Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jrich523
jrich523
Path Finder
Member since:
04-12-2010
06-05-2020
Community Statistics
| Posts | 27 |
| Solutions | 2 |
| Karma Given | 6 |
| Karma Received | 8 |
| Member Since | 04-12-2010 |
Activity Feed
- Karma Re: relating fields with eval for martin_mueller. 06-05-2020 12:48 AM
- Karma Re: Test Email in Splunk for petercow. 06-05-2020 12:46 AM
- Karma Re: Color in a table based on values for LukeMurphey. 06-05-2020 12:46 AM
- Karma Re: Move index and resize for lguinn2. 06-05-2020 12:46 AM
- Got Karma for Re: BucketMover moving to cold on UNC. 06-05-2020 12:46 AM
- Got Karma for Re: How do I list all sources on a specific host?. 06-05-2020 12:46 AM
- Karma Re: How to create stacked bar chart for http/https? for gkanapathy. 06-05-2020 12:45 AM
- Karma Re: application icon for callan_splunk. 06-05-2020 12:45 AM
- Got Karma for Monitor problem?. 06-05-2020 12:45 AM
- Got Karma for display average hits per minute for each hour for a time range. 06-05-2020 12:45 AM
- Got Karma for display average hits per minute for each hour for a time range. 06-05-2020 12:45 AM
- Got Karma for display average hits per minute for each hour for a time range. 06-05-2020 12:45 AM
- Got Karma for How to create stacked bar chart for http/https?. 06-05-2020 12:45 AM
- Got Karma for how do i remove the saved search warning when i switch to free?. 06-05-2020 12:45 AM
- Posted Re: How to chart with multiple hour fields from 0h to 24h? on Splunk Search. 06-24-2016 02:18 PM
- Posted Re: How to chart with multiple hour fields from 0h to 24h? on Splunk Search. 06-24-2016 10:42 AM
- Posted How to chart with multiple hour fields from 0h to 24h? on Splunk Search. 06-24-2016 09:45 AM
- Tagged How to chart with multiple hour fields from 0h to 24h? on Splunk Search. 06-24-2016 09:45 AM
- Tagged How to chart with multiple hour fields from 0h to 24h? on Splunk Search. 06-24-2016 09:45 AM
- Posted How to normalize events with multiple keys? on Splunk Search. 06-18-2016 10:55 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
06-24-2016
02:18 PM
Its still a little weird (seems like there is duplicate data perhaps?) but i was able to get that working. thanks! I'll have to go read up on untable, it seems to be the real magic here
... View more
06-24-2016
10:42 AM
I'm not sure I follow, where you have the YourHourFieldHere, that's one field, I have 24 fields related to time, h0, h1,h2 all the way to h24
... View more
06-24-2016
09:45 AM
I have some performance data that is for the most part, fairly standard, such as SystemName, Metric (cpu, memory, whatever), counter type (percent, kbs, the unit basically), and then I have field 0h to 24h, which is the value on the hour.
I'd like to show, for example, the memory percent as a line chart, but I'm unsure how to tell Splunk to pull the data from the hour fields.
Sample Data:
Workload Name, Counter Name, Counter Metric,Rollup Type, 0h, 1h, 2h, 3h
SYSTEM1234, Read workload metric, number, max, 77, 141, 254, 190
this only shows hours 0 to 3, there are 24 of those fields.
So what i'd like to see is a line chart, where the X axis has the 0h, 1h, 2h all the way to 24h and the Y is retaliative to the values (in this case, 77-254)
Thanks
... View more
06-18-2016
10:55 AM
I have a couple of fields, Node and NodeID, which will both have a number. Then I have NodeName which is of the format "Node001", so to make sure they all have a NodeName, I did this
eval NodeName="Node".substr("000".NodeId,-3) | eval NodeName = "Node".substr("000".Node,-3)
However, this seems rather wasteful. How would I combine this into one statement? It's unlikely an event will have both Node and NodeID, but I'd have to dig through the data more
... View more
06-12-2016
11:46 AM
I have two fields (different sourcetypes) that have a Node ( for example: node001) and NodeID (example: 1)
How would i extract Node to NodeID dealing with the leading zeros?
