:24:45,053 INFO module='GeneratorRealWorker' sample='null': Stopping GeneratorThreadWorker 0 2016-02-01 08:24:45,053 INFO module='config' sample='null': Exiting main thread. My hr_data.sample file is located in $SPLUNK_HOME/etc/apps/myapp/samples/ and my eventgen.conf is the following: [hr_data.sample] sampletype = raw mode = sample interval = 60 earliest = -60s latest = now count = 100 outputMode = splunkstream ## replace timestamp 01:12:01 token.0.token = \d{2}:\d{2}:\d{2} token.0.replacementType = timestamp token.0.replacement = %H:%M:%S ## replace HR value token.1.token = "value":\s"(\d{2})" token.1.replacementType = random token.1.replacement = integer[20:220] The hr_data.sample file is the following: {"activities-heart": [{"dateTime": "today", "customHeartRateZones": [], "heartRateZones": [{"max": 93, "caloriesOut": 1.24524, "minutes": 1, "min": 30, "name": "Out of Range"}, {"max": 130, "caloriesOut": 0, "minutes": 0, "min": 93, "name": "Fat Burn"}, {"max": 158, "caloriesOut": 0, "minutes": 0, "min": 130, "name": "Cardio"}, {"max": 220, "caloriesOut": 0, "minutes": 0, "min": 158, "name": "Peak"}], "value": "85"}], "activities-heart-intraday": {"datasetInterval": 1, "datasetType": "minute", "dataset": [{"time": "09:26:00", "value": 85}]}} Again, I'm probably just missing something obvious, but any help you can provide would be greatly appreciated. Thanks!

jbouch03 · ‎05-07-2015

The two searches are the same logs, just ingested with different sourcetypes (ps is production server). This was done as a test. I found the issue though, and its stupid mistake. I, or one of the other admins, moved the searching results to verbose instead of fast. With the amount of data being processed Verbose mode was taking way too long.

jbouch03 · ‎05-06-2015

The number of events are a lot different, but I'm still not seeing why the degradation has only been occurring the last couple of days, with the same number of events. lispy for degraded is [AND sourcetype::iis] lispy for non-degraded is [AND sourcetype::ps]

jbouch03 · ‎05-06-2015

Added to answer to fit all the information Execution costs for degraded Duration (seconds) Component Invocations Input count Output count 0.03 command.fields 28 238,967 238,967 15.91 command.remotetl 28 238,967 - 50.73 command.search 28 - 238,967 0.33 command.search.index 48 - - 0.18 command.search.filter 28 - - 0.11 command.search.fieldalias 28 238,967 238,967 0.04 command.search.calcfields 28 238,967 238,967 0.00 command.search.index.usec_1_8 1,280 - - 0.00 command.search.index.usec_64_512 12 - - 0.00 command.search.index.usec_8_64 249 - - 37.94 command.search.typer 28 238,967 238,967 5.48 command.search.tags 28 238,967 238,967 3.38 command.search.kv 28 - - 2.92 command.search.rawdata 28 - - 0.07 command.search.lookups 28 238,967 238,967 0.02 command.search.summary 28 - - 0.00 dispatch.check_disk_usage 4 - - 0.01 dispatch.createdSearchResultInfrastructure 1 - - 0.15 dispatch.evaluate 1 - - 0.15 dispatch.evaluate.search 1 - - 37.47 dispatch.fetch 28 - - 0.03 dispatch.parserThread 28 - - 0.01 dispatch.preview 13 - - 1.15 dispatch.process_remote_timeline 27 12,928,718 - 0.02 dispatch.remote_timeline_fullevents 3 411,073 200 66.63 dispatch.stream.remote 28 - 13,482,133 37.45 dispatch.stream.remote.index1 15 - 5,762,677 29.17 dispatch.stream.remote.index2 13 - 7,719,456 0.05 dispatch.timeline 28 - - 0.06 dispatch.writeStatus 28 - - 0.08 startup.configuration 3 - - 493.61 startup.handoff 3 - - Execution costs for non-degraded Duration (seconds) Component Invocations Input count Output count 0.00 command.addinfo 3 10,744 10,744 0.01 command.bin 3 10,744 10,744 0.26 command.eval 15 56,600 56,600 0.00 command.fields 3 10,744 10,744 0.42 command.multikv 3 2,880 13,624 0.10 command.prestats 3 10,744 2,873 0.07 command.rex 9 32,232 32,232 0.17 command.search 6 13,624 13,624 0.08 command.search.kv 1 - - 0.05 command.search.rawdata 1 - - 0.03 command.search.filter 4 - - 0.00 command.search.calcfields 1 2,880 2,880 0.00 command.search.fieldalias 1 2,880 2,880 0.00 command.search.lookups 1 2,880 2,880 0.00 command.search.summary 3 - - 0.00 command.search.tags 1 2,880 2,880 0.00 command.search.typer 1 2,880 2,880 0.00 command.search.index.usec_1_8 171 - - 0.00 command.search.index.usec_8_64 3 - - 0.02 command.stats.execute_input 4 - - 0.00 command.stats.execute_output 1 - - 0.02 command.timechart 1 2,873 49 0.00 command.timechart.execute_output.reduce_and_emit 1 - - 0.00 command.timechart.execute_output.series_filter 1 - - 0.00 command.timechart.execute_output.getIntermediateResults() 1 - - 0.00 dispatch.check_disk_usage 1 - - 0.01 dispatch.createdSearchResultInfrastructure 1 - - 0.09 dispatch.evaluate 1 - - 0.09 dispatch.evaluate.search 2 - - 0.00 dispatch.evaluate.eval 5 - - 0.00 dispatch.evaluate.rex 3 - - 0.00 dispatch.evaluate.bin 1 - - 0.00 dispatch.evaluate.multikv 1 - - 0.00 dispatch.evaluate.stats 1 - - 0.00 dispatch.evaluate.timechart 1 - - 1.21 dispatch.fetch 4 - - 0.01 dispatch.parserThread 3 - - 1.00 dispatch.stream.remote 3 - 370,779 0.99 dispatch.stream.remote.indexer1 2 - 366,197 0.00 dispatch.stream.remote.indexer2 1 - 4,582 0.02 dispatch.writeStatus 7 - - 0.08 startup.configuration 3 - - 493.45 startup.handoff 3 - -

