About rgcurry

rgcurry · ‎01-20-2015

This is long overdue -- my apologies for not posting this well over a year ago. The cause of this problem was a matter of placement. We use Search Head Pooling but we use a script to rsync our search heads pooling area of the file system. The install process naturally does not recognize our pooling structure so the required code to provide the menu/links for this was not copied into the pooling area. That being so, the web interface does not have access to it since it too pulls from this pooling area. Modifying the install process to copy what was missing (etc/apps/search/(appserver|bin|default|scripts|metadata/default.meta) resolved this problem. Now that many of us have or will soon move to v6, this is probably not so helpful. If anyone is still at v4.x, get to v5(current) now! You’ll be glad you did.

rgcurry · ‎12-03-2013

I am looking for Manager > Report Acceleration and I am an admin on the system. I saved a search and checked the box for report acceleration for it. When I attempted to verify the summary index was being built for it, I discovered the missing option.

rgcurry · ‎12-02-2013

I am testing Splunk 5.0.5 for our next upgrade. I am currently testing Report Acceleration and have created a new search from which I am starting this part of this work. After saving the search and setting it to use Report Acceleration, I went to Manager and do not see "Report Acceleration" as an option. The upgrade went without error and this is the first problem like this that I've seen. Is there a setting that needs made or a config that needs edited? Please advise.

rgcurry · ‎10-31-2013

My data is formatted differently, like this: LOCATION RUN DATE FIELD-ONE LOC-ONE 03/05/13 157052 LOCATION RUN DATE FIELD-ONE LOC-TWO 03/05/13 157052 LOCATION RUN DATE FIELD-ONE LOC-THRE 03/05/13 157052 LOCATION RUN DATE FIELD-TWO LOC-ONE 03/06/13 35868 LOCATION RUN DATE FIELD-THREE LOC-FOUR 07/15/13 0 LOCATION RUN DATE FIELD-FOUR LOC-FIVE 07/15/13 6385 Data is from three logs same sourcetype. The third header is variable. The doc for the FIELDS statement implies I can't use RegEx to capture the field name (“\w+”). That would make a nice feature, eh? (8->) Suggestions?

rgcurry · ‎10-30-2013

Without knowing your data or situation, I am curious as to what is keeping you or someone from creating the field extractions needed/wanted to make this work? You could also use the rex command to dynamically create fields from the raw data. Have you played with the Field Extracions page in Manager? As for the malformed eval error, your search is quite generic to me and I don't see the error. What I do in a situation where I have a lot of evals and cannot see which one is in err is to remove all but the first and run the search, if it works, add the next one back and rerun; repeat as needed until the solution is found.

rgcurry · ‎10-30-2013

Here is what I'd put into the props.conf if this were my data: TIME_PREFIX = TimeStamp = TIME_FORMAT = %m/%d/%Y %H:%M:5S.%3N %p MAX_TIMESTAMP_LOOKAHEAD = 165 But if you are wanting a field extraction for the date/time, try this: [sS]tamp\s+\=\s+(?<dateTime>\d+\/\d+\/\d+\s+\d+\:\d+\:\d+\.\d+\s+\w+)\s+ You mention "picking up another time later in event string" but there is no way for any of us to know what impact that might have. Try one of these and let us know if it works. There may be a better answer if you provide us with more info.

rgcurry · ‎09-12-2013

I made a slighgt change to the code you suggested Hiroshi, I added the following to the end of my search so that the proper count is reported. 'Injecting' the 'extra' host into the results made a server with no sessions show as having 1. But now the chart shows what is needed and wanted by the user. Thank you again for your suggestion. I appreciate your time and expertise. The following is what I added to the end of the search to realign to the true session count value while reporting all of the servers: | eval SessionCount=SessionCount-1

rgcurry · ‎09-11-2013

I will give this a try, it looks like it will do the trick. After I posted this, I got to wondering if I could use the lookup table I already had to "force feed" the host into the results but I did not think of using append to pull in that data. Nicely done Hiroshi! I will post back on the results. Right now -- all servers have been having active sessions over a 15min (our lowest timeframe) period.

