Hi All, Good Morning, I have requirement to create a dashboard to display the total number of concurrent running builds in Jenkins and team city. Need 4 panels to display total number of builds with time chart and single value visualization. Already we have 9 panels to display Build count, Build duration and Queue Time by Day in place. Details about the Panels Type and Query: 1) TC Build Duration Per day Index = TC-App sourcetype =tc:srv “Build started” OR “Finished build” | transaction buildId keepevicted =true | time chart span =1h sum(duration) 2) TC Build count & Duration: Index = TC-App sourcetype =tc:srv “Build started” OR “Finished build” | transaction buildId keepevicted =true | time chart span =1h count (duration) 3) Jenkins Build & Queue Time By Day: Index =JK-App sourcetype=* event_tag =”Job_event” type=”completed” build_number = “*” | dedup host build_url sortby - _time | search ‘UTC_to_local_time(Job_started_at)’ | time chart span = 1h sum(Job_duration) sum(Queue_time) 4) Jenkins Build Count & Duration & Queue Time: Index =JK-App sourcetype=* event_tag =”Job_event” type=”completed” build_number = “*” | dedup host build_url sortby - _time | search ‘UTC_to_local_time(Job_started_at)’ | time chart span = 1h sum(Job_duration) sum(Queue_time) count 5) TC Build Count: Single Value Visualization: Index = TC-App sourcetype =tc:srv “Build started” OR “Finished build” | transaction buildId keepevicted =true | stats count 6) TC Build Count in seconds: Single Value Visualization: Index = TC-App sourcetype =tc:srv “Build started” OR “Finished build” | transaction buildId keepevicted =true | sum (duration) 7) Jenkins Build Count: Single Value Visualization: Index =JK-App sourcetype=* event_tag =”Job_event” type=”completed” build_number = “*” | dedup host build_url sortby - _time | search ‘UTC_to_local_time(Job_started_at)’ | stats count 😎 Jenkins Build Duration in seconds : Single Value Visualization Index =JK-App sourcetype=* event_tag =”Job_event” type=”completed” build_number = “*” | dedup host build_url sortby - _time | search ‘UTC_to_local_time(Job_started_at)’ | stats sum (Job_duration) 9) Jenkins Queue Time in seconds: Index =JK-App sourcetype=* event_tag =”Job_event” type=”completed” build_number = “*” | dedup host build_url sortby - _time | search ‘UTC_to_local_time(Job_started_at)’ | stats sum (queue_time) Now need to create additional panels to display the concurrent running build Jobs in Jenkins and Team city. Kindly guide me how to do that. ... View more

Hi All, I had two question's on splunk. 1) How to list the indexes details available in splunk search heads? 2) What is streaming and non-streaming commands and how are they executed (in which scenario's it is used) thanks in advance. ... View more

Hi Splunkers, I am seeing some 2023 event counts for the below mentioned error detail in splunkd.log in all the indexer instances, so can any one guide me how /where to start the investigation on fixing this issue. ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user="test01". Search filter="(&(uniquemember=uid=test01,ou=Internal,ou=Users,dc=xxx,dc=com)(cn=Splunk_Admin))" strategy="XXXX LDAP" Splunk Version : 7.0.4 ... View more

Hi Splunkers, I got a requirement from the cyber security user to remove the events with header displaying empty and retain those events with header details having some values into it. Header Details: USERNAME LINE HOSTNAME TIME We are using Splunk Add-on for Unix and Linux version 5.2.4 to capture the UNIX details in splunk and the who.sh scripted input are used to capture the who logged on to the system details and both the Linux, Solaris OS details are successfully ingested into splunk via scripted inputs but there are many events with zero values in it and only Header details are shown as a event which we wanted to remove it. Attached snap shot for your references. . dirname $0 /common.sh CMD='who -H' HEADER='USERNAME LINE HOSTNAME TIME' HEADERIZE='{NR == 1 && $0 = header}' FORMAT='{length(hostname) || hostname=$NF; gsub("[)(]", "",hostname); time=$3; for (i=4; i<=lastTimeColumn; i++) time = time " " $i}' PRINTF='{if (NR == 1) {print $0} else {printf "%-14s %-10s %-40.40s %-s\n", $1,$2,hostname,time}}' if [ "x$KERNEL" = "xLinux" ] ; then FILL_BLANKS='{hostname = ""; lastTimeColumn = NF-1; if (NF < 5) {hostname = " "; lastTimeColumn = NF}}' elif [ "x$KERNEL" = "xSunOS" ] ; then FILL_BLANKS='{hostname = ""; lastTimeColumn = NF-1; if (NF < 6) {hostname = " "; lastTimeColumn = NF}}' elif [ "x$KERNEL" = "xAIX" ] ; then FILL_BLANKS='{hostname = ""; lastTimeColumn = NF-1; if (NF < 6) {hostname = " "; lastTimeColumn = NF}}' elif [ "x$KERNEL" = "xDarwin" ] ; then FILL_BLANKS='{hostname = ""; lastTimeColumn = NF-1; if (NF < 6) {hostname = " "; lastTimeColumn = NF}}' elif [ "x$KERNEL" = "xFreeBSD" ] ; then FILL_BLANKS='{hostname = ""; lastTimeColumn = NF-1; if (NF < 6) {hostname = " "; lastTimeColumn = NF}}' fi assertHaveCommand $CMD $CMD | tee $TEE_DEST | $AWK "$HEADERIZE $FILL_BLANKS $FORMAT $PRINTF" header="$HEADER" echo "Cmd = [$CMD]; | $AWK '$HEADERIZE $FILL_BLANKS $FORMAT $PRINTF' header=\"$HEADER\"" >> $TEE_DEST Note: we have used Line_Breaker stanza in props.conf to break the multiple events into single events as per the requirement. [who] SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+) TRUNCATE=1000000 DATETIME_CONFIG = CURRENT Kindly guide us on how to do this customization. ... View more