... View more
11-11-2014
09:04 PM
For now you can override it with custom css.
For the django templates you typically will use the divs for layouts so if you slap an ID on the panel you can access the msg like so
.msg {
visibility: hidden;
}
#errordetails .msg:after {
content: '<< Please select an error type on the left...';
visibility: visible;
position: relative;
padding: 20px;
}
I havent figured out how to position the new text correctly yet but that should send you in the right direction
... View more
11-20-2013
03:13 PM
Sorry, should have mentioned that in the post, its version 6. I'll look at the hiddensavedsearches though
... View more
11-20-2013
01:25 PM
I want to mix live data and reports. So for the timeconf id want something like
15 min (live)
60 min (live)
4 hour (live)
yesterday (report)
this week (report)
so i'd be trying to have one view (dashboard) that showed either live OR report data, depending on the selection in the drop down. basically i dont want to have to create the dashboard twice when it will be the same layout, just different source
... View more
11-20-2013
01:15 PM
So, i cant really mix it on a single view? I have to create a nav menu that has live data (15min-4hour) and a report view?
... View more
11-20-2013
12:52 PM
1 Karma
host="abc" | dedup source | table field source
... View more
11-20-2013
12:33 PM
So it looks like i can use that to control the time ranges, but how about reports?
... View more
11-20-2013
12:16 PM
Im doing a fairly simple search template that just isnt working. It seems to be limited at 1000 events? (cant find any docs that would suggest this) and only 1 of the 3 charts even attempts to use the template at all.
It looks like the first timechart count works ok (only populates 1000) and the following timecharts (that have a "by") are getting all nulls.
so two questions, is there a limit and if so do i have any control over it?
why are charts 2 and 3 getting all empty entries?
<form>
<label>General Usage Stats</label>
<description/>
<searchTemplate>sourcetype="f5:irule:webaccess" | rex field=url "(?<base>[^?]+)\?(?<querystring>.*)" | eval kb=(response_data_size/1024)</searchTemplate>
<fieldset autoRun="true" submitButton="false">
<input type="time" searchWhenChanged="true">
<default>
<earliestTime>-15m</earliestTime>
<latestTime>now</latestTime>
</default>
</input>
</fieldset>
<row>
<chart>
<title>Total Hits</title>
<searchPostProcess>timechart count</searchPostProcess>
<option name="charting.chart">line</option>
</chart>
<chart>
<title>Hits by URL</title>
<searchPostProcess>timechart count by base limit=5 useother=f usenull=f</searchPostProcess>
<option name="charting.chart">line</option>
<option name="count">10</option>
</chart>
<chart>
<title>Hits by Server</title>
<searchPostProcess>timechart count by server_name limit=5 useother=f usenull=f</searchPostProcess>
<option name="charting.chart">line</option>
</chart>
</row>
</form>
... View more
11-20-2013
11:42 AM
I have a simple dashboard that currently uses the FieldSet with an Input of Time, which gives the normal time selection.
Is it possible to define the options there (I dont want users being able to do anything more than 4 hours)
I'd also like to be able to grab reports so they could pick from
15 min
60 min
4 hours
Yesterday (populated via a report that runs nightly)
This Week (report based as well)
Is this possible or would i have to do two different dashboards?
... View more
11-15-2013
02:00 PM
1 Karma
one part I left out, that was important to solving this was that i had moved the Warm files previously and it had screwed up the permissions so the problem was i didnt have access to move the local files. reset permissions and things started to move.
