About dmlee

dmlee · ‎06-06-2014

Hi which version are you using ? if you are using Tableau 8.1 , it already include "Splunk" data source , so you do not need to install Splunk ODBC app first.

dmlee · ‎06-06-2014

Hi if the length of this field is fixed , you can try this

dmlee · ‎06-06-2014

Hi I do not know Japanese , so I guess this is what you want , if not correct please let me know

dmlee · ‎06-05-2014

according to the description of "batch" in inputs.conf.spec , you should set move_policy = sinkhole . move_policy = sinkhole * IMPORTANT: This attribute/value pair is required. You *must* include "move_policy = sinkhole" when defining batch inputs. * This loads the file destructively. * Do not use the batch input type for files you do not want to consume destructively. * As long as this is set, Splunk won't keep track of indexed files. Without the "move_policy = sinkhole" setting, it won't load the files destructively and will keep a track of them.

dmlee · ‎06-05-2014

I think the problem is time zone, "China Standard Time" is not the correct format of TZ , you can set TZ=CN or TZ=Asia/Shanghai in props.conf for example : TIME_FORMAT=%m-%d-%Y %H:%M:%S TIME_PREFIX=ctime= TZ=CN

dmlee · ‎11-14-2013

update : I create another pure new splunk 5.0.5 environment and install sideview 2.7 , Table module works correctly !

dmlee · ‎11-10-2013

Hi Somesh, the source code is too long to paste here, I can email to you , is it ok ? I tried Table and SimpleResultsTable modules, Table doesn't support horizontal scrolling , SimpleResultsTable does support ; Table support drilldown but SimpleResultsTable doesn't support drilldown I tried using broser : Chrome 30 and Firefox 24 and IE 7 Regards, Owen

dmlee · ‎11-10-2013

Hi Nick, I think I did not correctly upgrade sideview to version 2.7 , I tried to upgrade again a few minutes ago, now I am sure linking2_tables use Table module and can work (drilldown) correctly . my I know why SimpleResultsTable does not support drilldown ? thanks

dmlee · ‎11-08-2013

Hi the table module support horizontal scrolling ? I do not see the scroll bar , when there are too many columns in the table I can not scroll to right size of table thanks, Owen

dmlee · ‎11-08-2013

Hi I found the drilldown function of SimpleResultsTable does not work after we upgrade to Splunk 5.0.5 and upgrade sideview to 2.7 I run the dashboard "linking2_tables" which is in Sideview Utils App , and found the drilldown function does not work any idea about it ? thanks Owen

dmlee · ‎09-12-2013

Hi , I saw this search command in "File Monitor Inputs" dashboard in SoS App this command can get some special information about splunk monitor file , for example : splunk detect a file which size is zero , seek pointer position is zero , status is "finished reading" , I need these kind of information anyone know how to get theose message using search command ? I tried to study the source code of "tpstatusquery" command but it is too difficult for me thanks

dmlee · ‎09-10-2013

I think you can try below command : sourcetype=counter | bucket _time span=20m | stats min(counter_value) as min_cv max(counter_value) as max_cv by counter, _time | eval diff = max_cv- min_cv | search diff<1000 by the way, if your time span is 20 minutes , the answer should be counter 1 between 3:00:00pm to 3:19:59pm ( not 3:20:00pm) value=100 , 3:20:00 is the beginning of next 20 minutes , right ?

dmlee · ‎07-16-2013

have You tried " | fillnull value=0 totalPaid " ?

dmlee · ‎07-16-2013

may I know if the live time of an allocated IP is always 15 minutes or can be any range ? if the live time is always 15 minutes , you can try this : sourcetype="omend" | rex "(?P [^,]+),(?P [^,]+),(?P [^,]+),(?P [^,]+)" | transaction maxpause=15m IP HostName

dmlee · ‎07-16-2013

first , you need to check if your rex command get correct result sourcetype=tamasvincze | rex ";(?P<UniqueID>([a-z]|[0-9]){32})" | table UniqueID if the result is correct, then run : sourcetype=tamasvincze | rex ";(?P<UniqueID>([a-z]|[0-9]){32})" | transaction UniqueID please note, the field name is case sensitive I use your example log , run above command I pasted and I got four groups Sent;2013-07-12 10:00:06.561;3c34c5e2a32c8b1a7b853958207d223f Timeout;2013-07-12 10:00:07.796;3c34c5e2a32c8b1a7b853958207d223f duration=1.235 Sent;2013-07-12 10:00:06.561;d86dd547438271f2c5bc6c2bceb7e6f3 Received;2013-07-12 10:00:07.984;d86dd547438271f2c5bc6c2bceb7e6f3 duration=1.423 Sent;2013-07-12 10:00:06.561;3c126ec175261f75fcbc567c5c89751d Timeout;2013-07-12 10:00:07.984;3c126ec175261f75fcbc567c5c89751d duration=1.423 Sent;2013-07-12 10:00:06.546;7792eff1b42c35e7a208ffec68f63220 Received;2013-07-12 10:00:07.984;7792eff1b42c35e7a208ffec68f63220 duration=1.438

dmlee · ‎06-27-2013

below are my suggestion : 1st, check the permission and app of the field you defined , you must be in the same app as the field belongs to ( if you share to "App" but not to "global" ) 2nd, click the "edit" icon on the upper right corner of "Interesting field list" , you can see all fields list 3rd, if you cannot find specific field that you defined before , may be the reason is there is no matched rule in your search result

dmlee · ‎06-27-2013

it means, your event is long long time ago (2000/05/10 ) , exceed MAX_DAYS_AGO ( default 2000 days ) in props.conf , so Splunk warning you , you should check if the time extract setting is correct or not , or you should amend the props.conf to increase MAX_DAYS_AGO ( from 2000 to 4745 e.g.)

