About joelshprentz

delink · ‎12-21-2015

I downvoted this post because heartbeat messages are still being sent even with sendcookeddata = false and heartbeatfrequency = 0. this is on version 6.2.7. it'd be really nice if splunk fixed this.

joelshprentz · ‎06-08-2012

The excellent response from gkanapathy needed a few changes to work in our Splunk 4.3.1 installation. The hardest part was discovering the SOURCE_KEY for hosts; it is MetaData:Host . Here are the resulting configuration stanzas ... outputs.conf [tcpout] indexAndForward = true defaultGroup = nothing [tcpout:nothing] disabled = false server = falsefoo.bar.com:9998 dropEventsOnQueueFull = 1 [tcpout:dest-host1-log4j] server = dest1:6001 sendCookedData = false [tcpout:dest-host1-syslog] server = dest1:6002 sendCookedData = false [tcpout:dest-host2-log4j] server = dest1:6003 sendCookedData = false [tcpout:dest-host2-syslog] server = dest1:6004 sendCookedData = false Changes: Send logs via TCP instead of syslog. Force raw format for our third-party destination. Index locally in addition to forwarding. Forward only logs for the designated hosts and source types. Worked around for bug SPL-50576 in Splunk 4.3.1 and 4.3.2. See this answer. props.conf [log4j] TRANSFORMS-transform-host1-log4j = route-host1-log4j TRANSFORMS-transform-host2-log4j = route-host2-log4j [syslog] TRANSFORMS-transform-host1-syslog = route-host1-syslog TRANSFORMS-transform-host2-syslog = route-host2-syslog Unchanged. transforms.conf [route-host1-log4j] SOURCE_KEY = MetaData:Host REGEX = host1 DEST_KEY = _TCP_ROUTING FORMAT = dest-host1-log4j [route-host1-syslog] SOURCE_KEY = MetaData:Host REGEX = host1 DEST_KEY = _TCP_ROUTING FORMAT = dest-host1-syslog [route-host2-log4j] SOURCE_KEY = MetaData:Host REGEX = host2 DEST_KEY = _TCP_ROUTING FORMAT = dest-host2-log4j [route-host2-syslog] SOURCE_KEY = MetaData:Host REGEX = host2 DEST_KEY = _TCP_ROUTING FORMAT = dest-host2-syslog Changes: Send logs via TCP instead of syslog. Use the documented SOURCE_KEY for the host.

joelshprentz · ‎09-20-2012

Thanks. The tech notes describe the problem we see. The new 4.3.3 functionality should fix it. This will provide some impetus to our request to upgrade from 4.3.1. I accept your answer.

Jason · ‎11-19-2010

According to http://answers.splunk.com/questions/8370/using-custom-ui-navigation-besides-default-xml - not without some serious customization. "Default.xml" seems hard coded deep in the module definition.

gmelnik · ‎07-25-2015

Joel, [Splunk Developer Guide - Building Splunk Solutions]1 contains many good and proven app building practices discussed in the context of real-world apps. Check it out! Also, these days Simple XML (not Advanced XML) is a way to go.

joelshprentz · ‎10-07-2010

Thank your very much for your well explained solution. It worked for me. I noticed that the original green panel heading came from the group parameter of an EnablePreview module (after conversion from a dashboard to advanced XML). This is rendered as an HTML h2. The SimpleResultsHeader renders an HTML h3 class=header, which is black. Still, that's good enough for me. Thanks again.

Dan · ‎06-16-2010

Yes, it is Splunk Replay modified to take advantage of real-time search. However, at this time there are two issues that need to be mended before the app can be released: allowing the flash movie to communicate directly with splunkd without opening a security hole causing the realtime search to stop when the user navigates away from the page I will post an update once I know more about a release date

jrodman · ‎05-13-2015

FWIW, in both recipes you probably want to consider manipulating the PATH variable as well, to put the things you'll want to use higher on the path than splunk's bin (or dropping the splunk bin dir entirely if that matches your goals), but that's harder to encapsulate in an example.

carasso · ‎12-06-2013

Comparing week-over-week results used to a pain in Splunk, with complex date calculations. No more. Now there is a better way. I wrote a convenient search command called "timewrap" that does it all, for arbitrary time periods. ... | timechart count span=1h | timewrap d That's it! http://apps.splunk.com/app/1645/

Posts	21
Solutions	3
Karma Given	27
Karma Received	28
Member Since	‎05-21-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Raw TCP forwarded events contain ForwarderInfo in ...

Forwarding based on both host and sourcetype

How to resume indexing a file after Splunk ignores...

Can an app use multiple navigation menus?

Best practices for scalable application developmen...

How to display dashboard form choice as a chart or...

Incoming Activity Chart

Python scripted inputs run with the wrong version ...

Re: Raw TCP forwarded events contain ForwarderInfo...

Re: Forwarding based on both host and sourcetype

Re: How to resume indexing a file after Splunk ign...

Re: Can an app use multiple navigation menus?

Re: Best practices for scalable application develo...

Re: How to display dashboard form choice as a char...

Re: Incoming Activity Chart

Re: Python scripted inputs run with the wrong vers...

Re: Line chart comparing yesterday's result with t...

Join the Conversation