... View more
11-15-2013
01:48 PM
I get the following error:
ERROR BucketMover - aborting move because recursive copy from src='C:\Program Files\Splunk\var\lib\splunk\f5test\warmdb\db_1380909713_1380904989_18' to dst='\10.20.120.120\Splunk\Node01\F5test\inflight-db_1380909713_1380904989_18' failed (reason='The operation completed successfully.')
I is indication successful but i check the folder and there is nothing there.
I logged in to the server (windows 2012 R2) as the service account that runs splunkd and checked to make sure access was ok and im able to create/read/write ok. Also it created the F5Test folder when i added the cold path to the index so its not an access issue.
I ran procmon to see if it showed anything and I can see it trying to access the path
1:42:54.2746637 PM splunkd.exe 1684 CreateFile \10.20.120.120\splunk\Node01\F5test\inflight-db_1380909713_1380904989_18 NAME NOT FOUND Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
So that seems normal, based on the fact that the file isnt there and it should be the Copy (CreateFile is used for a lot of things)
Is there something else i can do to look at why this might not be working?
thanks
... View more
11-15-2013
11:39 AM
I saw a decent amount of questions about similar stuff, but i wasnt able to make it happen.
I have a field that is http-status and i want the percent of http-status > 499 of total
... View more
11-14-2013
10:45 AM
Thanks Iguinn,
that worked ok with the exception of the limitation on the size. its currently at 150gb (original moved size) and hasnt gone down at all since i moved it yesterday.
im investigating the splunkd.log now to see if i can pinpoint anything.
... View more
11-13-2013
09:48 AM
I have an Index which is on NAS. Im mostly having connection issues (win 2012R2 and Isilon NAS)
so i was thinking about moving it local, restricting its size and using the NAS as Cold storage however i have a small problem that i dont want to figure out by testing.
The index i'd like to move is currently about 200GB of data, I'd like to limit the warm on the new location (local to the server) to 50gb.
so if i change the config file and move the files, when it starts up will it start to push that extra 150gb of files over ok?
... View more
10-15-2013
01:24 PM
I used the SOS app to find the triggered events that were published in the log and created this search
index=_internal source=*splunkd.log component=timeinvertedIndex
after finding that search i did the drop down in the search results page to convert this to an alert and configured it to email and restart the services via a script.
... View more
10-14-2013
04:51 PM
I start to get these errors in the splunkd.log file, which, as best i can tell is a connectivity issue via TCP/IP.
"Error trying to begin socket accept: An invalid argument was supplied"
This is a windows 2012 box using Isilon as the storage.
getting Isilon to work well with windows 2012 was a bit of a struggle on its own, so I think this has to do more with 2012 and isilon than it does splunk. And its not that the indexer is overwhelmed, its that it cant communicate to the storage, once i restart splunk it processes the indexer queue in a matter of seconds.
... View more
10-14-2013
03:36 PM
I have an issue with the storage i use (NAS) that is dropping its connection (or more so its ability to write) which is resolved with a restart of the splunk service. Is there a way to trigger a restart of the service when the indexer queue gets high?
Splunk 6 on windows 2012.
Thanks
... View more
04-29-2010
06:31 PM
I've disabled the windows app and that seems to have removed the banner. i assume the windows app is now worthless with the free version because i cant run schedules?
... View more
04-29-2010
02:54 PM
I've done that, and all of the scheduled times are set to 'None'. in looking at the config files (multiple savedsearches.conf) i didnt see any times set except for the one related to the Windows app, but im not really sure what to do with it. for example: cron_schedule = 4 */2 * * *
... View more
I get a message that says
Search scheduler is disabled in Splunk's Free version. Scheduled searches that populate the summary index were found, they will not be executed - this might impact load times for dashboards that depend on the summary index. More Info
i click on the more info but it doesnt tell me how to stop it from showing up.
... View more
- Tags:
- savedsearch
04-14-2010
05:56 PM
1 Karma
is it possible to do a stacked bar chart where it splits it in two to show how much is https requests and how much is http requests?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:02 AM
|
Karma from
Karma given to
