Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About stefandagerman
stefandagerman
Path Finder
Member since:
09-04-2012
06-05-2020
Community Statistics
| Posts | 27 |
| Solutions | 4 |
| Karma Given | 0 |
| Karma Received | 15 |
| Member Since | 09-04-2012 |
Activity Feed
- Got Karma for Re: OS and browser extraction from useragent. 06-05-2020 12:46 AM
- Got Karma for Re: field value is field name Defined. 06-05-2020 12:46 AM
- Got Karma for Re: BREAK_ONLY_BEFORE_DATE catches serial numbers. 06-05-2020 12:46 AM
- Got Karma for Re: BREAK_ONLY_BEFORE_DATE catches serial numbers. 06-05-2020 12:46 AM
- Got Karma for Re: incorrect host names. 06-05-2020 12:46 AM
- Got Karma for Re: incorrect host names. 06-05-2020 12:46 AM
- Got Karma for Re: Folder Monitoring. 06-05-2020 12:46 AM
- Got Karma for Re: need basic directions for cleaning out indexed data. 06-05-2020 12:46 AM
- Got Karma for Re: How to develop splunk app using java?. 06-05-2020 12:46 AM
- Got Karma for How to to search across clustered and stand-alone indexers. 06-05-2020 12:46 AM
- Got Karma for Re: How to to search across clustered and stand-alone indexers. 06-05-2020 12:46 AM
- Got Karma for Re: How to to search across clustered and stand-alone indexers. 06-05-2020 12:46 AM
- Got Karma for Re: How to to search across clustered and stand-alone indexers. 06-05-2020 12:46 AM
- Got Karma for Re: How to to search across clustered and stand-alone indexers. 06-05-2020 12:46 AM
- Got Karma for Re: how do i access a field that is not listed?. 06-05-2020 12:46 AM
- Posted Re: how do i access a field that is not listed? on Security. 05-29-2014 05:03 PM
- Posted Re: automatic lookup on a field that is automatically looked up on Splunk Search. 07-10-2013 05:47 PM
- Posted Re: How to develop splunk app using java? on Splunk Dev. 04-18-2013 11:44 AM
- Posted Re: need basic directions for cleaning out indexed data on Dashboards & Visualizations. 04-18-2013 11:39 AM
- Posted Re: Folder Monitoring on Getting Data In. 04-15-2013 01:25 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 |
05-29-2014
05:03 PM
1 Karma
Can you not set KV_MODE=JSON (your event looks like it is valid JSON) in props.conf for the sourcetype and let Splunk do the work for you?
props.conf docs
... View more
07-10-2013
05:47 PM
I assume you meant:
LOOKUP-foo = lookuptablefoo userid AS myuserid OUTPUT username AS myusername
LOOKUP-bar = lookuptablebar username AS myusername OUTPUT usergroup AS myusergroup
Yes, you can use the result of one lookup anywhere after that lookup executed as the OUTPUT data (myusername) will be a regular field accessible to subsequent commands.
You probably want to make sure you get one and only one match from the first lookup. I believe Splunk will return multiple matches as a multikv field, which the subsequent lookup probably won't know what to do with.
... View more
04-18-2013
11:44 AM
1 Karma
Splunk apps are not really code, they are collections of searches, dashboards, reports, scripts etc. that are grouped together in a directory.
I would suggest you peruse this
http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/Whatsinthismanual to learn how to go about creating them.
A good starting point: http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/AppIntro
... View more
04-18-2013
11:39 AM
1 Karma
You don't need a script.
May I suggest reading up on how to configure your index(es) to define data retention?
This may be helpful:
http://docs.splunk.com/Documentation/Splunk/5.0.2/Indexer/HowSplunkstoresindexes
http://wiki.splunk.com/Deploy:BucketRotationAndRetention
... View more
04-15-2013
01:25 PM
1 Karma
Anything in here missing to answer your question? http://docs.splunk.com/Documentation/Splunk/latest/Data/Configureyourinputs
Splunk does not do 'timed' monitoring. It can monitor your folder and pick up any *.msg file when it appears/changes. If you need to make sure that data is only indexed every 15 minutes (use-case?), setup a cronjob that copies the file "on the quarter hour" into the folder monitored by splunk and consider using a batch input, if your file size justifies it.
... View more
04-15-2013
12:04 PM
For MySQL, it looks like this:
http://dev.mysql.com/doc/refman/5.0/en/columns-table.html
... View more
04-15-2013
11:54 AM
What you could do in that case is to query the database catalog tables for the table you are interested in and get a list of the columns that are defined for that table. Depends on the RDBMS you are using, for DB2, for example, it's something like: "SELECT * from SYSIBM.SYSCOLUMNS where schema="foo" and table="bar".
That would give you the names (and attributes) of all columns for the table. You could easily filter by adding " AND name LIKE "field name_%" if you only want to see the column names that follow a given pattern.
... View more
04-15-2013
11:45 AM
As asked, this is really a SQL question and I think the answer in that case is no, I don't think you can use wildcards in database columns. But I think I may be misunderstanding the question.
Can you tell us a bit more of what exactly you are trying to do?
