About Claw

Claw · ‎10-01-2019

This is exactly the use case for Phantom and using Phantom in the non-security role. Send the alert to Phantom and handle the rest of the logic there. However, I have to disagree with the assertion above. there are many ways to address this in Splunk directly. To do this you need to create a state table of some sort in Splunk and look for results. There are many ways you can do this directly from an alert. Some examples are... - Update a lookup table to run in your search - Create an entry in the triggered alert index and monitor that. - Add a Splunk index entry directly and monitor that If we use an index, the process could look like this... Write a Splunk Search that results in triggering an alert action, well call it "Node Suspected Down" which tests the node to see if it responds. When the test for "Node Suspected Down" completes, write a record to "SplunkDex" with condition "Node Confirmed Up" or "Node Confirmed Down" In the same alert also write an event to a Splunk index. Let's call this index "SplunkDex" and add an event with the condition of "Node Suspected Down" On a timed basis, execute a search looking for active records in "SplunkDex" that haven’t been closed. That is their most current state is "Node Confirmed Down" If the condition is "Node Confirmed Down" set Alert and "Open a Ticket" In the same alert also write an event to "SplunkDex" setting the condition to "Node Ticket Created"

Claw · ‎06-05-2018

If I understand your example and you have date and time in year=2018 month=04 day=05 hour=20 you will have to convert this to a single field for the strptime command to work. | eval my_time=year."-".month."-".day."-".hour."-0-0" | eval _time=strptime(my_time,"%Y-%m-%d-%H:%M:%S") Hope this helps.

Claw · ‎05-18-2018

Check out this blog. https://www.splunk.com/blog/2016/09/16/i-cant-make-my-time-range-picker-pick.html This will make the time range picker work and more.

Claw · ‎04-25-2017

PS. This data is against Hadoop Data via Hunk and there are no date time indexes. So the beautiful append is you wrote in the first example is going to take in this environment probably 3 or 4 hours to run.

Claw · ‎04-25-2017

You are assigning field results to reserved words. As in | stats count as count ,mean(net_pd_amt) as avg by drg_code prov_group below I have changed it to this | stats count as mycount ,mean(net_pd_amt) as myavg by drg_code prov_group Try this instead. index=<claims_table> claim_classification=INPATIENT OR claim_classification="INPATIENT (PART A)*" fst_srvc_dt>=2015* fst_srvc_dt<=2016-11-29 drg_code!=NO_APR drg_code!="N/A" drg_code!=" " drg_code!=00000 | eval prov_group=if(prov_tin=<tin1> OR prov_tin=<tin2> OR prov_tin=<tin3> OR prov_tin=<tin4> OR prov_tin=<tin5> OR prov_tin=<tin6> OR prov_tin=<tin7> OR prov_tin=<tin8> OR prov_tin=<tin9> OR prov_tin=<tin10> OR prov_tin=<tin11> OR prov_tin=<tin12>,"montefiore"," all others") | stats count as mycount ,mean(net_pd_amt) as myavg by drg_code prov_group | eval myavg=round(myavg,0) | eventstats sum(mycount) as mytotal by drg_code | sort 20 -mytotal | xyseries drg_code prov_group myavg mycount | addtotals fieldname=grandtotals | sort -grandtotals After that start from the initial search and test each step to see if you get results. index= claim_classification=INPATIENT OR claim_classification="INPATIENT (PART A)*" fst_srvc_dt>=2015* fst_srvc_dt<=2016-11-29 drg_code!=NO_APR drg_code!="N/A" drg_code!=" " drg_code!=00000 And then index= claim_classification=INPATIENT OR claim_classification="INPATIENT (PART A)*" fst_srvc_dt>=2015* fst_srvc_dt<=2016-11-29 drg_code!=NO_APR drg_code!="N/A" drg_code!=" " drg_code!=00000 | eval prov_group=if(prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin=,"montefiore"," all others") And then index= claim_classification=INPATIENT OR claim_classification="INPATIENT (PART A)*" fst_srvc_dt>=2015* fst_srvc_dt<=2016-11-29 drg_code!=NO_APR drg_code!="N/A" drg_code!=" " drg_code!=00000 | eval prov_group=if(prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin= OR prov_tin=,"montefiore"," all others") | stats count as mycount ,mean(net_pd_amt) as myavg by drg_code prov_group until you have the entire search running.