jbouch03 · ‎05-06-2015

Have a strange instance that I haven't seen before. Two days ago I could complete my core search within 10 seconds (to include All Time). For the last two days just 24 hours worth of data takes 30 minutes to complete. There haven't been any changes to the Search Head, or Indexers, and the amount of data hasn't increased. I've tried investigating through SOS but I can't find anything that would be causing this. On my dashboards, and apps everything runs as normal. It's just on Search and Reporting that I am having an issue. I even removed all my searches from the dashboards and made sure that all concurrent searches were stopped. No change in performance. I can't think of anything else to check.

jbouch03 · ‎04-03-2015

the inputs.conf is linear, and through researching this one it looks like that it can't be done. The reason is that the monitor stanza is actually a modular input from Splunk that contains a checkpoint dir. The checkpoint directory is what helps Splunk determine what events have already been sent or not so that you don't re-ingest the same data over and over. Since the inputs.conf file is linear it should always attach the sourcetype of the first stanza. You can test this theory by playing around with the order of the stanzas and re-ingesting a log file in those folders using btprobe with a --reset flag. Here is the link to the btprobe commands for reference: http://docs.splunk.com/Documentation/Splunk/6.2.2/Troubleshooting/CommandlinetoolsforusewithSupport#btprobe I'm pretty sure that this can't be done they way you want it though. You can through an individual file based monitor but not a folder monitor.

jbouch03 · ‎04-03-2015

What version of Splunk are you using? In 6.2 there is an option for CSV under the email alert settings. See attached screenshot: Are you trying to send a different CSV file then what is produced by the alert results? alt text

jbouch03 · ‎04-03-2015

Not a problem...remember to set your interval time accordingly. 300 is 5 minutes, but you probably won't need that much in your report. The higher the interval time the less license you will eat up during the day.

jbouch03 · ‎04-03-2015

It looks like it comes from any stanza starting with [WinHostMon://]. I use [WinHostMon://disk] [WinHostMon://computer] and [WinHostMon://service] to create the eventtype. However, your original query states that you are specifically looking for the type disk, so here is my disk stanza: [WinHostMon://disk] type=disk interval=300

jbouch03 · ‎04-03-2015

It's packaged as part of Splunk_TA_windows. Did you load the TA correctly, and add the stanza to the local/inputs.conf file in Splunk_TA_windows?

jbouch03 · ‎04-03-2015

no problem...there is also Splunk Storm which you could access through a web app from any system. I'll be honest, though, I've never really used it and don't know much about it.

jbouch03 · ‎04-03-2015

As far as I know you can't. Not with a stock chromebook anyway. To clarify, you can install the Splunk tar file on the system as a non root user, but most of the chromebooks have very low compute resources (such as hard drive space, procs, and ram). To install splunk you will have to access the crosh shell, then install it like regular Splunk on linux. There are no dependencies that I'm aware of that will prevent the install, its mostly just a matter of compute resources. As far as I've read, crosh only gives you sudo access as well. Hope that helps, but here are some links for more info. How to access and use the crosh shell: https://software.intel.com/en-us/blogs/2014/08/18/two-simple-ways-to-get-to-the-chrome-os-shell Crosh shell builtin commands: http://www.howtogeek.com/170648/10-commands-included-in-chrome-oss-hidden-crosh-shell/

jbouch03 · ‎03-20-2015

This has been great information. Thanks for all your help. I really appreciate it.

