About ldongradi_splun

ldongradi_splun · ‎01-23-2021

Hello, Gravity inline documentation mentions the Load Balancing has to be handled outside of their cluster (from a DNS ?). But they are not explicit on the need for a virtual ip address to be set before the installation. What are the network prerequisites for a DSP installation in a cluster ? Do we need a DNS load balancer ? A VIP set before the installation ? Can we rely on the first node (master/controlplane) IP address, then switch to another ? The low latency network mentioned as good practice between gravity nodes communication in DSP deployment procedure: do we have additional info about its' requirements ? Then another question : Can I start with a DSP standalone deployment, and make it a cluster later on ? Obviously the standalone would be for testing/demoing while the hacluster would be for production, but this can be usefull for testing as well

ldongradi_splun · ‎08-30-2020

Almost there! I had a bad substitution in the regex, missing \/ for / as eventgen logs told me. Now, trying to replay 1 event at a time from that big 10k raw sample.

ldongradi_splun · ‎08-29-2020

I'd like to replay a log, simulating prod, and continuously generating events (every 30 seconds is fine). I'm all good with sample mode, but it looks like I can only have random timestamps between earliest/latest. As with this code, giving my 28k events generated again and again every 30s with new timestamps from -1w till now. Problem is I'd like to keep the sequence of events. Can I have sample mode not scramble the timestamps ? [myfile.sample] mode = sample outputMode = file fileName =/opt/log/mynew.log interval = 30 earliest=-1w latest=now token.0.token = \d{2}/\w{3}/\d{4}:\d{2}:\d{2}:\d{2} token.0.replacementType = timestamp token.0.replacement = %d/%b/%Y:%T Instead, I am trying replay mode. But I can't get the outputfile generated. Nothing. What is wrong with my replay mode? [myfile.sample] mode = replay outputMode = file fileName =/opt/log/mynew.log count = 0 interval = 30 earliest=now latest=now token.0.token = \d{2}/\w{3}/\d{4}:\d{2}:\d{2}:\d{2} token.0.replacementType = replaytimestamp token.0.replacement = %d/%b/%Y:%T Thanks for your help.

ldongradi_splun · ‎08-08-2020

(Old question with an answer still valuable) In a SHC the SH resources are not shared among searches, but for scheduled searches. Ad-hoc searches running on a SHC member will consider the cpu cores and memory resources as if it was unique. For the scheduler, the captain will mitigate starvation by distributing scheduled jobs to available members. Each member not being supposed to consume more than its capacity. So you give more resources to scheduled jobs automatically in a SHC, while for adhoc searches it depends on where the users are logged in. A load balancer for users connections can help, for high availability: users don't need to know each member fqdn nor ipod address to get in.

ldongradi_splun · ‎06-10-2020

@to4kawa 's solution is elegant, and I can only scavenge his idea to propose this. As appendpipe will be used, the non-streaming eventstats can be replaced by stats: | appendpipe [ | untable Date, Job, data | stats avg(data) as avg_Job stdev(data) as sd_Job by Job | eval avgSD = avg_Job + sd_Job | transpose header_field=Job column_name=Date ] .. but as you know, it's easier to modify/adapt/criticize than to create

ldongradi_splun · ‎06-04-2020

6 years later, that answer is the good one ! With python 2.7 not supported after 2020/01/01 the semantic_version installed by default is still too high for the slim partition command !

ldongradi_splun · ‎06-04-2020

/tmp/ folder can't be natively monitored by splunk as the splunkd process does not have permissions to access your files in /tmp/ You'd either need to have the files in /tmp generated by splunkd, or give extra permissions to the splunkd process owner to access /tmp files

ldongradi_splun · ‎08-19-2019

As you used #test, it's only valid for 1 text box. The js function can receive several definitions, like : $('#password1 [data-test="textbox"]').attr('type','password'); $('#password2 [data-test="textbox"]').attr('type','password'); $('#password3 [data-test="textbox"]').attr('type','password'); and all the text boxes needing password protection from the xml would use: id="password1" id="password2" id="password3"

ldongradi_splun · ‎11-14-2018

You can use the power of 1024, and anticipate the use of a macro, plus you need to use eval out of the sum() if you want to round the results: index="_internal" source="*metrics.log" per_sourcetype_thruput| chart sum(kb) as Size by series | eval KB=round(Size/pow(1024,0),2), MB=round(Size/pow(1024,1),2), GB=round(Size/pow(1024,2),2) | table series, Size, KB, MB, GB

ldongradi_splun · ‎10-30-2018

You can either start the search with : search | ... or use | makeresults | ...

ldongradi_splun · ‎10-30-2018

An eval based macro must return a string. tostring(now()) is not a string ... dough ! you need to ensapsulate it with double quotes [macronow] definition = "tostring(now())" iseval = 1 To test with |makeresults count=2 |eval show=strftime( macronow ,"%D %T")

ldongradi_splun · ‎07-12-2018

Using search instead of where will give you the solution, here. | search myfield="match % this"

ldongradi_splun · ‎05-25-2017

I downvoted this post because the error is not related to an app but to the .csv file format

ldongradi_splun · ‎03-20-2017

First, in UI : add all the reports you want in your final dashboard (be sure they are programmed reports). Then organise your left panel (the final left dashboard as you would name it) with 7 panels side by side. Organise the 1st row (it contains 7 panels) : Edit the source, remove the end of the previous </panel> and the beginning of new <panel> between the 7 panels of the 1st row. All the reports will belong to the same panel. You then add an HTML entry to create a new line where you want : after the 1st header report, and after each set of 3 single values reports. A simple <html> Make a new line </html> will make it. Now that you have 1 single panel containing the 7 reports organised as you wanted them (from your graphic, it's the left dashboard), move one of the other reports to the right of this panel, so it creates a second panel (you called it the right dashboard) Edit the source, and use the same syntax to place all your remaining reports where you want, in one single panel. <dashboard> <label>Multiple Panel DB</label> <row> <panel> <title>Left Panel</title> <single> <title>Avg Errors by minute by server</title> <search> ... </search> </single> <html>By Servers</html> <single> <title>SV1</title> <search> ... </search> </single> <single> <title>SV2</title> <search> ... </search> </single> <single> <title>SV3</title> <search> ... </search> </single> <html>New line</html> <single> <title>SV4</title> <search> ... </search> </single> <single> <title>SV5</title> <search> ... </search> </single> <single> <title>SV6</title> <search> ... </search> </single> </panel> <panel> <title>Right Panel</title> <single> <title>Avg Errors by minute by USER</title> <search> ... </search> </single> <html>By Users</html> <single> <title>USR1</title> <search> ... </search> </single> <single> <title>USR2</title> <search> ... </search> </single> <single> <title>USR4</title> <search> ... </search> </single> </panel> </row> </dashboard>

ldongradi_splun · ‎02-13-2017

Thx Martin. It does not work. As a workaround so far I added the english-american keyboard to my settings, and switch to it when I want to show the effect of *CMD + \ *. Then I use the *CMD + ` * as this is where the *\ * key is supposed to be on the QWERTY keyboard. But this is not a nice solution.

ldongradi_splun · ‎02-13-2017

Hi all, Do you know a different sequence to reorder the search fields than *CMD + \ * that would work on AZERTY keyboard ? Explanation : The search fields reorder command on Windows is CTRL + \ ** , whereas on Mac, it's *CMD + \ * on a QWERTY keyboard. On AZERTY keyboard (French), the backslash is not available naturally. You have to use the sequence *SHIFT + ALT + : * , as / is obtained with a **SHIFT + : It seems it's impossible to get a full sequence of SHIFT + ALT + CMD + : to get the same behavior on a AZERTY keyboard as a *CMD + \ * on a QWERTY.

Posts	16
Solutions	0
Karma Given	8
Karma Received	3
Member Since	‎2017-02-06

Online Status	Offline
Date Last Visited	‎01-24-2021 06:42 AM

How to load balance toward DSP cluster - What are ...

Can I use specific timestamps with SA-Eventgen in ...

CMD + backslash on MAC AZERTY keyboard

How to load balance toward DSP cluster - What are ...

Re: SA-Eventgen replay - leaking events with backf...

Can I use specific timestamps with SA-Eventgen in ...

Re: How to calculate Splunk search concurrency lim...

Re: Add avg to xyseries

Re: Error while running slim partition command

Re: How to monitor log files from /tmp/folder_name...

Re: how can i change inputtext: text to password

Re: Convert kb to GB

Re: How to pass eval value as macro parameter wher...

Re: Can you use now() in eval-based macros?

Re: Need to escape % using LIKE.

Re: Why am I getting "⚠ cannot concatenate 'str' a...

Re: How to position my two single value dashboards...

Re: CMD + backslash on MAC AZERTY keyboard

CMD + backslash on MAC AZERTY keyboard