About andyk

rsantkumar · ‎05-20-2020

hi @jeff @andyk @Rob : I have 3 fields(Key, Version, Date) seperated by comma and records(can be many) seperated by ;(semicolon). Example: pgn-aemrules,1.1,2020-04-02;pgn-csharp,8.4 (build 15306),2020-02-21;pgn-csharp,8.5 (build 15942),2020-03-16; I am trying to extract the 3 fields and display as a table in splunk. Please help.

andyk · ‎10-15-2012

That solved the problem! Thanks! The documentation could be better on this subject. On this page http://docs.splunk.com/Documentation/Splunk/4.3.4/Developer/HowToUseListers#EntityLinkLister it says: "The below example returns a list of saved searches that are available (using Splunk's permissions system) to the current Splunk user and app." It does not mention the namespace parameter.

petercow · ‎01-07-2014

Not so. In a distributed environment, the knowledge bundles need to get distributed. Until they are, your results may be "inconsistent".

kristian_kolb · ‎04-19-2012

Try this; sourcetype=your_sourcetype earliest=-5m | stats c AS Total c(eval(status_id="OK")) AS Good c(eval(status_id="ERROR")) AS Bad | eval bad_ratio = Bad/Total Then set the search to run every 5 minutes, and alert on Custom Condition; search bad_ratio > 0.25 Hope this helps, Kristian

wimvdheijkant · ‎11-21-2012

Dear all, When I do what is says above the duration I get return is off by 2 hours...? I'm using the following: Search | convert timeformat="%d-%m-%Y %H:%M:%S" mktime(ADCreatedTime) | convert timeformat="%d-%m-%Y %H:%M:%S" mktime(FIMCreatedTime) | where ADCreatedTime > FIMCreatedTime | Eval Duration = ADCreatedTime - FIMCreatedTime | convert timeformat="%H:%M:%S" ctime(Duration) as D | convert timeformat="%d-%m-%Y %H:%M:%S" ctime(ADCreatedTime) as ADC | convert timeformat="%d-%m-%Y %H:%M:%S" ctime(FIMCreatedTime) as FDC | Table user, FDC, ADC, D The results are: user FDC ADC D abiggelaar 25-03-2011 11:02:34 25-03-2011 12:05:49 03:03:15 ahayward 16-02-2011 12:54:59 16-02-2011 13:57:49 03:02:50 beheer.danaher 04-03-2011 09:49:39 04-03-2011 10:53:39 03:04:00 I can't find any time zone stuff going wrong. Can anyone point me in the right direction? Thanks! Wim

peter_krammer · ‎10-10-2014

Try to clean out your fishbucket. %SPLUNK_HOME%/bin/splunk stop %SPLUNK_HOME%/bin/splunk clean eventdata -index _fishbucket %SPLUNK_HOME%/bin/splunk start

gkanapathy · ‎05-15-2013

As I said, anything under a [default] stanza is inherited by all stanzas in a file.

rickybails · ‎11-19-2019

It might be over 8 years later and we're now on splunk 7.2 but we've just had a big issue with splunkd process consuming a lot of memory (1GB). Just want to let people know that setting an ignoreOlderThan config DID have a huge impact in reducing memory (reduced it to a quarter of what it was). In our case Splunk was monitoring a directory that had over 200k files in. A cleanup job was the answer but before that could be implemented, we set ignoreOlderThan = 2d to bring the server memory down from a critical level. CPU also came down.

andyk · ‎05-24-2011

Just after I wrote the question it came to me, the eval command: search | eval amount= if(amount < 100, "99", amount) | eval amount= if(amount > 500, "501", amount)| bucket amount span=50 | stats count by amount | sort by amount Someone with more experiance maybe can check if this is the correct way to do it.

jitsinha · ‎02-26-2015

No its not working with real time search. Let say for a low value I have green color on the dashboard, but it should have been yellow once the returned result breaches the threshold. BUt its reflecting the changes only after refreshing the dashboard.

andyk · ‎04-18-2011

Works perfect, thanks!

Masa · ‎03-18-2013

What do you mean by "sending data via tcp and both are separated.."?

ziegfried · ‎02-02-2011

You can execute the following command to get the effective inputs configuration: splunk cmd btool inputs list To just get the monitor inputs execute splunk cmd btool inputs list monitor To just get the stanza headers, you can do splunk cmd btool inputs list | grep "\[" (All the examples assume you have the splunk binary in your PATH) Btw. this works for all other configurations as well. For example query the effective props.conf: splunk cmd btool props list

gkanapathy · ‎12-07-2010

Yes, but you'd have to create such a view yourself. It would actually be a very simple view. I have updated above with an example that would render as a chart, but you could make a similar one with a table, etc.

ziegfried · ‎11-30-2010

Yes. Quote "If the specified directory contains subdirectories, Splunk recursively examines them for new files." in http://www.splunk.com/base/Documentation/latest/Admin/Monitorfilesanddirectories

Posts	32
Solutions	2
Karma Given	4
Karma Received	16
Member Since	‎11-30-2010

Online Status	Offline
Date Last Visited	‎09-07-2022 05:04 AM

How do I extract a comma separated field during se...

Why does the REST endpoints only show data from th...

How do I reload csv lookup files?

Alert on changed ratio between 2 different events?

calculate time difference between 2 fields | sum a...

How much splunk memory use should I expect while m...

Inherit monitor attributes in input stanzas?

Lots of log files, how can I reduce forwarder memo...

histogram report of purchase amount

Does Splunk have a "Traffic Light"-control for a d...

Re: How do I extract a comma separated field durin...

Re: Why does the REST endpoints only show data fro...

Re: How do I reload csv lookup files?

Re: Alert on changed ratio between 2 different eve...

Re: calculate time difference between 2 fields | s...

Re: How much splunk memory use should I expect whi...

Re: Inherit monitor attributes in input stanzas?

Re: Lots of log files, how can I reduce forwarder ...

Re: histogram report of purchase amount

Re: Does Splunk have a "Traffic Light"-control for...

Re: compare no. of events with a specific value, t...

Re: UDP input and _TCP_ROUTING - is it possible?

Re: How do I list all active input stanzas in all ...

Re: Link and pass parameter to saved search?

Re: How do I monitor files in a folder as well as ...