About jmeyers_splunk

jmeyers_splunk · ‎05-13-2019

I realize this is a bit of a late comment, but I wanted to share a point of clarity around distributed search vs. index replication / indexer clustering. Having more than one indexer means does not automatically mean indexer clustering. It does mean distributed search - which enables horizontal scaling of indexers. from: About Distributed Search Horizontal scaling for enhanced performance. Distributed search facilitates horizontal scaling by providing a way to distribute the indexing and searching loads across multiple Splunk Enterprise instances, making it possible to index and search large quantities of data. Indexer clustering is a complementary concept which then adds replication for indexed data. from About Indexer Clusters Indexer clusters are groups of Splunk Enterprise indexers configured to replicate each others' data, so that the system keeps multiple copies of all data. This process is known as index replication. By maintaining multiple, identical copies of Splunk Enterprise data, clusters prevent data loss while promoting data availability for searching.

jmeyers_splunk · ‎10-17-2017

Perhaps wrap btprobe inside of a loop. See: https://answers.splunk.com/answers/542172/use-btprobe-reset-to-re-index-multiple-files.html

jmeyers_splunk · ‎04-24-2017

I'll just chalk that up to "strange occurrences"

jmeyers_splunk · ‎04-24-2017

jmeyers_splunk · ‎04-24-2017

I have a situation where I want to use a subsearch to resolve to a conditional expression in an if statement - a.k.a. eval x = [mysubsearch] using return. When I return a string literal the eval works. However, when return a field whose value is that same string the eval does not work. Anybody know why or how to address this? examples: works: search: | makeresults | eval foo = [|makeresults | eval str = "if(1<2, 1, 0)" | return $str] | table foo result: `foo 1` does not work: search: | makeresults | eval a = "if(1<2, 1, 0)", foo = [|makeresults | eval str = a | return $str] | table foo result: FATAL: Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression

jmeyers_splunk · ‎05-24-2016

I realize this comment is pretty old, but I wanted to supply an update to anybody who ends up here... Indexer Clustering (http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Aboutclusters) seems to take care of your needs around license consumption. It will replicate data in the background without incurring any additional splunk ingest.

jmeyers_splunk · ‎04-05-2016

Awesome. Thank you for posting back your results and what lead to your problem. Those pieces of information will help somebody else in the future.

jmeyers_splunk · ‎04-04-2016

this should work. is it possible that you don't have a field named exactly "uri_host" in your events? also, if you post your related props.conf & transforms.conf stanzas along with your lookup file definition & sample we can help with debugging a bit more.

jmeyers_splunk · ‎01-21-2016

Can you provide a small working example for the community?

jmeyers_splunk · ‎01-14-2016

any props.conf will work. Splunk merges all of them together based on rules of precendence (described here: http://docs.splunk.com/Documentation/Splunk/6.1/Admin/Wheretofindtheconfigurationfiles). typically in a new install where you are trying to get familiar with splunk, you will make your changes in either $SPLUNK_HOME/etc/system/local/props.conf OR $SPLUNK_HOME/etc/apps/search/local/props.conf. in production, these will often be placed in a purpose built custom apps local or default props.conf file.

jmeyers_splunk · ‎01-10-2016

I don't know of a video, but this search should work as a quick demo. The json you posted does not validate because of the broken quotes around ' Asia '. I fixed that, then escaped the quotes (so that I could inject it via the search bar). index=_internal | head 1 | eval f = "{\"ts\": \"2014-07-30T07:14:06.840\",\"pid\": 2104,\"tid\": \"1e88\",\"sev\": \"info\",\"req\": \"U9j9rgqgYVgAAA@kHr8AAAHs\",\"sess\": \"B84F19DEC88D4362B9164D87A687CFBC-0:1\",\"site\": \"Default\",\"user\": \"nsawant\",\"k\": \"begin-query\",\"v\": {\"protocol\": \"c4561a0\",\"query\": \"(restrict (aggregate (select (project (table [Extract].[Extract]) (([yr:Date:ok] (year [Date])) ([none:Region:nk] [Region]) ([none:Country / Region:nk] [Country / Region]))) (= [none:Region:nk] Asia))(([none: Country / Region: nk][none: Country / Region: nk]))(([avg: P: Population(count): ok](average[P: Population(count)]))))([none: Country / Region: nk][avg: P: Population(count): ok]))\"}}" | fields f | spath input=f | fields - f

jmeyers_splunk · ‎01-10-2016

KV_MODE = json tells splunk to automatically perform search time extractions on json data INDEXED_EXTRACTIONS = json tells splunk to create index time extractions for the data In the first scenario you are saving disk at the expense of processing power (and potentially search time) In the second scenario you are saving processing power (and potentially search time) at the expense of disk

jmeyers_splunk · ‎11-03-2015

I know this is an old post, but in this case I would look at either: metadata (http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/metadata) or tstats (http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats)

jmeyers_splunk · ‎11-11-2014

you don't need an app for this. these commands are built into splunk. just have a search that includes an ip address, pipe that to iplocation and then pipe that to geostats. for example: sourcetype=access_combined | iplocation clientip | geostats count With that and 6.1+ you will have the option for "map" visualization. You can also supply anything to iplocation which is an IP and other aggregate operations to geostats. See the references for the search commands that @MuS already included above.

jmeyers_splunk · ‎11-04-2014

Did you try changing the encoding? see: http://docs.splunk.com/Documentation/Splunk/latest/Data/Configurecharactersetencoding

jmeyers_splunk · ‎10-23-2014

I'm pretty sure that this is a search time lookup operation. what makes you think that it is index time only?

jmeyers_splunk · ‎10-16-2014

Have you tried to use the event generator (https://github.com/splunk/eventgen) to generate data based on samples from production? This is not a direct answer to your question, but could help you achieve the goal of having relatively current data in your test environment. You could set it up in test and have it constantly generate matching fresh data. This would avoid the need to copy / move buckets. Depending on your use case it might work.

Posts	17
Solutions	0
Karma Given	9
Karma Received	5
Member Since	‎10-29-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Subsearch as eval expression works with strings, b...

Re: How many resources would I need to receive 150...

Re: Re-indexing multiple files using btprobe

Re: Subsearch as eval expression works with string...

Re: Subsearch as eval expression works with string...

Subsearch as eval expression works with strings, b...

Re: Can single forwarder forward data to two diffe...

Re: How to add a lookup table value to matching se...

Re: How to add a lookup table value to matching se...

Re: Route map to draw a line of coordinates

Re: How to parse and extract JSON log files in Spl...

Re: How to parse and extract JSON log files in Spl...

Re: How to parse and extract JSON log files in Spl...

Re: Fastest way to count records per day

Re: External IP location

Re: Sharepoint logs are coming in Hex

Re: DNS lookup for IP address in Log Meesage

Re: Copying data between servers in different envi...