Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About gunnist
gunnist
Explorer
Member since:
08-18-2021
09-28-2026
Community Statistics
| Posts | 12 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 08-18-2021 |
Activity Feed
- Posted What are some best practices for Splunk universal forwarder? on Getting Data In. 12-08-2022 03:08 PM
- Posted Re: Splunk Dashboard drilldown - replace "NULL" with isnull(myfield) in a drilldown search on Dashboards & Visualizations. 03-18-2022 08:17 AM
- Posted Re: Splunk Dashboard drilldown - replace "NULL" with isnull(myfield) in a drilldown search on Dashboards & Visualizations. 03-13-2022 02:36 PM
- Posted Splunk Dashboard drilldown: How to replace "NULL" with isnull(myfield) in a drilldown search? on Dashboards & Visualizations. 03-13-2022 07:14 AM
- Posted Re: What's the optimal best performance solution for creating log files to avoid file locks? on Getting Data In. 08-26-2021 04:10 AM
- Karma Re: What's the optimal best performance solution for creating log files to avoid file locks? for codebuilder. 08-26-2021 04:10 AM
- Posted Re: What's the optimal best performance solution for creating log files to avoid file locks? on Getting Data In. 08-26-2021 02:00 AM
- Posted Re: What's the optimal best performance solution for creating log files to avoid file locks? on Getting Data In. 08-25-2021 01:32 PM
- Posted What's the optimal best performance solution for creating log files to avoid file locks? on Getting Data In. 08-25-2021 11:51 AM
- Posted Re: Splunk search - is it possible to automatically expand a result property wrap? on Splunk Search. 08-23-2021 09:26 AM
- Posted Splunk search - is it possible to automatically expand a result property wrap? on Splunk Search. 08-23-2021 06:47 AM
- Posted Splunk - Assigning custom time on Getting Data In. 08-20-2021 02:23 PM
- Posted Splunk - How to generate an “identity column” id 1,2,3... on Splunk Enterprise. 08-18-2021 07:32 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-08-2022
03:08 PM
My Splunk Forwarder inputs.conf looks like this:
[batch://C:\Splunk\MyApi\Local\Api\*.json] index = myapi_local move_policy = sinkhole disabled = 0 source = myapi sourcetype = Api
My logging files are generating every second . Is that perhaps a little bit too excessive? What's the best practice in using the Forwarder?
File name examples:
MyAPI_2022-12-08 23-06-28.json
MyAPI_2022-12-08 23-06-29.json
...
Thanks! 🙂
... View more
Labels
- Labels:
-
universal forwarder
03-18-2022
08:17 AM
Hi, Thanks, but where do I put the: "<eval token="AnimalTypesSearch">....."
... View more
03-13-2022
02:36 PM
Then I get (when I click on the "NULL" legend in the chart): index="myindex" | ... | where AnimalTypes=if("NULL"="NULL","","NULL")
... View more
03-13-2022
07:14 AM
The search behind my chart:
index="myindex" | ... | timechart count by AnimalTypes (the problem is that AnimalTypes sometimes doesn't exist)
My dashboard displays the following Legend:
- cats
- dogs
- NULL (because sometimes AnimalTypes doesn't exist)
Drilldown search:
index="myindex" | ... | search AnimalTypes=$click.name2$
If I click my dashboard for cats or dogs, it works fine , but when I click the NULL barchart, my clickdown search becomes:
index="myindex" | .. | search AnimalTypes=NULL
(doesn't work)
But it want the search to look like this (which works):
index="myindex" | ... | where isnull(AnimalTypes)
How do I do this? 🙂
... View more
Labels
- Labels:
-
drilldown
-
single value
-
timechart
08-26-2021
04:10 AM
Second thought, just keeping it simple seems enough: # 'batch' reads in the file and indexes it, and then deletes the file on disk. [batch://C:\Splunk\Local\*.json] index=myIndex move_policy = sinkhole disabled = 0 Splunk forwarder waits for roughtly 3 seconds before he deletes it. I think I can just use the default batch settings and create a log file every second, f.ex: 2021-08-26 08-56-40.json Thanks 🙂
... View more
08-26-2021
02:00 AM
I'm thinking of creating a log file every second: $2021-08-26 08-56-40.json $2021-08-26 08-56-41.json etc. ..with one or many record in each. Then after reading this: https://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf [batch://C:\Splunk\Local\*.json] index=myIndex move_policy = sinkhole time_before_close = 1 multiline_event_extra_waittime = true disabled = 0 That should let splunk batch leave the file alone long enough (1sec) so there won't be any conflict. Right?
... View more
08-25-2021
01:32 PM
I want Splunk to delete the data after it reads it in. This works, it eats the files (removes them after reading them in). [batch://C:\Splunk\Local\*.json] index=myindex move_policy = sinkhole disabled = 0 I guess batch is the way to go if I want Splunk to delete the files afterwards. I guess I have to find a way to tell the log system (NLog): "Write your file and then release the lock and leave it alone" Do you agree?
... View more
08-25-2021
11:51 AM
F.ex. when using NLog file target: https://github.com/NLog/NLog/wiki/File-target What's the optimal performance way for creating log files for the Forwarder? One record per file (timestamp + guid.json)...which would create a lot of files. Or perhaps logging every second (multiple records per log file), but what about file locks? I don't want Splunk Forwarder to fight with nlog about who has a lock on the file. What's the optimal best performance solution for creating log files to avoid file locks?
... View more
Labels
- Labels:
-
universal forwarder
08-23-2021
09:26 AM
source=my_local| sort -Date | mvexpand Properties gives me: Field 'Properties' does not exist in the data. Am I missing something?
... View more
08-23-2021
06:47 AM
Hi, In my query: index="my_local" | sort -Date I get a list of items, and if I look at one item (and lick "show as raw text") it looks like this: {"Level":"Info","MessageTemplate":"ApiRequest","RenderedMessage":"ApiRequest","Properties":{"httpMethod":"GET","statusCode":200}, ...} Since a lot of the properties are wrapped inside "Properties", I always have to expand it manually by clicking the expand icon (with plus sign). Is there any way to get the search results already expanded (so I don't always have to click "Properties" to manually expand it)? Many thanks! 🙂
... View more
08-20-2021
02:23 PM
I want my time to be the "Date" property in the following json: { "Level": "ERROR", "Date": "2021-08-20 17:21:53.6355", "Logger":.... } I created a props.conf here: ...\Splunk\etc\system\local with: TIME_PREFIX = "Date":\s" TIME_FORMAT = %Y-%m-%d %H:%M:%S.%4N I then restarted splunk...but it's not working. Any idea what I'm missing?
... View more
Labels
- Labels:
-
props.conf
08-18-2021
07:32 AM
We're logging info/error logs in splunk/db. We're using .net and nlog. In db, we're getting it in the right order when sorting because of identity column. In Splunk, it's coming out of order if many log entries have the same date. Is there a chance to tell splunk to create a "identity column" for everything that is piped into it? We're piping the logs into Splunk using HTTP Event Collector. Thank you! Gunnar
... View more
Labels
- Labels:
-
using Splunk Enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-28-2026
06:12 AM
|
