Still good after all these years ... View more

@damodeI have the same issue in a Windows machine after changing Splunk from Local account to domain account. Did you find a solution? ... View more

Thank you for sharing that, I understand the problem. However, I have done a reasonably thorough review of the internet and while many people have this same question, I was not able to find anyone who had solved it in a way I could reproduce. What if we changed minutes to hours? it is not ideal, because you end up with decimal hour units, 8.6 hours etc, but it is more intuitive perhaps than minutes and it is easily possible. You could waste many hours putting together an alternative when this gets you most of the way. | makeresults | eval _raw="baseDate,start,end,procTime 2023/05/01,2023/05/01 09:00:14,2023/05/01 09:03:17,183 2023/05/01,2023/05/01 09:03:17,2023/05/01 09:04:57,100 2023/05/01,2023/05/01 09:04:57,2023/05/01 09:08:48,231 2023/05/02,2023/05/02 09:00:11,2023/05/02 09:03:18,187 2023/05/02,2023/05/02 09:03:18,2023/05/02 09:05:31,133 2023/05/02,2023/05/02 09:05:31,2023/05/02 09:09:14,223 " | multikv forceheader=1 | eval pHours = procTime/60 | chart sum(pHours) as Hours by baseDate | eval Hours = round(Hours,1) I am sorry I wasn't able to be of more help. Splunk tempts us with how much it CAN do, but it still has many things it cannot. それを共有していただきありがとうございます、問題は理解しました。しかし、インターネットをかなり徹底的に調査したにもかかわらず、この同じ質問を持つ多くの人々がいる一方で、私が再現できる方法で解決した人を見つけることはできませんでした。 代替案として、分を時間に変更するとどうなるでしょうか？残念ながら、これはあまり理想的ではありません。なぜなら、あなたは小数点以下の時間単位、例えば8.6時間などになってしまうからです。しかし、それは分よりも直感的かもしれませんし、それは容易に可能です。あなたはこれが大部分を満たすときに、代わりに多くの時間を組み立てることに時間を浪費するかもしれません。 もっと役に立てずに申し訳ありません。Splunkはその能力を示唆し、多くのことができると示しますが、まだできないことも多くあります。           ... View more

ok, lets say MY server A is named "splunk.matt.com". in that case, my /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf would look like: [streamfwd://streamfwd] splunk_stream_app_location = https://splunk.matt.com:8000/en-us/custom/splunk_app_stream/ disabled = 0  so for you it would be [streamfwd://streamfwd] splunk_stream_app_location = https://<nanikananika.nanika.com>:8000/ja-jp/custom/splunk_app_stream/ disabled = 0  As for server B, this is the part of the docs that tell you: Install an Independent Stream Forwarder - Splunk Documentation.  Note that the splunk on server A will generate a curl command for you. The curl command will cause server B to download and install from server A. here is the part translated by Chat GPT: curlを使用してIndependent Streamフォワーダーをインストールする Splunk App for Stream（splunk_app_stream）は、コマンドラインから実行できるcurlスクリプトを生成します。これを使用してフォワーダーをインストールできます。 1. Splunk App for Streamのメインメニューで、[設定] > [分散フォワーダー管理] をクリックします。 2. [Streamフォワーダーのインストール] をクリックします。[Streamフォワーダーのインストール]ウィンドウが表示されます。 3. curlスクリプトをコピーします。 4. Independent StreamフォワーダーをインストールしたいLinuxマシン(Server B)にSSHでアクセスします。 5. splunk_app_streamからコピーしたcurlスクリプトを実行します。例えば： curl -sSL https://<nanikananika.nanika.com>:8000/ja-jp/custom/splunk_app_stream/ | sudo bash 各プロンプトでyesかnoと答えて、streamfwdバイナリをダウンロード、インストール、起動します。 I hope that helps. ... View more

