About alacercogitatus

alacercogitatus · ‎11-01-2012

I believe you want the dedup command. sourcetype="incident"| rename record.affectedCI as CI | lookup threshold-Lookup CI AS CI OUTPUT threshold AS threshold | dedup CI| table CI threshold http://www.splunk.com/base/Documentation/5.0/SearchReference/Dedup

alacercogitatus · ‎11-01-2012

Your top command is using total for its "pivot", but I think you want the top number of signatures per dept. Try this: index="myindex_summary" | fields dept, signature | top 10 signature by dept | sort dept, -count

alacercogitatus · ‎10-26-2012

The default is in $SPLUNK_HOME/etc/system/default/times.conf . You will want to copy that to $SPLUNK_HOME/etc/system/local/times.conf and make your changes there. If your question has been satisfactorily answered, please accept the answer.

alacercogitatus · ‎10-26-2012

Well, from the documentation, for 30 minutes you'd have a stanza such as: [last_30_minutes] label = Last 30 minutes header_label = in the last 30 minutes earliest_time = -30m You would change this stanza to match what times you want. Please see the times.conf documentation for more information. I don't see a way to remove them.

alacercogitatus · ‎10-22-2012

I know you can create custom time ranges but not sure about removing them. I'll look deeper in a bit times.conf

alacercogitatus · ‎10-19-2012

field names are case sensitive. what value does "op" have? It should be |eval op = one.":".two.":".three.":".four|

alacercogitatus · ‎10-19-2012

You could try: eval Location=replace(Location,":*",":") , if that doesn't work, could you post some sanatized data to look at?

alacercogitatus · ‎10-19-2012

You will want to use the eval command. your_search | eval new_location = replace(Location, ":+",":")|more_your_search http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions

alacercogitatus · ‎10-18-2012

Do you have outputs configured to send the data to the indexer? Also, the file name is inputs.conf that should go in that folder. make sure you have the s in there.

alacercogitatus · ‎10-18-2012

What file are you putting that in? Could you post the input configuration please? Thanks!

alacercogitatus · ‎10-18-2012

You will want to set that on the input. Example: [monitor:///var/log/syslog] sourcetype = MY_SOURCETYPE disabled = false http://www.splunk.com/base/Documentation/5.0/Admin/Inputsconf

alacercogitatus · ‎10-17-2012

By using the contingency command as mentioned earlier. You're entire search would be sourcetype=foo index=one OR index=two OR index=three|contingency keyword index

alacercogitatus · ‎10-17-2012

If you are refering to Splunk indexes, you can throw them in the same search. sourcetype=foo index=one OR index=two OR index=three

alacercogitatus · ‎10-17-2012

I'm not sure if this is what you are looking for, but you could use the contingency keyword sourcetype=foo | contingency keyword, index It should output something like: keyword one two three four TOTAL Mumbai count count count count total_count chennai count count count count total_count http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Contingency

alacercogitatus · ‎10-17-2012

Using a fschange input might be helpful here. By monitoring the file, and setting the option "sendEventMaxSize = N" then when the input checks the file, it will only send the contents of the file upto N bytes. If no content is sent, then you have progress. Not exactly what you are looking for, but without a perl/bash/python/etc script, I don't think it's possible. That is the other option, by the way. Write a scripted input to output the filesize of the file, and perform your search on that input. http://docs.splunk.com/Documentation/Splunk/5.0/Data/Monitorchangestoyourfilesystem http://docs.splunk.com/Documentation/Splunk/5.0/admin/inputsconf

alacercogitatus · ‎10-17-2012

Please use the backticks (`)around paths, so they don't become garbled. All you should need is: [monitor://D:\test_splunk] whitelist = .* disabled = false followTail = 1 sourcetype = sitescope

alacercogitatus · ‎10-16-2012

You just specify those indexes on the search line: keyword=BLAH index=index1 OR index=index2 OR index=index3 | foo by bar

alacercogitatus · ‎10-15-2012

I believe what you want is to run an alert action. Schedule the search for the data you want sent to the script. Make an alert action that runs a script. The arguments are sent to the script and you can parse it at will from there. http://docs.splunk.com/Documentation/Splunk/5.0/Alert/Setupalertactions#Run_a_script

alacercogitatus · ‎10-15-2012

If I understand your garbled part, I think you are trying to index a UNC. \\servername\C$\test_splunk\Central_wrapper.log.1 or something similar perhaps? I would suggest adding the file instead to the etc/system/local/inputs.conf file to the Universal Forwarder on the WINDOWS server. (most likely under C:\Program Files\Splunk\etc\system\local\ http://docs.splunk.com/Documentation/Splunk/5.0/admin/inputsconf

alacercogitatus · ‎10-15-2012

The only way I do it is via python script. There is no other way to get those logs?

alacercogitatus · ‎10-15-2012

I haven't heard any thing official or even unofficial. Update Splunk 5 was release on Oct 30, 2012. If this is the answer you were looking for, please mark as accepted. Thanks.

alacercogitatus · ‎10-15-2012

You can specify a tcp out via the outputs.conf. You will want to set the flags for indexAndForward=true and sendCookedData=false. The docs cover this really well. I can elaborate if needed. http://docs.splunk.com/Documentation/Splunk/5.0/admin/outputsconf

alacercogitatus · ‎10-12-2012

In a very quick nutshell, you need to start splunk, add the data (logs) to splunk, and then search the logs. 1. http://docs.splunk.com/Documentation/Splunk/5.0/Tutorial/StartSplunk 2. http://docs.splunk.com/Documentation/Splunk/5.0/Tutorial/GetthesampledataintoSplunk 3. http://docs.splunk.com/Documentation/Splunk/5.0/Tutorial/Startsearching

alacercogitatus · ‎10-12-2012

Please accept the answer if my answer answered your question. Thanks!

alacercogitatus · ‎10-12-2012

You will want to review the Tutorial. There is a lot of good information and can get you started in the right direction. The Splunk Tutorial

Posts	1173
Solutions	262
Karma Given	465
Karma Received	1316
Member Since	‎04-19-2011

Online Status	Offline
Date Last Visited	‎10-27-2025 02:25 PM

SplunkJS/HTML Dashboards + map command + $foo$ sub...

Transpose Multi Value Fields

Web Framework Require Local File

Search Returns Exit Code -2

Splunk Daemon Not Responding

Splunk-system-user Report Acceleration Search Stuc...

Modular Input Scripts Don't Die during Splunk rest...

Beta Testers Wanted - Google Apps Modular Input

AutoRun form from populated dropdown when only one...

Linebreaking Failure - BREAK_ONLY_BEFORE_DATE

Re: Problem with Lookup table

Re: Limit search to top 10 by specific fields

Re: Can we give a predefined time for the time pic...

Re: Can we give a predefined time for the time pic...

Re: Can we give a predefined time for the time pic...

Re: how to replace a multiple character to one cha...

Re: how to replace a multiple character to one cha...

Re: how to replace a multiple character to one cha...

Re: Splunk - Universal forwarder

Re: Splunk - Universal forwarder

Re: Splunk - Universal forwarder

Re: search in a multiple index at one go

Re: search in a multiple index at one go

Re: search in a multiple index at one go

Re: Monitor File Size

Re: File path does not exist

Re: How can i do the search in multiple indexes

Re: How to execute perl script in splunk

Re: File path does not exist

Re: Import email body as log

Re: When is Splunk 5 released?

Re: 1 Splunk server that indexes, but also duplica...

Re: Deployment question

Re: Deployment question

Re: Deployment question

Join the Conversation