About vaijpc

vaijpc · ‎01-16-2012

Thanks @araitz, that explains the behaviour. I do remember that "feature" coming up before and wondering whether it was the correct word between my quotes.. Thanks for the help!

piebob · ‎01-10-2012

additional info here: http://docs.splunk.com/Documentation/Splunk/latest/Installation/RunSplunkasadifferentornon-rootuser

woodcock · ‎05-29-2015

Run it at midnight for the last 36 hours and do this: ... earliest = -36h@h latest -12h@h | timechart span=1h min(foo)

gkanapathy · ‎07-21-2011

... | streamstats window=2 current=t first(randomletter) as newletter last(randomletter) as prevletter | where newletter!=prevletter | streamstats window=2 current=t first(_time) as changedtime | eval duration=changedtime-_time | table _time,newletter,duration I may have the duration offset by one, depending if you mean the duration the of the current letter, or the duration until the current letter changed.

vaijpc · ‎04-26-2011

I guess a scheduled search and splunk/bin/fill_summary_index.py could get the job done... not exactly the cleanest solution.

sideview · ‎03-08-2011

Sure, it's easy. Just send an email to support@splunk.com and they'll file it for you. splunk support is awesome. Say hi from nick. 😃

vaijpc · ‎02-03-2011

You may be interested to know that it works in the same way on Windows. Start a path with '\' on windows, or '/' on linux and it will think you want to start at the 'root' of the drive'. I'm afraid it was only doing what you told it to do 🙂

vaijpc · ‎02-03-2011

That doesn't work, all values in my table become '0'. Though yes, I only get "host", "success" and "queued" columns.

vaijpc · ‎02-03-2011

Try installing from inside your splunk manager. Manager > Apps > Browse Splunkbase for more apps. Then find it in the list. (break it up by apps, addons, suites on the left) When you find it, hit 'Install' and everything should be taken care of automagically.

vaijpc · ‎01-25-2011

A quick google pointed me to http://answers.splunk.com/questions/1391/error-while-modifying-splunk-for-bluecoat-dashboard-search where someone claims the 'workaround' fixed their issue.

vaijpc · ‎01-25-2011

Aha thanks for that, could very well be useful. Right now I'm only running through a few Mbs a day (with a backlog) and almost all data has this field from the source. It may be a performance issue in larger deployments but I'm not worried about that currently on my little laptop and regardless, yes that differing syntax isn't nice. I'm going to wander off now and perhaps read up on that whole "search-time" vs "index time" argument... If only I could have my cake and eat i.!

Posts	46
Solutions	4
Karma Given	30
Karma Received	15
Member Since	‎01-24-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

'NOT' not working properly since 4.3

timechart span starting at specified point

Finding length of time that a field remains the sa...

Get a field from same time every day, or closest.

Possible eval min bug?

Summary Indexing (or nice monthly stats from data)

Fields correctly shown in results but not searchab...

Re: 'NOT' not working properly since 4.3

Re: can splunk be installed as non root

Re: timechart span starting at specified point

Re: Finding length of time that a field remains th...

Re: Get a field from same time every day, or close...

Re: Possible eval min bug?

Re: inputs.conf access by root only??!?!

Re: Summary Indexing (or nice monthly stats from d...

Re: Splunk for Bind App

Re: Error updating saved search dhcpd_alert_new_ma...

Re: Fields correctly shown in results but not sear...

Join the Conversation