Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jankowsr
jankowsr
Path Finder
Member since:
05-04-2011
09-26-2023
Community Statistics
| Posts | 31 |
| Solutions | 1 |
| Karma Given | 5 |
| Karma Received | 9 |
| Member Since | 05-04-2011 |
Activity Feed
- Got Karma for Re: Is there a way to enable event sampling in a search?. 07-23-2024 09:35 PM
- Posted Re: Disk space Health Status alert doesn't go away on Monitoring Splunk. 05-05-2022 06:20 AM
- Karma In Splunk Enterprise 7.2, Can you help me clear the Splunkd Health Report feature? for AzJimbo. 05-05-2022 06:20 AM
- Posted Re: Disk space Health Status alert doesn't go away on Monitoring Splunk. 04-22-2022 10:41 AM
- Posted Re: Disk space Health Status alert doesn't go away on Monitoring Splunk. 04-22-2022 10:24 AM
- Posted Why won't disk space Health Status alert go away? on Monitoring Splunk. 04-22-2022 08:15 AM
- Karma Re: indexes.conf change not reflected in GUI without restart for PickleRick. 04-22-2022 08:06 AM
- Posted Re: indexes.conf change not reflected in GUI without restart on Getting Data In. 04-21-2022 12:14 PM
- Karma Re: indexes.conf change not reflected in GUI without restart for isoutamo. 04-21-2022 12:12 PM
- Posted Why is indexes.conf change not reflected in GUI without restart? on Getting Data In. 04-21-2022 09:10 AM
- Karma Re: showperc and usother for stats/charts? for lguinn2. 06-05-2020 12:48 AM
- Karma Re: What is the best way to rename timechart columns? for sundareshr. 06-05-2020 12:48 AM
- Got Karma for Best Splunk IP geolocation and Internet route registry lookup utility. 06-05-2020 12:48 AM
- Got Karma for Re: Best Splunk IP geolocation and Internet route registry lookup utility. 06-05-2020 12:48 AM
- Got Karma for Re: Best Splunk IP geolocation and Internet route registry lookup utility. 06-05-2020 12:48 AM
- Got Karma for Re: Best Splunk IP geolocation and Internet route registry lookup utility. 06-05-2020 12:48 AM
- Got Karma for What is the best way to rename timechart columns?. 06-05-2020 12:48 AM
- Got Karma for Is there a way to enable event sampling in a search?. 06-05-2020 12:48 AM
- Got Karma for Re: Is there a way to enable event sampling in a search?. 06-05-2020 12:48 AM
- Got Karma for Re: Is there a way to enable event sampling in a search?. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
05-05-2022
06:20 AM
I just noticed my issue is a duplicate of: https://community.splunk.com/t5/Monitoring-Splunk/In-Splunk-Enterprise-7-2-Can-you-help-me-clear-the-Splunkd/m-p/447614
... View more
04-22-2022
10:41 AM
The screenshot I provided was already incognito window. And in my opinion the fact whether it was incognito mode or not should not matter. At the end web application should manage cookies/etags/browser cache/whatever and if it needs incognito window in order to work properly I would still consider it as a bug. Unless we suspect that client browser or intermediate proxy does not honor web standards but it's typically not the case.
... View more
04-22-2022
10:24 AM
the disk_space check passes but it does not seem to clear alert
... View more
04-22-2022
08:15 AM
Splunk Enterprise 8.0.4.1
There was a low disk space issue and Health Status alert was raised as expected. But now there is plenty of disk space and the message says: 04-22-2022 15:05:05.257 +0000 WARN DiskMon - MinFreeSpace=5000. The diskspace remaining=221121 is less than 2 x minFreeSpace
221121 is definitely not less than than 2x5000
Am I missing something or is it a bug?
... View more
Labels
04-21-2022
12:14 PM
Thank you, the link you provided did the job. It's still not clear to me if this is needed because of any kind of bug but at least restart is not needed.
... View more
04-21-2022
09:10 AM
I use Splunk Enterprise 8.0.4.1
In indexes.conf I have changed maxTotalDataSizeMB value.
According to https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/Determinerestart that kind of change should not require splunk restart. Anyway I can't see the change in GUI https://my_splunk/en-US/manager/launcher/data/indexes without doing splunk restart. Any clue why is it like that?
... View more
Labels
- Labels:
-
index
05-02-2017
09:06 AM
3 Karma
Some solution that does not answer my question literally (it's not applying sample rate in a query) but completely suits my needs and I have to admit is completely obvious:
<fieldset submitButton="false">
.....
