Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About AlexMcDuffMille
AlexMcDuffMille
Communicator
Member since:
08-20-2013
06-05-2020
Community Statistics
| Posts | 50 |
| Solutions | 1 |
| Karma Given | 43 |
| Karma Received | 6 |
| Member Since | 08-20-2013 |
Activity Feed
- Karma Re: What is the most efficient way to filter search results by list? for martin_mueller. 06-05-2020 12:47 AM
- Got Karma for Extract value from JSON array of objects. 06-05-2020 12:47 AM
- Got Karma for Extract value from JSON array of objects. 06-05-2020 12:47 AM
- Got Karma for Why Splunkd does not automatically restart when Windows server is rebooted and how to fix?. 06-05-2020 12:47 AM
- Karma Re: Count when sum reaches specific number then start over. for aholzer. 06-05-2020 12:46 AM
- Karma Re: Change color of single value visualization for sowings. 06-05-2020 12:46 AM
- Karma Re: Graph weekly average but only show graph for last 24 hours for emiller42. 06-05-2020 12:46 AM
- Karma splunkd service does not start when the server is rebooted for wendyctlam. 06-05-2020 12:46 AM
- Karma Problem logging into splunk for lain179. 06-05-2020 12:46 AM
- Karma Re: Is there any reason to schedule a real-time search if it has no alerts? for Jordan_Brough. 06-05-2020 12:46 AM
- Karma Re: Pie Charts in splunk for _d_. 06-05-2020 12:46 AM
- Karma Re: Count the concurrent transactions with a single log entry by transaction for yannK. 06-05-2020 12:46 AM
- Karma Re: Combining Two Columns to Chart 3rd for Root Cause for lguinn2. 06-05-2020 12:46 AM
- Karma how to split the json array into multiple new events for wood1986. 06-05-2020 12:46 AM
- Karma Re: Return string of numbers after equals sign for jhupka. 06-05-2020 12:46 AM
- Karma Re: Count when sum reaches specific number then start over. for mkinsley_splunk. 06-05-2020 12:46 AM
- Karma Re: Filter based on a list for jtrucks. 06-05-2020 12:46 AM
- Karma Re: Filter based on a list for jtrucks. 06-05-2020 12:46 AM
- Karma Re: Graph by two fields for MuS. 06-05-2020 12:46 AM
- Karma Re: Show count of zero on chart for the_wolverine. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 2 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 |
08-18-2015
10:53 AM
2 Karma
I have a JSON object that has an array inside of it. The array is a list of objects, not just a list of values. See below for an example.
I want to extract the 'duration' field for each event when the name is 'responseTime'. Does anyone know how to do that? I can also assume that it's always going to be the 2nd entry in the list, so if I could do something like Timings[1] that would work. I can't seem to get spath to work because I'm looking for an item within an array.
In the end, I would like to do something like graph/table the duration of the 'providerTime' and the 'responseTime'
{
Timings: [
{
duration: 218
name: providerTime
}
{
duration: 204
name: responseTime
}
]
}
... View more
08-27-2014
05:26 AM
$SPLUNK_HOME/etc/apps/my_app_name/bin/scripts is the correct directory.
... View more
08-27-2014
05:20 AM
Hello,
I have a graph that I'm displaying as a 100% stacked column chart. Even though the Y-Axis is set to 0-100 I still see just the raw/absolute values when I mouse over the colored sections of the columns. Is there a way to make Splunk show the raw/absolute value and the percentage, like it does with the pie chart?
I've been able to get around this in one of my searches by using the "appendcols" command and then taking the percent of one column compared to both added together, but I'm not positive that method will work very well when I have more than 2 series.
Thanks,
Alex
... View more
08-21-2014
06:42 AM
It is a domain user.
The service starts fine with the domain user credentials manually anytime (not just after a reboot of the server).
We tried setting it to delayed with the SYSTEM login, and it worked! We then tried delayed with the domain credentials and it did not work (after waiting several hours).
Any other ideas?
Thanks,
Alex
... View more
08-15-2014
09:47 AM
When do pie charts collapse values into "other" (see sliceCollapsingThreshold)
... View more
08-14-2014
11:38 AM
1 Karma
Hello,
When I go to services.msc I have splunkd set up to restart as a user with a u/n and p/w. However, it does not automatically start when the server restarts. This is happening on several servers, including a search head and forwarders.
Does anybody else have this issue or any ideas on how I can fix it?
Thanks,
Alex
... View more
07-31-2014
10:59 AM
Yes, those are examples of log events.
All of the different devices go to a central server, and the central server goes to a single index in Splunk. I am not able to install a forwarder on the devices themselves.
I think your search will count the number of inactivity_timeouts, but there will be times when the device is not used for an extended period of time and multiple logs like that will be created by the same device, so I'll need to combine them all into one event. Does that make sense?
Thanks!
... View more
07-31-2014
06:30 AM
Correct. I have not yet implemented it, but I believe that is the general gist of how to do it.
... View more
07-31-2014
06:14 AM
Hello,
I am looking to filter my search results by the 'UniqueID' field so that I only get results from the devices that I want to monitor.
I believe there are two ways to do this:
Search like this (make it an event type for easier reading): index=index1 (UniqueId=1 OR UniqueId=2 OR UniqueId=3 OR UniqueId=4)
Create a lookup table and use input lookup.
Does anyone know if there is a 3rd option? Or if one is more efficient than the other?
Thanks!
... View more
07-29-2014
02:57 PM
Hello,
I am monitoring several different devices simultaneously and have several log files in a row that say "action=inactivity_timeout" for each device. The timeout log gets generated every ~80 seconds or so with no activity. I would like to be able to group transactions based on the deviceId and deviceType and group multiple timeout logs together by deviceId and deviceType so I can see how many times the device times out.
