Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About aubine
aubine
Explorer
Member since:
02-20-2020
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 2020-02-20 |
Activity Feed
- Posted Dealing with logs that have different update times (while comparing them) on Splunk Search. 09-01-2021 06:32 AM
- Posted Re: Creating a search that looks up values from one logfile and compares against another on Splunk Search. 09-01-2021 06:13 AM
- Karma Re: Creating a search that looks up values from one logfile and compares against another for richgalloway. 09-01-2021 06:12 AM
- Posted Re: Creating a search that looks up values from one logfile and compares against another on Splunk Search. 08-30-2021 08:03 AM
- Posted Creating a search that looks up values from one logfile and compares against another on Splunk Search. 08-27-2021 11:11 AM
- Posted Designing a Splunk Refresh for very non-standard environment on Deployment Architecture. 08-27-2020 10:37 AM
- Posted Re: Is there a difference between runnning Intel CPU's VS AMD EPYC CPU's? on Deployment Architecture. 08-21-2020 10:08 AM
- Karma Re: Is there a difference between runnning Intel CPU's VS AMD EPYC CPU's? for richgalloway. 08-21-2020 09:52 AM
- Posted Is there a difference between runnning Intel CPU's VS AMD EPYC CPU's? on Deployment Architecture. 08-21-2020 08:02 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-01-2021
06:32 AM
(This is a continuation of https://community.splunk.com/t5/Splunk-Search/Creating-a-search-that-looks-up-values-from-one-logfile-and/td-p/565097) So what I'm trying to do is compare values across two different logs that have a unique ID (see above link for more info). The problem I have is that the one log runs on a cronjob every 5 minutes, while the other log only runs when required. I'm using the below code: index=foo (sourcetype=test1 OR sourcetype=test2) host=A* (source="/data/stuff/logfile1.log" OR source="/data/stuff/logfile2.log")
| eval coalesce(lastupdate_direc,file1ID)
| stats values(lastupdate_time) as lastupdate_time, values(file1ID) as file1ID by host, ID
| eval int_time=strptime(lastupdate_time, "%F %H:%M")
| eval timenow=now()
| eval diff_new=timenow-int_time
| eval days_since=((diff_new-14400)/60/60/24)
| table lastupdate_time host name ID days_since As I'm trying to be nice to my indexer, I'm only looking at the past 15 minutes (because of time drift between the servers) so I get multiple lastupdate_time entries in the table and because of that, the days_since field will be left blank. I've tried using chart latest of the values, but I get no results. Am I just not outputting to the correct visualization function or would something other than table be better? Thanks!
... View more
09-01-2021
06:13 AM
Thanks for all your help @richgalloway . Unfortunately, it made a new problem and I will post a new question about that. Thanks again!
... View more
08-30-2021
08:03 AM
Hi Rich, I don't think I properly explained myself so here I'll put the Splunk search that I currently have and you can comment from there: logfile1.log: file1time, epoch, file1ID (this is the unique field), name (this is the field I would like added), flag, stat1, stat2, stat3 logfile2.log: lastupdate_time, lastupdate_direc (this is the unique field), epoch index=foo sourcetype=test host=* source="/data/stuff/logfile2.log"
| eval new_time=strptime(lastupdate_time, "%F %H:%M")
| eval diff_new=now()-new_time
| eval days_since=((diff_new-14400)/60/60/24)
| table host lastupdate_direc lastupdate_time days_since
| dedup lastupdate_direc
| sort days_since
| reverse
| rename host as "Server" lastupdate_direc as "Directory Name" lastupdate_time as "Date/Time Last updated" days_since "Days since last update" The directory is a number field and I have another log file logfile1.log that has the same number field that I want to associate and make it so that I can associate the "name" field (because it's in another software) with the last time the directory updated (and that logs only when there's update rather than constantly and I don't want users to be using an "All Time" search if I can help it). Currently the output looks something like: Server Directory Name Date/Time Last Updated Days since last update server1 1 2021-08-30 11:00 0 server1 2 2021-08-01 11:00 29 server2 1 2021-08-29 00:00 1 What I would like to do is to add one field to that table from logfile1.log with the "name" field that has the same unique ID as the Directory Name (lastupdate_direc). I hope that explained it better. Let me know if it makes sense. Thanks for your quick response! 😄
... View more
08-27-2021
11:11 AM
I have two logfiles, logfile1.log and logfile2.log. I have created their own field extractions for both of them. Here is an example line for both logs: logfile1.log: file1time, epoch, file1ID, name, flag, stat1, stat2, stat3 logfile2.log: lastruntime, file2ID, epoch What I need to do is compare logfiles each against the ID's, ensure that they're the same, and output the "name" field in the search that has logfile2.log as it's source. There's probably a very easy way to do this, but I can't think of it. Any help would be greatly appreciated. Thanks!
... View more
08-27-2020
10:37 AM
Hello all, I've been using Splunk for the past four years and am loving it. I would like to know from the Splunk Community what you all think of the following configuration setups. I am currently running a single instance Splunk server with 16 cores, 64 GB of RAM and 7.2k HDD's. I'm monitoring about 50-100 servers (90%+ are different flavors of Linux) which have very low indexing. All servers together amount for about 150-200MB/day. But I also have about 75 users which need access to the dashboards. I inherited the server about four years ago and it was intially deisgned as of a PoC and it eventually got shipped into Production (with no changes). The server is old and is needs to be evergreened. My question is this: If you could design a new system, what would you go with? I have the possibility of using VM's to create a more distributed environment instead of a single instance, but is it worth it? My idea was to throw AMD's new 64 core EPYC chips with similar 64GB of RAM, have a 500GB SATA SSD and 4TB of 7.2k drives for historical searches. I'm curious to see what the Splunk Trust & Community has to say, because I was talking with several people at .conf19 and most of them had not seen this kind of environment before (low amounts of data and high numbers of users). Any ideas or suggestions would be appreciated. Thanks! Erick
... View more
08-21-2020
10:08 AM
@richgalloway - Thanks! I didn't think that it would matter, but I thought I would ask the community. The price difference between the CPU's is massive and has much higher core counts.
... View more
08-21-2020
08:02 AM
Hello, I'm looking into refreshing my hardware for my Splunk server and was wondering if: 1) Does Splunk support AMD Epyc CPU's? 2) Is there any performance difference between using Intel or AMD chips(ie is Intel preferred or is better optimized for)?
... View more