<input type="dropdown" token="sample_rate">
<label>Sample Rate</label>
<choice value="1">1:1</choice>
<choice value="10">1:10</choice>
<choice value="100">1:100</choice>
<choice value="1000">1:1000</choice>
<choice value="10000">1:10000</choice>
<fieldForLabel>sample_rate_label</fieldForLabel>
<fieldForValue>sample_rate_value</fieldForValue>
<default>1</default>
</input>
</fieldset>
<query>index = netflow |lookups .... |eval bs=bytes * $sample_rate$ |stats sum(bs) by Country</query>
<sampleRatio>$sample_rate$</sampleRatio>
... View more
04-24-2017
11:50 AM
Even though it samples the base query I don't think it improves performance at all, actually in terms of performance I don't think it's anything better than the solution with random() function.
... View more
04-24-2017
09:52 AM
1 Karma
Is there any way to enable event sampling in a search?
I know this can be enabled in a GUI using dropdown list under the searchbar but I need that functionality in a search statement.
I have seen some suggestions like adding "| eval rand=random() % 100 | where rand=0 " to the search but it doesn't work really fast.
The ultimate goal is to use custom sample rate in searches behind the dashboard that takes time range as an input argument and it can be few minutes to few weeks so it has big impact on execution time. I would like to give user an option to specify sample rate to speed up the search and adjust calculated statistics accordingly.
... View more
02-10-2017
02:44 PM
3 Karma
I haven't found anything that exactly suits my needs but I've found acceptable for me compromise. Instead of using geoip from Google Maps and Geo ASN, which are slow and obsolete I use the following combination:
for Country/City/Region/latitude/longitude I use Splunk builtin iplocation; specify lang=code to get country codes instead of country names
for BGP prefix and ASN I've created CIDR type lookup from the bgp table
available on the NANOG looking glass server
http://lg01.infra.ring.nlnog.net/table.txt . I also use max_matches = 1 and make sure the most specific prefix matches https://answers.splunk.com/answers/559239/cidr-type-lookup-and-matching-the-most-specific-pr.html
for ASN description (organisation name) I use simple CSV string lookup from the Internet route registry. Specifically in my case I use one of the commercial databases but http://www.caida.org/data/as-organizations/ provids more or less the same data for free
As a result query is few times faster in comparision to geo ASN and goip python lookups and the data is much more up to date.
... View more
02-08-2017
04:28 AM
I came across the same issue and the first thing I did was also increasing limit to literally 100MB, it's probably quite obvious as value has to be integer but what fixed the problem was setting it to
max_memtable_bytes = 100000000
instead of 100MB
... View more
01-18-2017
04:08 AM
1 Karma
I'm looking for the best Splunk IP geolocation and IRR lookup utility (doesn't have to be necessarily free and doesn't have to be one tool).
Ideally it should provide the following info: country code, country name, city, latitude, longitude, ASN number, ASN org name, BGP network prefix, prefix name from the route registry
What I have found so far:
Splunk builtin Iplocation https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Iplocation
Main issues: No route registry information, no BGP data
geoip from from Google Maps https://splunkbase.splunk.com/app/368/
Main issues: obsolete, no route registry information
Geo ASN https://splunkbase.splunk.com/app/576/
Main issues: obsolete, no country code
I guess most of that job should do simple script using free MaxMind database. I'm somehow surprised I can't find anything like that but I could have overlooked something obvious.
Any other suggestions with regards to up to date tools?
... View more
12-09-2016
01:43 AM
I think your idea is magnificent! 🙂
I wasn't really aware of untab and xyseries functions.
I would just do something like
| lookup dnslookup clientip as src_ip OUTPUT clienthost as DST_RESOLVED
|eval DST_RESOLVED=if(isnull(DST_RESOLVED),src_ip,DST_RESOLVED)
in order not to loose "OTHER" value.
Thank you very much
... View more
12-07-2016
12:51 AM
It does not seem to be working for me and I guess the reason for it is that |inputlookup dnslookup is going to work only for static lookup tables. Also I'm not sure if that query would handle correctly "OTHER" column produced by timechart.
... View more
12-07-2016
12:47 AM
First of all I guess you meant to write "sum(bytes) AS bytes" instead of "sum(bytes) a bytes". Anyway
index = netflow flow_dir= 0 | bin span=15m _time | stats sum(bytes) AS bytes by _time src_ip
may return hundreds of thousands results so to be honest I don't think performance is going to be better than doing DNS lookup before timechart unless you select top values. And in such case (selecting top values) you have to take care of calculating "OTHER" column which will probably make query quite complex.
