About Claw

Claw · ‎10-01-2019

This is exactly the use case for Phantom and using Phantom in the non-security role. Send the alert to Phantom and handle the rest of the logic there. However, I have to disagree with the assertion above. there are many ways to address this in Splunk directly. To do this you need to create a state table of some sort in Splunk and look for results. There are many ways you can do this directly from an alert. Some examples are... - Update a lookup table to run in your search - Create an entry in the triggered alert index and monitor that. - Add a Splunk index entry directly and monitor that If we use an index, the process could look like this... Write a Splunk Search that results in triggering an alert action, well call it "Node Suspected Down" which tests the node to see if it responds. When the test for "Node Suspected Down" completes, write a record to "SplunkDex" with condition "Node Confirmed Up" or "Node Confirmed Down" In the same alert also write an event to a Splunk index. Let's call this index "SplunkDex" and add an event with the condition of "Node Suspected Down" On a timed basis, execute a search looking for active records in "SplunkDex" that haven’t been closed. That is their most current state is "Node Confirmed Down" If the condition is "Node Confirmed Down" set Alert and "Open a Ticket" In the same alert also write an event to "SplunkDex" setting the condition to "Node Ticket Created"

Claw · ‎06-05-2018

If I understand your example and you have date and time in year=2018 month=04 day=05 hour=20 you will have to convert this to a single field for the strptime command to work. | eval my_time=year."-".month."-".day."-".hour."-0-0" | eval _time=strptime(my_time,"%Y-%m-%d-%H:%M:%S") Hope this helps.

Claw · ‎05-18-2018

Check out this blog. https://www.splunk.com/blog/2016/09/16/i-cant-make-my-time-range-picker-pick.html This will make the time range picker work and more.

Claw · ‎04-25-2017

PS. This data is against Hadoop Data via Hunk and there are no date time indexes. So the beautiful append is you wrote in the first example is going to take in this environment probably 3 or 4 hours to run.

Claw · ‎04-25-2017

You are assigning field results to reserved words. As in | stats count as count ,mean(net_pd_amt) as avg by drg_code prov_group below I have changed it to this | stats count as mycount ,mean(net_pd_amt) as myavg by drg_code prov_group Try this instead. index=<claims_table> claim_classification=INPATIENT OR claim_classification="INPATIENT (PART A)*" fst_srvc_dt>=2015* fst_srvc_dt<=2016-11-29 drg_code!=NO_APR drg_code!="N/A" drg_code!=" " drg_code!=00000 | eval prov_group=if(prov_tin=<tin1> OR prov_tin=<tin2> OR prov_tin=<tin3> OR prov_tin=<tin4> OR prov_tin=<tin5> OR prov_tin=<tin6> OR prov_tin=<tin7> OR prov_tin=<tin8> OR prov_tin=<tin9> OR prov_tin=<tin10> OR prov_tin=<tin11> OR prov_tin=<tin12>,"montefiore"," all others") | stats count as mycount ,mean(net_pd_amt) as myavg by drg_code prov_group | eval myavg=round(myavg,0) | eventstats sum(mycount) as mytotal by drg_code | sort 20 -mytotal | xyseries drg_code prov_group myavg mycount | addtotals fieldname=grandtotals | sort -grandtotals After that start from the initial search and test each step to see if you get results. index= claim_classification=INPATIENT OR claim_classification="INPATIENT (PART A)*" fst_srvc_dt>=2015* fst_srvc_dt<=2016-11-29 drg_code!=NO_APR drg_code!="N/A" drg_code!=" " drg_code!=00000 And then index= claim_classification=INPATIENT OR claim_classification="INPATIENT (PART A)*" fst_srvc_dt>=2015* fst_srvc_dt<=2016-11-29 drg_code!=NO_APR drg_code!="N/A" drg_code!=" " drg_code!=00000 | eval prov_group=if(prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin=,"montefiore"," all others") And then index= claim_classification=INPATIENT OR claim_classification="INPATIENT (PART A)*" fst_srvc_dt>=2015* fst_srvc_dt<=2016-11-29 drg_code!=NO_APR drg_code!="N/A" drg_code!=" " drg_code!=00000 | eval prov_group=if(prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin=,"montefiore"," all others") | stats count as mycount ,mean(net_pd_amt) as myavg by drg_code prov_group until you have the entire search running.

