Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About quahfamili
quahfamili
Path Finder
Member since:
09-14-2017
06-15-2020
Community Statistics
| Posts | 35 |
| Solutions | 0 |
| Karma Given | 6 |
| Karma Received | 1 |
| Member Since | 09-14-2017 |
Activity Feed
- Posted Re: install splunk 8.0.1 on windows server 2012 R2 on Installation. 06-15-2020 07:01 PM
- Got Karma for Can you give me some advice on expanding my Splunk systems?. 06-05-2020 12:50 AM
- Karma Re: Dynamically change height of panel in dashboard based on search result for niketn. 06-05-2020 12:49 AM
- Karma Re: Chart event that are unique over month for HiroshiSatoh. 06-05-2020 12:49 AM
- Karma Re: Migrating splunk by changing the existing splunk to become forwarder/secondary indexer for nickhills. 06-05-2020 12:49 AM
- Karma Re: Using dashboard for presentation for niketn. 06-05-2020 12:49 AM
- Karma Re: Why my remote access do not have a login page? for MuS. 06-05-2020 12:49 AM
- Karma Re: How to replace slash characters in field values with spaces instead (ex: change "A/B/C/D" to "A B C D")? for richgalloway. 06-05-2020 12:47 AM
- Posted Re: SRE Burn rate based alerts on Alerting. 10-26-2019 07:27 PM
- Posted SRE Burn rate based alerts on Alerting. 10-26-2019 02:53 AM
- Tagged SRE Burn rate based alerts on Alerting. 10-26-2019 02:53 AM
- Tagged SRE Burn rate based alerts on Alerting. 10-26-2019 02:53 AM
- Posted Re: How can I transpose/transform data in multiple rows? on Splunk Search. 03-31-2019 05:53 PM
- Posted How can I transpose/transform data in multiple rows? on Splunk Search. 03-31-2019 12:31 AM
- Tagged How can I transpose/transform data in multiple rows? on Splunk Search. 03-31-2019 12:31 AM
- Posted Re: Json ingest with weird characters or binary on Getting Data In. 03-26-2019 04:12 AM
- Posted Re: Can you give me some advice on expanding my Splunk systems? on Getting Data In. 03-25-2019 11:40 PM
- Posted Re: Can you give me some advice on expanding my Splunk systems? on Getting Data In. 03-25-2019 11:30 PM
- Posted Can you give me some advice on expanding my Splunk systems? on Getting Data In. 03-25-2019 01:26 AM
- Posted Can you give me some advice on upgrading and deploying? on Installation. 12-21-2018 12:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-21-2023
12:59 AM
I have to disagree. It worked for us but: It was an upgrade, not an installation from scratch. We upgraded from 7.3.9 to 8.1.10.1 We are using Splunk as a DS and a HF in that server. We did this because it was our only option due to several reasons. This is not supported by Splunk so I would not recommend to try it with IDX or SHs or if you have other supported options Cheers!
... View more
09-05-2021
10:21 PM
There's another option that works if you're looking to do some simple sorting. | makeresults
| eval name="Alice,Bob,Frank,Steve"
| makemv delim="," name
| mvexpand name
| eval fakenumber=len(name)
| eval sorted_name=if(name=="Frank"," Frank",name)
| eval sorted_name=if(sorted_name=="Steve"," Steve",sorted_name)
| stats max(fakenumber) as namelen by sorted_name It'll put the trellis in the order of Steve, Frank, Alice, Bob. There's two spaces before "Steve" and one before "Frank"
... View more
10-26-2019
07:27 PM
Sorry missed the link.
This is the link https://landing.google.com/sre/workbook/chapters/alerting-on-slos/
... View more
03-31-2019
05:53 PM
Hi it works, 1 more question for {} how do i control the numbers of keys? it seems like defaulted at 24 columns.
... View more
04-15-2019
11:39 AM
Obviously, your old data now exists only on a single indexer but it will age out. If you decide to add a Cluster Master , you can do a Bucket Rebalance to spread the old data across both Indexers.
... View more
12-21-2018
09:54 AM
i would make sure to read this
How to move index buckets from one host to another
If you want to retire a Splunk Enterprise instance and immediately move the data to another instance, you can move individual
buckets of an index between hosts, as long as:
When you copy individual bucket files, you must make sure that no bucket IDs conflict on the new system. Otherwise, Splunk
Enterprise does not start. You might need to rename individual bucket directories after you move them from the source system to
the target system.