dmlee · ‎06-26-2013

Hi , my splunk version is 5.0.3 , I find the flashtimeline dashboard shows only the first 1000 events if the number of my search result is large then 1000 events for example I search "index=_internal | head 1010" , Splunk shows there are 1010 events match my search command , but in "Paginator's" module , it only show 20 pages (50 events per page) any idea about that ? thanks

dmlee · ‎02-26-2013

Hi, we do test using version 5.0.2 , master node still won't push other apps (under @SPLUNK_HOME/etc/master-apps/) to index nodes , only _cluster app will be pushed to index nodes. according to http://docs.splunk.com/Documentation/Splunk/5.0.2/Indexer/Updatepeerconfigurations , it should work ,we will do more test later.

dmlee · ‎03-20-2012

my suggestion is : first, check your props.conf (which you had modified DATETIME_CONFIG=CURRENT ) is placed in heavy forwarder or indexer (if no heavy forwarder). second, check your props.conf is work (you should restart splunkd after you modify props.conf; and you should save your props.conf under $SPLUNK_HOME/etc/apps//local/ directory ), use "splunk btool --debug props list" to check if your setting is work

dmlee · ‎01-10-2012

Hi , if one of the indexer is also the search head (run summary search), will outputs.conf be in conflict ?

dmlee · ‎12-01-2011

I saw this error message when I tried to login splunk web , the whole message is Login will fail due to significant clock differences between the server and this machine I check both machine's system time , there is only a few differences between them (seconds). any idea about this ? thanks

dmlee · ‎11-21-2011

Hi araitz, our customer also want to use splunk to monitor logs and send alert message to ArcSight, May I know the progress of your framework ? Could you please share rtoutput.py to us ? thank you.

dmlee · ‎11-07-2011

this issue can be solved by using Sideview's module "Pager" , thanks Nick.

dmlee · ‎11-03-2011

Hi I wrote a simple form search dashboard using <table> module . I found if the number of results over 50,000 , when I click any label of table fields (for example : please refer to below source code , if I click the label said s_Seq , table module will sort whole result base on the content of s_Seq field) , the table won't sort results correctly , if the number of results is less then 50,000 , sort function works fine . anyone know why ? thanks. <?xml version="1.0" encoding="UTF-8"?> <form> <fieldset> <input type="time" /> </fieldset> <row> <table> <searchTemplate> sourcetype=abc Type=2 | where len(ProdId)<10| dedup SeqNo | sort 0 SeqNo | delta SeqNo as diff | where diff>1 | eval s_Seq=SeqNo-diff+1 | eval e_Seq=if(diff>2,SeqNo-1,"") | eval s_time=strftime(_time,"%Y/%m/%d %H:%M:%S.%3N") | eval lost=diff-1 </searchTemplate> <option name="count">10</option> <option name="showPager">true</option> <fields>s_time, s_Seq, e_Seq, lost</fields> </table> </row> </form>

Posts	80
Solutions	8
Karma Given	44
Karma Received	48
Member Since	‎05-04-2010

Online Status	Offline
Date Last Visited	‎07-12-2024 01:26 AM

Sideview Utils Table module question

drilldown function of SimpleResultsTable does not ...

the mechanism of tpstatusquery command

the flashtimeline dashboard only shows first 1000 ...

significant clock differences

can't sort table results from a form search

WinEventLogChannel - saveCheckpointStr : Unable to...

multiple management ports

Received unrecognized signature --splunk-cooked-mo...

load compressed files

Re: Tableau-Splunk-ODBC Issue

Re: Adjust fieldvalue (regex)

Re: 時間の計算方法を教えてください

Re: inputs.conf using batch in stanza

Re: Script Input - Timestamp field extraction from...

Re: Sideview Utils Table module question

Re: Sideview Utils Table module question

Re: drilldown function of SimpleResultsTable does ...

Sideview Utils Table module question

drilldown function of SimpleResultsTable does not ...

the mechanism of tpstatusquery command

Re: Compare two counter values in time

Re: How to have eval use results of accum

Re: Perform Transaction for only repeating values ...

Re: Calculate response time from starttime and end...

Re: Problem with extracted field

Re: A possible timestamp match outside of the acce...

the flashtimeline dashboard only shows first 1000 ...

Re: Clusters and Apps

Re: DATETIME_CONFIG issue

Re: how do you configure the searchead so it sends...

significant clock differences

Re: CEF output to Arcsight - where can I find 'rto...

Re: can't sort table results from a form search

can't sort table results from a form search