Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About chaoservices
chaoservices
Explorer
Member since:
09-20-2016
06-05-2020
Community Statistics
| Posts | 11 |
| Solutions | 2 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 09-20-2016 |
Activity Feed
- Karma Are there any new app updates on Splunk App for Web Analytics? for sbrice18. 06-05-2020 12:49 AM
- Posted Full results not being returned from Web dataset on All Apps and Add-ons. 10-24-2018 12:18 PM
- Tagged Full results not being returned from Web dataset on All Apps and Add-ons. 10-24-2018 12:18 PM
- Tagged Full results not being returned from Web dataset on All Apps and Add-ons. 10-24-2018 12:18 PM
- Tagged Full results not being returned from Web dataset on All Apps and Add-ons. 10-24-2018 12:18 PM
- Tagged Full results not being returned from Web dataset on All Apps and Add-ons. 10-24-2018 12:18 PM
- Posted Re: Why am I getting an error on dashboards when ingesting data in Splunk App for Web Analytics? on All Apps and Add-ons. 06-05-2018 01:50 PM
- Posted Re: Why am I getting an error on dashboards when ingesting data in Splunk App for Web Analytics? on All Apps and Add-ons. 06-04-2018 02:37 PM
- Posted Why am I getting an error on dashboards when ingesting data in Splunk App for Web Analytics? on All Apps and Add-ons. 06-03-2018 02:40 PM
- Tagged Why am I getting an error on dashboards when ingesting data in Splunk App for Web Analytics? on All Apps and Add-ons. 06-03-2018 02:40 PM
- Tagged Why am I getting an error on dashboards when ingesting data in Splunk App for Web Analytics? on All Apps and Add-ons. 06-03-2018 02:40 PM
- Tagged Why am I getting an error on dashboards when ingesting data in Splunk App for Web Analytics? on All Apps and Add-ons. 06-03-2018 02:40 PM
- Tagged Why am I getting an error on dashboards when ingesting data in Splunk App for Web Analytics? on All Apps and Add-ons. 06-03-2018 02:40 PM
- Tagged Why am I getting an error on dashboards when ingesting data in Splunk App for Web Analytics? on All Apps and Add-ons. 06-03-2018 02:40 PM
- Posted Re: SonicWall Analytics: Why is the size of this lookup so huge? on All Apps and Add-ons. 12-14-2017 04:53 PM
- Posted Re: SonicWall Analytics: Why is the size of this lookup so huge? on All Apps and Add-ons. 12-14-2017 04:53 PM
- Posted How compare variable URLs in a log against a lookup table of significant, matching substrings? on Splunk Search. 04-12-2017 04:11 PM
- Tagged How compare variable URLs in a log against a lookup table of significant, matching substrings? on Splunk Search. 04-12-2017 04:11 PM
- Tagged How compare variable URLs in a log against a lookup table of significant, matching substrings? on Splunk Search. 04-12-2017 04:11 PM
- Tagged How compare variable URLs in a log against a lookup table of significant, matching substrings? on Splunk Search. 04-12-2017 04:11 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-24-2018
12:18 PM
Trying to determine where people spend their time in the Behavior Overview Dashboard I noticed that the results of Page seemed low for the Time Period. Looking at the query it seems that only 24 hours of results show-up and I do not understand why
As far as the web Data Model goes, the events are in there but they are not getting used somehow.
... View more
06-05-2018
01:50 PM
That did it! Thanks.
I'm not clear what that function is supposed to do...
... View more
06-04-2018
02:37 PM
Good points. I noticed that the Splunk CIM also had a DM Web and when I disabled that App the Data Model Acceleration check table became clearer (Acceleration, 1, Status, 100%, Events, 0). So I ran the lookups again and rebuilt the DM Web but no dice.
tag=web is returning results with clean and discrete fields ( file looks like a list of files 🙂 and the DM seems to contain data (it has size and buckets) but I still get the error: Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info.
Perhaps something is wrong with the Knowledge Objects getting distributed to the indexers?
... View more
06-03-2018
02:40 PM
Hi all,
I've got data ingesting from a couple of servers, and setup went okay with the real-time returning results but something seems to be wrong with my data model acceleration since no other dashboard has content.
The "Data Model Acceleration check" returns returns red exclamations despite saying it is 100% and the Data Model Audit is equally affirming.
Nothing is jumping out at me from the Search job inspector, so what could be going wrong here and how to I get the remaining features working?
... View more
12-14-2017
04:53 PM
Yeah, this is a problem I've been putting off addressing until today.
I had setup a cronjob to delete the file everyday lest it grow to big and causes the distributed bundle replication manager to start choking.
Are we the only two people using dsa? I don't see how this app is workable with this csv file.
*sorry I "answered" but should have commented.
... View more
12-14-2017
04:53 PM
Yeah, this is a problem I've been putting off investigating until today. Are we the only two people using dsa?
I just setup a cronjob to delete the file everyday lest it grow to big and cause the distributed bundle replication manager to start choking.
... View more
04-12-2017
04:11 PM
I have large variable URLs being logged that may include a unique substring somewhere within that is significant. How do I compare that URL against a lookup table of significant substrings?
For example some URL fields:
http://go.ABC123.com:80/ps/i.do?ty=bs&v=2.1&u=foo&it=search&p=GPS&dblist=&qt=OQE~foo2&sw=w&st=T003&authCount=1
http://go.ABC123.com:80/ps/i.do?v=2.1&u=foo&pg=BasicSearch&it=static&sw=w&p=GPS
http://auth.123XYZ.com:80/cgi-bin/go_up_login?formu=cblez&formp=cblez&link=bkflix.ABC123XYZcompany.com
https://google.com:443/
Match against two significant lookups, (keyword, Database):
"p=GPS" as "Database A"
auth.123XYZ as "Database B"
Any thoughts?
... View more
03-14-2017
11:07 PM
I'd just started down the soup path but not much luck with the sub-search and the fillnull value didn't get me there either.
I had to get myself doughnuts when I figured out what did work:
| eval mac3=if(isnull(mac),macAddress,mac)
now I have a col of macs that I could stats and eval to my hearts content
... View more
03-13-2017
04:08 PM
I've also tried thinking this through crafting 1 search that has all the fields but not getting anywhere fast. Obv I have a list of all the significant log files and fields but I'm not able to take that next step.
... View more
03-13-2017
03:56 PM
I think this is simple and I think I see similar questions, but I've failed to implement them for my case and any help is gratefully received.
I have 2 searches that end in two tables with variable numbers of rows.
1)
table, mac, stat1, stat2, stat3, stat4
2)
table, macAddress, hostname
Every mac can be found in a row of macAddress. So I want:
*)
table, hostname, stat1, stat2, stat3, stat4
But I can't work out how. Lookups seem to static, subsearchs seem to only pass information in 1 direction I can append searches but that is just a mess. I haven't had much luck parsing other questions for useful answers. Any inspirations?
... View more
