About mwdbhyat

mwdbhyat · ‎11-11-2016

Sure did.. I edited the xml to look like this: Security Continuous Monitoring - High Level Metrics <input type="link" token="unused" id="resized_input" searchWhenChanged="true"> "form stylesheet" references the application.css which has this at the bottom of it: #resized_input { width: 250px; } That should do the trick..

mwdbhyat · ‎10-27-2016

Hi, I am receiving the above error ERROR S2SFileReceiver - event=statSize replicationType=eJournalReplication...status=failed Running in a clustered environment. There are always only 5 events, once a day at different times. The error is identical to this: ERROR S2SFileReceiver - event=statSize replicationType=eJournalReplication bid=test~26~89C0FF94-5EB0-410A-9B4D-0E17DBD7FB78 path=/opt/splunk/var/lib/splunk/test/db/26_89C0FF94-5EB0-410A-9B4D-0E17DBD7FB78/rawdata/journal.gz status=failed Any thoughts? Thanks

mwdbhyat · ‎10-27-2016

Did you ever figure out what this was ?

mwdbhyat · ‎09-08-2016

Thanks - I should probably have mentioned that I need this information to display in the table on the dashboard where my search results currently get displayed.. So im guessing ill just set up a saved search to output the file to csv and update it daily, then on the dashboard use an inputlookup search to display the results.. My next task is to the somehow create a way to manually edit the lookup on the dashboard when required..I know there is a lookup app, any thoughts on how I could integrate this into my dashboard within my app?

mwdbhyat · ‎09-08-2016

Hi, I am currently running a search in a custom app that finds sourcetypes by number of hosts: - | tstats dc(host) as "Number of Hosts" where index=test* by sourcetype Id like to know how to: - Convert the results to a lookup table - Edit the lookup table when required in the UI - Would I be able to use the lookup app within my custom app? Thanks!

mwdbhyat · ‎09-07-2016

Figured it out with the CLI.. did a oneshot monitor. http://docs.splunk.com/Documentation/Splunk/6.4.2/Data/MonitorfilesanddirectoriesusingtheCLI

mwdbhyat · ‎09-07-2016

Thanks - Is there a way around this without using the Web, not splitting the file ?

mwdbhyat · ‎09-07-2016

Hi, How does one upload files larger than 500mb? I get an error "File too large. The file selected is 996Mb. Maximum file size is 500Mb" Is this due to using the trial ? Thanks

mwdbhyat · ‎09-05-2016

Hi there, How would I set up a table to find out which forwarders have not phoned home in the last day ? I am currently using this REST search for other related activity: -index=_internal group=tcpin_connections | join hostname [| rest /services/deployment/server/clients splunk_server=* | eval lastPhoneHome=tostring(now()-lastPhoneHomeTime,"duration") Thanks!

mwdbhyat · ‎09-01-2016

Hi, Is it possible to use a backfill script without the need of pointing to an app name? EG - ./splunk cmd python fill_summary_index.py -app APPNAME -name SEARCHNAME I want to backfill searches in various apps and not have to point to specific app name. Thanks

mwdbhyat · ‎08-30-2016

Thanks for the reply.. Its not the summary indexing I am unsure about, more the searches.. I suspect using the rest command will create invalid results if it is populating a summary index every 10m, and then I report on that with a stats sum or count..it will just add. Basically what im trying to achieve is the results I get from the above REST searches to be displayed in the dashboard exactly the same way, however, they must be stored in a summary index for access control. The above searches display index size and number of agents deployed.

mwdbhyat · ‎08-30-2016

Hi, I am currently using these 2 REST searches to populate a a dashboard. | REST /services/data/indexes | search title=test* | stats sum(currentDBSizeMB) as currentSize | eval currentSize=currentSize/1024 | rest /services/deployment/server/clients splunk_server=SGB*APSDS1001 | where (now()-lastPhoneHomeTime)<(24*60*60) | stats count I would like to use a summary index for this. Could anyone advise on how to change my searches to use summary indexing and get the same results? Thanks!

mwdbhyat · ‎08-19-2016

Cool, thanks!

mwdbhyat · ‎08-19-2016

How would I pass the admin username in just once with creds as it is asking me for each search to type in the username and pass?

mwdbhyat · ‎08-19-2016

Awesome, thank you!

mwdbhyat · ‎08-19-2016

Sweet, thanks a lot!

mwdbhyat · ‎08-19-2016

Hi Raghav, Thanks for the reply.. It is for 1 app yes. Basically I have created a txt file with all 60 searches listed with the ./backfill command as above. Initially just to add in previous 12w worth of data I just want it to do the automated backfill once. So if I just run my txt file with 60 searches listed, will it just do them 1 at a time until the whole list is done ?

mwdbhyat · ‎08-19-2016

Thanks - noob question but could you give me an example of how this would work? starting script code ? ./splunk cmd python fill_summary_index.py -app APPNAME -name SEARCHNAME -et -12w@w -lt now -dedup true exit script code ?

mwdbhyat · ‎08-19-2016

Hi, I need to automate the backfill script for about 60 searches.. Is there a way to put all 60 searches in a single script and then make them run one by one(wait until previous one is done before continuing to next) Thanks

mwdbhyat · ‎08-16-2016

I found out the issue - I was just being an idiot and wrote my si command differently to the actual timechart. Thanks anyway!

mwdbhyat · ‎08-16-2016

Hi, I need a top count of the total number of events by sourcetype to be written in tstats(or something as fast) with timechart put into a summary index, and then report on that SI. Using sitimechart changes the columns of my inital tstats command, so I end up having no count to report on. Any thoughts? My initial search before the sitimechart is: | tstats count where index=main* groupby sourcetype _time Thanks

mwdbhyat · ‎08-11-2016

Awesome, thanks for the help!

mwdbhyat · ‎08-11-2016

Thanks for this! Could you please explain what the -et -1t mean ?

mwdbhyat · ‎08-11-2016

Hi there, Can someone help me create my backfill script? I am creating a new summary index that runs every 10min with a time range of -15m@m to -5m@m, however when I first start using this I would like the previous 12weeks worth of data to be in it as well.. Could anyone help with scripting this (noob). Does this script have to be run by an admin from the cli? Thanks

mwdbhyat · ‎08-08-2016

Cool thanks for the help.. Is there any reason why you shouldnt have eval in the summary index populating search?

Posts	188
Solutions	13
Karma Given	4
Karma Received	27
Member Since	‎07-20-2016

Online Status	Offline
Date Last Visited	‎09-18-2024 01:46 PM

Data Age Search

Sourcetype by Forwarder GUID

Search Sourcetype by Port ingested

Deployment Server over old config management

Deployment server app behaviour

Stop all-time searches from running

AWS deployment requirements

Uf + HF on on server

Search to find the total number of ALL searches ac...

monitor Splunk internal logs with Cloudwatch from ...

Re: Link Switcher Width

Why am I receiving "ERROR S2SFileReceiver - event=...

Re: Why am I getting "ERROR S2SFileReceiver - even...

Re: Search results to lookup table

Search results to lookup table

Re: Upload large file

Re: Upload large file

Upload large file

Forwarder Phone Home last day

Backfill without app name

Re: REST summary index

REST summary index

Re: Automate backfill script

Re: Automate backfill script

Re: Automate backfill script

Re: Automate backfill script

Re: Automate backfill script

Re: Automate backfill script

Automate backfill script

Re: How to search total events by sourcetype using...

How to search total events by sourcetype using tst...

Re: Help creating backfill script

Re: Help creating backfill script

Help creating backfill script

Re: Summary Indexing for dashboard

Join the Conversation