About bwmetz

bwmetz · ‎07-25-2017

Amendment to my suggestion to protect against invalid values in large data sets causing "..." to come out of the macro. Adding a validation rule to the macro might be smarter, but more complex when you don't understand them. eval $long$temp=tonumber($long$) | eval $ip$0=floor($long$temp/16777216) | eval $long$temp=$long$temp-($ip$0*16777216) | eval $ip$1=floor($long$temp/65536) | eval $long$temp=$long$temp-($ip$1*65536) | eval $ip$2=floor($long$temp/256) | eval $ip$3=$long$temp-($ip$2*256) | strcat $ip$0 "." $ip$1 "." $ip$2 "." $ip$3 $ip$ | eval $ip$=if($ip$="...","",$ip$) | fields - $ip$0,$ip$1,$ip$2,$ip$3,$long$temp

bwmetz · ‎07-25-2017

The macro answer shown first is good, but is prone to errors. Change the definition to first ensure your temp value is a number and then uses floor() instead of round() to calculate the dotted decimal values. Use of round() in the original solution will produce negative octet values in some cases. Use of floor() imitates integer division, e.g. int(); alas a function several other community answers confirm is not available in Splunk, much to our lament: definition = eval $long$temp=tonumber($long$) | eval $ip$0=floor($long$temp/16777216) | eval $long$temp=$long$temp-($ip$0*16777216) | eval $ip$1=floor($long$temp/65536) | eval $long$temp=$long$temp-($ip$1*65536) | eval $ip$2=floor($long$temp/256) | eval $ip$3=$long$temp-($ip$2*256) | strcat $ip$0 "." $ip$1 "." $ip$2 "." $ip$3 $ip$ | fields - $ip$0,$ip$1,$ip$2,$ip$3,$long$temp

bwmetz · ‎02-19-2014

I successfully created 65 different scheduled exports using Hadoop Connect without an error, but only 29 appear in the scheduled exports list. The remaining 36 all produce the following error when I attempt to re-add them. I checked HDFS and see the directories. Something seems messed up on the Splunk side. 2014-02-20 00:46:57,901 ERROR hdfs_export_handler.py [persistSavedSearch] [129] - Failed to save search object Traceback (most recent call last): File "/opt/splunk_nfs/etc/apps/HadoopConnect/bin/hdfs_export_handler.py", line 126, in persistSavedSearch if not saved_search.save(): File "/opt/splunk/lib/python2.7/site-packages/splunk/models/base.py", line 773, in save return self.create() File "/opt/splunk/lib/python2.7/site-packages/splunk/models/base.py", line 929, in create if super(SplunkAppObjModel, self).create(): File "/opt/splunk/lib/python2.7/site-packages/splunk/models/base.py", line 758, in create newEntity = self.manager()._put_entity(new_endpoint, self.entity, messages, sessionKey=self.sessionKey) File "/opt/splunk/lib/python2.7/site-packages/splunk/models/base.py", line 520, in _put_entity return self._put_args(id, postargs, messages, sessionKey=sessionKey) File "/opt/splunk/lib/python2.7/site-packages/splunk/models/base.py", line 453, in _put_args serverResponse, serverContent = splunk.rest.simpleRequest(id, postargs=postargs, raiseAllErrors=True, sessionKey=sessionKey) File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 553, in simpleRequest raise splunk.RESTException, (serverResponse.status, serverResponse.messages) RESTException: [HTTP 409] [{'text': "In handler 'savedsearch': Unable to create saved search with name 'XYZ report'. A saved search with that name already exists.", 'type': 'ERROR', 'code': None}] Has anyone run into this before? If so, how did you fix it? I don't see any CLI tools that might allow me to wipe these out and start again.

Posts	3
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎08-16-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Hadoop Connect - Scheduled Export Failure

Re: How i can know splunk's method or function nam...

Re: How i can know splunk's method or function nam...

Hadoop Connect - Scheduled Export Failure