To do this properly you would need to do this at index time so that proper event breaking would occur.  If you are trying to do event breaking at search time this becomes much harder.  If this data was properly event broken, each event would have the correct time assigned to it.  this is the best practice.  However I know that is not always within your control. If the above is not possible, then I would start with a rex command with the max_match=0 parameter to capture each pattern repeatedly.  it might look like:  | rex max_match=0 field=_raw (or whatever the field is named) ".*(<ipAddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})(?<connectionTime>.*)(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) This would create 2 new fields per event, one with ALLthe ip address and one with ALL the time field values.  so seperate the multivalue fields, you can use mvexpand, it will create a duplicate event for each value. once you captured a time field, you might then need to use strftime to convert it into Epoch time so that splunk can put it in time order for you. eval _time= strptime(connectionTime, "%Y-%m-%d %H:%M:%S.%N") As you can see, the method to fix this at search time is very complicated.  this search is poorly optimized and they are many points of failure. The best way to proceed, especially if you want to use this data long term, is to set up proper event breaking.  If your Splunk teams needs any help with the event breaking, I'd be happy to walk them through it. ... View more

if i understand your question, I might start by using the split() or rex command to turn the field into two fields: |rex field="接続プロトコル" "(?<user>[^\|]+)\|(<?protocol>.*)" the intent here is captur everyting until '|' and use it to create a 'user' field.  then capture every after '|' and use it to create a protocol field.   once you have two fields, you can: |stats count by user protocol  ... View more

