About mrunals

mrunals · ‎10-08-2021

Has anyone run into an issue where the Microsoft 365 App for Splunk is causing a search head to crash? I'm wondering if part of the issue is the use of the sankey visualizations on some of the dashboards given the volume of data it is trying to display. The SH that are crashing are moderately beefy. https://splunkbase.splunk.com/app/3786/ Does the new answers backend support tagging the app? I forget how to do that.

mrunals · ‎06-14-2021

I had this issue and recently found the solution. I'd suspect you have an empty health check somewhere in a checklist.conf. One way to find this is to load the health check list dashboard (add "_list" to the end of the health check dashboard that doesn't load). Then click on either the name or action field and then disable any empty items there in the UI. The dashboard also shows which app the checks are in so you can look at the checklist.conf in that app to see what's up. In my case I had an app where the attribute settings for a check were all commented out except for the health check name.

mrunals · ‎12-03-2020

Ultimately the use case is the data in the dashboard should be tailored to whom the emailed PDF is being delivered to. Because of the nature of how Splunk works I'm proposing making a copy of a master dashboard and changing the owner to who is going to receive it in order to dynamically adjust the data that is presented (ironically enough). And yes that rest call will show all dashboard and their owners. What I'm trying to figure out is a rest call (or other internal-to-Splunk method) of identifying the specific dashboard being called/used/emailed and that dashboard's owner as the dashboard is being opened by the PDF engine to actually run the dashboard's queries. The challenge is the native GUI, or otherwise, methods don't support that use case.

mrunals · ‎12-02-2020

Short Version Is there a way to see who the owner is of the dashboard currently opened? This is similar to, but different from, being able to see who the current user is that is looking at a dashboard (| rest splunk_server=local /services/authentication/current-context). The idea would be to hide that query into the dashboard in order to manipulate the data results. Note: I know there are rest calls to see all of knowledge objects and owners; I'm specifically interested in the currently active dashboard. Use Case If you had a dashboard that displayed data based on who is actively looking at it you could leverage the rest query I pasted above. The end result might be something like this >link<; likely a number of ways to achieve similar ends. However, this requires the user logging into Splunk. What if you wanted to email a PDF copy of a dashboard to a user/user group but have the results customized based on the recipient? In the end you will likely need to create a dashboard instance for each destination group but how do you minimize the manual work of individual customizations? Further, unlike viewing saved searches as the user (vs owner), the pdf/report delivery engine will not recognize the user; it will only use the owner of the dashboard. My thought is if you use macros for the vast majority of your searches you can at least minimize the number of places you need to make changes as the need arises. The next pieces is what about when you create that copy of the dashboard you changed the owner to the recipient. If you could replace that hidden search that would otherwise look at who the user is and pass tokenized arguments as variables to display data could you do the same thing if that hidden search would instead look at who owns the current copy of the dashboard? Anyone else gone down this route - either to identify the current dashboard owner or in support of the ultimate use case?

mrunals · ‎06-10-2020

It takes time to accept changes but I'm not a fan of the new look/feel Way too much whitespace Fonts are too large Answer and reply format structure is gone Much harder to visually parse the information in posts Forcing structure to questions is good in theory until you try to use it in practice/find answers. What about people who want to answer questions? I'm guessing they have to browse through 20 +/- locations? The search feature doesn't work anndddd you have to use only predefined labels. I'm guessing those are largely unique for each location /sigh When the page opened from my Google search I literally thought I was on a generic site that had screen scrapped the Answers pages. Please reassess. This is not great UX.

mrunals · ‎08-27-2019

Interesting! Appreciate the insight. I'm guessing then the fsck scan is 'full featured' in that it is looking for multiple aspects of corruption.

mrunals · ‎08-24-2019

When it comes to looking for corrupt buckets I wonder if those two commands are morally the same - at least on some level. If they aren't the same how do they differ? Anyone have thoughts or experience on this? The chief advantage of doing a | dbinspect search is you can run that while Splunk is running. If you have searchhead affinity turned on in a multi-site index cluster then I'd imagine the results would be limited. No doubt corrupt buckets are probably more a symptom of an underlying issue but their presence (rare as it might be) impacts searching. In theory though this is a way to proactively monitor for their presence without having to shut down your indexers.

mrunals · ‎06-20-2019

I'd probably link up index A and B through either a stats or subsearch. Then use a join to map src to user. Based on the size of the data in index C having a search create a continuously updated/ing lookup might make sense.

mrunals · ‎04-22-2019

I think you do want chart but you have to do the OVER and BY splitting | chart count over version by types

mrunals · ‎04-22-2019

I'd try a case statement. If I follow your logic it might look something like this. This way you end up with just one field and one value to then display in your single value visualization. The "fixme" at the end is just in case there is some logic issues to work out you get some result vs everything not evaluating as true. | eval foo = case(RT>Target, "Bad", RT<=(Target-1) AND (RT>(Target/2)), "Warning", RT<=((Target/2)-1), "Good", 1=1, "fixme") | fields foo

mrunals · ‎03-06-2019

What bin does is 'smoosh' , in this case, the time field so that all of the dates appear the same (essentially midnight of the day in question). I'm doing this because now you can run your query across a number of days - 7, 30, etc - and get the unique number of days a user might have logged in. To see this in action you could do something like ...| eval foo = _time | bin span=1d _foo | convert ctime(foo) | table _time foo Even though you've smooshed (quite a technical term I must say) the time field you still have individual login instances which allows you to also get a total count of logins per user & database. Sorting is simply a matter of picking which field you want and of course you can sort on multiple fields. Hopefully that helps a bit.

mrunals · ‎03-04-2019

The other answers are pointing you in the right direction based on the specific wording you used. However, if you wanted to find out how many days someone logged in (ie Fred used the application 10 days in Feb while Mary used the application 23 days) you could do something like this ... | bin span=1d _time | stats dc(_time) as uniqueDays by customer database | sort -uniqueDays You could combine both pieces of data with something like ... | bin span=1d _time | stats dc(_time) as uniqueDays count as uniqueLogins by customer database

mrunals · ‎03-04-2019

To somesoni2's point - when you say "(real time)" are you indicating you are running this as a real time search or more like when you run the search over the last hour's worth of events? Assuming you aren't running this as a real time search, which I wouldn't, there could be a delay in data ingestion. Try running something like the following index=<where the data is> sourcetype=<what the data is> | eval delta = _indextime - _time | timechart avg(delta) perc90(delta) max(delta) Since Splunk places events in their correct chronographical location it might be events are coming in after the search has run but before you manually go searching for them.

Posts	13
Solutions	0
Karma Given	0
Karma Received	11
Member Since	‎03-04-2019

Online Status	Offline
Date Last Visited	‎10-26-2021 07:33 PM

Microsoft 365 App for Splunk causing SH to crash

Identify owner of the dashboard being used

What happened to Answers? The change is for the wo...

| dbinspect corruptonly=true index=* VS ./splunk f...

Microsoft 365 App for Splunk causing SH to crash

Re: Monitoring Console Health Check does not run

Re: Identify owner of the dashboard being used

Identify owner of the dashboard being used

What happened to Answers? The change is for the wo...

Re: | dbinspect corruptonly=true index=* VS ./splu...

| dbinspect corruptonly=true index=* VS ./splunk f...

Re: How to correlate between three data sources?

Re: How to display host types in Y axis and X axis...

Re: How to display a certain value in a single val...

Re: How do you get a list of unique users for the ...

Re: How do you get a list of unique users for the ...

Re: Splunk alert returns 0 events