About jfraiberg

jfraiberg · ‎10-14-2017

or you can keep it as column, but go to "overlay" and chose one of the values..

jfraiberg · ‎10-14-2017

hmm, that should give you 2 columns, one called mb_private_bytes and one called mb_working_set_peak with chrome as the instance. Is that not what you are seeing? What happens if you change the chart format to "multi series mode"?

jfraiberg · ‎10-13-2017

I am sorry, I totally misunderstood. Try this: source="perfmon:test" counter="Private Bytes" NOT _total instance=chrome | eval MB_Used=Value/1024/1024 | timechart sum(MB_Used) AS mb_private_bytes by instance useother=f | appendcols [search counter="Working Set Peak" NOT _total instance=chrome | eval MB_Used=Value/1024/1024 | timechart span=1m avg(MB_Used) AS mb_working_set_peak useother=f by instance]

jfraiberg · ‎10-13-2017

no, you are only renaming the name of the field, not the values.

jfraiberg · ‎10-13-2017

In simplexml you can add an html panel at the top and add what you want there - <row> <panel> <html> <div> your stuff goes here </div> </html> </panel> </row> Instead of trying to make it persistent across every dashboard, you can just add it to every dashboard 🙂

jfraiberg · ‎10-13-2017

for starters you can just use one lookup table that has both prod and non-prod hosts, just have an "environment" field in it that says prod or nonprod. whether this is the best way depends on how many hosts you have in your lookup table and how often that changes. If it is a significant amount of hosts (tens of thousands'ish) and they update frequently you may want to move to a KVSTORE. other than that you could also create a new index extracted field that add that metadata to the events at index time with prod or nonprod. From there you could just do "index=perfmon env::prod....."

jfraiberg · ‎10-13-2017

any chance you can adjust the logs to also add the name of the actual interface as a field? You could then try "| transaction hostname interface startswith..."

jfraiberg · ‎10-13-2017

add this to the end of your 2nd search - "| rename instance AS instance2"

jfraiberg · ‎10-13-2017

This really depends on how you are using ldap and sudo in your environment. Do the usernames match between the 2 log sources? If they do you should be able to easily correlate the 2. If they are not the same you could create a mapping between the 2 and use a lookup table or kvstore to facilitate the correlation.

jfraiberg · ‎10-10-2017

Have you tried just downloading the app and extracting it to the $SPLUNKHOME$\etc\apps directory manually and restarting?

jfraiberg · ‎10-10-2017

Can you run the ps -ef command without the awk and kill command and list the output for us?

jfraiberg · ‎03-17-2017

I have the following metrics: date:01 yada yada yada total 80 date:02 yada yada yada total 120 date:03 yada yada yada total 50 date:04 yada yada yada total 110 date:05 yada yada yada total 40 I need a timechart that will take the remainder of the total (anything over 100) and add it to the total of the previous minute. e.g. should end up looking like so: date:01 yada yada yada total 100 date:02 yada yada yada total 100 date:03 yada yada yada total 60 date:04 yada yada yada total 100 date:05 yada yada yada total 40

jfraiberg · ‎03-04-2014

That all made sense and it is exactly the answer I was looking for! Thank you very much for the help and the awesome app!

jfraiberg · ‎03-04-2014

Some go to views, and some go to an external URL. The table in the end will be a merging of 2 tables, some of the rows will redirect to a Splunk view, and other ones may redirect to a 3rd party dashboard. It is a table that will reside on the first page of a dashboard and the rows will change colors depending on availability/response, etc. but the data comes from Splunk AND non Splunk sources such as custom monitoring application logs. It is possible that I am making things more complicated doing it this way (using a dynamic table as a referrer) but its what came to my head at the time.

jfraiberg · ‎03-04-2014

Thanks for the interest! I have updated my original question with the relevant code I used.

Posts	45
Solutions	6
Karma Given	5
Karma Received	19
Member Since	‎04-13-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

How to create a timechart that takes the remainder...

Static redirects per table row sideview utils

macros in Cisco ASA app don't seem to exist?

Changing drilldown default time from "All time"

splunk-optimize in multi-instance enviroments

forwarding syslog data via UDP to 3rd party server...

dashboards doing parallel searches

monitor that proper amount of events are coming in...

sending AIX audit log stream to splunk

Error on dashboard - splunk agent monitoring app

Re: How can I fix my double timechart graphs?

Re: How can I fix my double timechart graphs?

Re: How can I fix my double timechart graphs?

Re: How can I fix my double timechart graphs?

Re: How to add another app-bar, right below App's ...

Re: Using lookup tables to create separate alerts ...

Re: How to use streamstats to calculate device ava...

Re: How can I fix my double timechart graphs?

Re: Are there related fields between sudo log and ...

Re: Box Plot Viz

Re: Splunk uninstallation / kill command failed --...

How to create a timechart that takes the remainder...

Re: Static redirects per table row sideview utils

Re: Static redirects per table row sideview utils

Re: Static redirects per table row sideview utils