About MikeKulls

MikeKulls · ‎07-16-2014

And yes it still works as of v6.1

MikeKulls · ‎07-16-2014

/opt/splunk/etc/splunk-launch.conf

MikeKulls · ‎03-20-2014

It appears the reason was the half the servers have different config on them. Being a large company it was difficult to get anyone to fix it so I just strip out the embedded quotes before sending the message across to Splunk. Not ideal but sometimes you just have to go with the simplest solution 🙂

MikeKulls · ‎07-16-2013

I'm sending syslog messages through to Splunk in field/value pairs. When the field value contains spaces or certain other characters we put double quotes around the value. When the value contains quotes we add a backslash before the quote, eg Message=Closed Message="It was closed" Message="The dir \"datavol3\" was closed" The problem is with the third item. Sometimes it will process the \" correctly as being an embedded quote and sometimes it will think it is the end of the string. So completely at random the value of the message field will be one of these: The dir "datavol3" was closed <----- correct value The dir \ <----- string cut short I can send the same log through to Splunk 20 times and it parses the message correctly pretty much 50% of the time. Can anyone suggest why this might happen?

MikeKulls · ‎06-20-2013

Oh, you just rename the field, easy. System=Shark | head 1 | table Pid | rename Pid as ParentPid

MikeKulls · ‎06-20-2013

Hmmm, you are right, it isn't matching against FileCount=100. For some reason I thought it was. I'd still be interested to know how to specify the field that it does match. Say I wanted to get the latest Pid but then search for all processes where ParentPid is equal to that value, ie the same as "SELECT * FROM TableX WHERE ParentPid = (SELECT TOP 1 Pid FROM TableY)"

MikeKulls · ‎06-19-2013

I guess putting all of that data into Splunk is an option but I'm a bit concerned with overusing Splunk. It's not a relational database and I don't want to use it for cases where I should be using a rdbms. We have an 18 month turnaround for Splunk data and if I store topology information in Splunk things could get messy. eg, if I write a log every time something changes but an element doesn't change for 18 months then data will be lost. Also, searching very old data in Splunk can be slow.

MikeKulls · ‎06-19-2013

It's anything related a the workings of a large network. It could be performance data, alarms, fault reports, topology information

MikeKulls · ‎06-19-2013

Getting the data into Splunk isn't really a good option. Using SQL directly in the dashboard would be the bee's knees of features imo. I would like to see a large number of employees go to Splunk first thing in the morning to get an overview of what is working and what isn't. But not everything is in Splunk so SQL access would make this a complete solution. I could even see some dashboards getting all of their information from SQL or sources outside Splunk.

MikeKulls · ‎06-19-2013

In all our logs we write out the PID of the unix process. In many cases I just want to look at the latest run of a script. I do this with a query like this System=Shark [search System=Shark | head 1 | table Pid] this will get the latest Pid for the system called "Shark" and return only results that contain that Pid. This works very well however it will match anything with that value, not just the Pid field. Eg, in the 2 logs below it will match both logs when I don't want it to match the second. Is there some way to tell it to only match the Pid field to the value calculated from the sub search? I tried Pid=[search...] but it didn't like that. from latest run of script System=Shark Message="Wrote some file" Pid=100 from previous run of script: System=Shark Message="Deleted all files" Pid=99 FileCount=100

MikeKulls · ‎06-19-2013

Is it possible to create a dashboard that gets all or some of its information from an SQL database? We find the dashboard to be an excellent tool but not all of our data is in Splunk.

MikeKulls · ‎02-03-2013

Thanks for the reply. When I click the create dropdown button I don't get the option to create an alert. I'm gathering that means it has been locked down by an administrator?

MikeKulls · ‎01-30-2013

I've been asked to trigger a script when certain messages are received in splunk. Alerts appear to do exactly what I need. Unfortunately we are using v4.35 of splunk and this appears to be a version 5 feature. Can someone tell me if that is correct and if there is any way to do something similar in v4? Thanks in advance, Michael

Posts	13
Solutions	1
Karma Given	3
Karma Received	0
Member Since	‎01-24-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Random behaviour from splunk

How to get the latest of a group

Use dashboard with SQL database

Alerts in version 4?

Re: How do I bind Splunk to a specific interface?

Re: How do I bind Splunk to a specific interface?

Re: Random behaviour from splunk

Random behaviour from splunk

Re: How to get the latest of a group

Re: How to get the latest of a group

Re: Use dashboard with SQL database

Re: Use dashboard with SQL database

Re: Use dashboard with SQL database

How to get the latest of a group

Use dashboard with SQL database

Re: Alerts in version 4?

Alerts in version 4?