About rshoward

ultimo · ‎09-02-2020

Hi, I can't perform any searches and i cant get any results. I am a mac user. I downloaded splunk for fundemantals 1. Do you happen to have any suggestion? Best.

wjk5828 · ‎03-28-2017

Did you find a solution on this problem? I have a similar non-JSON data set where I would just prefer to "flatten" the tree while indexing.

Goku1 · ‎05-12-2017

Use the following code:: | stats count as sumfield by "field_name" | eventstats sum(sumfield) as Total | eval Entropy= -1*(sumfield/Total)log(sumfield/Total) | stats sum(Entropy) as entropy_value by "*field_name"

mattymo · ‎03-22-2017

Meta Woot all day for this one, gets the basics done for you and you can enrich nicely... https://splunkbase.splunk.com/app/2949/ shout out to the DI team

lqiao · ‎12-18-2017

Yes, you can use Windows TA or simply in the UF inputs.conf, configure the whitelist or blacklist. The whitelist or blacklist functionality exists only from UF v6 onwards. The original post was in 2012, probably at that time, the solution was to do the regex on the indexer or heavy forwarder layer.

Paolo_Prigione · ‎12-14-2011

Mappy has disappeared from the latest 4.3Beta (out Dec 13th, build 114250). It was in $SPLUNK_HOME/etc/apps/search/bin/mappy.py in the september beta, and is present in the beta docs.

rshoward · ‎04-14-2011

this was all in my fast and flustered attempt at getting my first streaming command, and first python code (Yes I've been living under a rock, but only renting), to run before the weekend. I ended up with http://answers.splunk.com/questions/13636/calculate-entropy-just-entropy-not-change-in-entropy-like-associate/13701#13701 I came to the conclusion that I might have been using the functions completely backwards. (bulk for streaming etc)

kogane · ‎07-18-2013

Sadly, was getting an error code 1 from this script... I think I fixed it by removing the "Strip command header" section and setting enableheader=false in commands.conf.

anstoitsec · ‎04-12-2011

Thanks for the help! I've done some fooling around but haven't managed to get the fields right. For some reason some of my fields are not showing up in the 'search' field in the SplunkforSquid app. I'll update the post with a sample log and transforms/props file.

sideview · ‎04-01-2011

Sounds like you're talking about splitSeries in the Simplified XML you would put this inside your <chart> <option name="charting.layout.splitSeries">False</option> and in the advanced XML you'd put this inside your HiddenChartFormatter module: <param name="charting.layout.splitSeries">False</param> However it's strange that you'd ask this question because False is the default. In other words if you're seeing the split series mode, that means your view already has this configuration in there, and it would be set to True. So maybe you mean something else. There are some more (very advanced) docs about this at: http://www.splunk.com/base/Documentation/latest/Developer/AdvChartingConfig-LayoutData

bandit · ‎05-18-2017

Negative latency typically would be improper timezone/timestamp recognition as @srinivasup noted or possibly an invalid system clock time on a host. i.e. if a host clock is running 5 seconds slow, you could see -5 second latency.

Posts	26
Solutions	2
Karma Given	14
Karma Received	25
Member Since	‎04-01-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Determining Logging Lag (and Device Feed Monitorin...

Is mappy here to stay?

splunk.Intersplunk.outputResults sending another h...

Calculate entropy (just entropy, not change in ent...

XML options to change area chart from split to com...

Re: "Waiting for data..." and cannot perform searc...

Re: Splitting header and each entry from a nested ...

Re: What happened to the entropy command?

Re: Determining Logging Lag (and Device Feed Monit...

Re: How to configure a forwarder to filter and sen...

Re: Is mappy here to stay?

Re: splunk.Intersplunk.outputResults sending anoth...

Re: Calculate entropy (just entropy, not change in...

Re: Custom Squid log format

Re: XML options to change area chart from split to...

Re: How can I view the indexing latency for incomi...

Join the Conversation