About David_Hodgson

David_Hodgson · ‎09-01-2016

Unfortunately GMT is described as one of London, Dublin etc. That implies it's using summer time (BST), which for my case is wrong. There seems to be no way, using the UI, to set a user to have unaltered times reported. I've edited the user's user-props.conf to have tz = UTC, but it's a defect that this isn't available through the UI, and that setting the user to "Default System Timezone" isn't working.

David_Hodgson · ‎09-01-2016

For clarity, the support staff work in UTC when looking at logs. The Splunk indexers are all running with /etc/localtime => UTC The new versions seem to be ignoring the server timezone and using GMT instead. I cannot see an option in the user administration timezone dropdown for UTC, or is this the wrong way to set the UI timezone? p.s. this seems to be new behaviour. Has someone "corrected" the UI timezone handling?

David_Hodgson · ‎08-31-2016

Thanks for the help. I'll spend a few hours reloading and then we'll see. Consistently wrong I can live with 🙂

David_Hodgson · ‎08-31-2016

... the list of timezones available for the user account doesn't include UTC.

David_Hodgson · ‎08-31-2016

That seems to be the problem, unless I'm misunderstanding what's being presented to me by Splunk. The page you referred to says "Timestamp values are stored in the _time field (in UTC time format)." yet the log files which have the timezone explicitly set as UTC are showing an incorrect time in queries. How do I stop Splunk from interpreting times into my local (desktop) timezone. This is corrupting the data.

David_Hodgson · ‎08-31-2016

I'm having a problem with the site, as the comment by tin_fish is no longer visible to me. (S)he suggested I checked the sourcetype definition's and, sure enough, one was different: the log showing correct _times had a timezone of Auto and the others (with incorrect _times) had timezones of UTC. I've corrected that (so they all say UTC) so they should all now be equally wrong, but will, at least, match in joins, transactions etc. I've restarted the server, but it looks like I'll need to clean the index and reload the logs into the server ... Any way to set the entire server so everything is UTC (including reports) so I don't need to worry about this again? Any idea why _time is wrong when the sourcetype's TZ is right, and right when the TZ is Auto?

David_Hodgson · ‎08-31-2016

Here's a longer example covering all the log files:

David_Hodgson · ‎08-31-2016

I have a set of application logs, all processed into Splunk. Each has the entry timestam in the first 18 chars of the row. Each has its own sourcetype, and these are mostly identical in props.conf, apart from the name. Specifically they all have: DATETIME_CONFIG = MAX_TIMESTAMP_LOOKAHEAD = 18 TZ = UTC One of the logfiles' timestamps are being correctly used and presented in Splunk as UTC. Three are presenting the timestamps as GMT (local time). When doing matching (e.g. joins) between logs they're failing as the timestamps appear different. Here's an example of the defect: The two rows are from different log files, one showing correct interpretation and the other showing incorrect. Please advise: 1. what do I have to change so Splunk interprets ALL date-times as UTC 2. where should I look to find what's different between the sourcetypes / why they're producing different results? I'm using Splunk desktop 6.4.2 on a Linux platform. The files are read in from a set of watched folders, one for each sourcetype. Thanks in advance for any assistance. David

David_Hodgson · ‎07-11-2016

Thanks. That worked! That's a bug in my book.

David_Hodgson · ‎07-11-2016

I have a log file with rows for each transaction in a request sequence, each identified by msg_id. I'm trying to get requests per second (RPS) and transactions per second (TPS). I can get one or the other, but am having trouble getting both. I think I'm missing something really obvious. Please help! sourcetype=log | eval time=strftime( _time, "%Y-%m-%d %H:%M:%S" ) | stats count AS countX BY time, msg_id | stats count AS RPS, sum( countX ) as TPS BY time I get RPS, but no TPS. I tried previously: sourcetype=log | eval time=strftime( _time, "%Y-%m-%d %H:%M:%S" ) | stats count AS TPS, dc( msg_id ) AS RPS BY time And that also didn't work (TPS, but no RPS). Help!

David_Hodgson · ‎04-19-2016

I need to add a maximum column for a set of fields on each row (created using chart ... OVER ... BY ... ), and then add the maximum of this into the totals row. Any suggestions on how to do this?

David_Hodgson · ‎03-29-2016

Minor correction. The duration match needs to be \d+(\.\d+) as singletons have a duration of 0.

David_Hodgson · ‎03-29-2016

Perfect, apart from the rex needing "\d+\.\d+" as the match for time and duration. Thanks

David_Hodgson · ‎03-24-2016

Information in each log record are: timestamp, client_ip_address, api, process_micros sourcetype=requests source="*STATUS*" | transaction client_ip_address maxspan=7m maxpause=1m keeporphans mvlist=t | eval client_ip_address=mvindex(client_ip_address,0) | eval munge=mvzip(api, process_micros, "|") | fields - api, process_micros | mvexpand munge | eval api=replace(munge, "\|.*$", "") | eval process_micros=replace(munge, "^.*\|", "") | eval munge=client_ip_address. "|" . _time | chart count sum(process_micros) AS process_micros OVER munge BY api | eval client_ip_address=replace(munge, "\|.*$", "") | eval _time=replace(munge, "^.*\|", "") | table _time, client_ip_address, duration, eventcount, count*, process_micros*, total_count, total_process_micros missing & required are total_count = sum(count*) for the transaction, and total_process_micros = sum(process_micros*), and duration from the transaction

David_Hodgson · ‎03-23-2016

I have a system with customers interacting with a catalogue, stepping through the menus, searching etc. I can chunk these into transactions using user ID & time period (max 7 mins, max pause 1 min). I've got it as far as combining the numbers into a count of each type of system request by transaction, and the server resources used by system request type, all on a single line (using transaction with mvlist=t, then mvzip -> mvexpand as explained link:here(http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Mvexpand "mvexpand"), then chart over _time by system request type). I'm stuck on 2 final steps: - how to preserve one and only one copy of the duration & eventcount from the transaction into the final row - how to create total_count & total_process_time from the count* & process_time* fields across the row Can anyone point me at the right answer? Thanks David

Posts	15
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎03-23-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

UTC timezone missing?

wrong timestamps in some files

Why am I unable to get results for the second stat...

How to add a column with the max values for a set ...

totals for a transaction

Re: UTC timezone missing?

UTC timezone missing?

Re: wrong timestamps in some files

Re: wrong timestamps in some files

Re: wrong timestamps in some files

Re: wrong timestamps in some files

Re: wrong timestamps in some files

wrong timestamps in some files

Re: Why am I unable to get results for the second ...

Why am I unable to get results for the second stat...

How to add a column with the max values for a set ...

Re: totals for a transaction

Re: totals for a transaction

Re: totals for a transaction

totals for a transaction