... View more
04-10-2013
05:17 PM
Yes you can, with a userid that has can_delete privilege (admin does not have that by default).
Construct a search that returns all events you want deleted, make sure the result is what you expect and add "| delete" once you are sure.
Note that events will not be deleted physically, so if you want to reclaim the disk space immediately, I think you would have to delete and recreate the index and re-index everything.
... View more
04-10-2013
01:54 PM
Does the query get executed successfully outside of Splunk, say using an Oracle client?
... View more
04-10-2013
01:38 PM
Note that that new field won't be indexed like the 'host' field is.
... View more
04-10-2013
01:37 PM
2 Karma
If you don't want to or cannot reindex your data, I would probably use tags or create a new field with an appropriate RegEx that normalizes your server names. You'd then use the tag or new field name in your searches rather than the original server name.
... View more
03-13-2013
08:42 AM
Not quite, the link talks about how to add metadata to indexed data, which is done through props/transforms/fields as well. If you want to add a metadata field to each event, that is how you need to do it.
So, the only open questions are:
What is your system property variable, i.e. where is it defined (environment, config file, etc.)?
and
Can you write a RegEx to retrieve that variable?
If you can't, I don't know of any way to achieve what you are trying to do.
... View more
03-08-2013
01:19 PM
Take a look here and note that this is NOT a recommended practice due to the impact on indexing performance
... View more
01-31-2013
04:07 PM
True, if you are wiling to accept that your previously non-clustered indexer is a candidate for receiving new data as part of satisfying replication requirements for indices defined in the cluster and don't want to retire the non-clustered node.
The goal for the approach outlined above - even if I failed explicitly stating it - was to enable migration to a clustered environment while preserving access to historical data until it ages out without adding new data to the indexer hosting it. I definitely could have been clearer about that. 🙂
... View more
01-31-2013
11:37 AM
Are the arguments to the count() function field names or strings?
... View more
01-31-2013
11:25 AM
How about you create your own topic, given the completely different nature of your question, once you have determined the the Splunk documentation at http://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf does not provide the answer to your question?
Please don't hijack threads as it is unlikely that you will get a response.
... View more
01-31-2013
11:05 AM
4 Karma
Since you cannot search across a mixed indexer environment (clustered and non-clustered), you will have to create a one-node cluster.
Here are the required steps:
Stop forwarding any new data to the standalone indexer
If your standalone indexer is pre-V5, upgrade to V5
In the standalone indexer with historic data, install another instance of Splunk (change default ports as needed)
Configure this new instance as a cluster master (Let's call it CM_Historic). Set RF and SF = 1
Configure your standalone indexer to be part of CM_Historic. Now you've successfully setup the 1-node cluster
Go to your SH and configure the server .conf to search across both the clusters (CM_Historic and CM_Current, which is your shiny new cluster that receives all the new data).
Once your historic data has aged out, you can remove CM_Historic from server.conf and decommission the server
Hope this helps folks facing a similar situation.
... View more
01-31-2013
10:59 AM
1 Karma
Assuming you have an established Splunk infrastructure with one or more indexers and everything is happily humming along. Now you have decided to take advantage of the V5 index cluster feature and create a new index cluster with the search and replication factors that satisfy your availability needs. But you still have good historic data in your standalone indexers that you want to be considered when searching data now indexed by your cluster.
Since it is not possible to setup a search head such that it uses clustered and non-clustered indexes at the same time, how can you make that work?
PS: Sorry for the misleading question title... 😉
... View more
01-09-2013
04:57 PM
Can you take a look here and see if that is what you are looking for? Your inner search would need to extract the two time values from the XML, format them and you should then be able to use those values in your outer search.
Sorry if I misunderstood your question!
... View more
01-03-2013
03:18 PM
2 Karma
This will hopefully make your life a whole lot easier... http://strftime.net
In your case, you probably need: %A %b %e %T %Y (not tested)
... View more
11-26-2012
11:28 AM
If there is no space after the ':', automatic field extraction will not happen and you will instead need to setup the required field extractions as per http://docs.splunk.com/Documentation/Splunk/5.0.1/Knowledge/Addfieldsatsearchtime
... View more
11-23-2012
01:48 PM
I believe that if both EXTRACTs apply to the same source, sourcetype or host, you will get the outcome you see. The documentation for the props.conf spec (http://docs.splunk.com/Documentation/Splunk/5.0/Admin/Propsconf#props.conf.spec) states that you need to use REPORT instead of EXTRACT if - amongst other reasons - you want to:
* Apply more than one field-extracting regular expression to the same source, source
type, or host. This can be necessary in cases where the field or fields that you want
to extract from a particular source, source type, or host appear in two or more very
different event patterns.
Can you try REPORT and (pun not intended) report back, please?
... View more
11-17-2012
03:23 PM
1 Karma
I think you need to try to restate your question. It may be just me, but I really don't understand what you are trying to do.
... View more
11-17-2012
03:13 PM
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/Spath#Examples
Have you tried spath path=HDD.HDID and it didn't work?
It should. and spath path=HDD.VOL.VNM should give you the third level element.
... View more
