About kallu

kallu · ‎11-26-2013

Would it work better if you change the end (?P<status>.+?)\t(?P<data>.+?)\t(?P<test>.+?) to (?P<status>.+)\t(?P<data>.*)\t(?P<test>.+) then you should match to an empty string if there is just 2 tabs in case of "Ok"? It sounds too easy and I didn't test it with Splunk, so maybe I'm missing something?

kallu · ‎04-13-2013

If you want to extend Splunk with your legacy scripts, maybe this example helps you to get started. If you just want to anonymize your logs before sending them to some 3rd party, maybe scrub -cmd could do it for you without custom scripts? None of these actually can hide your data that has been indexed by Splunk. These only manipulate search results. You can still dig out the original data using another search. If it is something really sensitive you should do the masking & hashing at indexing time. Not sure how/if custom code could be used in that case.

kallu · ‎03-31-2013

Would Outputlookup work better than outputcsv ? (or you can extend splunk with your own output -cmd that lets you specify directory & filename, and creates a huge security issue too 🙂

kallu · ‎03-25-2013

Or if you're worried about losing data because of log rotation or have problems starting/stopping all your forwarders, you can also close the receiver (indexer) during business hours. This will make forwarders to buffer data so make sure there is enough space available. Forwarders will resume transfer as soon as receiver is enabled again.

kallu · ‎03-22-2013

So what is the requirement for failover time and what is your NFS client timeout now?

kallu · ‎01-29-2013

Don't worry about fail-over. It's taken care by NFS client and server. Splunk doesn't know anything about it. It's just a filesystem like any other filesystem. At worst case there might be a temporary hick-up but once your NFS server is back in business things will continue as normal.

kallu · ‎01-29-2013

You'll need only 2 hosts for HA NFS, and those can serve any number of search heads. So your number of hosts would double only if you have minimal configuration of 2 searchs + 2 NFS servers (if that makes you feel any better). Running HA NFS (and linux cluster) on your search heads is not a good idea.

kallu · ‎01-28-2013

Hmmm... I'm not sure if I got your question right, but is there some problem in using e.g. linux cluster to provide HA NFS service for your search heads? Just google for "HA NFS" and you'll find many examples how to configure a pair of linux servers to provide highly available NFS service.

kallu · ‎01-21-2013

It's all in manuals 🙂 Let's say you have a set of events where the IP address is extracted to either clientip or ipaddress. This example defines a new field called ip, that takes the value of either clientip or ipaddress, depending on which is not NULL (exists in that event): ... | eval ip=coalesce(clientip,ipaddress) http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

kallu · ‎01-04-2013

How about adding ".log" to the end. Like this [monitor://D:/Program Files/Apache Software Foundation/Tomcat 6.0/logs/tomcat6-stdout*.log] This is then exactly like in examples in Splunk docs (=should work) http://docs.splunk.com/Documentation/Splunk/latest/Data/Specifyinputpathswithwildcards Ps. I'm not sure if it makes difference but have you tried turning your "/" to "\" if it is Windows?

kallu · ‎01-02-2013

http://splunk-base.splunk.com/answers/37372/can-you-customize-the-heatmap-colors

kallu · ‎12-18-2012

Everything works for me now, it must be something personal 🙂 Cleaning your browser cache & cookies usually helps for issues like this.

kallu · ‎11-28-2012

Just a eager to sell it into my company. Does it make a difference?

kallu · ‎11-28-2012

Has anyone run into nice samples of logs with debug instructions that could be used for demoing Splunk for those who haven't yet seen how great product it is 🙂 I know I can install forwarders and create myself a free SplunkStorm account but then running applications to generate meaningful logs is more than trivial task. If someone has already done this and is willing to share his/hers logs with documentation what was happning and how it was debugged with Splunk, that would be a great help in selling the idea of using Splunk. Or maybe Splunk has this already available somewhere, but I've just missed it?