jbouch03 · ‎03-20-2015

That's a really good point. We already have a TA in the works for the app.

jbouch03 · ‎03-20-2015

So if I'm reading this right, it's best to create the app on a non clustered dev Splunk implementation, then once its mostly complete, move it to the production clustered environment? Then just package app updates? I was really hoping we can do it in production. We are required to use Redhat Enterprise and we already burned up all our licenses moving from 1 server to 6. It's not a big deal, but that means we have to purchase another license.

jbouch03 · ‎03-20-2015

Hi, We just recently redeployed our Splunk implementation with a indexer clustering and distributed search heads, and want to recreate our core Splunk application from the ground up. Indexer clustering and distributed search heads are still pretty new to us, so I was wondering if anyone had any tips for app creation on a clustered instance. Our primary question is this: Do we start the app creation in the cluster master? And if so as we make changes to the application do we just push the bundle down to the indexers, or do we have to create our app on each indexer and cluster master until we have finished the app, then deploy it through the cluster master? Our app will need to meet the following constraints: Its own index Its own props.conf and transforms.conf Access to other indexers Ability to be searched through the primary search head and not just from the indexers Use the Splunk web framework with Django bindings Any assistance provided would be greatly appreciated. Thank you in advance.

jbouch03 · ‎10-29-2014

I found the issue. It wasn't with Splunk or the mail relay. The external exchange server that we need to use (provided by our parent company) was marking it as spam. Still can't figure out why the manual search didn't get marked as spam, but the alert did; however, its working now. Thanks for all your help.

jbouch03 · ‎10-29-2014

As far as I can tell everything looks correct. I get the INFO statements but I don't see any ERROR or WARN flags.

jbouch03 · ‎10-29-2014

the alert_actions.conf is configured. Is there a separate .conf file that needs to be configured?

jbouch03 · ‎10-29-2014

Hi, I'm having an issue with my Splunk server. I'm trying to setup some alerts, and have entered all my email relay data under the email settings. As a test, I created an alert that contains the following search: index=_internal | head 1 The alert is triggered, but I don't receive an email. I have checked the mail relay and it seems like the message is going through. But I still don't receive anything. As another test I did the following search: index=_internal | head 1 | sendemail to="<my email address>" format=raw sendresults=1 server=<smtp relay> footer="Sent from Splunk." from="SplunkAlerts" subject="Splunk Alert" message="The following Splunk Alert has been fired:" When I run this search I receive the email. Is their something I'm missing in my configuration for the alerts? Any help that you can provide would be greatly appreciated.

jbouch03 · ‎10-20-2014

This worked...The issue was with the sourcetype on the log file. Splunk had appended a -1 to the log file name, and a -2 when I restarted the process. I repaired that issue and added the BREAK_ONLY statement and it works perfectly. Thank you for your help

jbouch03 · ‎10-20-2014

Still having the same effect. See attachment i added to the original post.

Posts	38
Solutions	5
Karma Given	2
Karma Received	20
Member Since	‎07-25-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

SplunkJS: adding tokens on button click not workin...

Why is Eventgen not finding files in my samples di...

Search degradation on previous days results

What are recommendations for app creation and depl...

Why is my triggered alert email not sending?

How to configure LINE_BREAKER to split a multiline...

Help with charting results from two searches with ...

Earliest time not working in Web Framework

Using lookup tables

Merging results from two different searches in one...

Re: SplunkJS: adding tokens on button click not wo...

SplunkJS: adding tokens on button click not workin...

Re: Has anyone built a dashboard using data from t...

Why is Eventgen not finding files in my samples di...

Re: Search degradation on previous days results

Re: Search degradation on previous days results

Re: Search degradation on previous days results

Search degradation on previous days results

Re: Is inputs.conf processed in a linear manner?

Re: I've defined an alert to be emailed, but how d...

Re: How to get the missing eventtype hostmon_windo...

Re: How to get the missing eventtype hostmon_windo...

Re: How to get the missing eventtype hostmon_windo...

Re: Splunk on Chromebook?

Re: Splunk on Chromebook?

Re: What are recommendations for app creation and ...

Re: What are recommendations for app creation and ...

Re: What are recommendations for app creation and ...

What are recommendations for app creation and depl...

Re: Why is my triggered alert email not sending?

Re: Why is my triggered alert email not sending?

Re: Why is my triggered alert email not sending?

Why is my triggered alert email not sending?

Re: How to configure LINE_BREAKER to split a multi...

Re: How to configure LINE_BREAKER to split a multi...