Roll any hot buckets on the source host from hot to warm.
Review indexes.conf on the old host to get a list of the indexes on that host.
On the target host, create indexes that are identical to the ones on the source system.
Copy the index buckets from the source host to the target host.
Restart Splunk Enterprise.
use robo copy for windows
rsync if you're using Linux
... View more
03-26-2019
04:32 AM
If its Chinese, have you tried with UTF-16?
... View more
07-12-2018
09:01 PM
2 Karma
Hi @quahfamili ,
You might not find a single click solution to optimize the entire infrastructure because the performance issues might be of different reasons. If the increase in indexes is the main reason of performance degradation, you should re-look at the resource capacity. In a more general way,
Start with "Monitoring Console" (http://docs.splunk.com/Documentation/Splunk/7.1.1/DMC/DMCoverview) if you haven't looked into it. It gives you almost all information you need for finding the bottleneck
Identify the phase where you have issues - https://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Pipelinesets
Optimization starts from the data ingestion phase and continue until the search is executed. So define your data inputs in such a way that the indexing is proper and hence the data extraction.
Fine tune your data retention configurations according to your organization's requirements rather than depending on the default configuration. This will help you to reduce the amount of indexed data/storage.
Use the inbuilt performance improvements splunk is providing, for e.g.parallelization - http://docs.splunk.com/Documentation/Splunk/7.1.1/Capacity/Parallelization
Periodically re-look at your infrastructure capacity and upgrade the resources if necessary - http://docs.splunk.com/Documentation/Splunk/7.1.1/Capacity/Referencehardware
Monitor the user's activity - especially the long running searches and see if you could optimize them
Consider the suggestions from splunk
https://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/OptimizeSplunkforpeakperformance
http://docs.splunk.com/Documentation/Splunk/7.1.1/Troubleshooting/Troubleshootindexingperformance
Once you could identify the area of improvement and if it's recurring, you could automate
... View more
07-10-2018
08:56 PM
@quahfamili, you can use Simple XML Dashboard with <html> panels and CSS/JS Extension to style and add events.
Splunk Dashboard Example has one example for Image Overlay with Single Value that you can refer to for understanding how it can be done.
Splunk's premium solution IT Service Intelligence has built in Glass Tables which allow you to do something similar with ease from UI.
You should also check out Scalable Vector Graphics App which allows you to add svg to your dashboard panels.
... View more
03-01-2018
12:58 AM
1 Karma
I have similar experiences. Especially when the log files are on network shares rather than locally, that can take quite some time (even with much smaller numbers).
For you case: Are all those log files still active, or does it also contain rotated old files that are inactive? If there's a lot of old inactive files, there is a few options you can look at:
- put some cleanup script in place to get rid of those old files after some time
- If the old files can be recognized from their name (e.g. they get a suffix when rotated), write your input stanza such that they are ignored.
- Use the ignoreOlderThan setting in inputs.conf to ignore old files
If all those files are actively being written to, you could perhaps look at enabling multiple pipelines on your forwarder (if the hardware specs allow that), to enable Splunk to process multiple files in parallel.
... View more
02-26-2018
11:30 PM
Hi,
Thanks for the reply, I got it to work. I did a mistake to dudup the event.
Thanks again!
... View more
01-25-2018
06:17 PM
@quahfamili, I have converted my comment to answer. Please accept/up vote the answer if it has addressed your needs. Here is one of my previous answers for your reference: https://answers.splunk.com/answers/600749/chart-with-trendline-in-splunk.html
... View more
01-30-2018
01:38 AM
Hi @nickhillscpl
I would want to ask you :
You mentioned "When you are happy everything is working properly, you can change your forwarders to send directly to the 'new' indexer to remove your 'old' indexer from the burden."
How do I actually do it? Do i just changed the license to forwarder license, so it would not consume my data ingest limit?
