About gkanapathy

gkanapathy · ‎11-04-2014

You should use this app https://apps.splunk.com/app/1876/ instead of the one named "Splunk App for AWS".

gkanapathy · ‎11-03-2014

You would either need to define a field to differentiate the types. Or you can use the "Patterns" tab to have Splunk generate event types to help differentiate different patterns of event text.

gkanapathy · ‎10-31-2014

You may be thinking of the exporttool and importtool commands. These are only necessary if you're moving some of the data from main. If you're moving all data in main, you can simply copy the buckets/folders from main to the new index (while Splunk is stopped, and not taking into account if you're using clustering).

gkanapathy · ‎10-31-2014

This works, but I might suggest the use of the eventstats command rather than appendcols with a subsearch. That is probably a little more efficient, i.e., replace the | appendcols ... | ... with | bucket _time span=1d | eventstats count as TotalNumOrders by _time | ...

gkanapathy · ‎10-31-2014

Maybe but not exactly. Splunk has limits on the number of concurrent searches that may be run on the search head. This can be set globally, but can also be set by role and as a shared total for everyone in a role. If you reach that limit, then searches will be queued. In practice, this means you can't limit a dashboard specifically to do this. But it does mean you can cause this to happen for specific people for all dashboards.

gkanapathy · ‎10-30-2014

It will not available in a 6.2.x maintenance release. It would have to wait until a future minor (or major) release. (Note that the version number of the next non-maintenance release of Splunk has not yet been determined.)

gkanapathy · ‎10-30-2014

And the reason the service still exists and that you don't want to delete it is that it is still possible to reconfigure the system to use the old SplunkWeb/CherryPy UI server. If you need to do so, then you will need the Service to run and control the process.

gkanapathy · ‎10-29-2014

It should be posted in a few days. There was an error in the package build internally for this package so it was not available at the same time as the other releases.

gkanapathy · ‎10-29-2014

I'm guessing you have a realtime search that includes a subsearch as part of the RT search.

gkanapathy · ‎10-29-2014

because both the old and new versions existed on the search head already and therefore can compute the delta there instead of copying a large file for a small change.

gkanapathy · ‎10-29-2014

Yes, it is replicated each time there is a change and a new search has to run. The delta bundle is pushed simply so that the entire bundle doesn't have to be copied over the network, only the changed portions.

gkanapathy · ‎10-28-2014

Although, I do believe that if one site doesn't have enough servers, it will try to replicate to the other. Maybe you want this, maybe you don't.

gkanapathy · ‎10-28-2014

This is a better answer than mine.

gkanapathy · ‎10-28-2014

You can search both with one search head, but you need two masters, one for each cluster.

gkanapathy · ‎10-28-2014

Ah I see you've modified your question. Then perhaps: index=windows [ search index=windows | top limit=3 showperc=f user | where count > 3 ] | eventstats count by user | dedup 3 user sortby - count

gkanapathy · ‎10-27-2014

index=windows | top limit=3 user | where count > 3

gkanapathy · ‎10-27-2014

I don't understand what you're asking for. Why are you using multi-site clustering in the first place? Why don't you just create two separate clusters?

gkanapathy · ‎10-24-2014

What do you mean by "When you configure the input from wire data you list a destination"? Do you mean you created a new wire data instance, and pointed the Splunk App for Stream Location at your heavy forwarder? Or do you mean you modified the default mod input instance and added a _TCP_ROUTING entry that pointed at the heavy forwarder?

gkanapathy · ‎10-24-2014

You should just use normal JSON fields and don't worry about _meta as that's mainly for internal Splunk use. The entire JSON is already indexed, and if you set KV_MODE = json for the source/sourcetype in props.conf (on the search head), then Splunk will automatically do extractions on all JSON fields. Do you have any particular reason to want to create extra indexes for other fields?

gkanapathy · ‎10-24-2014

Actually you don't need to pair transactions or sessions if you just want the total number in a given time period: ... | rex "Session (?<s_sid>\d+) \(\@\) started" | rex "Session (?<e_sid>\d+) ended" | timechart span=1h count(s_sid) AS logins count(e_sid) AS logouts | eval net_logins=logins-logouts | streamstats global=t current=t sum(net_logins) as cumulative_net_users | timechart span=1h sum(cumulative_net_users)

Posts	3150
Solutions	814
Karma Given	1705
Karma Received	3545
Member Since	‎11-16-2009

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Using LWF as intermediate forwarder and using auto...

How do I use intentions and the ConvertToIntention...

Search Filters (srchFilter) when a user is in mult...

limits on "action.summary.index" vs piping to "col...

Can a subsearch return only the value (without the...

Can you refresh or reload index-time sourcetype pr...

How are values in lookups matched?

Does SEDCMD use PCRE regular expressions?

Is there a way to list enabled apps from the CLI?

Re: Why is there no option for S3 input data confi...

Re: How to count and filter types of error data th...

Re: What is recommended on moving select data in t...

Re: stats based on all events and filtered

Re: Is it possible to run dashboard panel searches...

Re: When will Search Head Clustering be enabled fo...

Re: Why is the Splunk Web service not running afte...

Re: Is it possible to get Splunk version 6.2 as So...

Re: What is causing my Activity Jobs pages to be f...

Re: bundle replication and delta

Re: bundle replication and delta

Re: How to stop site replication when using multis...

Re: How to stop site replication when using multis...

Re: How to stop site replication when using multis...

Re: How to get only first 3 events as a result fo...

Re: How to get only first 3 events as a result fo...

Re: How to stop site replication when using multis...

Re: Splunk Stream Distributed Indexing

Re: JSON, TCP Input and _meta

Re: How to graph a unique count of users logged on...