About Wilcooley

Wilcooley · ‎12-03-2014

Documentation is in the README.txt, so you have to look in the filesystem where the app is installed. @bigmuse85 The lookup command does not exactly work as you expect (and I myself can never remember): If the IP address is not in the field ip , add AS my_ip_field , which in your case would be ... | lookup whoisLookup ip AS c_ip .

Wilcooley · ‎06-13-2014

Wouldn't these give me separate transactions?

Wilcooley · ‎05-29-2014

I am trying to create transactions based on two fields where one changes and one is not always present. For example, I want single transaction of the following events: event=1 pid=1 event=2 pid=1 qid=2 event=3 pid=2 qid=2 But what I get is 2 transactions, with " ...|transaction qid pid ": event=1 pid=1 event=2 pid=1 qid=2 and event=3 pid=2 qid=2 Is it possible to make transaction do this? The only solution I have been able to think of is to null the pid field for the "event=3" sort of events, but that seems ugly. I have tried the various parameters to transaction , such as connected , unifyends , but they have made no difference. Just in case my simplified example is inconsistent with reality, the real events are Sendmail submission logs, where the name of the authenticated sender has no queue ID and can only be correlated with the actual messages sent by the PID (and host). (No idea what's going to happen if/when I get looking for multiple messages related to a single authentication event.) Here's a scrub 'd example of my results. First transaction: madonna sendmail[10102]: r2RPOYuJ011100: to=<Hildred_Joan@example.com>, delay=00:00:00, xdelay=00:00:00, mailer=esmtp, pri=000404, relay=marget-h0.example.com. [178.115.54.001], dsn=2.0.0, stat=Sent (Ok: queued as 502VQ10L21) Second transaction: madonna sendmail[02104]: AUTH=server, relay=host-167-042.dina.ben.edu [031.002.167.042], authid=hpjmm1@ben.edu, mech=PLAIN, bits=0 madonna sendmail[02104]: r2RPOYuJ011100: from=<hpjmm1@ben.edu>, size=10405, class=0, nrcpts=1, msgid=<V2K3020H-7264-3WMX-632E-T4X004IM01A0@ben.edu>, proto=ESMTP, daemon=MSA, relay=host-167-042.dina.ben.edu [031.002.167.042] FWIW, I'm still on 5.0.3.

Wilcooley · ‎03-17-2014

Follow up: Setting CASScope in the virtual host Location section to " / " seems to have fixed this issue for me: <Location /> ... AuthType Cas CASScope / ... </Location>

Wilcooley · ‎01-07-2014

Yes, I used "showsource=1" in the URL of a dashboard made with the Simple XML Panel Editor to see it, in addition to seeing it in the generated module docs. Thanks you for confirming that it was there to support the Simple XML application and was not necessary when working with Advanced XML directly; I suspected as much. So if I understand you correctly, the "ViewstateAdapter" module is also unnecessary in Advanced XML?

Wilcooley · ‎01-07-2014

The module doc says that the "Gimp" module "Listens to all instructions and says nothing" but gives no explanation for why that would be necessary or useful and it is not mentioned anywhere else in the docs. The wiki also turns up nothing, nor does searching here on splunk answers. Yet it is included in the advanced XML generated by the dashboard editor, so it seems like it must have a purpose.

Wilcooley · ‎09-03-2013

Were you able to resolve this? I am seeing basically the same problem that you have described, also using CAS for SSO. Deep links, such as a bookmark to a view or dashboard will sometimes not work. It seems to affect people who only look at the deep link; I usually do not see it myself, unless it's my first time hitting splunkweb since a browser restart or something -- I usually do not see it, in fact, because I usually hit the root path and get bounced through language detection into "search/flashtimeline", which is what I assume you mean by "the home page". My CAS settings are slightly different and I am using CAS 3.3.5: CASLoginURL https://sso.example.com/cas/login CASValidateURL https://sso.example.com/cas/serviceValidate CASProxyValidateURL https://sso.example.com/cas/proxyValidate The ?gateway=true part of your CASLoginURL is odd; from what I can tell, it is this: https://wiki.jasig.org/display/CAS/Using+CAS+without+the+CAS+login+screen which were I not having the same problem seems like it could be part of the problem. I am also unclear why you've used the proxyValidate URL instead of the serviceValidate URL.

