Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About andyk
andyk
Path Finder
Member since:
11-30-2010
09-07-2022
Community Statistics
| Posts | 32 |
| Solutions | 2 |
| Karma Given | 4 |
| Karma Received | 16 |
| Member Since | 11-30-2010 |
Activity Feed
- Karma Re: How do I extract a comma separated field during search? for jeff. 06-05-2020 12:46 AM
- Karma Re: Why does the REST endpoints only show data from the Search app? for dturnbull_splun. 06-05-2020 12:46 AM
- Karma Re: Need string minus last 2 characters for _d_. 06-05-2020 12:46 AM
- Got Karma for calculate time difference between 2 fields | sum and group by month. 06-05-2020 12:46 AM
- Got Karma for calculate time difference between 2 fields | sum and group by month. 06-05-2020 12:46 AM
- Got Karma for Lots of log files, how can I reduce forwarder memory usage?. 06-05-2020 12:46 AM
- Got Karma for Lots of log files, how can I reduce forwarder memory usage?. 06-05-2020 12:46 AM
- Got Karma for Re: Lots of log files, how can I reduce forwarder memory usage?. 06-05-2020 12:46 AM
- Got Karma for Re: Lots of log files, how can I reduce forwarder memory usage?. 06-05-2020 12:46 AM
- Got Karma for Re: Lots of log files, how can I reduce forwarder memory usage?. 06-05-2020 12:46 AM
- Got Karma for Re: Lots of log files, how can I reduce forwarder memory usage?. 06-05-2020 12:46 AM
- Got Karma for How much splunk memory use should I expect while monitoring a directory with many entries?. 06-05-2020 12:46 AM
- Got Karma for How much splunk memory use should I expect while monitoring a directory with many entries?. 06-05-2020 12:46 AM
- Got Karma for How much splunk memory use should I expect while monitoring a directory with many entries?. 06-05-2020 12:46 AM
- Karma Re: How do I list all active input stanzas in all apps? for ziegfried. 06-05-2020 12:45 AM
- Got Karma for Does Splunk have a "Traffic Light"-control for a dashboard?. 06-05-2020 12:45 AM
- Got Karma for Does Splunk have a "Traffic Light"-control for a dashboard?. 06-05-2020 12:45 AM
- Got Karma for Does Splunk have a "Traffic Light"-control for a dashboard?. 06-05-2020 12:45 AM
- Got Karma for Does Splunk have a "Traffic Light"-control for a dashboard?. 06-05-2020 12:45 AM
- Got Karma for How do I monitor files in a folder as well as the files in all subfolders?. 06-05-2020 12:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 3 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 4 |
02-15-2013
12:05 AM
Works perfect! Thanks!
... View more
02-14-2013
06:50 AM
I have event data in Splunk that look like this:
2013-02-14 11:32:46.4314 app=ws3 sev=INFO mid=1325748 , Fooo, Barr, , 7 rue de fuubarr, , 44540, xx zzz la yyyyy, , FR, ENG, , 1031, EUR,,,
I need to do an Ad Hoc report that count the events grouped by country. The country information is in the filed that contains "FR" in this example event.
... View more
- Tags:
- field-extraction
10-15-2012
01:23 AM
That solved the problem! Thanks!
The documentation could be better on this subject. On this page http://docs.splunk.com/Documentation/Splunk/4.3.4/Developer/HowToUseListers#EntityLinkLister
it says: "The below example returns a list of saved searches that are available (using Splunk's permissions system) to the current Splunk user and app."
It does not mention the namespace parameter.
... View more
10-11-2012
05:30 AM
I have created a new app with many saved searches. And I have created a new view in this app. In this view I have created a EntityLinkLister that have the entityPath set to "saved/searches". The list of saved searches shows up in the view but it only shows the defult saved searches from the Search app.
How do I make it show the saved searches in my app?
... View more
- Tags:
- rest
09-10-2012
01:53 AM
Never mind. I found the problem. There was a " in the lookup data and that caused problems for Splunk. I removed the extra " and now it works perfect.
... View more
08-28-2012
05:27 AM
Never mind. I found the problem. There was a " in the lookup data and that caused problems for Splunk. I removed the extra " and now it works perfect.
... View more
08-28-2012
04:56 AM
That did not help. Instead it caused a problem, Splunk stopped indexing input from my udp and tcp inputs.
I had to restart Splunk to get it to work again.
... View more
08-28-2012
04:16 AM
I'm running Splunk 4.3.3 on Windows Server 2008 R2 64-bit.
I have scheduled a small .net console application to overwrite a csv lookup file in "E:\Splunk\etc\apps\myapp\lookups" once a day.
The problem is that only parts of the lookup data is available in searches until I restart Splunk.
Is there a way to reload the lookup file without restarting Splunk?
... View more
04-19-2012
02:21 AM
I have events coming in that has a field called status_id. This field contains the values OK or ERROR. If I look at the last five minutes it's ok to have a ratio of 20% Errors and 80% events with status_id="OK".
How can I be alerted if the ratio changes to 50% Errors and 50% OK in next 5 minutes?