Thank you! I was able to verify the screenshot image. ... View more

I think I understand, you are wondering if there is an easier way.  You may also want a long term solution, one that automatically updates itself, not a one time solution.  Unfortunately, to the best of my knowledge, there is not a field in Splunk by default that displays a hosts server class membership.  The good news is we can create the field we need.  We can create the field called server_class.  And we can populate that field with the correct values. We can create such a field, either with a lookup table or tagging, or an index time field extraction.      For me, I would build on the method I suggested above, create a scheduled search on the deployment server that lists the members of each server class.  I would configure this report to write the results to an index.  I would then schedule a search on the search head to turn this data into a lookup table.  the result would be a self-updating lookup table that lists all hosts and which server classes they are a member of. Step 1 - scheduled report on deployment server I would use this search: | rest /services/deployment/server/clients count=0 splunk_server=local | stats values(serverClasses.*.stateOnClient) as * by hostname | untable hostname server_class dummy |fields - dummy |collect index=test sourcetype=serverclass this search will list ALL clients and server classes, then it will remove the field name dummy as it is not needed.  it then writes that data to an index, in this case the 'test' index.  It also applies a sourcetype=serverclass.  Also please note that I used the untable command to create a field called 'server_class'.   I will then schedule this to run every day, so it will be self-updating.   Step 2 - Schedule a search that creates a lookup table on the search head. Now that I have run the above search at least once, there will be new event data in my 'test' index with a sourcetype of serverclass.   I can now run a search that will create a table of all hosts and the server classes they are a part of.   index=test sourcetype=serverclass |stats count by server_class hostname |field - count |outputlookup serverClassLookup.csv this search will create a table of all hosts and server classes and then create a lookup file with those contents.  I will schedule this search same as the other one, so that it will update itself regularly. Step 3 - set up lookup definition and automatic lookup I will omit a detailed description of these steps in the interest of time, if you want more details on how to do so, I am happy to elaborate.  For now, let assume you did so.  You are now able to do a basic Splunk search such as index=wineventlog server_class=Airwatch. Now there are other ways to solve this same problem and MANY MANY details and decisions I have skipped over in order to keep things simple.  And there are plusses and minuses for the various options.  This is the best option in my opinion but it depends on your circumstances. (日本語) ------------------- I think I understand, you are wondering if there is an easier way.  You may also want a long term solution, one that automatically updates itself, not a one time solution.  わたしは適当に理解していると思います、もっと簡単な方法があるかどうか疑問に思っているんでしょう。 Unfortunately, to the best of my knowledge, there is not a field in Splunk by default that displays a hosts server class membership.  残念ながら、私の知る限り、Splunkにはデフォルトでserver classを表示するフィールドはありません。 The good news is we can create the field we need.  We can create the field called server_class.  And we can populate that field with the correct values. と言っても、必要な server_class というフィールドを作成することができます。 それに、そのフィールドに正しい値を設定できます。 We can create such a field, either with a lookup table or tagging, or an index time field extraction.  このようなフィールドを作成するように、それぞれの方法はあります。ルックアップテーブルまたはタグ付け、またはインデックス時間フィールドの抽出を使用して作成できます。    For me, I would build on the method I suggested above, create a scheduled search on the deployment server that lists the members of each server class.  I would configure this report to write the results to an index.  私にとっては、上記で提案した方法に基づいて、各サーバー クラスのメンバーを一覧表示するスケジュールされた検索を配置サーバーに作成します。そして、「| collect コマンド」をして、Splunkのインデックスに書き込むようにこのレポートを構成します。 I would then schedule a search on the search head to turn this data into a lookup table.  the result would be a self-updating lookup table that lists all hosts and which server classes they are a member of. 次に、Search Headで検索をスケジュールして、このデータをルックアップテーブルに変換します。そうすると、ルックアップテーブが自動的に更新されます。 Step 1 - scheduled report on deployment server I would use this search: | rest /services/deployment/server/clients count=0 splunk_server=local | stats values(serverClasses.*.stateOnClient) as * by hostname | untable hostname server_class dummy |fields - dummy |collect index=test sourcetype=serverclass this search will list ALL clients and server classes, then it will remove the field name dummy as it is not needed.  it then writes that data to an index, in this case the 'test' index.  この検索では、すべてのクライアントとサーバークラスが一覧表示され、不必要なdummyというフィールドも削除されます。 It also applies a sourcetype=serverclass.  Also please note that I used the untable command to create a field called 'server_class'.   I will then schedule this to run every day, so it will be self-updating.   また、sourcetype=serverclassも適用されます。untableコマンドを使用して「server_class」というフィールドの名前を作成したことに注意してください。その後、これを毎日実行するようにスケジュールするので、自己更新になります。 Step 2 - Schedule a search that creates a lookup table on the search head. Now that I have run the above search at least once, there will be new event data in my 'test' index with a sourcetype of serverclass.   I can now run a search that will create a table of all hosts and the server classes they are a part of.   上記の検索を少なくとも一度実行したので、 'index=test'には、sourcetype=serverclass付けの新しいイベントデータがあるはずです。これで、ルックアップテーブル生成検索を実行できます。 時間がなくなってきたので、ここで日本語はやめます。おそらくそれを本当に必要としなかったでしょうが、私にはいい勉強になってけっこう楽しかったです。 index=test sourcetype=serverclass |stats count by server_class hostname |field - count |outputlookup serverClassLookup.csv this search will create a table of all hosts and server classes and then create a lookup file with those contents.  I will schedule this search same as the other one, so that it will update itself regularly. Step 3 - set up lookup definition and automatic lookup I will omit a detailed description of these steps in the interest of time, if you want more details on how to do so, I am happy to elaborate.  For now, let assume you did so.  You are now able to do a basic Splunk search such as index=wineventlog server_class=Airwatch. Now there are other ways to solve this same problem and MANY MANY details and decisions I have skipped over in order to keep things simple.  And there are plusses and minuses for the various options.  This is the best option in my opinion but it depends on your circumstances.     ... View more

After I changed the url: http://splunk:8000/en-US/app/search/search to http://splunk:8000/ja-JP/app/search/search   I was able to save a search and use Japanese's characters for the panel title and whatnot.  Is this not what you experienced?   ... View more

thank you. I think this was the issue. There were thousands of extra directories that , while empty, would keep the tailingprocessor busy. ... View more

Here is how I did it. I used loadjob to call a specific report and then piped it to a search command that includes tokens |loadjob savedsearch="admin:search:Table of Clipping and Signal to Noise Ratio activity By UserName" | search UserName=$UserName$ Here is what it looks like in XML Look up loadjob for more info. <panel> <input type="text" token="UserName" searchWhenChanged="true"> <label>UserName</label> <suffix>*</suffix> <default>*</default> </input> <table> <title>Table of Clipping and Signal to Noise Ratio activity By Group</title> <search> <query>|loadjob savedsearch="admin:search:Table of Clipping and Signal to Noise Ratio activity By UserName" | search UserName=$UserName$</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <option name="count">10</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> ... View more