About tbrown

tbrown · ‎08-20-2020

I have the following scenario: There are two transactions that I want to monitor. Both occur randomly, and multiple times. I also want to search for some specific events (Events X). These events come in multiple times as well, but sometime come in during some of those transactions. I want to make a query that searches for all these events That Do NOT occur during any of the transactions. I have a temporary query that does what I explain, but it only works for 1 type of the two transactions. I also have a temporary query that works for the other type of transaction. How can I combine them to search for these events that do not occur during both types of transactions? Here are my queries that work for a single type of transaction: index="main" OR (<Events X>) | transaction startswith=<Start_Event1> endswith=<End_Event1> keeporphans=true | search (<Events X>) index="main" OR (<Events X>) | transaction startswith=<Start_Event2> endswith=<End_Event2> keeporphans=true | search (<Events X>) Any feedback helps.

isoutamo · ‎08-14-2020

I think that it now doable as you could use earlier added field belongs to transactions as unique field and then start and end as earlier? If I have understood right this should work. r. Ismo

bowesmana · ‎08-09-2020

See that your numbers in that column are left justified - that's always a good indicator that Splunk does not think they are numbers, so @isoutamo 's reply is likely to fix your problem

bowesmana · ‎08-06-2020

If the events are coming in sequence of the rising/falling host and the 'first' event with new values will apply to all subsequent rows until a new 'first' row is seen, then use 'filldown' https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Filldown If not, is there a way to correlate all events that relate to the rising/falling host fields against the events that do not contain the values? If so, then you can always sort by that field then use filldown, or aggregate the rows by that field with something like | stats values(Rising_Host) as Rising_Host values(Falling_Host) as Falling_Host by common_field Note that if you do not want to aggregate the rows, then use eventstats rather than stats Hope this helps

niketn · ‎07-30-2020

@tbrown if you found my answers and comments useful do up vote them!

tbrown · ‎07-30-2020

@richgalloway Unfortunately that didn't work either and it returns no results.

tbrown · ‎07-30-2020

isoutamo · ‎07-29-2020

bowesmana · ‎07-29-2020

The answer probably lies in generating tokens for the drilldown as part of the search drilldown, e.g. <drilldown> <eval token="latest">relative_time($row._time$,"+2m")</eval> </drilldown> but that will depends on what your data looks like and the result set, but hopefully this will point you in the right direction.

to4kawa · ‎07-17-2020

index=trigger_event [ search index=start_end_event | rex your_regex | eval earliest=strptime(startTime."+0000","%FT%TZ%z"), latest=strptime(endTime."+0000","%FT%TZ%z") | addinfo | eval timeargs="(earliest=".info_min_time." latest=".earliest.") OR (earlest=".latest." latest=".info_max_time.")" | return $timeargs] If there is the event, fire alert.

richgalloway · ‎07-17-2020

See if this helps. index=foo | rex "from \d to (?<state>\d)" | stats latest(state) by host

richgalloway · ‎07-09-2020

Try adding @echo off to the top of the batch file to prevent Windows from displaying the contents of the file. One cannot schedule a script to run every X seconds. The smallest increment is one minute.

richgalloway · ‎07-08-2020

Sourcetype processing is controlled by props.conf files on the indexers (or HF, if you have one).

anthonymelita · ‎07-02-2020

I think you want to look at should_linemerge or creating a specific line_breaker options in props.conf https://docs.splunk.com/Documentation/Splunk/8.0.4/Admin/Propsconf#Line_breaking

tbrown · ‎06-29-2020

Disregard the question, I gave permissions to these processes and they are running correctly now. Additionally, data is being sent to the 'nmon' index in Splunk which is good, but it is only sending the following data: Why are none of the metrics being forwarded? When I try to start nmon using: /opt/splunkforwarder/bin/splunk cmd /opt/splunkforwarder/etc/apps/TA-nmon/bin/nmon_helper.sh It gives the error: ERROR nmon:diskgroup file - failed to find disk=fd0 for group=fd0 disks known=16 and stalls there until I manually cancel it. I assume this is the issue, how would i fix this.

anilchaithu · ‎06-22-2020

@tbrown This has nothing to do with the app. Please check the below. 1) Can you please check whether the role that run splunkd has access to the data to be monitored. 2) Does the client is forwarding internal logs to the main splunk instance. index=_internal host="client" 3) Does the client communicating to the deployment server? settings -> forwarder management 4) if all the above checks out, please look for errors in the splunkd logs on the client .

richgalloway · ‎06-19-2020

Since you have multiple forwarders, you should be using a deployment server. Plan on doing that soon. It will make it easier to manage the forwarders, especially if more are added in the future. The simple solution is to edit the inputs.conf files on the Windows servers. They're probably in $SPLUNK_HOME\etc\system\local, but splunk btool --debug inputs list will tell you for sure. When you edit the file, you'll see most of the perfmon stanzas have "disabled = 1" in them. Change the "1" to "0" for those measurements you want to index. Then restart the UF.

richgalloway · ‎06-16-2020

I'm not aware of any option that would include _time with the results of a transaction command. You may be able to do it manually, however, by prefixing _time to _raw prior to transaction. ... | eval _raw=_time.";"._raw | transaction startswith="start" endswith="end" | rex max_match=0 "(?<epoch>\d{10})" | mvexpand epoch | delta epoch as diff | fields _time _raw diff

tbrown · ‎06-10-2020

@richgalloway What would that command look like then? I have been trying to parse the transactions but haven't been able to find a working command that calculates the delta times.

Posts	38
Solutions	1
Karma Given	14
Karma Received	4
Member Since	‎06-09-2020

Online Status	Offline
Date Last Visited	‎08-20-2020 03:52 PM

Search for events occurring outside of two differe...

Transaction and Filldown from different hosts

Timechart of values

How to make a field cover multiple events

Filtering Hosts within a Transaction

How to pass the time of a transaction to drill dow...

Binary/square Time chart

Bar Graph/Timechart show multiple values for same ...

Drilldown for transaction search time range not co...

Alert when certain event occurs outside of time pe...

Search for events occurring outside of two differe...

Re: Transaction and Filldown from different hosts

Re: Timechart of values

Re: How to make a field cover multiple events

Re: Binary/square Time chart

Re: Filtering Hosts within a Transaction

Re: How to pass the time of a transaction to drill...

Re: Bar Graph/Timechart show multiple values for s...

Re: Drilldown for transaction search time range no...

Re: Alert when certain event occurs outside of tim...

Re: Make a graph displaying enabled/disabled statu...

Re: How to configure batch file in inputs.conf of ...

Re: How to change props.conf based on input/source...

Re: How to forward entire .txt file in splunk from...

Re: TA-nmon fifo_reader.py, fifo_reader.sh, nmon.f...

Re: Universal Forwarder not sending monitor after ...

Re: PerfMon Data from Windows Forwarders

Re: Parse time deltas within transaction

Re: Time difference within a transaction command

Are you a member of the Splunk Community?