The total number of events during a 5 minutes period, can be between 20 and 200 depending on the time of the day.
... View more
- Tags:
- alerts
01-27-2012
05:06 AM
2 Karma
I have a log that looks like this:
start_time="2011-11-19T13:32:59" end_time="2011-11-19T13:34:59"
How do I create a report that shows the total duration by month?
I would like to do something like this:
search | eval xduration=(end_time-start_time) | stats sum(xduration) by date_month
But the above, of course, does not work. How do I get Splunk to recognize the vaules in the start_time and end_time fields as timestamps?
... View more
10-27-2011
06:31 AM
I had to modify your command since I'm on Windows: %SPLUNK_HOME%\bin\splunk.exe cmd btprobe -d %SPLUNK_HOME%\var\lib\splunk\fishbucket\splunk_private_db\ -k ALL | find /c "key". The result is 66827.
... View more
10-26-2011
07:37 AM
I have noticed a strange thing that I have described here:
http://splunk-base.splunk.com/answers/32999/clean-the-crc-database
... View more
10-26-2011
05:54 AM
3 Karma
If I remove the only input stanza I have on a forwarder and restart Splunk the memory usage is 2GB. How can a forwarder use that much memory if I don't have any input stanzas?
On this page it's described how Splunk use CRC checksums to keep track of which files it has seen before.
http://docs.splunk.com/Documentation/Splunk/latest/Data/Howlogfilerotationishandled
How much space does this data use on disk and in memory if you have let Splunk monitor a directory that over the years have contained more than 1 000 000 files?
This question is related to this question:
http://splunk-base.splunk.com/answers/32528/lots-of-log-files-how-can-i-reduce-forwarder-memory-usage
... View more
- Tags:
- monitoring
10-21-2011
01:47 AM
1 Karma
The cpu usage is about the same. It has to be this input that causes the high mem usage. It is the only input that differs from other forwarders that have normal mem usage, 200-300MB.
... View more
10-20-2011
07:36 AM
1 Karma
I added ignoreOlderThan = 3d and restarted the forwarder.
Saddly, it didn't help at all. The forwarder is now right back at 4.3 GB mem usage. I did a search and there is only 813 files in 73 directory's that are younger than 3 days.
... View more
10-20-2011
04:47 AM
Is it OK to do like this:
[monitor://E:\Data\pnlog\createsession\]
soucetype = createsession
recursive = false
host = 10.41.10.13
index = main
disabled = 0
followTail = 1
_TCP_ROUTING = pnlogGroup
[monitor://E:\Data\pnlog\endsession\]
soucetype = endsession
[monitor://E:\Data\pnlog\processing\]
soucetype = processing
Will the attributes from the first monitor stanza be inherited by the other monitor stanzas? or do I have to explicitly set the attributes on all monitor stanzas. I will have about 50 monitor stanzas.
... View more
- Tags:
- inputs.conf
10-20-2011
01:14 AM
2 Karma
Thank you for this very valuable information. I will try to implement your solutions right now! To bad Splunk support couldn't give me this information when I contacted them...
... View more
10-19-2011
06:51 AM
2 Karma
The forwarder is using 4.3 GB memory. I think that is insane.
OS: Windows 2008 R2
Splunk 4.2.3
The folder I am monitoring contains 11156 files in 699 folders. The total amount of log file data is 7.5 GB.
The forwarder is configured as a "full forwarder" since I need to send data to 2 different indexers.
[monitor://E:\Data\pnlog]
host = 10.41.10.13
index = main
whitelist = \.log$
disabled = 0
followTail = 1
_TCP_ROUTING = pnlogGroup
// Andreas
... View more
05-24-2011
07:49 AM
Just after I wrote the question it came to me, the eval command:
search | eval amount= if(amount < 100, "99", amount) | eval amount= if(amount > 500, "501", amount)| bucket amount span=50 | stats count by amount | sort by amount
Someone with more experiance maybe can check if this is the correct way to do it.
... View more
05-24-2011
07:29 AM
I have events that contains an amount. How do I create a histogram report that counts events grouped into these intervalls:
lt 100
100 – 149
150 – 199
200 – 249
250 – 299
300 – 349
350 – 399
300 – 449
450 – 499
gt 500
... View more
05-02-2011
05:37 AM
Found it, problem solved. Works great!
... View more
05-02-2011
03:13 AM
Where do I set "range"? Should I edit a file or is it done through the webgui?
... View more
04-29-2011
01:14 AM
4 Karma
I would like to have a couple of controls/reports on my Dashboard that shows the current status of my services. If configurable thresholds are exceeded the control should show red, yellow, green.
Can Splunk do this out of the box?
... View more
04-14-2011
11:17 AM
I have events that looks something like this:
merchant_id=5755757 status_id=22 amount=300
Now I want to compare the number of events from one specific merchant to the number of events from all the other merchants in a stacked bar diagram split by "specific merchant" / "other merchants". How can I do this?
The diagram should show the last 30 days, with one bar per day.
... View more
- Tags:
- report
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-07-2022
05:04 AM
|