kallu · ‎11-04-2012

Scripting ftp isn't that difficult. Here is some examples to get you started http://www.stratigery.com/scripting.ftp.html

kallu · ‎10-17-2012

Many features are not available through Splunk GUI but to edit dashboard XML you don't need access to conf files. Just go to your new dashboard, click "Edit: on" and then "Edit XML" ...

kallu · ‎10-16-2012

Is this something like you're looking for? http://wiki.splunk.com/Community:Search_Report:_How_to_Add_a_Range_Marker_by_Advanced_XML And some more examples of using chart overlays http://splunk-base.splunk.com/answers/9053/example-of-chart-overlay

kallu · ‎10-07-2012

If you just want to setup a Splunk demo, maybe sampledata.zip from Splunk tutorial could do? It's not Windows nor firewall or db logs, but on a plus side you get ready-made use-cases for you demo from tutorial with minimal effort. Link to sampledata.zip is at http://docs.splunk.com/Documentation/Splunk/latest/Tutorial/GetthesampledataintoSplunk If you really want to generate logs (ie simulate) for network devices then you should take a look at http://www.gns3.net/

kallu · ‎10-06-2012

Like Ayn said, your life will be much easier if you extract timestamps from CSV. Something like this in your props.conf should do it. [web_visitors] MAX_TIMESTAMP_LOOKAHEAD = 10 NO_BINARY_CHECK = 1 SHOULD_LINEMERGE = false TIME_FORMAT = %Y,%m,%d TZ=UTC EXTRACT-web_visitors = (?i)^\d+,\d+,\d+,(?P<source_from>[^,]+),(?P<visitors>.+)$ This should parse both timestamp and "from" & "visitors" -fields from your CSV. And if CSV header gets annoying, here is some ideas what you can do for it http://splunk-base.splunk.com/answers/49366/how-to-ignore-first-three-line-of-my-log

kallu · ‎09-27-2012

Not sure if this is anything similar to your issue; http://stackoverflow.com/questions/7384502/ie9-loses-cookies-after-redirect But missing P3P header or cached redirects could have something to do with it. Adjusting IE privacy settings might help(?)

kallu · ‎09-07-2012

Then it sounds like it is either still on developers desk or somewhere in Splunk's "approval process" waiting to be published at splunkbase. Be patient ... 🙂

kallu · ‎09-06-2012

Is it one these http://splunk-base.splunk.com/apps/search/?q=fireeye&Submit=Search

kallu · ‎09-03-2012

Did you remember to restart Splunk after removing the passwd? At startup Splunk will notice missing passwd and create you a new one with admin/changeme.

kallu · ‎08-29-2012

It's also worth noticing that pX() is using APPROXIMATION not exact value when you have >1000 data points, see http://splunk-base.splunk.com/answers/44336/percentile-implementation

kallu · ‎08-28-2012

Why you need to know if search is scheduled or not?

Posts	50
Solutions	8
Karma Given	2
Karma Received	28
Member Since	‎08-05-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Selling the idea of Splunk using sample logs?

Enhanced email alerts, anyone?

Re: Field Extraction (Regex) When Column Is Someti...

Re: Anonymize data by editing your own custom scri...

Re: Need to find outputcsv subroutine python file

Re: Could Splunk be configured to forward log data...

Re: HA Search Head Pooling

Re: HA Search Head Pooling

Re: HA Search Head Pooling

Re: HA Search Head Pooling

Re: Calculating time difference between two fields...

Re: Log file rotation with date in file name

Re: Data overly - Heat Map

Re: Special Page killing Splunk links in the wild ...

Re: Selling the idea of Splunk using sample logs?

Selling the idea of Splunk using sample logs?

Re: Fetch data from FTP Server

Re: Standard Deviation line on Bar graph

Re: Standard Deviation line on Bar graph

Re: Event Generator

Re: Can and cannot overwrite _time

Re: No cookie support detected. Check your browser...

Re: FireEye 2.0 app for Splunk

Re: FireEye 2.0 app for Splunk

Re: admin password reset did not work

Re: can i know the best95 and worst5 stats in splu...

Re: Dedicated Splunk Job Scheduler