... View more
12-06-2016
06:16 AM
1 Karma
I have a simple timechart query
index = netflow flow_dir= 0 |timechart sum(bytes) by src_ip
I'm wondering how I would rename top source IPs to the result of actual DNS lookups. Theoretically, I could do DNS lookup before the timechart
index = netflow flow_dir= 0
| lookup dnslookup clientip as src_ip OUTPUT clienthost as DST_RESOLVED
| timechart sum(bytes) by DST_RESOLVED
but in this way I would have to lookup every src IP (very slow) in the query not just top values. Is there any recommended approach for that problem?
... View more
10-24-2016
11:43 PM
Thank you for your response, Iguinn.
I'm fully aware of the fact that decision has to be made which column is used for sorting and selecting top values. Anyway since such decision is made having such stats with multiple aggregated columns out of the box and with the "others" row present would be to me a reasonable feature.
I don't want to propose syntax for it but I could imagine it wouldn't be something impossible.
I have just provided my tiny piece of feedback, obviously decision for the future is yours ;-).
... View more
10-24-2016
05:42 AM
ok, can you please clarify in your answer that you are referring to data inputs in the WEB GUI and not the commandline importtool? I would also emphasize that number of fields in the exported CSV file depends on the search mode (fast/smart/verbose).
... View more
10-24-2016
04:52 AM
Ok, I'm not sure how you exactly import that data. If you meant the commandline importtool then it's not working for me. At least not straight away with the syntax I specified above.
What finally has worked for me is importing the CSV file in web GUI Settings -> Data inputes -> (Local Inputs) Files & Directories
... View more
10-22-2016
01:10 PM
Thank you Iguinn, I hoped there will be something simpler that comes with stats/chart, so adding or changing column will not be necessary in 6 places. Anyway I still find it quite smart query
... View more
10-21-2016
07:16 AM
I have tried to do it already, but the format of the CSV is different depending if it was fast/smart/verbose search. Regardless which mode I use and then export CSV file it does not seem to be ready for import out of the box. I get the following error:
# /opt/splunk/bin/splunk cmd importtool /opt/splunk/var/lib/splunk/defaultdb/db 1477039178_330.csv
Using logging configuration at /opt/splunk/etc/log-cmdline.cfg.
unable to parse time.
[...]
unable to parse time.
Successfully imported 0 events into bucket.
Please ensure this bucket resides in a valid index and restart Splunk to recognize the new events.
so maybe I need to do some extra processing with that file or maybe I'm simply doing something stupid...
... View more
10-21-2016
04:13 AM
I'm wondering if there is any option to have a showperc and useother functionality in stats/charts? They seem to be available only in top command which (if I'm correct) can only aggregate by count of events.
So if I want to print simple statistics for top N talkers showing for example:
Source_IP transferred_bytes perc_of_transferred_bytes number_of_tcp_flows perc_of_tcp_flows
1:
2:
3:
.....
10:
Other:
then it becomes quite complex query.
The solution for calculating percents has been provided here: https://answers.splunk.com/answers/9660/stats-count-as-a-percentage-as-the-total.html
The question for calculating "Other" statistics has been raised here:
https://answers.splunk.com/answers/68744/stats-limiting-to-top-results-and-summarizing-the-rest.html
but not answered so far. If found a way of calculating "others" in another query and merging it with the usage of the appendpipe command.
Anyway as a result of all such combinations I have a huge, complex and hard to maintain query. showperc and useother options for stats/charts would make life so much easier. Any ideas?
... View more
10-21-2016
02:38 AM
Hi,
I have a user account on splunk and I would like to export events and then import them into splunk where I have admin rights as well as root account in OS. I do not have account in OS where the source splunk is running, so I don't think I could use the exporttool. I believe I just have standard export options available on web GUI (CSV, XML, JSON, raw events). Is there any recommended method of exporting and importing data in such scenario?
Possibly I could also connect to the source splunk via REST api if this is the way to go.
BTW, I'm not sure if it makes any difference or not but in my case events contain netflow data.
... View more
05-29-2014
10:28 AM
If you are trying to disable the check at the login page, follow my original advice. It is not done in the app.conf at all.
Ok, that answers my question. It seems that I incorrectly assumed that this notification comes from one of the apps and it would be fine to add "check_for_updates = 0" in just one app.conf but it seems I was wrong. I probably should have read more carefully app.conf doc but maybe it would be worth to make make clear distinction between these two options and note that only updateCheckerBaseURL is responsible for notification at login page.
Thank you for your support.
... View more
05-29-2014
09:33 AM
In /opt/splunk/etc/apps I have 12 subfolders. You mean I should create in EACH of them "local" folder and in EVERY "local" folder create app.conf file (if not exists) and add "check_for_updates = 0" entry in ALL 12 app.conf files to get rid of update notification at login page?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-26-2023
03:28 PM
|