rgcurry · ‎09-09-2013

I have a dashboard panel that displays the number of user sessions on a web server in a column chart. The user wants to know if we can display each of the hosts dedicated to his application even if there are no sessions in selected timeframe. Anything in the Time Picker less than 4hrs will show only a subset of the servers as the others will not have any sessions to report (this is currently only in our TEST Environment, so low volume of sessions -- for now). Is there a way to get Splunk to report each of the hosts reporting a particular sourcetype without any events during a particular timeframe? My current search looks something like this: index="{INDEX}" sourcetype="{SOURCETYPE}" ENV="$ENV$" (host="$host$" AND host="{HOST_FILTER}")| dedup sessionID | search NOT "*{SEARCH_FILTER}*" | stats count AS SessionCount by host I know that by the nature of this search, there will be events ONLY for those hosts that have had sessions in operation during the specified timeframe. Basically what I am looking to do is force each host to report even if the value is 0 (zero). Can I 'inject' that info into the final search results?

rgcurry · ‎08-21-2013

It is kept private versus set to app level or global.

rgcurry · ‎08-21-2013

As a developer, the solution that comes to my mind is to allow the admin to indicate to Splunk in some config file that the indexes are deployed and not local and it gets the index info from the indexers.

rgcurry · ‎07-18-2013

Putting the "\s:\s" into the capture string will include it all -- if that is what you are wanting. This is how I am reading your desired results, else what alacercogitatus provided is right on target.

rgcurry · ‎07-18-2013

"2 peer indexers are full" -- not clear on what you mean by that. Is this to say that there is no room left on the file system? Then I'd guess that the errant SH could not send its bundle when the other two filled the indexers up. As Scotty would say, "Cap'n, I need more space! I cannot do eet on my own."

rgcurry · ‎07-08-2013

Another thing to check is your performance metrics on the indexers. Something I saw shortly after I first noticed this post and entered that I too was seeing this was other similar messages such as Splunk unable to send the bundle to the search peer. So I looked into some of the performance metrics and found that there was a LOT of network traffic hitting the Indexers. In this situation, I had not yet extended the number of Indexers but had added nearly 100 Forwarders on top of the several hundred already in operation. Each also was sending data from at least 5 busy logs. There was also close to 20-25 users or scheduled searches running at any one time. This problem cleared once my rearchitecture of that Splunk instance was completed and more Indexers were available over which to spread the work.

rgcurry · ‎06-26-2013

From your first paragraph, it seems the ".000" is always there. Try hard-coding that in your TIME_FORMAT clause. That should eliminate that extra data.

rgcurry · ‎06-10-2013

I have gotten this too when the Forwarder has been setup on a server with a lot of files in the monitored directory. This message indicates that there are more files than the Forwarder can handle at one time. It is not a problem, notice that the message level is set to "INFO". Within time, and this depends upon how many files you have and the number of open files handles are defined for the Forwarder, it will catch up and process all of your logs. You can get more specific info with the Answer to the question "4.1.2 upgrade TailingProcessor - File descriptor cache is full"

rgcurry · ‎05-29-2013

As Ayn said above, the Knowledge Bundle is a part of normal processing. It seems to me that you are considering Search Head pooling where the information the Search Heads send to the Indexers is made static and stored on a shared file system to which all Search Heads and Indexers can access and updated when there are changes made to these configs. More info at http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/Configuresearchheadpooling. Know that there is a performance hit with this option; your milage may vary.

rgcurry · ‎05-21-2013

I am curious as to what has you thinking you need/want to do this? This is designed mostly for multiple indexers. True it is a performance consideration but with your configuration I don't know that it will gain you much improvments.

rgcurry · ‎05-15-2013

The problem with year 2038 may be due to UNIX Epoch time if your Splunk instance is running on a 32-bit UNIX system. Note the following: "At 03:14:08 UTC on 19 January 2038, 32-bit versions of the Unix time stamp will cease to work, as it will overflow the largest value that can be held in a signed 32-bit number. ..." Retrieved May 15, 2013 from http://en.wikipedia.org/wiki/Unix_time.