Claw · ‎02-08-2017

@somesoni2 is right this search will be a heavy hit in terms of performance so make sure to filter by time so that you are only searching what you have not already checked. Also, I would bet that this only occurs in specific indexes and sourcetypes. Filter by just those indexes and sourcetypes as well.

Claw · ‎12-21-2016

Well a data model can help in two ways. The data model can help to flatten complex data into a simpler flat file view which can help to make data complexity easier to work with. A data model when "accelerated" can reduce the processing and search time for the search. Data model "acceleration" literally creates a highly performant summary view of the data that can in the correct situation dramatically accelerate the backend search and it will make your Tableau experience run faster.

Claw · ‎12-16-2016

This has been answered in this blog. http://blogs.splunk.com/2011/11/21/whats-your-ulimit/

Claw · ‎12-12-2016

The problem is that you have too many file descriptors to manage. Manage how many files you are working with.... Can you move these logs to another location after you have ingested them? Can you copy them to another specific location long enough to ingest them? Allow more file handles…. You should check how many file handles you have configured on your machine. It is possible that you are seeing this problem because you are running out of file handles. https://answers.splunk.com/answers/13313/how-to-tune-ulimit-on-my-server.html But be aware that if you use large numbers of file handles, it will take a long time to start the Splunk forwarder. (I have seen an hour in bad scenarios) and a long time to stop the Forwarder. Setting the ulimit to a very high number could be and acceptable way to get the files loaded initially Skip looking at older files. After you get the old files ingested, you could set the following value in the indexes.conf to tell it to ignore files older than some time. This still means that you’re system has to look at all of the file handles to see how old they are. ignoreOlderThan=1s 1s --> ignores any files older than one sec ignoreOlderThan=1m 1m --> ignores any files older than one minute ignoreOlderThan=1h 1h --> ignores any files older than one hour ignoreOlderThan=1d 1d --> ignores any files older than one day Set up a scripted input using the excellent Splunk Add-On Builder. http://blogs.splunk.com/2016/12/07/easily-create-mod-inputs-using-splunk-add-on-builder-2-0-part-iv/ You will be responsible for inventing the logic in the script to make this possible but with this pass you are in control.

Claw · ‎11-10-2016

This problem is addressed for version 6.x users in the accepted answer listed as: https://answers.splunk.com/answers/141179/how-to-remove-automatic-real-time-searches-that-run-when-users-visit-the-home-page-and-search-app.html I have to admit that I was a little surprised by this problem as I never knew that these searches were real time. On the flip side they are very efficient searches as the are reading all of the data directly from the metadata. Also it is the only case I know of that you can still run real time searches even when turning off real time searches for that user.

Claw · ‎10-17-2016

Are you trying to collect the data from the missing forwarders or are you trying to add the forwarders to the Distributed Management Console. This process deletes the sourcetype holding all of the existing forwarders and the process is usesually ONLY run oneself or so to clean up an environment where you have many forwarders missing and only want to see existing forwarders. Once you run this process, any forwarders that are no longer reporting are just gone and so is any data about them. This is not retrievable. The 24 hour question is asking how much back data for each forwarder do you want to collect. It cannot collect any data from forwarders that it no longer has any record of.

Claw · ‎09-12-2016

When you are working with Hadoop using Hunk or when you are working with Splunk and the time field you want to work with is not _time, you may want to use the time picker in a dashboard with the correct time field. Or you may want to use some timeseries or any other time based Splunk command on that specific time field. Here is a solution you might use to make time selections work on every case including in panels. | inputlookup SampleData.csv | eval _time=strptime(claim_filing_date,"%Y-%m-%d") | sort _time | addinfo Lets Break this down into it’s parts. | inputlookup 837SampleData This is a way to pull in data directly from a csv file so that it behaves just like it would from one of your searches against a Hadoop file that has no _time value. In your search, you would supply something like [ index=SampleData state=”FL” ] Please remember to add enough filters to the search so that you aren’t working with the entire data set. In Hadoop this could be a serious situation leading to copying literally all of your data to a sort. Remember filter first munge later. | eval _time=strptime(claim_filing_date,"%Y-%m-%d") This converts the date in “claim_filing_date” into epoc time and stores it in “_time”. | sort _time This sorts all of the records by time since they weren’t in that order before. | addinfo This adds info_min_time and info_max_time fields which are the min and max of the new values for _time that you have. This is needed for the time control in reports and panels to make it work properly. This is not needed to execute splunk command that are time oriented but it is the magic that will make this work properly in the time drop down in your panels.

Claw · ‎09-07-2016

I would not say that is a recommendation. There are many situations where this is a perfect way to accelerate a search. It is just that the search syntax starts with the declarations for the pivot table and that is something new to learn.

Claw · ‎09-02-2016

All of these kinds of actions are documented here http://docs.splunk.com/Documentation/Splunk/6.4.3/RESTREF/RESTaccess

Claw · ‎04-25-2016

You still asking for a statistically verifiable data sample or are you using this to return a limited subset of the total data? Using this capability to return a limited subset of the data is more manageable than returning a statistically verifiable random sample of the events. In native Splunk we own the data storage algorithm and therefore can create a verifiable sample to the total records. In Hunk you are relying on Hadoop to store the data and therefore we can only deliver a verifiable random sample by returning random hadoop files. Any randomly selected hadoop file may contain zero or more records which meet the search criteria. This means that we can only approximate the total percentage of records returned from the random sample of Hadoop files examined. In fact, we will not know if the 25% sample of files mentioned above contains 10% of the records in question or 45% of the records because we do not know the distributions of target records within a hadoop file. Remember there is no inherent organization in a hadoop file. It is just whatever data your sources have put into it. Now, and here is the interesting point in this process, you could place all of the target searchable terms in a Splunk index by extracting them from Hadoop and indexing them together with the hadoop file name they are contained in and then you would gain all of the Splunk advantages and also keep the original data in hadoop. So searches become a two step process. Search the Splunk index to find the terms you want. Use the list of hadoop files that the terms you are interested and the dates that you are interested in to run a hunk search to return the actual records and then perform whatever other investigation on a much reduced subset of all your hadoop files. This means that all searches begin by selecting terms and dates that apply. Then running a final search to return the raw data. At that point, you can format the output to suit your needs in Hunk or export all of the returned results to your favorite tool. At the end of the first search, all of the statistics and sampling will work for those terms just as you requested.

Posts	38
Solutions	4
Karma Given	23
Karma Received	12
Member Since	‎04-21-2011

Online Status	Offline
Date Last Visited	‎08-09-2023 12:25 PM

When I try downloading the Boundary App for Splunk...

Extract fields fomr Python Dictionary text file

Reading from Tibco queues

Would like to find some sample log files for this ...

How do I set a default search index per app?

source::.../ in props.conf sourcetype stanza appea...

Re: How to chain custom alert actions?

Re: How to change the _time to values inside the e...

Re: How to change the _time to values inside the e...

Re: How can we improve the performance of an Hunk'...

Re: How can we improve the performance of an Hunk'...

Re: How can we indetify indexes which get currentl...

Re: How does Data Model and Tableau work together?

Re: How high can we safely set max_fd in limits.co...

Re: How can we systematically index many large dir...

Re: How to avoid the automatic invocation of a met...

Re: How far back can be go when rebuilding the for...

Re: Why is Hunk 6.1.1 ignoring 'earliest' and 'lat...

Re: Using Pivot command directly in inline search

Re: Is there a way to invoke a REST command to val...

Re: How to get a random sampling from a large data...