Wilcooley · ‎08-27-2013

Assuming that you are asking about concatenating fields of an individual event, I think you can use FORMAT in transforms.conf : [my_sourcetype] REGEX = (\S+)\s+HTTP/\d\.\d\s+\d+\s+(\S+) FORMAT = myurl::$1/$2 At least, there are examples in both the README and default directories of using extracted bits in the name and value of a single field, such as the auto-kv extraction and this from README/transforms.conf.example : [session-anonymizer] REGEX = (?m)^(.*)SessionId=\w+(\w{4}[&"].*)$ FORMAT = $1SessionId=########$2 DEST_KEY = _raw Oh, but RTFMing, I see in README/transforms.conf.spec:121 for 5.0.3: FORMAT for search-time extractions: ... NOTE: You cannot create concatenated fields with FORMAT at search time. That functionality is only available at index time. So I think I am going to have to change my answer to, "You can't have that wish, my Little Bear."

Wilcooley · ‎08-27-2013

Just for clarification: You're asking for concatenating the fields of an individual event of the 2nd sourcetype, not concatenating fields between events of different sourcetypes, correct?

Wilcooley · ‎04-17-2013

Yes, there is now a contributed Augeas lens that has not yet been released: https://fedorahosted.org/augeas/ticket/284 Combine that with the ability of Puppet 2.7.18 to sync Augeas lenses w/pluginsync and you're good to go: http://docs.puppetlabs.com/guides/plugins_in_modules.html (At least, in theory; I haven't tried either the lens or syncing lenses myself yet.)

Wilcooley · ‎02-27-2013

Interesting performance tip: For a reasonably optimized eventtype definition (in my test case it was just sourcetype=foo ), you get nearly the same performance running eventtype=foo | fields - eventtype as sourcetype=foo | fields - eventtype , in exploratory mode. It makes sense -- as a primary search term, the eventtype just expands like a macro; the post-processing "what eventtypes does this event match?" is the time sink.

Wilcooley · ‎02-14-2013

As of 5.0.2, the docs are... different. "Troubleshoot Splunk SSO" says, "Splunk is configured to accept the remote header value of X_REMOTE_USER , which is the default for most proxies." http://docs.splunk.com/Documentation/Splunk/5.0.2/Security/TroubleshootSplunkSSO "Configure ..." in that same doc says, "The default Splunk header used is REMOTE_USER , ...". And web.conf.spec agrees.

Wilcooley · ‎02-14-2013

Using REMOTE_USER as the HTTP header or something else? (To save everyone else the trouble of figuring out what "ARR v2.5 and URL rewriter 2.0" are: They're part of Microsoft IIS.)

Wilcooley · ‎02-13-2013

RFE: Please add a way to format arbitrary fields as a relative time text like reltime does for _time . Looking at the source for reltime.py , it looks like it should be straightforward to add, although from a user's perspective it might be more obvious to look for this sort of thing in eval .

Wilcooley · ‎02-13-2013

Oh, I see now that relative_time is supposed to return an epoch date -- I had assumed it worked like reltime and produced a string like "N days ago" or "N months ago", which is what I want, not a duration. So the short answer, I guess, is that I cannot cleanly do what I want. If preserving the origin time were important, I could just save and restore _time with eval : eval orig_time=_time |eval _time=since_epoch |...(reltime etc)... |eval _time=orig_time Thanks for validating that my logic was correct, aside from not carefully reading the doc about relative_time !

Wilcooley · ‎02-13-2013

I would like to format a field other than _time as relative time, like the reltime command does for _time (and only for _time , as far as I can tell). The following seems like it should work, but does not: (usual event search) | fields since | eval since_epoch = strptime(since, "%Y-%m-%d %H:%M:%S") | eval since_relative = "-" + tostring(round(now() - since_epoch,0)) + "s@s" | eval since_relative2 = relative_time(now(), since_relative) | table _time, since* Here is the result: _time since since_epoch since_relative since_relative2 1360674666.336103 2012-12-11 14:13:24.000000000 -0800 1355264004.000000 -5439049s@s 1355264004.000000 1360674664.507974 2013-01-10 17:09:47.027586083 -0800 1357866587.000000 -2836466s@s 1357866587.000000 1360674663.323016 2013-01-14 09:41:36.000000000 -0800 1358185296.000000 -2517757s@s 1358185296.000000 ... My guess is that relative_time does not like such a huge number of seconds and assumes there must be some error. I am currently using version 4.3.2.