For example, this would just be two 'timeout' entries. I have other devices reporting logs too, but I think I can filter them out to get a big picture view:
deviceId=1 deviceType=A action=activity
deviceId=1 deviceType=A action=inactivity_timeout
deviceId=1 deviceType=A action=inactivity_timeout
deviceId=1 deviceType=A action=activity
deviceId=1 deviceType=A action=activity
deviceId=1 deviceType=A action=activity
deviceId=1 deviceType=A action=inactivity_timeout
deviceId=1 deviceType=A action=inactivity_timeout
Thank you!
... View more
05-09-2014
12:59 PM
TIME_FORMAT=%d%B%Y:%H:%M:%S
sorry typo in my answer there, any other ideas?
... View more
05-09-2014
10:57 AM
Thanks of the help, I'm sure that needed to be fixed, however that didn't seem to help. I must still be missing something.
I've got TIME_FORMAT"%d%B%Y:%H:%M:%S
... View more
05-09-2014
10:03 AM
Hi Everyone,
This is probably really simple and I'm just not seeing it, but I'm having trouble pulling a timestamp from my data. Here is an example line of my data:
"123","L123ACM0004","17MAR2014:18:26:50","17MAR2014:18:26:39","17MAR2014:18:26:44","9105791332"
I'd like for the timestamp to be March 17th, 2014, at 18:26:50. I'm able to get the time, but not the date. This files is a .csv file with a header that in the same format of the data (i.e. "columnheader1","columnheader2"
This is my props.conf right now:
FIELD_DELIMITER = ","
HEADER_MODE = firstline
MAX_TIMESTAMP_LOOKAHEAD=40
NO_BINARY_CHECK=1
TIME_FORMAT=%d%B%Y%H:%M:%S
TZ=America/Chicago
CHECK_FOR_HEADER=true
KV_MODE=none
SHOULD_LINEMERGE=false
pulldown_type=true
Thanks!
... View more
05-02-2014
06:10 AM
If I remove the "| fields Description 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 " stanza then it completely then it completely omits the columns for the items that have a count of zero. To me it does make sense that Splunk would give a null value instead of zero because it never actually knew those fields existed.
Thanks for your help!
... View more
05-02-2014
06:04 AM
I think I get what you're doing here, more or less telling Splunk that all of those fields do indeed exist so the fillnull command will work on them. When I tried the exact search you gave me it came back with no results.
I removed the "| chart first(count) over sourcetype limit=0 by crane" stanza and it appears to be close to working. I see three columns "item" "Description" and "count(item)". The Items that have zero errors do indeed show 0 now (instead of just being blank). It would be great if I could somehow get that first column to be the first row.
Thanks for your help!
... View more
05-01-2014
02:29 PM
I got rid of the (item) after count and it did not make a difference.
I tried "| chart count over Description | fields..."
And everything was empty, except for the Description.
... View more
05-01-2014
01:19 PM
Correct, if I add just | fillnull at the end (or anywhere) or | fillnull value=0 it does not change anything.
... View more
05-01-2014
11:13 AM
This will only show values that have counts. Using the fields command we can show the count of other series that may have existed, but how do we fill those null values with 0 if they have no events? The fillnull command does not seem to work in that case.
... View more
05-01-2014
10:54 AM
I tried using the fillnull command but it does not seem to work, no matter where I put it in the search.
... View more
05-01-2014
10:47 AM
Hi Everyone,
I have a search that creates a chart that shows the counts of different errors for each item, but if there are no errors at all for a particular item it does not show "0" but rather just a blank cell.
I have a list of items that all have different errors associated with them. Sometimes the same item can have multiple errors, and the same error can be true on multiple items.
Item "Description"
1 "off"
1 "off"
1 "on"
2 "off"
2 "fail"
4 "fail"
I would like the chart to show the errors on the left side of the page, and the item numbers on the top of the page. However, if there are no errors for an item it does not say there are 0 errors, but rather leaves the column empty.
My current search looks similar to this:
<index,source,sourcetype,etc.> | chart count(item) over Description limit=0 by item | fields Description 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
Please see this image to better understand what I'm talking about. I'd like items numbered "6","7", and "9" to show all zeros.
Here's a link to the picture: http://s30.postimg.org/cj9v49h3l/splunknulltozero.png
Thank you!
... View more
04-23-2014
04:55 AM
Same thing happened to me after I changed the settings for the user role. I was logged in as admin.
... View more
03-19-2014
07:55 AM
well it's in the savedsearches.conf in the app folder, is that what you mean?
... View more
03-19-2014
07:03 AM
Hello,
I am running Splunk version 5.0.3, build 163460 on Ubuntu 12.04.2.
I do not see any dependency of the script itself. It works fine when I put it in $SPLUNK_HOME/etc/my_app_name/bin/scripts
I don't understand this, did you mean to say "script" instead of "search"?
"And Make sure the search also moved to the respective app. e.g. if you have your search is placed in search app it will be able to find it in global bin/script directory but it won't look into your_app directory."
Thanks for your help!
... View more
03-19-2014
06:08 AM
Hello,
I am currently able to successfully have a script execute after a search when located in $SPLUNK_HOME/bin/scripts. However, I would like to have my scripts be separated by apps. I have the script located now in $SPLUNK_HOME/etc/my_app_name/bin/scripts, but it doesn't work.
I've also put it in $SPLUNK_HOME/etc/apps/my_app_name/bin/scripts and have not succeeded.
Does anyone know how to get a script to work just in the context of an app?
Thanks!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