Claw · ‎02-08-2017

@somesoni2 is right this search will be a heavy hit in terms of performance so make sure to filter by time so that you are only searching what you have not already checked. Also, I would bet that this only occurs in specific indexes and sourcetypes. Filter by just those indexes and sourcetypes as well.

Claw · ‎12-21-2016

Well a data model can help in two ways. The data model can help to flatten complex data into a simpler flat file view which can help to make data complexity easier to work with. A data model when "accelerated" can reduce the processing and search time for the search. Data model "acceleration" literally creates a highly performant summary view of the data that can in the correct situation dramatically accelerate the backend search and it will make your Tableau experience run faster.

Claw · ‎12-16-2016

This has been answered in this blog. http://blogs.splunk.com/2011/11/21/whats-your-ulimit/

Claw · ‎12-12-2016

The problem is that you have too many file descriptors to manage. Manage how many files you are working with.... Can you move these logs to another location after you have ingested them? Can you copy them to another specific location long enough to ingest them? Allow more file handles…. You should check how many file handles you have configured on your machine. It is possible that you are seeing this problem because you are running out of file handles. https://answers.splunk.com/answers/13313/how-to-tune-ulimit-on-my-server.html But be aware that if you use large numbers of file handles, it will take a long time to start the Splunk forwarder. (I have seen an hour in bad scenarios) and a long time to stop the Forwarder. Setting the ulimit to a very high number could be and acceptable way to get the files loaded initially Skip looking at older files. After you get the old files ingested, you could set the following value in the indexes.conf to tell it to ignore files older than some time. This still means that you’re system has to look at all of the file handles to see how old they are. ignoreOlderThan=1s 1s --> ignores any files older than one sec ignoreOlderThan=1m 1m --> ignores any files older than one minute ignoreOlderThan=1h 1h --> ignores any files older than one hour ignoreOlderThan=1d 1d --> ignores any files older than one day Set up a scripted input using the excellent Splunk Add-On Builder. http://blogs.splunk.com/2016/12/07/easily-create-mod-inputs-using-splunk-add-on-builder-2-0-part-iv/ You will be responsible for inventing the logic in the script to make this possible but with this pass you are in control.

Claw · ‎11-10-2016

This problem is addressed for version 6.x users in the accepted answer listed as: https://answers.splunk.com/answers/141179/how-to-remove-automatic-real-time-searches-that-run-when-users-visit-the-home-page-and-search-app.html I have to admit that I was a little surprised by this problem as I never knew that these searches were real time. On the flip side they are very efficient searches as the are reading all of the data directly from the metadata. Also it is the only case I know of that you can still run real time searches even when turning off real time searches for that user.

Claw · ‎10-17-2016

Are you trying to collect the data from the missing forwarders or are you trying to add the forwarders to the Distributed Management Console. This process deletes the sourcetype holding all of the existing forwarders and the process is usesually ONLY run oneself or so to clean up an environment where you have many forwarders missing and only want to see existing forwarders. Once you run this process, any forwarders that are no longer reporting are just gone and so is any data about them. This is not retrievable. The 24 hour question is asking how much back data for each forwarder do you want to collect. It cannot collect any data from forwarders that it no longer has any record of.

Claw · ‎09-12-2016

When you are working with Hadoop using Hunk or when you are working with Splunk and the time field you want to work with is not _time, you may want to use the time picker in a dashboard with the correct time field. Or you may want to use some timeseries or any other time based Splunk command on that specific time field. Here is a solution you might use to make time selections work on every case including in panels. | inputlookup SampleData.csv | eval _time=strptime(claim_filing_date,"%Y-%m-%d") | sort _time | addinfo Lets Break this down into it’s parts. | inputlookup 837SampleData This is a way to pull in data directly from a csv file so that it behaves just like it would from one of your searches against a Hadoop file that has no _time value. In your search, you would supply something like [ index=SampleData state=”FL” ] Please remember to add enough filters to the search so that you aren’t working with the entire data set. In Hadoop this could be a serious situation leading to copying literally all of your data to a sort. Remember filter first munge later. | eval _time=strptime(claim_filing_date,"%Y-%m-%d") This converts the date in “claim_filing_date” into epoc time and stores it in “_time”. | sort _time This sorts all of the records by time since they weren’t in that order before. | addinfo This adds info_min_time and info_max_time fields which are the min and max of the new values for _time that you have. This is needed for the time control in reports and panels to make it work properly. This is not needed to execute splunk command that are time oriented but it is the magic that will make this work properly in the time drop down in your panels.