... View more
12-27-2017
08:20 AM
Give this a try
start "" CALL 'splunk.exe search "index=xx |eval xx| table xx xx xx" -output csv c:\test.csv'
... View more
03-26-2018
11:08 PM
1 Karma
You can detect outliers in a number of ways, e.g.
| timechart span=1h count
| streamstats window=24 avg(count) as avg stdev(count) as std
| eval m=2, lower=avg-(std * m), upper=avg+(std * m), outlier = if(count < lower OR count > upper, 1, 0)
| table _time upper lower count outlier
and then if you plot the outlier field on a chart overlay with a max Y axis of say, 2, you will have a vertical line showing the outliers
Adjust m to get a suitable standard deviation multiplier
... View more
11-23-2017
07:57 AM
2 Karma
@quahfamili, Please try the following run anywhere dashboard.
Since you want to dynamically decide the height of panel based on number of results, I have coded <done> Search Event Handler in Simple XML to set the height token based on number of results as captured by default search token $job.resultCount$ > I have set couple of other tokens just for example to show/hide chart based on whether results are returned or not and also the number of results returned so that we can understand how height is changing with results. I have created four conditions for height, you may refine as per your need.
<done>
<!-- No Results unset showChart token to hide panel height is set to 200 but it will not be displayed -->
<condition match="$job.resultCount$==0">
<unset token="showChart"></unset>
<set token="tokResultCount">0</set>
<set token="tokPanelHeight">200</set>
</condition>
<!-- Results between 0 to 20. height is set to 400 -->
<condition match="$job.resultCount$<=20">
<set token="showChart">true</set>
<set token="tokResultCount">$job.resultCount$</set>
<set token="tokPanelHeight">400</set>
</condition>
<!-- Results between 20 to 40. height is set to 800 -->
<condition match="$job.resultCount$>20 AND $job.resultCount$<40 ">
<set token="showChart">true</set>
<set token="tokResultCount">$job.resultCount$</set>
<set token="tokPanelHeight">800</set>
</condition>
<!-- Results above 40. height is set to 1200 -->
<condition>
<set token="showChart">true</set>
<set token="tokResultCount">$job.resultCount$</set>
<set token="tokPanelHeight">1200</set>
</condition>
</done>
Please find the complete run anywhere Simple XML dashboard code for your reference. Please try out and confirm.
<form>
<label>Dynamic Limit on Height</label>
<fieldset submitButton="false"></fieldset>
<row>
<panel>
<input type="time" token="tokTime">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<html rejects="$showChart$">
<div style="color:red;font-weight:bold;text-align:center;font-size:150%">No Results Found... Increase Search Time span</div>
</html>
<chart depends="$showChart$">
<title>Result Count: $tokResultCount$ - Height: $tokPanelHeight$</title>
<search>
<query>index=_internal sourcetype=splunkd log_level!=INFO
| chart count by component log_level useother=f limit=50
| sort - count
| head 50</query>
<earliest>$tokTime.earliest$</earliest>
<latest>$tokTime.latest$</latest>
<sampleRatio>1</sampleRatio>
<done>
<condition match="$job.resultCount$==0">
<unset token="showChart"></unset>
<set token="tokResultCount">0</set>
<set token="tokPanelHeight">200</set>
</condition>
<condition match="$job.resultCount$<=20">
<set token="showChart">true</set>
<set token="tokResultCount">$job.resultCount$</set>
<set token="tokPanelHeight">400</set>
</condition>
<condition match="$job.resultCount$>20 AND $job.resultCount$<40 ">
<set token="showChart">true</set>
<set token="tokResultCount">$job.resultCount$</set>
<set token="tokPanelHeight">800</set>
</condition>
<condition>
<set token="showChart">true</set>
<set token="tokResultCount">$job.resultCount$</set>
<set token="tokPanelHeight">1200</set>
</condition>
</done>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">bar</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">1</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="height">$tokPanelHeight$</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel>
</row>
</form>
... View more
09-14-2017
09:00 PM
1 Karma
Hi quahfamili,
as you can read on the docs page of Splunk Free http://docs.splunk.com/Documentation/Splunk/latest/Admin/MoreaboutSplunkFree?r=searchtip#What_is_included_with_Splunk_Free.3F
There is no authentication or user and role management when using Splunk Free. This means:
There is no login. The command line or browser can access and control all aspects of Splunk Free with no user/password prompt.
All accesses are treated as equivalent to the admin user. There is only one role (admin), and it is not configurable. You cannot add more roles or create user accounts.
Hope this helps ...
cheers, MuS
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-15-2020
07:31 PM
|
