Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ejpulsar
ejpulsar
Path Finder
Member since:
04-02-2013
06-05-2020
Community Statistics
| Posts | 17 |
| Solutions | 1 |
| Karma Given | 2 |
| Karma Received | 1 |
| Member Since | 04-02-2013 |
Activity Feed
- Karma Re: Determine numerical value belong to intervals which stored in static lookup for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Overlapped events in summary index when using sitimechart for somesoni2. 06-05-2020 12:46 AM
- Got Karma for Search Head pool on RAMdisk. 06-05-2020 12:46 AM
- Posted Re: Planning Cluster Total Storage Capacity (when no one peer holds entire buckets set) on Deployment Architecture. 10-30-2014 12:57 AM
- Posted Re: Determine numerical value belong to intervals which stored in static lookup on Splunk Search. 10-30-2014 12:46 AM
- Posted Re: Determine numerical value belong to intervals which stored in static lookup on Splunk Search. 10-30-2014 12:40 AM
- Posted Re: Determine numerical value belong to intervals which stored in static lookup on Splunk Search. 10-29-2014 11:55 PM
- Posted Re: Search Head pool on RAMdisk on Deployment Architecture. 10-29-2014 05:26 AM
- Posted Determine numerical value belong to intervals which stored in static lookup on Splunk Search. 10-29-2014 01:32 AM
- Tagged Determine numerical value belong to intervals which stored in static lookup on Splunk Search. 10-29-2014 01:32 AM
- Tagged Determine numerical value belong to intervals which stored in static lookup on Splunk Search. 10-29-2014 01:32 AM
- Posted Re: Confused with sed replace. Change 1,2,...,20,21,22 to 1,2,...,20,###,22 on Splunk Search. 07-15-2014 01:21 AM
- Posted Confused with sed replace. Change 1,2,...,20,21,22 to 1,2,...,20,###,22 on Splunk Search. 07-15-2014 12:54 AM
- Tagged Confused with sed replace. Change 1,2,...,20,21,22 to 1,2,...,20,###,22 on Splunk Search. 07-15-2014 12:54 AM
- Tagged Confused with sed replace. Change 1,2,...,20,21,22 to 1,2,...,20,###,22 on Splunk Search. 07-15-2014 12:54 AM
- Posted Re: Overlapped events in summary index when using sitimechart on Splunk Search. 06-18-2014 05:19 AM
- Posted Re: Overlapped events in summary index when using sitimechart on Splunk Search. 06-18-2014 02:42 AM
- Posted Re: Overlapped events in summary index when using sitimechart on Splunk Search. 06-17-2014 12:34 AM
- Posted Overlapped events in summary index when using sitimechart on Splunk Search. 06-16-2014 11:30 PM
- Tagged Overlapped events in summary index when using sitimechart on Splunk Search. 06-16-2014 11:30 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
10-30-2014
12:57 AM
Hi Kristian! Thanks for the answer and late accept.
Now I clearly figured this.
... View more
10-30-2014
12:46 AM
As you see below, its possible now 🙂
... View more
10-30-2014
12:40 AM
Got it!
With expanding case argument by subsearch
Thanks to all for help!
* | eval NUM=150 | eval NAME=case([|inputlookup name_range.csv| eval argument="NUM>=".interval_begin." AND NUM<=".interval_end.",\"".name."\"" | stats values(argument) as argument | eval argument=mvjoin(argument,",")|return $argument])
... View more
10-29-2014
11:55 PM
We've tried this way. Unfortunately intervals is so big and resulting lookup over 10-20GB in size.
... View more
10-29-2014
05:26 AM
Hi!
Yes, we've got nearly 100k sustained IOPS on RHEL HA Storage and NFS.
But this configuration is not moved to production, we've decide to stand on SSD's.
... View more
10-29-2014
01:32 AM
Hi!
We've "broken" our heads on this.
Let we have events with field
NUM=100
NUM=150
And static lookup with interval looks like this (yes, we can change it format if needed):
NAME START END
A 100 120
B 121 180
We need to produce evens like
NUM=100 NAME=A
NUM=150 NAME=B
... View more
07-15-2014
01:21 AM
You are awesome right!
Thank you!
... View more
07-15-2014
12:54 AM
Hi,
I try to test sed expressions in search app for futher proper filtering of incoming data with SEDCMD.
Let 1 have a strings [0-9a-zA-Z]* delimited by commas. There can be no any string between commas.
i.e. 1,a,B,,D,5
I'm trying to build regex to change 21-th pattern occurence in the string to some fixed chars (#)
Splunk IFX gives me that perfect extraction regex
(?i)^(?:[^,]*,){21}(?P [^,]+)
I tried to transform it to sed replace
s/(?i)(?:[^,]*,){21}([^,]+,)/###,/
It gives me all string wiped from start to 22-th pattern occurence
###,22-th occurence,24,25
What am I doing wrong?
... View more
06-18-2014
05:19 AM
Thanks, i've finally got this settings. Are it correct?
1) Start Time: -1h@h
2) End Time: @h
3) Cron Schedule: 5 ! ! ! !
(!=*, incorrect site formatting)
... View more
06-18-2014
02:42 AM
Yes, definetely.
But I'm upset that si- commands acts as collect command and didn't help to automate filling gaps in summary index.
Are there any trick to construct search to fill all summary index gaps which was a week or a month ago?
... View more
06-17-2014
12:34 AM
Ahrrgw sorry.
I forgot to delete "earliest=" string at the top of the search.
... View more
06-16-2014
11:30 PM
Hi,
i'm using splunk 6.1.1
I made this si- search and scheduled it to run "every hour" at period -1h@m to "now"
..
| where isnotnull(HAS_ERROR_TYPE)
| dedup SID1
| sitimechart span=1h count by HAS_ERROR_TYPE
I've got many overlapping events in Summary index next day.
,"2014-05-25T00:00:00.000+0400",,"Summary Index - USSD","Summary Index - USSD","Found overlap in saved search 'Summary Index - USSD' between search ids: '1402966801.531' and '1402974001.568' from 'Sun May 25 00:00:00 2014' to 'Tue Jun 17 05:00:01 2014'","Sun May 25 00:00:00 2014","Tue Jun 17 05:00:01 2014"
Whats wrong in my search or scheduler?
... View more
10-28-2013
12:59 AM
1 Karma
Hi,
As I know, search head pool needs a tremendous IOPS to operate fast. Last "good to go" configuration i've heard from splunk architect was 10k IOPS per search peer.
If I'll setup 30GB RAMDISK with Linux tmpfs, sharing it over tuned NFS to another head and supplying it with proper rsync scripted "backend", will it sounds good?
... View more
- Tags:
- ramdisk
- search_head
10-14-2013
02:09 AM
Hi!
I need to build realtime search which tracks if NO events with particular P_LOGIN_NAME are received in last 15 minutes.
But the core problem is: if no events, there are no these lines in chart.
1) I have events with fields
P_LOGIN_NAME=STRING1 status=200
P_LOGIN_NAME=STRING1 status=404
P_LOGIN_NAME=STRING3 status=200
LOGIN=STRING4 status=200
2) My realtime core search (rt-15m) with some enrichment with external csv:
source="Apache_dealers_pays_logs" status=200 OR status=404 |
eval P_LOGIN_NAME=coalesce(P_LOGIN_NAME,LOGIN) |
chart count OVER P_LOGIN_NAME by status
3) It works flawlessly until no events in past 15 minutes present by P_LOGIN_NAME . I tried to avoid it by csv with all P_LOGIN_NAME :
source="Apache_dealers_pays_logs" status=200 OR status=404 |
eval P_LOGIN_NAME=coalesce(P_LOGIN_NAME,LOGIN) |
chart count OVER P_LOGIN_NAME by status |
JOIN type=outer P_LOGIN_NAME [ | inputcsv PLATEZHI_KASSY_Description.csv | table P_LOGIN_NAME ]
4)
First trouble: I still didn't see joined rows with empty fields.
Second trouble: I did not know, how it will be work in rt search.
... View more
09-12-2013
02:44 PM
Hello
Should we point forwarders on all 50 peers?
... View more
09-10-2013
02:24 AM
Hi,
I've read several cluster deployment references but still have no clearly answer for one question.
I need to store 50 TB of data in a cluster with 30-50 typical peers which have 1-2TB RAID1,10 storage on each. I need to expand this storage by simply adding peers. I do not want to use Storage Systems with 25-50TB pool (it's so expensive). Can Splunk spread buckets to other peer and holds on first peer only part of entire buckets?
Аccording "Buckets and clusters" first peer holds all buckets, but when it's dead all buckets spreads across all cluster.
Is this any performance impact on searching? Or we must use storage systems or third party file system virtualization tools?
... View more
09-02-2013
12:01 AM
Hi, I'm trying to calculate daily time shift baseline by this query
source="MySource" | eval ReportKey="Today" |
eval d1AgoEarliest=relative_time(_time,"-1d@d")|
eval d1AgoLatest=relative_time(_time,"-0d@d")|
append [search source="MySource" starttimeu=d1AgoEarliest endtimeu=d1AgoLatest]
It retuns error
d1AgoEarliest is not a valid value for starttimeu. It is not a positive floating point number.
... View more
- Tags:
- subsearch