Claw · ‎09-07-2016

I would not say that is a recommendation. There are many situations where this is a perfect way to accelerate a search. It is just that the search syntax starts with the declarations for the pivot table and that is something new to learn.

Claw · ‎09-02-2016

All of these kinds of actions are documented here http://docs.splunk.com/Documentation/Splunk/6.4.3/RESTREF/RESTaccess

Claw · ‎04-25-2016

You still asking for a statistically verifiable data sample or are you using this to return a limited subset of the total data? Using this capability to return a limited subset of the data is more manageable than returning a statistically verifiable random sample of the events. In native Splunk we own the data storage algorithm and therefore can create a verifiable sample to the total records. In Hunk you are relying on Hadoop to store the data and therefore we can only deliver a verifiable random sample by returning random hadoop files. Any randomly selected hadoop file may contain zero or more records which meet the search criteria. This means that we can only approximate the total percentage of records returned from the random sample of Hadoop files examined. In fact, we will not know if the 25% sample of files mentioned above contains 10% of the records in question or 45% of the records because we do not know the distributions of target records within a hadoop file. Remember there is no inherent organization in a hadoop file. It is just whatever data your sources have put into it. Now, and here is the interesting point in this process, you could place all of the target searchable terms in a Splunk index by extracting them from Hadoop and indexing them together with the hadoop file name they are contained in and then you would gain all of the Splunk advantages and also keep the original data in hadoop. So searches become a two step process. Search the Splunk index to find the terms you want. Use the list of hadoop files that the terms you are interested and the dates that you are interested in to run a hunk search to return the actual records and then perform whatever other investigation on a much reduced subset of all your hadoop files. This means that all searches begin by selecting terms and dates that apply. Then running a final search to return the raw data. At that point, you can format the output to suit your needs in Hunk or export all of the returned results to your favorite tool. At the end of the first search, all of the statistics and sampling will work for those terms just as you requested.

Claw · ‎03-04-2016

If someone wants to take on the project to create an app which adds this functionality, this would be a good learning exercise.

Claw · ‎03-04-2016

So finally we are getting to the core of your question and these are the issues. This is a scheduled report and clicking on the Refresh Button on the bottom of the screen returns the results of the saved search and does not re-execute the search. If you click the Magnifying Glass to execute the search in the search panel and then It would have brought up the search with the same saved time as the search was last run. At this point you can select a current time period and get the updated results. But of course every one else that looks at the saved search in the panel still gets the same old last hour or day or whatever time period. One of the main reasons we create a scheduled report on a dashboard is so that every visitor (100? 1000?) doesn't re-execute expensive searches. Another is to publish an edited results set to obfuscate sensitive data. Which brings me full circle. An admin can easily go in and re-run the scheduled search on demand.

Claw · ‎03-03-2016

Make sure not to miss this comment. NOTE: To ensure that the fill_summary_index.py script only executes summary index searches at times that correspond to missing data, you must use -dedup true when you invoke it.

Claw · ‎03-01-2016

One way around this is to use | loadjob with the name of the saved search . You could create an administrative panel for this to keep you users from executing it to many times. Another way you can do this with the REST API by POSTing to the scheduled search's own dispatch endpoint @ curl -k -u admin:pass \ https://localhost:8089/servicesNS/admin/search/saved/searches/MySavedSearch/dispatch \ -d trigger_actions=1

Claw · ‎03-01-2016

Hi Dan Are you saying that the records are not actually JSON or that we have extra spaces to deal with or that you don't want to view the records as JSON?

Claw · ‎02-03-2016

Gary, It looks like a truly interesting APP and I would like to give it a try, but when I try to download this, it sends me to your website and then nothing happens, just an empty screen.

