×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
carasso
Splunk Employee
Member since: ‎01-23-2010
‎06-05-2020
Community Statistics
Posts 150
Solutions 59
Karma Given 117
Karma Received 218
Member Since ‎01-23-2010
Activity Feed
Topics I've Started
View All

Re: Timewrap and x-axis lables

by Splunk Employee in All Apps and Add-ons
‎12-16-2014 10:44 AM
1 Karma
‎12-16-2014 10:44 AM
1 Karma
The timechart UI expects full times, not days of week. If you're willing to lose the hourly details within a day, something like this should work: index=volume_hourly_summary report="volumebyhour" earliest=-4w@w latest=@w | timechart span=1d sum(count) as TotalVolume | timewrap w series=exact| eval time=strftime(_time, "%A") | fields - _time | table time * (note, this removes _time and uses 'time', and I replaced 1h with 1d) You might have to sort the days of the week. ... View more

Re: Splunk Software Distribution with - System Cen...

by Splunk Employee in All Apps and Add-ons
‎12-04-2014 01:46 PM
‎12-04-2014 01:46 PM
We're hosting a contest for the best SCCM app. http://splunk.challengepost.com/ Microsoft SCCM - The first place winner in the Microsoft SCCM app category wins $30,000 and a complimentary pass to .conf 2015 - Splunk's premier annual user conference. Value: approx. $1,695. Innovation - The first place winner in the Innovation category wins $20,000 and a complimentary pass to .conf 2015 - Splunk's premier annual user conference. ... View more

Re: Monitor SCCM Log & correlate to file system ch...

by Splunk Employee in Monitoring Splunk
‎12-04-2014 01:46 PM
‎12-04-2014 01:46 PM
We're hosting a contest for the best SCCM app. http://splunk.challengepost.com/ Microsoft SCCM - The first place winner in the Microsoft SCCM app category wins $30,000 and a complimentary pass to .conf 2015 - Splunk's premier annual user conference. Value: approx. $1,695. Innovation - The first place winner in the Innovation category wins $20,000 and a complimentary pass to .conf 2015 - Splunk's premier annual user conference. ... View more

Re: How can I monitor SCCM 2012 logs with Splunk?

by Splunk Employee in Getting Data In
‎12-04-2014 01:45 PM
1 Karma
‎12-04-2014 01:45 PM
1 Karma
We're hosting a contest for the best SCCM app. http://splunk.challengepost.com/ Microsoft SCCM - The first place winner in the Microsoft SCCM app category wins $30,000 and a complimentary pass to .conf 2015 - Splunk's premier annual user conference. Value: approx. $1,695. Innovation - The first place winner in the Innovation category wins $20,000 and a complimentary pass to .conf 2015 - Splunk's premier annual user conference. ... View more

Re: Can Sentiment Analysis app be used to analyze ...

by Splunk Employee in All Apps and Add-ons
‎08-27-2014 08:44 AM
‎08-27-2014 08:44 AM
http://answers.splunk.com/answers/11566/how-can-i-index-config-files-and-text-documents-as-individual-events that will tell splunk that files of sourcetype "myconfigs" (change name to anything) will treat the whole file as one event. Then tell splunk to index your directory where the files are, and set the sourcetype to "myconfigs" ... View more

Re: Can Sentiment Analysis app be used to analyze ...

by Splunk Employee in All Apps and Add-ons
‎08-26-2014 03:39 PM
2 Karma
‎08-26-2014 03:39 PM
2 Karma
Yes, this app works on a field on splunk events. The splunk events can be completely unstructured text. You'd need to index all the documents as separate events, and then use the sentiment app to rate the sentiment of each event (doc). ... View more

What are your best anomaly finding searches?

by Splunk Employee in Splunk Search
‎08-18-2014 12:10 PM
1 Karma
‎08-18-2014 12:10 PM
1 Karma
Besides the obvious things of looking for rare field values... what are all the list of anomaly searches you use to find unexpected events? How do you limit false positives, or uninteresting anomalies? the more specific and the more searches you can list out, the better. . ... View more

Re: Splunk for SQL App (i.e. database activity mon...

by Splunk Employee in Getting Data In
‎08-08-2014 10:50 AM
‎08-08-2014 10:50 AM
Any updates? it's been 2.5 years. thx ... View more

Re: Splunk for SQL App (i.e. database activity mon...

by Splunk Employee in Getting Data In
‎08-08-2014 10:46 AM
‎08-08-2014 10:46 AM
Erik -- a search of "sql" on apps.splunk.com didn't return your app. Users might find your app better if you throw in a few relevant keywords into your apps description: Oracle, Microsoft SQL, Informix, DB2, Sybase and Sybase IQ, Postgres, and MySql. ... View more

Re: Do you have sample data and want an app built ...

by Splunk Employee in All Apps and Add-ons
‎08-07-2014 12:45 PM
1 Karma
‎08-07-2014 12:45 PM
1 Karma
bookmark these links. suggest apps you want built. help others build apps. vote up apps that you also want. ... View more

Re: Do you have sample data and want an app built ...

by Splunk Employee in All Apps and Add-ons
‎08-07-2014 12:42 PM
8 Karma
‎08-07-2014 12:42 PM
8 Karma
Use the app-wanted tag to discuss which apps you want built: http://answers.splunk.com/tags/app-wanted/ Clicking on the big grey "Ask a Question" button: http://answers.splunk.com/ask/?tag=app-wanted and find others to help you build an app. ... View more

Do you have sample data and want an app built for ...

by Splunk Employee in All Apps and Add-ons
‎08-07-2014 12:38 PM
10 Karma
‎08-07-2014 12:38 PM
10 Karma
. If you have sample data you understand, and want someone else to help build an app for you... ... View more

