About cgilbert_splunk

cgilbert_splunk · ‎06-13-2011

I've seen this error before when trying to add a user that didn't exist on the system (this is a system user, not a splunk user). One thing you can try is this: cat /etc/passwd if you have permissions to do so...this will tell you if the user "splunk" exists. The next thing (if splunk does exist) would be to start splunk as the splunk user (to make sure it has proper permissions to do so). If you can't view the /etc/passwd file, you can try this: ./splunk enable boot-start See if this works (if it does, it will use user "root" by default). Hopefully this helps you move the ball forward...

cgilbert_splunk · ‎06-09-2011

Okay, I'll give it a shot...I didn't see any way of doing this with either metadata or dbinspect...but here's what I did: 1) I splunked Splunk...basically, I started monitoring my /splunk/etc directory and ingesting all my splunk config files 2) I determined that the parameter I was looking for in the indexes.conf file is: maxTotalDataSizeMB 3) I defined a field extraction to extract the "header" of each section of a splunk conf file...my regex is: (?im)^(?P [.+]$) ...this helps when I perform my search 4) The search I used after doing all this was: source="/splunk/etc/system/local/indexes.conf" | table Header maxTotalDataSizeMB | rename Header to Index Index maxTotalDataSizeMB [_thefishbucket] 600000 (this is what the results looked like...well, it looked better in Splunk, but hopefully you get the picture)...by the way, this matched up exactly to what I saw in manager. Not at all sure if this solves your problem the way you wanted it solved, but I had fun trying to figure it out!

cgilbert_splunk · ‎06-06-2011

You might try checking out this thread...I haven't had the chance to validate the searches, but there are a few things in here that seem to map to your use case: http://splunk-base.splunk.com/answers/2602/can-splunk-filtermatch-events-and-bring-back-neighbouring-events-like-gnu-grep

cgilbert_splunk · ‎06-03-2011

One way that comes to mind would be to use the "transaction" parameter...this allows you to group events into a single transaction at search time...there are probably a few ways to use transaction in this manner: source=foo | transaction maxspan= for X_identifier...I'd just be looking for something you'd only see in event X. for "field", you have to choose a field in splunk that will be common to both of these transactions...common ones might be host, clientip..etc. maxspan isn't required, but I've found it useful. What this will do is filter for X event, then build a transaction around X that presumably includes Y as well. Now, there may be better ways to do this, but this is one that I've used before for this purpose.

cgilbert_splunk · ‎06-03-2011

My strong suspicion is that this isn't supported. The description for the Radial guage is: The radialGauge, like the other gauge chart types, enables the visualization of a single numerical value mapped against a range of colors that may have particular business meaning or logic. The radial gauge is similar in appearance to a speedometer in appearance; it has an arced range scale and a rotating needle. Also, referencing the chart legend in the developers manual: http://www.splunk.com/base/Documentation/latest/Developer/CustomChartingConfig-ChartLegend#radialgauge Please note that the "valueStyle" property appears to be the only one that allows for modification of the value at the bottom of the gauge...but the description specifically references that you can't use this parameter to permit setting of a text string. "valueStyle style Provides the style properties for the value at the bottom of the gauge. Note that valueStyle can be used to change the way the value displays (font, bolding, italicization, and so on.), but it can't be used to actually change the text itself. For example, you can't use valueStyle to replace the value with a specific text string. See the textBlock table for specific defaults." If I locate anything that indicates that your use-case is supported, I'll definitely update this answer...but as of now, I don't believe it is.

cgilbert_splunk · ‎06-03-2011

What does your search look like? Here's mine: search = * | head 1 | eval count = 32 | gauge count 0 25 50 75 100 What I get is a radial gauge with 0-100 in increments of 10...with "32" in the middle of the gauge and the hand pointing to where 32 would be on the gauge.

cgilbert_splunk · ‎06-02-2011

I believe that your DEST_KEY value isn't valid....keys are case-sensitive and MetaData:Sourcetype is the correct value, not MetaData:SourceType From: $SPLUNK_HOME/etc/system/README/transforms.conf.spec ******* KEYS: ******* NOTE: Keys are case-sensitive. Use the following keys exactly as they appear. queue : Specify which queue to send the event to (can be parsingQueue, nullQueue, indexQueue). _raw : The raw text of the event. _done : If set to any string, this represents the last event in a stream. _meta : A space-separated list of metadata for an event. _time : The timestamp of the event, in seconds since 1/1/1970 UTC. MetaData:FinalType : The event type of the event. MetaData:Host : The host associated with the event. The value must be prefixed by "host::" _MetaData:Index : The index where the event should be stored. MetaData:Source : The source associated with the event. The value must be prefixed by "source::" MetaData:Sourcetype : The sourcetype of the event. The value must be prefixed by "sourcetype::"

cgilbert_splunk · ‎06-02-2011

Do you want a static value to appear in the center of the gauge, or a static range on the radial portion? If you want the latter, you can pipe to the "gauge count" command, followed by the values you want to demarcate the gauge "colors" by. So, issuing "| gauge count 0 25 50 75 100" after your search will start the gauge at "0", then end the green area at "25", the next colored area at "50"...etc (the number of colors is determined by the number of values you use after "count"..basically, n-1) . Now the arc of the gauge can actually have different values listed than you specified (or not)...in this case, my search will produce an arc where the increments go from 0-100 by 10s...but I've seen other behavior based on the number of parameters you use and other factors. Now, if you want to have a static value appear in the CENTER of the gauge, I think you can just change the value of the count using eval...something like this: "| eval count = 1000" Hopefully either of these answered your question.

cgilbert_splunk · ‎05-17-2011

You could run the './splunk enable boot-start' command on the first instance of splunk, then just rename your /etc/init.d script to something like "splunk1" or "splunk2" or something like that, then run chkconfig -add (e.g. chkconfig -add splunk1...that will create all the symbolic links in the rcx.d folders and perform all the other magic. Then, you can move to the next instance and run ./splunk enable boot-start on this instance and rename it again...etc. Basically, every instance will edit/overwrite the script /etc/init.d/splunk...so plan accordingly. You could also edit the /etc/init.d/splunk script, I suppose...but that seems more error-prone.

Posts	9
Solutions	5
Karma Given	0
Karma Received	5
Member Since	‎04-18-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Re: "First-time-run has not finished." After migra...

Re: max index size value

Re: Context Search

Re: Context Search

Re: How to set radialGauge text value?

Re: How to set radialGauge text value?

Re: Tranformations to set different sourcetypes ba...

Re: How to set radialGauge text value?

Re: Multiple instances of Splunk w/ Boot-start