About DreadEclipse

DreadEclipse · ‎06-06-2016

So, it turns out the easiest way to grab data is just to do a straight out search. Use the .export command in java and then, in the parenthesis type exactly the same search you put into Splunk, but type "search " in front with a space after it. This will give an overall search. To search for a specific time range, add "earliest=-" followed by the time range (like 1h for one hour or 15s for fifteen seconds), without the quotes, of course. This takes the search from about 3 hours to about 6 seconds, a very nice 180,000% increase in performance!

DreadEclipse · ‎06-03-2016

I downvoted this post because not enough information

DreadEclipse · ‎06-03-2016

Even when you close out of a Splunk query, it might still be active until either you delete it or the internet finishes the full search. Calls from external sources might be slower than calling through Splunk's internet site. There can also be multiple tabs under the drop-down menu where your searches are stored. Make sure to check all of the types of searches and not just the defaults. There is an all button for your convenience.

DreadEclipse · ‎06-02-2016

I was having the same trouble just two days ago. Have you checked with the people in charge of the server where you work? It might be that the Host name or else the Port have changed or else something has happened to your personal information in the last two days (well, since the 22nd of May). Are you trying to access Splunk through a different source than you used before? When I switched from accessing purely by the internet to using Java, my system gave me the same error. It turns out, if your password has any control characters, you'll need to HTML hard code them into the String or else they might not work every time. Hope this helps!

DreadEclipse · ‎06-02-2016

I am writing a series of programs to make regular calls to the Splunk server and quickly sort the results of a search. The only language I use is Java, specifically the Eclipse IDE. I have the Splunk SDK downloaded and installed and added successfully to my Eclipse project. I have successfully connected to splunk using my credentials. My goal is to access the splunk dashboard and retrieve all the events that result from a specific search, returning them as Strings or else in a .txt file. I have read the documentation extensively and tried several solutions including service.export and MultiResultsReaderXml but neither seem speedy enough for my desires and neither seems to produce the Strings I need, namely the specific words of the Events from the search. Both seem like they would have to run for hours just to run a query on a one second time frame. I need to be able to search at least an hour. Since the beginning of time would be even better. The rest of the program is designed to use the text shown in the Splunk events, and should work once I have this last piece. Whether there is a quicker way or not, please let me know. Thanks!

Posts	5
Solutions	1
Karma Given	16
Karma Received	0
Member Since	‎06-02-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

What is the fastest way to turn Splunk search resu...

Re: What is the fastest way to turn Splunk search ...

Re: Connecting to splunk enterprise using splunk s...

Re: Why am I getting "Maximum disk usage quota has...

Re: Using Java to make a REST API call to Splunk, ...

What is the fastest way to turn Splunk search resu...