Wilcooley · ‎01-31-2013

There is eventgen, which was extracted from one of the official Splunk apps. I'm not sure why it isn't included in SplunkBase.

Wilcooley · ‎01-09-2013

The Splunk forwarder package is a subset of the Splunk package, installed into a different directory, so adding the forwarder is redundant since the installed Splunk package can do all of the file monitoring that the forwarder does. I would be surprised if you can have them both running at the same time.

Wilcooley · ‎01-09-2013

I don't suppose you could give an example of the field? That would help immensely. I'm guessing it's something like "100 kWH"? Have you confirmed that eval xx=rtrim(Total_Energy,"kWH") results in something that looks like a number? Is there a space in your "kWH" that I can't see and is there a space between the number and the string? A trailing space might make the rtrim output look not like a number and would be hard to see. rtrim seems kinda like an odd choice, though it seems like it should work. Personally I would have used a regular expression with replace : replace(Total_Energy, "^(\d+)", "\1")

Wilcooley · ‎01-09-2013

Oh wow, I read this as CSV until I saw your example... With some of my Git repos I log on repo push (which is effectively a commit on the master repo) with the 'post-update' hook. I haven't looked at CVS for years, but if I recall correctly, it has a hook mechanism that you could use similarly. I use logger which logs to syslog, so I only use the first line of the commit message, which by convention in the Git world is a summary or subject. If you want to index the whole commit message, you'll probably need to use a Splunk forwarder. Here it is in the cvsbook.

Wilcooley · ‎10-18-2012

@abhayneilam: Does this answer your question? If so, could you mark it as such?

Wilcooley · ‎10-16-2012

I've updated with these 2 additional constraints. By "delete if any blank line" do you mean the whole line could be blank or just the "SEARCH" column? The first case should be handled automatically; the "search SEARCH=*" should work for the latter.

Wilcooley · ‎10-16-2012

| inputlookup (or inputcsv) foo.csv | search SEARCH=* | eval SEARCH=lower(SEARCH) | stats count by SEARCH

Wilcooley · ‎10-11-2012

To use the CLI w/the free version, use the default login: admin/changeme.

Wilcooley · ‎09-06-2012

Sorry for bringing up an old question but I happened upon this after some recent IRC discussion. I am curious about the size of the journal in your ext4 file system. With ext3 (and presumably ext4 by extension), having too small of a journal was a source of stalls or hangs when writing. This could happen if you initially created a small file system and then grew it significantly. You can find out with the dumpe2fs command (sub '4' for '2' if on EL5): dumpe2fs -h /dev/XXX |grep Journal It would also be interesting to know what features are enabled; you can get that with either the dumpe2fs or tune2fs -l command. Also, what kernel version & distro are you using? I am assuming that you're using Splunk as the UDP listener and not feeding via an intermediary syslog server? (My Splunk never sees UDP traffic because I feed it via rsyslog.)

Posts	36
Solutions	4
Karma Given	48
Karma Received	32
Member Since	‎04-25-2011

Online Status	Offline
Date Last Visited	a week ago

Transaction with changing transitive field?

What is the purpose of the "Gimp" module?

How to format non-_time field as relative time?

SSO works with anything but REMOTE_USER

What should be in my .gitignore for a new app/add-...

Surprising behavior of nav collections of saved se...

Filtering results based on subsequent events?

Manual PDFs in non-letter page size?

Re: whois on Splunk 6?

Re: Transaction with changing transitive field?

Transaction with changing transitive field?

Re: SSO sometimes fails with "deeper" URLs

Re: What is the purpose of the "Gimp" module?

What is the purpose of the "Gimp" module?

Re: SSO sometimes fails with "deeper" URLs

Re: concatenating fields at search time in props.c...

Re: concatenating fields at search time in props.c...

Re: augeas lenses for Splunk?

Re: performance considerations for eventtypes?

Re: SSO works with anything but REMOTE_USER

Re: SSO works with anything but REMOTE_USER

Re: How to format non-_time field as relative time...

Re: How to format non-_time field as relative time...

How to format non-_time field as relative time?

Re: Event Generator

Re: How to use forwarder

Re: tonumber() not working

Re: Injecting CVS commits to Splunk index

Re: Report using Splunk

Re: Report using Splunk

Re: Report using Splunk

Re: App for Web Intelligence - Summary Indexes not...

Re: UDP droppage because of ext4 filesystem: