About narwhal

narwhal · ‎06-14-2017

I need to test a given UF or HWF box for connectivity to several other systems and ports. That is, I have an app that fails if it can't talk to several boxes on several ports so I would like to test for that access every so often. So, I'm looking for a scripted input or modular input that would give me the equivalent of telnetting to a remote port. I found TA-connectivity in SplunkBase, and, while it works for successful connections, it doesn't do very well at outputing useful failure data (DNS resolution failure, connection refused, connection timeout). More precisely, it doesn't output failures at all from what I can create in my lab. I'm trying to avoid creating/recreating the wheel here. Anyone have a port pinger/tester I could hack on? My goal would be a tool like TA-connectivty that took a config file (csv?) and "telnet-like" connected to it to see if the other side was reachable. "timestamp, host=www.foo.com, port=22, status=success, reason=blob_o_text"

narwhal · ‎07-15-2016

I am trying to embed a YouTube (an YouTube?) video iframe in a Splunk dashboard. I either get nasty errors when I save or I get a completely blank view. Any simple examples?

narwhal · ‎08-13-2015

Is this a lookup failure or an automatic lookup issue? That is, does the lookup work manually? ( ... | lookup lookupName lookupKeyValue OUTPUT lookupOutputValue ) ???

narwhal · ‎05-28-2015

Pretty sure you can't use trailing #blah style comments on the REGEX line. Splunk will want THAT to be part of the matching REGEX.

narwhal · ‎03-04-2014

I have taken the preprocessor route on this issue. Again, I have a programmatically created HTML file that has 202 lines html gunk at the top and 17 lines at the bottom. I want to strip that off and have just the "table" html with the "rows" indexed into Splunk. So, I now have an every minute fired off Linux cron task that does a combination of head & tail to clean it up and create a new file, and I monitor that file. My script loops and does this for each file, but the important part is how to use head/tail to accomplish my goal. head -n -17 filename.html | tail -n +202 > filename.html.table Hope that helps someone...

narwhal · ‎03-04-2014

OK, trial and error finally paid off. My input variable is called st, so: validation = st="blah" OR st="blahblah" errormsg = usage: mymacro(st) where st is blah or blahblah

narwhal · ‎03-04-2014

I'm having trouble getting input validation to work on my macro. I want to pass in a text string, not a number, but can't find any examples that appear to work for me. Thoughts?

narwhal · ‎03-03-2014

Thanks Brian! Is "fields | format" more efficient than "table"? I mean, why not just "table delete_id" in the subsearch? btw, I made macros of this, but pondering making an external program that would do it, display an overview of the search, ask for confirmation, then do the delete. Useful?

narwhal · ‎02-25-2014

I'm trying to monitor a html table in an html file that is updated regularly. My gotcha is that there are about 15 lines at the bottom of the HTML that finish up the page. I already know how to use props/transforms to only keep the entries that I want, but I'm worried that Splunk will see the file get bigger but really only eat the footer again and again. Is there some way that (without a preprocessor--which isn't out of the question) that I can get Splunk to not only see that there is more data in the file, but to eat the new entries not just the same footer over and over as it gets pushed deeper into the file?

narwhal · ‎02-22-2014

Yeah, thanks Gerald. I figured that out about 15 minutes after my caffeine starved brain woke up.

narwhal · ‎02-22-2014

OK, probably a dumb question--but I can't get it output the way I want. I have a series of values that rise up through the course of a day. I really only want the highest value during each day so that I can chart that over time. (Yes, it's for my fitbit.) I thought I could do "... | chart max(blah) by date_day", but that didn't return any results. Am I missing something?

narwhal · ‎02-13-2014

I got this sorted out with Nick. Turns out he needed two things. props.conf on the indexers, not the LWF/UF's props.conf contents of BREAK_ ONLY_BEFORE _DATE = true TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N TIME_PREFIX = ^ (NOTE THE COMMA, NOT A PERIOD in the TIME_FORMAT --the "unwanted" timestamps have periods before the %3N's)

narwhal · ‎08-23-2013

It appears from my testing that there is a line length limitation in the "FIELDS =" definition. So, I am now extracting them as short names ("F001","F002",etc) and then doing FIELDALIAS'es on them to have longer names. Now all fields (including the CSV embedded inside another field in quotes) are properly extracted. I then am sub-extracting the embedded field with another stanza. To be more precise: props.conf: [myBigCSV] REPORT-foo = BigCSV, SubCSV transforms.conf [BigCSV] DELIMS = "," FIELDS = "F001","F002","F003" FIELDALIAS-F001 = F001 AS MyFirstBigFieldName [SubCSV] SOURCE_KEY = F003 DELIMS = "," FIELDS = "F003a","F003b","F003c" FIELDALIAS-F003c = F003c AS MyThirdSubField A very elegant and easy to maintain config. -tv

narwhal · ‎08-16-2013

I have a large CSV data file (CDR) that has some 300 fields. Looks something like: value1,value2,value3,...,value51,"subvalue52.1,subvalue52.2.,...subvalue51.20",value53,...,value300 The gotcha is field52. field51 is properly extracted, but field52 isn't. I'm not worried yet about the subextraction--right now, I just want field52 to be the whole thing inside the quotes. from transforms.conf: [my-report-stanza-name] DELIMS = "," FIELDS = f1,f2,f3,...,f300 (where f1-300 are LONG NAMES) Is it because my f1-f300 are LONG? Do I have the syntax for DELIMS wrong? (like, is that saying the delim char can be any of " OR , OR ' ?) Once I do get this right, what's the best way to subextract f52? adTHANKSvance gang! -tv

narwhal · ‎04-12-2013

I guess I'm missing something too--but wouldn't the useful output be more like: ... | stats count by User,Time,IP,Location | ... ??? -tv

narwhal · ‎09-07-2012

If that answered your question, be sure to accept the best response so others see it and know it worked for you 🙂

narwhal · ‎09-07-2012

Right, so something kind of like this I think: MUST_BREAK_AFTER = (SignaturePolicy:\sBINDING_DEFAULT$)|(SignatureStatus:\sBINDING_DEFAULT$)|(EXCEPTION)

narwhal · ‎09-06-2012

ah, yes, latest is assumed to be NOW, so you need to fix that. for last month, try: "earliest=1mon@mon latest=0mon@mon"

narwhal · ‎09-06-2012

for THIS month, try this: source="/flocal/logs/tomcat-6.0.18/lawyers/search-mapping.log" searchTerm PAMapped earliest=-0mon@mon | eval Legal_Issue=urldecode(searchTerm) | eval Practice_Area=if(isnull(PAMapped),"Not Mapped",urldecode(PAMapped)) | search Legal_Issue="Securities Law" for LAST month, try this: source="/flocal/logs/tomcat-6.0.18/lawyers/search-mapping.log" searchTerm PAMapped earliest=-1mon@mon latest=-0mon@mon | eval Legal_Issue=urldecode(searchTerm) | eval Practice_Area=if(isnull(PAMapped),"Not Mapped",urldecode(PAMapped)) | search Legal_Issue="Securities Law"

narwhal · ‎09-06-2012

Shouldn't your -30d@mon be: earliest=-0mon@mon ??? (for THIS month -- ie, since Sept 1) Or earliest=-1mon@mon for LAST month (ie, Aug 1 to Aug 31) Or am I missing your goal? oh, related point-- why not put the "earliest=..." in the first search not the last one?

Posts	20
Solutions	5
Karma Given	7
Karma Received	9
Member Since	‎12-17-2010

Online Status	Offline
Date Last Visited	‎09-30-2025 07:23 AM

Looking for a TCP port connectivity tester

embedding a youtube video in a splunk dashboard

macro input validation

Monitor:// for a file that has a FOOTER

How to chart max per day

DELIMS/FIELDS with a field that has sub fields?

Looking for a TCP port connectivity tester

embedding a youtube video in a splunk dashboard

Re: After defining an automatic lookup in Splunk W...

Re: How to edit my regex in transforms.conf to fil...

Re: Monitor:// for a file that has a FOOTER

Re: macro input validation

macro input validation

Re: How to delete duplicate events?

Monitor:// for a file that has a FOOTER

Re: How to chart max per day

How to chart max per day

Re: XML Logfile not breaking correctly

Re: DELIMS/FIELDS with a field that has sub fields...

DELIMS/FIELDS with a field that has sub fields?

Re: Grouping results by count

Re: How to include "month to date" timeline in the...

Re: MUST_BREAK_AFTER -How to give for multiple val...

Re: How to include "month to date" timeline in the...

Re: How to include "month to date" timeline in the...

Re: How to include "month to date" timeline in the...

Join the Conversation