About duckware

duckware · ‎02-04-2021

I figured out a way (for my usage case). In my case, I just needed to mark events with X seconds of another event. In one direction, this can be done with delta. But then using sort to reverse direction, and running another delta gets the other direction. So when events E1 and E2 are with 5 seconds of each other, running a delta one direction marks E2 as being within 5 seconds (of E1). That leaves E1 not marked. But then sort to reverse direction of the events and delta again then marks E1 as being within 5 seconds (of E2).

duckware · ‎02-02-2021

Using 'delta' I am able to figure this out, but in one time direction. Now I need the other time direction. In the current event, I essentially need to get the answer to: Is there another event within X seconds (both forwards and backwards) of the current event. Is there a way to do this?

duckware · ‎01-24-2021

Confirmed! key=value past 10 KB in JSON event and Splunk can't find it.

duckware · ‎01-24-2021

I may have just noticed a pattern? The 'not found' events are on 'large' sized JSON events (>10KB) where the keys are near the end of the JSON event. When I search on totally different keys (near the front of that specific event), the one event is found. Hopefully this is enough to get my administrators to fix the issue, but off hand, do you know what setting needs to be changed to get Splunk to index the entire JSON event (not just up to a point)?

duckware · ‎01-24-2021

Every event in an index has field XYZ (with a non-null positive number, no exceptions), and yet this search: index=<index> XYZ=* only finds 99.8% of the events. The way to find the 'missing' 0.2% of the events is by this search: index=<index> NOT XYZ=* Looking at the missing event's _raw, the data is there, and extracting values from _raw (spath) works -- just not via field names in Splunk Search. This 'error' only impacts around 0.2% of the events. Has anyone seen anything like this before? The event is in Splunk, just not searchable. What do I ask the administrators here to investigate?

Posts	5
Solutions	1
Karma Given	1
Karma Received	0
Member Since	‎01-24-2021

Online Status	Offline
Date Last Visited	‎02-04-2021 06:01 AM

How to tell if event is within X seconds (both for...

Some events are in Splunk, but are not searchable

Re: How to tell if event is within X seconds (both...

How to tell if event is within X seconds (both for...

Re: Some events are in Splunk, but are not searcha...

Re: Some events are in Splunk, but are not searcha...

Some events are in Splunk, but are not searchable

Join the Conversation

How to tell if event is within X seconds (both for...

Some events are in Splunk, but are not searchable

Re: How to tell if event is within X seconds (both...

How to tell if event is within X seconds (both for...

Re: Some events are in Splunk, but are not searcha...

Re: Some events are in Splunk, but are not searcha...

Some events are in Splunk, but are not searchable