Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sh4kesbeer
sh4kesbeer
Explorer
Member since:
12-02-2016
06-05-2020
Community Statistics
| Posts | 8 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 3 |
| Member Since | 12-02-2016 |
Activity Feed
- Got Karma for Why is my custom streaming search-command executed on the search head?. 06-05-2020 12:49 AM
- Got Karma for Why is my custom streaming search-command executed on the search head?. 06-05-2020 12:49 AM
- Got Karma for Re: Weird / Faulty (?) Behaviour when comparing numbers. 06-05-2020 12:49 AM
- Karma Custom Streaming Command Won't Distribute to Indexers (Python SDK, V2) for kcnolan13. 06-05-2020 12:48 AM
- Posted Re: Can Splunk be served from a different endpoint? on Security. 09-10-2018 10:07 AM
- Posted Can Splunk be served from a different endpoint? on Security. 09-10-2018 09:46 AM
- Tagged Can Splunk be served from a different endpoint? on Security. 09-10-2018 09:46 AM
- Tagged Can Splunk be served from a different endpoint? on Security. 09-10-2018 09:46 AM
- Tagged Can Splunk be served from a different endpoint? on Security. 09-10-2018 09:46 AM
- Tagged Can Splunk be served from a different endpoint? on Security. 09-10-2018 09:46 AM
- Tagged Can Splunk be served from a different endpoint? on Security. 09-10-2018 09:46 AM
- Posted Re: Weird / Faulty (?) Behaviour when comparing numbers on Splunk Search. 09-21-2017 10:48 AM
- Posted Weird / Faulty (?) Behaviour when comparing numbers on Splunk Search. 09-18-2017 02:58 AM
- Tagged Weird / Faulty (?) Behaviour when comparing numbers on Splunk Search. 09-18-2017 02:58 AM
- Tagged Weird / Faulty (?) Behaviour when comparing numbers on Splunk Search. 09-18-2017 02:58 AM
- Tagged Weird / Faulty (?) Behaviour when comparing numbers on Splunk Search. 09-18-2017 02:58 AM
- Tagged Weird / Faulty (?) Behaviour when comparing numbers on Splunk Search. 09-18-2017 02:58 AM
- Tagged Weird / Faulty (?) Behaviour when comparing numbers on Splunk Search. 09-18-2017 02:58 AM
- Posted Re: Why is my custom streaming search-command executed on the search head? on Splunk Dev. 08-29-2017 05:30 AM
- Posted Why is my custom streaming search-command executed on the search head? on Splunk Dev. 08-28-2017 01:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 2 | |||
| 0 |
09-10-2018
10:07 AM
Okay there is a root_endpoint option for the web.conf which works as expected. It seems I did oversee this initially
... View more
09-10-2018
09:46 AM
I am currently trying to let splunk run behind a reverse proxy so that there can be multiple web-services on the same domain.
The goal is to run splunk from e.g.:
https://example.com:9000/abc/
so that this maps to e.g.
http://some-local-machine:8000/
where splunk is running at port 8000.
I was able to configure nginx to handle normal requests and even the redirects coming form splunkweb in the right way but it seems some of the assets contained in the page are not referenced relative to the current page but rather contain an absolute path which is determined based on the Host-field in the request issued from the proxy.
Is there some way to let splunk know that it is supposed to run from some other endpoint than /? So that it can inject this endpoint into all links (by prefixing them) that are needed for the dynamic parts of the page.
Thanks in advance!
... View more
09-21-2017
10:48 AM
1 Karma
Thanks a lot, I was probably staring for too long at this problem to notice the obvious 😄
... View more
09-18-2017
02:58 AM
Hello,
I am currently facing a weird behaviour when comparing two numeric fields in splunk.
The attached screenshot shows the situation, where I want to compare the time difference to some previous and some subsequent event. The fields for the (correctly calculated) difference are prevDif and postDif. I compare them to gather a decision of which event should be taken (selectedPosition). I multiplied the prevDif and postDif by 2 after I encountered the error, to verify the fields are treated as numbers (and they are, postDif was 42 without the multiplication in most of the cases). So as 0 is clearly < 84 the selectedPosition should be "prev" but somehow the comparison fails and "post" is selected.
Can someone explain this behaviour or is this just a bug?
I would greatly appreciate any hints to why this does not work correctly!
... View more
08-29-2017
05:30 AM
This parameter is not available when using the SCP v2 the spec states:
If true, the only other commands.conf attributes supported are is_risky, maxwait, maxchunksize, filename, and command.arg..
for the "chunked" option which decides on the protocol version
... View more
08-28-2017
01:46 AM
2 Karma
I am trying to implement a custom streaming search-command right now. I would like to use the SCP v2 protocol with the splunklibs python interface. The command itself is running fine but the "remoteSearch" field and the overall performance indicates that it is not distributed to the indexer-cluster but rather executed on the searchhead.
I tried different options for the Configuration Decorator (e.g. distributed=true) but it did not have any effect.
I am inheriting from StreamingCommand and so I am not able to mutate the "type" field in the configuration. The type is said to be "streaming" in the documentation but it turns out to be "stateful" when read out from "self.configuration" (from inside the commands class)
To me this seems to be the cause for my command not being "distributable streaming" but rather "stateful streaming". How can I tackle this to be able to distribute my command to the indexer-cluster for optimal performance?
... View more
01-17-2017
11:58 AM
thanks for your reply! Its not that I receive any out-of-order-data, my question is rather if it could happen, that under certain (maybe very unlikely) circumstances the order might be broken? I will look at your link, although it looks familar to me, maybe I will be able to find the answer there, thanks!
... View more
01-17-2017
11:02 AM
Hi,
I am working on some Splunk searches that highly rely on the order the events are returned in, by the search command.
I searched a lot of docs to find some quote that says I can rely on this order, but it seems there is no such guarantee.
So for every search, I need to pre-sort the results by | sort 0 -_time to be confident about the order. This introduces a big performance-penalty because the searches operate on large datasets. Is there a statement about this, I missed somewhere? And what does your experience tell about relying on the order?
Best Regards!
EDIT: The root of this question is the use of the streamstats command as a hack to replace the non-existent by-clause for the delta operator. So it looks something like ... | streamstats current=f window=1 global=f first(_time) as prev_time by object_id , upon this I can calculate the time-delta for events of each distinct object. It does not matter if I do it forward or backward, I could build the query either way, but in both ways this is highly dependant on the order beeing correct. It does not matter if the order is stable in this case.
It seems that, based on DalJeanis's answer, especially in clustered deployments the default order can not be guaranteed. I would be very grateful if someone could provide a definitive answer.
... View more
