About nnesje

nnesje · ‎02-09-2023

Is it possible, or advised, to add a custom log to the Splunk _internal index? What are the formatting rules if a log is added to the default location?

nnesje · ‎11-04-2022

Here's what I've got so far. Anyone got something better? index=_internal sourcetype=splunkd source="/opt/splunk/var/log/splunk/metrics.log" group=per_host_thruput aws_role=splunk_indexer | stats avg(eps) as eps by host | eval _time=now() | stats sum(eps) as total_eps

nnesje · ‎11-04-2022

Can you go into more detail on "expanding the macros" for the DMC-based searches? As I understand it, the DMC is running jobs that collect data from the cluster and store it on the DMC, then the dashboards call that data via the searches/macros. When I try to copy/run a search that's part of a dashboard in the DMC on a non-DMC searchhead that's part of the cluster, I'm not seeing anything since the DMC data is not searchable from the SH cluster. I'm happy to hear if I'm wrong or if there's another way to access DMC data from the main cluster.

nnesje · ‎11-04-2022

Anyone have a search that will return the indexed events per second across the entire indexer cluster?

nnesje · ‎11-04-2022

Understood, but saving those dashboard panels as a separate report in the DMC doesn't help me. I need to re-create those searches NOT in the DMC, which is a stand-alone searchhead and not part of the shcluster.

nnesje · ‎11-04-2022

I'm looking for a search I can run that will return the ingest rate (KB/s) across the entire cluster. I know there's a "Deployment-Wide Total Indexing Rate" panel in the DMC dashboard "Indexing Performance: Deployment" that contains this data but I need to recreate this on the cluster itself to push to a summary index for retention and quick export. Also, if there's a similar search that will return events/s, I'm looking for that as well.

nnesje · ‎05-26-2022

I need to push data from a Splunk report to Graphite. I know there's an archived app in Splunkbase but I'm sure the python is incompatible with Splunk 8.2.4. Anyone have a method for pushing scheduled report data to Graphite?

nnesje · ‎05-10-2021

Is is supported to use a lookup table in searches without creating a lookup definition?

nnesje · ‎05-10-2021

We have 90+ lookups to migrate from a 6x Splunk cluster to a new 8x cluster. How can this be done in bulk?

nnesje · ‎05-03-2021

How can I identify which Dashboards contain a specific saved search?

nnesje · ‎02-18-2021

Receiving the following error: java.sql.SQLSyntaxErrorException: ORA-00911: invalid character However, no character is highlighted in the Data Lab SQL editor for the following query: select LI.BBY_ACTIVATION_LINK_SEQ ,li.bby_activation_line_seq , li.bby_pos_sale_seq, li.bby_plan_match_flg, pl.pos4partkey, pl.line_item_type POS_LINE_ITEM_TYPE,pl.hardware_sku POS_HARDWARE_SKU,pl.hardware_esn POS_HARDARE_ESN,pl.void_status POS_VOID_STATUS,pl.activation_phone_nbr POS_PHONE_NUMBER,pl.bbym_bskt_id POS_BAKT_ID, pl.bby_plan_sku POS_PLAN_SKU,al.hardware_type ACTIVATION_LINE_TYPE, al.hardware_esn ACTIVATION_HARDWARE_ESN,al.activation_phone_nbr ACTIVATION_PHNE_NUMBER, al.activation_type,al.tender_status ACTIVATION_TENDER_TYPE, al.actv_mthd, al.created_on ACTIVATION_CREATED_ON, al.amended_on ACTIVATION_AMENDED_ON,pl.created_on POS_LINE_CREATED_ON,pl.amended_on POS_LINE_CREATED_ON,li.created_on LINK_CREATED_ON from bst_bbym_sch01.BBY_POS_BEAST_ACTIVATION_LINK LI,bst_bbym_sch01.BBY_ACTIVATION_LINE AL,bst_bbym_sch01.BBY_POS_SALE_LINE PL where LI.BBY_POS_SALE_SEQ = PL.BBY_POS_SALE_SEQ and LI.BBY_ACTIVATION_LINE_SEQ = AL.BBY_ACTIVATION_LINE_SEQ and li.transaction_line_no = pl.transaction_line_no AND LI.created_on >= sysdate – 1 Is there something obvious I'm missing?

nnesje · ‎12-03-2020

Can a developer license be used on a Mac version of Splunk? If not, what's the best solution to use a developer license on a Mac? VM?

nnesje · ‎10-07-2020

what is the strptime format for 2020-09-09T13:04:15.7007091Z

Posts	13
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎10-07-2020

Online Status	Offline
Date Last Visited	a week ago

Is it possible or advised to add a custom log to t...

Anyone have a search that will return the indexed ...

Search to return cluster ingest rate (KB/s)

Anyone have a method for pushing scheduled report ...

Using a Lookup table without a Lookup definition

Migrate lookups from one Splunk cluster to another...

Dashboard

DB Connect invalid character error

Developer license on Mac laptop

what is the strptime format for 2020-09-09T13:04:1...