Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About JykkeDaMan
JykkeDaMan
Path Finder
Member since:
08-18-2017
08-14-2025
Community Statistics
| Posts | 37 |
| Solutions | 3 |
| Karma Given | 1 |
| Karma Received | 5 |
| Member Since | 08-18-2017 |
Activity Feed
- Posted Re: Splunk DB Connect deployment to shcluster gives error "Identity password is corrupted." on All Apps and Add-ons. 08-14-2025 03:53 AM
- Posted Re: Splunk DB Connect deployment to shcluster gives error "Identity password is corrupted." on All Apps and Add-ons. 08-11-2025 11:44 PM
- Posted Re: Splunk DB Connect deployment to shcluster gives error "Identity password is corrupted." on All Apps and Add-ons. 08-11-2025 01:22 AM
- Posted Splunk DB Connect deployment to shcluster gives error "Identity password is corrupted." on All Apps and Add-ons. 08-08-2025 01:20 AM
- Got Karma for Re: Splunk add-on for unix and linux: nfsiostat support for RHEL9/Rocky9?. 10-09-2023 06:11 PM
- Got Karma for Re: Splunk add-on for unix and linux: nfsiostat support for RHEL9/Rocky9?. 10-09-2023 11:24 AM
- Posted Re: Splunk add-on for unix and linux: nfsiostat support for RHEL9/Rocky9? on All Apps and Add-ons. 10-09-2023 11:17 AM
- Posted Splunk add-on for unix and linux: nfsiostat support for Rocky9? on All Apps and Add-ons. 10-09-2023 10:04 AM
- Posted Re: Report results to event summary index, why value with hyphen (-) is double quoted? on Splunk Search. 10-06-2022 06:04 AM
- Posted Report results to event summary index, why value with hyphen (-) is double quoted? on Splunk Search. 10-05-2022 12:50 PM
- Posted Re: How to split by comma and use values as field names? on Splunk Search. 09-30-2022 05:01 AM
- Posted How to split by comma and use values as field names? on Splunk Search. 09-29-2022 11:19 PM
- Posted Re: spunk perfmon.exe counters not found error in splunk internal index on Getting Data In. 10-25-2021 02:02 AM
- Posted Checkbox value to another token with searchWhenChanged=false on Dashboards & Visualizations. 09-19-2021 11:01 PM
- Got Karma for How to customize Alert Manager incident email alert results_link and view_link URL (host:port)?. 01-29-2021 07:33 AM
- Got Karma for How to use events only from 'active' host?. 10-29-2020 03:34 AM
- Posted How to use events only from 'active' host? on Splunk Search. 10-28-2020 11:04 PM
- Karma Re: How do I get RobotFramework tags into Splunk via Jenkins plugin? for Ted. 10-28-2020 12:34 PM
- Posted Re: How do I get RobotFramework tags into Splunk via Jenkins plugin? on Getting Data In. 10-28-2020 04:10 AM
- Posted Re: How do I get RobotFramework tags into Splunk via Jenkins plugin? on Getting Data In. 10-27-2020 11:49 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-14-2025
03:53 AM
This is how I got it fixed. So, what I did instead was: - Stop Splunkd on deployer. - curl delete secret on every shcluster member. curl -k -u username -X DELETE https://<host>:<management-port>/servicesNS/nobody/splunk_app_db_connect/storage/collections/data/secret - Delete full directory /opt/spluk/etc/apps/splunk_app_db_connect from shcluster members. - Restart Splunkd on all shcluster members. - Start deployer and push bundle to deploy the app again. Now the identity.dat is the same on all sh1-3 and deployer. But I think the issue comes from my deployment process due to this nasty bug: https://splunk.my.site.com/customer/s/article/Pushing-App-config-changes-from-search-head-cluster-deployer-are-not-being-pushed As I cannot just change the .conf files under shcluster/apps/<app>/ and push the bundle, I have to do: 1. mv shcluster/apps/splunk_app_db_connect shcluster/apps/splunk_app_db_connect_temp 2. Push the bundle and wait for the rolling restart of shcluster members. 3. mv shcluster/apps/splunk_app_db_connect_temp shcluster/apps/splunk_app_db_connect 4. Push the bundle and wait for the rolling testart of shcluster members. And while the _temp app gets deployed and started, I assume that will mess up the KV-store secret (and/or the identity.dat)? As after my above procedure, the identity.dat on shcluster members != deployer and the app gives an error again.
... View more
08-11-2025
11:44 PM
Hmmm, how do I run the curl to 8089 if I have the Splunkd stopped on all the shc nodes?
... View more
08-11-2025
01:22 AM
Ok, i'll try. But was there something I did wrong when deploying the app? Why did I end up into this state and how to prevent it in the future?
... View more
08-08-2025
01:20 AM
I have installed and configured the DB connect under my deployer. Added identities and connections. Then copied the etc/apps/splunk_app_db_connect to /etc/shcluster/apps/ and pushed the bundle to shcluster. As per doc: https://help.splunk.com/en/splunk-cloud-platform/connect-relational-databases/deploy-and-use-splunk-db-connect/4.0/install-splunk-db-connect/install-and-configure-splunk-db-connect-on-a-splunk-enterprise-on-premise-distributed-platform-deployment App is deployed but identity.dat file is generated every 30s on sh members and that is different than on my deployer. DB Connect GUI on SH members gives me an error: "Identity password is corrupted." What did I miss?
... View more
Labels
- Labels:
-
troubleshooting
10-09-2023
11:17 AM
2 Karma
Yes, I will create a support request also. A quick and dirty workaround to get at least the same old columns from Rocky9 I can use field ID_LIKE from /etc/os-release: if [ -e $OS_FILE ] && ( ( (awk -F'=' '/ID_LIKE=/ {print $2}' $OS_FILE | grep -q rhel) ...
... View more
10-09-2023
10:04 AM
App: https://splunkbase.splunk.com/app/833 It looks like the nfsiostat.sh script is not compatible with the RHEL9. I'm testing with Rocky9.2 and the nfsiostat command output is already different to 7.9. EDIT: It seems to support RHEL9 explicitly (without the new columns), but NOT Rocky9. Example from 7.9: # nfsiostat
server:/mnt/yumrepo mounted on /repos/pkg.repo.d:
op/s rpc bklog
33.88 0.00
read: ops/s kB/s kB/op retrans avg RTT (ms) avg exe (ms)
1.382 43.682 31.613 3357 (0.0%) 0.612 1.551
write: ops/s kB/s kB/op retrans avg RTT (ms) avg exe (ms)
4.595 138.038 30.041 1041 (0.0%) 1.659 11.039 Example from Rocky9.2: - First op/s => ops/s - 2 new metrics: "avg queue (ms)" and "errors" server:/mnt/yumrepo mounted on /repos/pkg.repo.d:
ops/s rpc bklog
0.453 0.000
read: ops/s kB/s kB/op retrans avg RTT (ms) avg exe (ms) avg queue (ms) errors
0.000 0.001 1.356 0 (0.0%) 0.096 0.108 0.006 0 (0.0%)
write: ops/s kB/s kB/op retrans avg RTT (ms) avg exe (ms) avg queue (ms) errors
0.001 0.035 25.519 0 (0.0%) 0.562 0.600 0.027 0 (0.0%) nfsiostat.sh script cannot parse the new format and currently I get something like this: # /usr/ipbx/splunkforwarder/etc/apps/Splunk_TA_nix/bin/nfsiostat.sh
Mount Path r_op/s w_op/s r_KB/s w_KB/s rpc_backlog r_avg_RTT w_avg_RTT r_avg_exe w_avg_exe
server:/mnt/yumrepo /repos/pkg.repo.d read: write: ops/s ops/s 0.000 avg avg RTT RTT
0.000 0.001 rpc 0.096 0.108
0.001 0.453 read: 0.000 ops/s avg RTT
write: kB/o ops/s rpc mounted
... View more
Labels
- Labels:
-
installation
10-06-2022
06:04 AM
But is this only 9.x feature, since I cannot find it from 8.x. I'm still running 8.1.2.
... View more
10-05-2022
12:50 PM
Isn't hyphen a minor breaker so I'm wondering why the values with hyphen get double quoted when doing summary indexing? This breaks the tstats TERM and PREFIX usage. Assume I have the following datas: _time field1 field2 2022-10-05 22:22:22 what-not whatnot Will end up into summary event index with: 10/05/2022 22:22:22, field="what-not", field=whatnot What I have missed when populating my summary index?-)
... View more
Labels
- Labels:
-
tstats
09-30-2022
05:01 AM
Indeed, stats(*) as * by <field_always_exist> :-).
... View more
09-29-2022
11:19 PM
I have the following fields, where some of them might be null, empty, whatnot values. I would like to split the Services values, which might have 1-N values separated by a comma, to separate columns/fields prefixed with "Sp.". For example: | makeresults | eval Platform="p1", Ent="ent1", Ext="100", Fieldx=null(), Fieldy="" , Services="user,role,func1,func2" | append [ | makeresults | eval Platform="p1", Ent="ent2", Ext="100", Fieldx="", Fieldy=null(), Services="user2,role2,func4,func8,func5,role3" ] | fields _time Platform Ent Ext Fieldx Fieldy Services Gives an example like: _time Platform Ent Ext Filedx Fieldy Services 2022-09-30 08:56:11 p1 ent1 100 user,role,func1,func2 2022-09-30 08:56:11 p1 ent2 100 user2,role2,func4,func8,func5,role3 How do I split the Services into a separate fields? I think I cannot just use stats list() by "All_fields" due to those possible null values in other fields. _time Platform Ent Ext Fieldx Fieldy Services Sp.func1 Sp.func2 Sp.func4 Sp.func5 Sp.func8 Sp.role Sp.role2 Sp.role3 Sp.user Sp.user2 2022-09-30 09:07:00 p1 ent1 100 user,role,func1,func2 func1 func2 role user 2022-09-30 09:07:00 p1 ent2 100 user2,role2,func4,func8,func5,role3 func4 func5 func8 role2 role3 user2
... View more
Labels
- Labels:
-
fields
10-25-2021
02:02 AM
Hi, did you figure out the issue here? Since I see the same errors, but the data is still coming in.
... View more
09-19-2021
11:01 PM
I cannot make this work if I have the searchWhenChanged=false. I would like to set the token and do the search only after Submit button is pressed. <form script="simple_xml_examples:showtokens.js">
<label>Set another token by checkbox value</label>
<fieldset submitButton="true">
<input type="checkbox" token="checked" searchWhenChanged="false">
<choice value="yes">Check for yes</choice>
<change>
<condition value="yes">
<eval token="checked_result_value">if(true(), $form.checked$, "never_here"</eval>
</condition>
<condition>
<eval token="checked_result_value">"NotChecked"</eval>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<single>
<search>
<query>| makeresults | eval value="$checked_result_value$"</query>
</search>
</single>
</panel>
</row>
</form>
... View more
Labels
- Labels:
-
token
10-28-2020
11:04 PM
1 Karma
I have 2 different data set: 1. host and prevStatus field with IDLE value 2. server (same values as host) and server state with active/standby values. I would like to use prevStatus events ONLY from the active server. My base search is something like index=indx (host=app1 OR host app2) (prevStatus=IDLE OR (server_state=active OR server_state=standby)) How do I mark all the prevStatus events so, that they have the current server_state field on them, so that I can then just filter prevStatus=IDLE AND host=server AND server_state=active? I think I need to use streamstats, but I did not quite get it there. Example data table below: _time host prevStatus server server_state
2020-10-07 11:13:29.283 app1 IDLE
2020-10-07 11:28:09.284 app1 IDLE
2020-10-07 11:51:17.138 app2 IDLE
2020-10-08 01:55:27.816 app1 app2 standby
2020-10-08 01:55:40.591 app2 app1 active
2020-10-08 13:37:01.284 app1 IDLE
2020-10-09 12:11:13.786 app2 IDLE
2020-10-12 09:01:49.119 app1 app2 active
2020-10-12 09:12:30.444 app2 app1 standby
2020-10-12 10:43:59.461 app2 IDLE
2020-10-12 10:57:41.298 app1 IDLE I think I need something like this: _time host prevStatus server server_state
2020-10-07 11:13:29.283 app1 IDLE
2020-10-07 11:28:09.284 app1 IDLE
2020-10-07 11:51:17.138 app2 IDLE
2020-10-08 01:55:27.816 app1 app2 standby
2020-10-08 01:55:40.591 app2 app1 active
2020-10-08 13:37:01.284 app1 IDLE app1 active
2020-10-09 12:11:13.786 app2 IDLE app1 active
2020-10-12 09:01:49.119 app1 app2 active
2020-10-12 09:12:30.444 app2 app1 standby
2020-10-12 10:43:59.461 app2 IDLE app2 active
2020-10-12 10:57:41.298 app1 IDLE app2 active
... View more
Labels
- Labels:
-
stats
10-28-2020
04:10 AM
I managed to get it like this: import hudson.plugins.robot.RobotBuildAction
import com.splunk.splunkjenkins.utils.LogEventHelper
def build=splunkins.build
def robotAction=build.getAction(RobotBuildAction)
if(robotAction) {
def robotResults=[]
def allTestCases = robotAction.result.suites[0].getAllCases()
allTestCases.each { test ->
robotResults << ["name" : test.getRelativePackageName(), "tags":test.tags, "duration":test.duration,
"passed": test.passed, "description":test.description]
}
def metadata = LogEventHelper.getBuildVariables(build)
def robotData = ["metadata":metadata, "build_url":build.url, "robot_results":robotResults, "build_number": build.number]
splunkins.send(robotData)
}
... View more
10-27-2020
11:49 PM
Thanks, I was hopping something like this. I fixed a minor typo in "build_url", build.url -> "build_url":build.url I tried it, but I got empty results like this: { [-]
build_url: job/658/
metadata: { [-]
scm: git
}
robot_results: [ [-]
]
}
... View more
10-27-2020
03:46 AM
Do we need a new RobotFramework adapter? https://github.com/jenkinsci/splunk-devops-plugin/tree/master/splunk-devops/src/main/java/com/splunk/splunkjenkins/model
... View more
10-26-2020
12:35 PM
I have the Splunk Jenkins plugin in use, but I cannot find the RobotFramework test tags from the raw data. Should I do some custom configurations into Jenkins side so that it would add the test level RobotFramework tags into the testcase data? Below in an example from the Robot results. Is the plugin sending only the "Test results", but not "Robot Results" to the Splunk? Currently I can find only the following test level results from the Splunk. { [-]
classname: Testsuites.Assistant tests.Configurations
duration: 307
errordetails: *HTML* ...
errorstacktrace:
failedsince: 329
groupname: Testsuites
skipped: false
status: FAILURE
testname: Assistant For External Callers
uniquename: Testsuites.Assistant tests.Configurations.Assistant For External Callers
}
... View more
Labels
- Labels:
-
HTTP Event Collector
10-25-2020
02:49 PM
One thing: If I have build numbers like 4x, 5x, 3xx, the xyseries seems to sort them as string, not as a number. Now I get: 3xx, 4x, 5x I would like to have: 4x, 5x, 3xx, 4xx, 5xx
... View more
10-25-2020
01:17 AM
This is what I have now and it is looking good. I'm still playing and verifying it. ...
| streamstats count as session
| spath output=test "testsuite.testcase{}"
| fields session test host job_name build_number
| mvexpand test
| eval result=if(isnotnull(errordetails), "Failed", if(skipped=="true", "Skipped", "Passed"))
| eval duration=round(duration, 2)
| eval result=result
| stats values(build_number) as build_number by session test
| spath input=test output=status "status"
| spath input=test output=name "name"
| spath input=test output=testname "testname"
| eval testname=coalesce(name, testname)
| spath input=test output=classname "classname"
| spath input=test output=errordetails "errordetails"
| spath input=test output=skipped "skipped"
| eval result=if(isnotnull(errordetails), "Failed", if(skipped=="true", "Skipped", "Passed"))
| table build_number classname testname result
| eval tmp=classname."_".testname
| xyseries tmp build_number result
| eval classname=mvindex(split(tmp,"_"),0), testname=mvindex(split(tmp,"_"),1)
| fields - tmp
| table classname testname * And your latest example look good as well :-). I will accept your answer after I have verified a bit. Thanks A LOT!
... View more
10-24-2020
11:55 PM
I think I have some testcases larger than 5000 characters and spath only parses the first 5K? I have 6K of chars, in case of error happens. BTW, does it help, if I already have index time extractions defined for sourcetype? [json:jenkins]
pulldown_type = true
INDEXED_EXTRACTIONS = json
KV_MODE = none
TRUNCATE = 0
category = Structured
LEARN_MODEL = false
description = JavaScript Object Notation format. So my events have already to following fields: job_name
job_result
level
linecount
log_source
log_thrown
message
metadata.scm
page_num
testsuite.duration
testsuite.errors
testsuite.failures
testsuite.passes
testsuite.skips
testsuite.testcase{}.classname
testsuite.testcase{}.duration
testsuite.testcase{}.errordetails
testsuite.testcase{}.errorstacktrace
testsuite.testcase{}.failedsince
testsuite.testcase{}.groupname
testsuite.testcase{}.skipped
testsuite.testcase{}.status
testsuite.testcase{}.testname
testsuite.testcase{}.uniquename
testsuite.tests
testsuite.time
testsuite.total
... View more
10-24-2020
10:52 PM
Yes, the first example dit not work, I only removed the prefix "build_number_" to make the output shorter. But your second example looks better with the split by 'session'. Now we get one row per build there. I'll look into and get back to you.
... View more
10-24-2020
05:47 AM
Close already. I put the build number only to short the output.
... View more
10-24-2020
05:39 AM
{"event_tag":"build_report","metadata":{"scm":"git"},"job_name":"job1","testsuite":{"failures":0,"passes":2,"skips":0,"total":2,"duration":1968.0,"tests":2,"time":1968.0,"errors":0,"testcase":[{"duration":122.0,"classname":"Testsuites.MyCallCenter","testname":"Login","groupname":"Testsuites","skipped":false,"failedsince":0,"uniquename":"Testsuites.MyCallCenter.myCallCenter basic tests.Login","status":"PASSED"},
{"duration":148.0,"classname":"Testsuites.MyCallCenter","testname":"Edit Calendar","groupname":"Testsuites","skipped":false,"failedsince":0,"uniquename":"Testsuites.MyCallCenter.myCallCenter basic tests.Edit Calendar","status":"PASSED"}]
},"build_number":615,"page_num":1,"job_result":"PASSED","user":"(timer)","build_url":"job/build/615/"}
... View more
10-24-2020
01:59 AM
I'm wondering if the following table structure is possible (without custom JS). Raw events are from Jenkins plugin. Below one event example. I get one per job/test/build. { [-]
build_number: 615
build_url: job1
event_tag: build_report
job_name: jobname
job_result: FAILURE
metadata: { [+]
}
page_num: 1
testsuite: { [-]
duration: 1968
errors: 0
failures: 6
passes: 7
skips: 0
testcase: [ [-]
{ [-]
classname: Testsuites.MyCallCenter
duration: 122
failedsince: 0
groupname: Testsuites
skipped: false
status: PASSED
testname: Login
uniquename: Testsuites.MyCallCenter.Login
}
{ [-]
classname: Testsuites.MyCallCenter
duration: 148
failedsince: 0
groupname: Testsuites
skipped: false
status: PASSED
testname: Edit Calendar
uniquename: Testsuites.MyCallCenter.Edit Calendar
}
{ [+]
}
]
tests: 13
time: 1968
total: 13
}
user: (timer)
} Can I create a table, which has a dynamic build number in the header somehow like this? classname | testname | build-613 | build-614 | build-615
Testsuites.MyCallCenter | Login | PASSED | PASSED | PASSED
Testsuites.MyCallCenter | Edit Calendar | PASSED | FAILED | PASSED
... View more
Labels
- Labels:
-
table
11-11-2019
11:44 AM
Indeed. Great. Looks like I do not know how to use the search in docs. ;-).
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-14-2025
03:37 AM
|