Claw · ‎07-30-2013

To reinforce Sanford's response, we would recommend using a "syslog-aggregator" as "Best Practice" since it provides a reliable way to persist the incoming UDP or TCP data stream. Making your collection process more resilient.

Claw · ‎07-30-2013

This is a straight forward index time override. Place the following props.conf and Transforms.conf entries in your index instances and you will be golden. Make sure you test the regex with your data as your exact [instance=my-instance-01] text my not match my regex. props.conf [udp:5514] TRANSFORMS-udpsource=sourceoverride transforms.conf [sourceoverride] DEST_KEY = MetaData:Source REGEX = [instance=(.+)] FORMAT = source::$1

Claw · ‎07-26-2013

Here is a very clean answer. It assumes that the sourcetype is called python dictionary. Change this to meet your needs. The oddball issue here is the "start" field so we set up automated extractions for every thing else using DELIMS and handle the exceptions with regular extracts. Props.conf [pythondictionary] EXTRACT-PD_MessageLevel = (?i)[.?] (?P \w+)(?=:) EXTRACT-PD_Agent = (?i)^[^[] [(?P [^]]+) REPORT-pythondictionary = PD-Extract EXTRACT-PD_Message = {(?P .+)(?=}) EXTRACT-start = \'start\':\s(? .*?),\s\' Transforms.conf [PD-Extract] SOURCE_KEY = PD_Message DELIMS = ",", ":" Kudos for this solution goes to Dritan Bitincka in Splunk ps.

Claw · ‎07-26-2013

How do I create an extract that handles variable numbers of fields. I am generating events that are time stamped Python dictionaries. The list of items are emitted to the event using Python logging where everything in curly brackets was from a single Python dictionary. The dictionary is rendered using built-in rend(d) where d is a dict. The list of items in the {} brackets are variable, and the order of items is arbitrary. 2013/07/18 19:51:00.090 UTC [DssSplunkHostAgent] INFO: {'rtime': 31556.303133832, 'ABI': 32, 'egid': 20000, 'uid': 101, 'mrcv': 0, 'pctcpu': 0.0, 'pctmem': 0.5523681640625, 'args': 'python -W ignore::DeprecationWarning -m DssCore', 'pid': 9452, 'Taskname': 'DssCore', 'start': datetime.datetime(2013, 7, 18, 11, 5, 5, 785854), 'gid': 20000, 'euid': 101, 'fname': 'python', 'time': 1.244510313, 'oublk': 0, 'dmodel': 1, 'inblk': 0, 'ppid': 9289, 'msnd': 0, 'ctime': 256.16}

Posts	38
Solutions	4
Karma Given	23
Karma Received	12
Member Since	‎04-21-2011

Online Status	Offline
Date Last Visited	‎08-09-2023 12:25 PM

When I try downloading the Boundary App for Splunk...

Extract fields fomr Python Dictionary text file

Reading from Tibco queues

Would like to find some sample log files for this ...

How do I set a default search index per app?

source::.../ in props.conf sourcetype stanza appea...

Re: How to chain custom alert actions?

Re: How to change the _time to values inside the e...

Re: How to change the _time to values inside the e...

Re: How can we improve the performance of an Hunk'...

Re: How can we improve the performance of an Hunk'...

Re: How can we indetify indexes which get currentl...

Re: How does Data Model and Tableau work together?

Re: How high can we safely set max_fd in limits.co...

Re: How can we systematically index many large dir...

Re: How to avoid the automatic invocation of a met...

Re: How far back can be go when rebuilding the for...

Re: Why is Hunk 6.1.1 ignoring 'earliest' and 'lat...

Re: Using Pivot command directly in inline search

Re: Is there a way to invoke a REST command to val...

Re: How to get a random sampling from a large data...

Re: Dashboard with savedsearch need update now????

Re: Dashboard with savedsearch need update now????

Re: Dashboard with savedsearch need update now????

Re: Dashboard with savedsearch need update now????

Re: Why is Hunk outputting space separated values ...

When I try downloading the Boundary App for Splunk...

Re: Question about override source value for a sin...

Re: Question about override source value for a sin...

Re: Extract fields fomr Python Dictionary text fil...

Extract fields fomr Python Dictionary text file