Re: Using the Year/Annual Timewrap

by Splunk Employee in All Apps and Add-ons
‎07-21-2014 11:55 AM
1 Karma
‎07-21-2014 11:55 AM
1 Karma
I've uploaded a new version that supports "y" (years). There was a mismatch between the message and the validation code. It assumes 365 to a year, ignoring leap days. ... View more

Re: Timewrap app : Using the globally exported "t...

by Splunk Employee in All Apps and Add-ons
‎07-16-2014 05:44 PM
2 Karma
‎07-16-2014 05:44 PM
2 Karma
1) When you say it "won't work", what do you mean? What error do you get? 2) I just went into two other apps and successfully used timewrap. I'm not sure what is different with your setup. 3) Maybe there's something in the SOS app that limits the commands? In SOS, it does: [] import = search Perhaps trying changing that import to be "search, timewrap" ... View more

Re: multiple searches in one graph

by Splunk Employee in Getting Data In
‎05-21-2014 12:01 PM
1 Karma
‎05-21-2014 12:01 PM
1 Karma
Comparing week-over-week results used to a pain in Splunk, with complex date calculations. No more. Now there is a better way. I wrote a convenient search command called "timewrap" that does it all, for arbitrary time periods. ... | timechart count span=1d | timewrap w That's it! http://apps.splunk.com/app/1645/ ... View more

Re: Two query results overlay on same graph

by Splunk Employee in Splunk Search
‎05-21-2014 11:59 AM
2 Karma
‎05-21-2014 11:59 AM
2 Karma
Comparing week-over-week results used to a pain in Splunk, with complex date calculations. No more. Now there is a better way. I wrote a convenient search command called "timewrap" that does it all, for arbitrary time periods. ... | timechart count span=1d | timewrap w That's it! http://apps.splunk.com/app/1645/ ... View more

Re: Charting / Graphing Multiple data sources one ...

by Splunk Employee in Splunk Search
‎05-21-2014 11:56 AM
‎05-21-2014 11:56 AM
Comparing week-over-week results used to a pain in Splunk, with complex date calculations. No more. Now there is a better way. I wrote a convenient search command called "timewrap" that does it all, for arbitrary time periods. ... | timechart count span=1d | timewrap w That's it! http://apps.splunk.com/app/1645/ ... View more

Re: Today vs. Yesterday vs. Last Week

by Splunk Employee in Splunk Search
‎05-21-2014 11:55 AM
1 Karma
‎05-21-2014 11:55 AM
1 Karma
Comparing week-over-week results used to a pain in Splunk, with complex date calculations. No more. Now there is a better way. I wrote a convenient search command called "timewrap" that does it all, for arbitrary time periods. ... | timechart count span=1h | timewrap d That's it! http://apps.splunk.com/app/1645/ ... View more

Re: field extractor app errors

by Splunk Employee in All Apps and Add-ons
‎05-21-2014 10:32 AM
‎05-21-2014 10:32 AM
I fixed the problem. Update the app to 2.3. I just updated the Field Extractor app to work in distributed environments, so it works with indexes not on the search head. http://apps.splunk.com/app/494/ Let me know if you see any problems. ... View more

Re: Field Extractor and non-default indicies

by Splunk Employee in All Apps and Add-ons
‎05-21-2014 10:27 AM
‎05-21-2014 10:27 AM
I fixed the problem. Update the app to 2.3. I just updated the Field Extractor app to work in distributed environments, so it works with indexes not on the search head. http://apps.splunk.com/app/494/ Let me know if you see any problems. ... View more

Re: Field Extraction Regex - optional fields

by Splunk Employee in All Apps and Add-ons
‎04-04-2014 01:17 PM
‎04-04-2014 01:17 PM
The correct regex is: "(?P [^,n]+),\d*--(?P [^,]+),(?P [^,]+),(?P [^,]+),(?P [^,]),(?P [^,]+),(?P [^,]\ *),(?P [^,] ),(?P [^,]),(?P [^,] )(?:,\d*--(?P .*))?" The entire extra argument is encased in one "(?: ... )?". The other regexes suggested above allow invalid things, such as just "5-5,5-5,parent" ... View more

Re: Is there more documentation on the Sentiment A...

by Splunk Employee in All Apps and Add-ons
‎03-21-2014 01:35 PM
‎03-21-2014 01:35 PM
Hi -- Do you want instructions on using your own data to train the sentiment analysis, or do you want instructions on how to use the search commands? there is a description of the training data in the app: sentiment/training_data/README and also by example of the data itelf. for a description of the search commands, the app's home page gives a little description. I'm aware the docs aren't great. Can you give me an idea of what things you're trying to do and what things aren't clear? thanks! ... View more

Re: Is there more documentation on the Sentiment A...

by Splunk Employee in All Apps and Add-ons
‎03-21-2014 01:27 PM
‎03-21-2014 01:27 PM
If you have a list of questions I can add them to the little docs there are, or make an FAQ. Thanks. ... View more

Re: Field Extractor and non-default indicies

by Splunk Employee in All Apps and Add-ons
‎03-19-2014 05:12 PM
‎03-19-2014 05:12 PM
Is it possible the user running the field extractor does not have permission to use that index? ... View more

Re: Timewrap monthly delineation?

by Splunk Employee in All Apps and Add-ons
‎02-26-2014 02:28 PM
1 Karma
‎02-26-2014 02:28 PM
1 Karma
When you specify "3m" it does indeed use 90 days, for example. I'm not convinced this is a bug. The problem is -- supposing I used the length of the last month -- what do you want to do with that knowledge, how do you want to timewrap things? In other words, if you compare January to February, what do you want it to do? If you can answer that, I can change the behavior. In the meantime, use weeks or days, which are fixed and well defined. (e.g. 4w or 28d) ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:02 AM
Karma from
Karma given to