rgcurry · ‎05-15-2013

I typically create my field extractions by editing the props.conf directly, but I'm a shell bigot. (8->) When ever I cannot see my fields defined in the Fields Sidebar, I realize that I have failed to create metadata for my fields. As you are using the Web UI, I am not certain what might be doing this for you. Do you have access to the file system? Check the metadata/local.meta file in your app's etc/apps directory and assert that it has permissions set for your fields.

rgcurry · ‎05-15-2013

I had a similar results but in my case, it was individual searches, not post processing. The data being charted was similar data with slight differences in filtering and field selections from the source data. What I did to resolve the difference in chart widths was sync up the timeframe of each search's data source. Not sure this is what is causing your problem but for me, the data in timechart #1 was a longer timeframe than that of the data in timechart #2. Both searches used the same search time selection; in my case it was "earliest=-7d@d latest=@d". Making the data source fill the same timeframe gave me the same size charts.

rgcurry · ‎05-09-2013

Thank you for this update info on SV, it looks like it can work for most of the updates our users need to make. There are some, albeit rarel cases where the update is to include a new or additional columns so for those situations this won't work. Any chance this can be done? Many of our lookup tables are not used for "Automatic Lookups", they are loaded via "inputlookup" and a search used to extract what is needed; such as to fill a listbox. Your post also provides me with some of the info I need to make this work. Thanks for this and a a great product in Sideview Utilities.

rgcurry · ‎05-09-2013

THis is good info and I already do that for a couple of our lookup tables whose data is in an index without the Splunk data store. However, there are also some lookup tables in which the data source is external to Splunk; I was not clear about that in my post. The wiki article looks like it may provide me with a foundation from which I might be able to get this done. Thanks!

rgcurry · ‎05-09-2013

For me, your question is not quite clear. In your example, what is the "dynamic field name"? What makes it dynamic? If what you are asking is the value of those items in your example as "prod 1" and "prod 2" change, how is that represented in your data source? Please provide an exmaple of the data source and perhaps we can find a way to get what you want.

rgcurry · ‎05-09-2013

Have you considered using the "KV_MODE" parameter in your props.conf for this sourcetype? Check it out at http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles.

Posts	93
Solutions	10
Karma Given	9
Karma Received	45
Member Since	‎09-07-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

'Report Acceleration' Missing in Manager

How to Generate Bar Chart to Include Hosts with No...

Updating LookUp Table Data Externally - 'Auto-magi...

How to Move License from One License Master to Ano...

How Can I Verify that All Forwarders Received a De...

Second Indexer/SearchPeer reports "The lookup tabl...

What am I missing in this props/transforms pair to...

Can the Deployment Server be configured to stagger...

Updating the 'deploymentclient.conf' on Forwarders...

Splunking HTML Formatted Log Files

Re: 'Report Acceleration' Missing in Manager

Re: 'Report Acceleration' Missing in Manager

'Report Acceleration' Missing in Manager

Re: manual field extraction from header

Re: How do I use inputlookup to create table of st...

Re: trouble using regex to find a timestamp

Re: How to Generate Bar Chart to Include Hosts wit...

Re: How to Generate Bar Chart to Include Hosts wit...

How to Generate Bar Chart to Include Hosts with No...

Re: DBConnect - Can we populate a lookup table fro...

Re: New Indexes do not show in Web UI

Re: Proper REX command

Re: Splunk Dispatch Command WARN - unable to searc...

Re: Authentication Failed using distributed search

Re: Timestamps

Re: file descriptor cache is full - trimming...

Re: knowledge bundle without a shared storage?

Re: knowledge bundle without a shared storage?

Re: Last indexed event is in the future

Re: Field Extraction

Re: Chart width in Sideview Utils Table module

Re: Updating LookUp Table Data Externally - 'Auto-...

Re: Updating LookUp Table Data Externally - 'Auto-...

Re: Adding filed format to dynamic field names

Re: Can Splunk dynamically extract JSON Key names ...