Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ConnorG
ConnorG
Path Finder
Member since:
09-03-2014
06-05-2020
Community Statistics
| Posts | 34 |
| Solutions | 3 |
| Karma Given | 24 |
| Karma Received | 10 |
| Member Since | 09-03-2014 |
Activity Feed
- Got Karma for Difference in Size Between Events. 09-19-2020 07:08 PM
- Karma Re: Benefits of Using a Forwarder? for ddrillic. 06-05-2020 12:47 AM
- Karma Re: I'm indexing thousands of events from Sonicwall in Splunk 6.3, but why are summary dashboards not showing any data? for grantsmiley. 06-05-2020 12:47 AM
- Karma How can I add icons that replace the cell.value on my table without using rangemap? for sfatnass. 06-05-2020 12:47 AM
- Karma Re: After adding logging statements into Python script and running it via Splunk CLI, why are there no log messages in python.log? for jkat54. 06-05-2020 12:47 AM
- Karma What's your best Humans vs Zombies query? for Runals. 06-05-2020 12:47 AM
- Karma Re: Difference in Size Between Events for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Difference in Size Between Events for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Difference in Size Between Events for j4adam. 06-05-2020 12:47 AM
- Karma How to customize or change the default footer in Splunk Web? for fdi01. 06-05-2020 12:47 AM
- Karma Re: How to create a graph showing values for each percentile from 0 to 100? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Can someone show an example of sending data through TCP to a Splunk server using the C# SDK? for s2_splunk. 06-05-2020 12:47 AM
- Karma Re: Benefits of Using a Forwarder? for thomrs. 06-05-2020 12:47 AM
- Karma Re: How to set up an alert every time someone tries to access the configuration terminal on cisco routers to make changes? for mikaelbje. 06-05-2020 12:47 AM
- Karma Re: Splunk SDK: Is there a way to set the time of an event created from Submit? for Damien_Dallimor. 06-05-2020 12:47 AM
- Got Karma for Splunk SDK: Is there a way to set the time of an event created from Submit?. 06-05-2020 12:47 AM
- Got Karma for Re: How to calculate splunk data size injected per day or time based on forwarders. 06-05-2020 12:47 AM
- Got Karma for Can someone show an example of sending data through TCP to a Splunk server using the C# SDK?. 06-05-2020 12:47 AM
- Got Karma for Re: Can someone show an example of sending data through TCP to a Splunk server using the C# SDK?. 06-05-2020 12:47 AM
- Got Karma for Re: Collecting to a summary index not working. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 1 |
07-18-2017
12:41 PM
Was this done by importing the default logging levels? Or is there another setting to reset that I'm missing here?
... View more
11-16-2016
12:28 PM
Many applications provide a public facing API that you can pull data from. One of my favorites is Zillow. Just google around and you'll find plenty of things that you can load into Splunk.
... View more
12-29-2015
08:50 AM
Yes I noticed this, but if you read further down it also states that
"You can also just call logging directly and your logs will appear in python.log"
As I followed in my example.
... View more
12-29-2015
06:12 AM
1 Karma
I'm trying to debug a Python script and in doing so placed some logging statements into the script.
Following these posts for the basics:
Logging from Python in Splunk
Python logging in splunk
I'm going off the simple statement here
"You can also just call logging directly and your logs will appear in python.log:"
logging.warning("Something bad happened: %s", "out of memory")
so my code looks just like
import logging
logging.info("message here")
Running it using the Splunk CLI command:
splunk cmd python ./confcheck_correlation_searches.py
And yet still nothing in python.log. Any ideas what I'm missing here?
... View more
10-20-2015
10:48 AM
Sticking to the old format would give us:
var tables = ['web_stat_page_tbl', 'web_diag_tran_tbl', 'web_diag_comp_tbl', 'web_stat_tran_tbl'];
for(i = 0; i < tables.length; i++) {
mvc.Components.get(tables[i]).getVisualization(function(tableView) {
// Add custom cell renderer
tableView.addCellRenderer(new CustomRangeRenderer());
// Add custom row renderer
tableView.addRowExpansionRenderer(new CustomRowRenderer());
});
}
... View more
10-20-2015
10:43 AM
2 Karma
I fixed it after referencing the example dashboards app. Below you can find my code.
6.2.4 code:
var tables = ['web_stat_page_tbl', 'web_diag_tran_tbl', 'web_diag_comp_tbl', 'web_stat_tran_tbl'];
for(i = 0; i < tables.length; i++) {
mvc.Components.get(tables[i]).getVisualization(function(tableView) {
// Add custom cell renderer
tableView.table.addCellRenderer(new CustomRangeRenderer());
// Add custom row renderer
tableView.table.addRowExpansionRenderer(new CustomRowRenderer());
// Force the table to re-render
tableView.table.render();
});
}
6.3.0 code:
var tableElement = mvc.Components.getInstance("web_stat_page_tbl");
tableElement.getVisualization(function(tableView) {
// Add custom cell renderer, the table will re-render automatically.
tableView.addCellRenderer(new CustomRangeRenderer());
tableView.addRowExpansionRenderer(new CustomRowRenderer());
});
... View more
10-20-2015
10:10 AM
Below is the table object in a debug view coming from Splunk 6.2.4. Here we can see the addRowExpansionRenderer is still listed under the object.
Here is the same object in 6.3. No mention of RowExpansionRenderer anywhere.
... View more
10-20-2015
08:09 AM
After upgrading to Splunk 6.3, it seems the previous web framework for Javascript does not work properly.
My jscript is getting a TypeError: tableView.table.addRowExpansionRenderer is not a function error when being run under a 6.3 instance.
The code I'm using is expanding upon the concepts provides here
Anyone know if there were changes to the web framework and how to accommodate those changes?
... View more
10-12-2015
11:51 AM
You can use this view to see which sources are using up a large amount of volume on your Splunk server.
http(s)://your_server/en-GB/app/search/indexing_volume
If you are sending perfmon stats from each host you may want to change the interval the metrics are sent at. I've got my boxes all sending stats every 20 seconds (as seen below) and that works just fine. I believe the default for the Windows App is 10 seconds. Below is an example from inputs.conf
[perfmon://CPU Load]
counters = % Processor Time;% User Time
instances = _Total
interval = 20
object = Processor
index=pt_infra_monitoring
... View more
09-30-2015
07:24 AM
I went ahead and threw together a modification to the update_lookup.js file. The addition is an UpdateAll button that when pressed will update all visible rows.
Though I need your help. I'm having an issue.
Once the updates are pushed the rows don't actually show the changes until the web page is reloaded. I believe this is due to the context being pushed to only the children of the row that the button was clicked. Any assistance will be great.
View my code here:
https://github.com/ConnorRules/SideView---Lookup-
... View more
09-28-2015
01:44 PM
A recommendation for something to add to the Lookup Updater is the ability to update all changes. Only being able to change one row at a time is rather a pain when you need to make many changes.
Really love the view though. Thanks for putting this out there.
... View more
09-08-2015
07:03 AM
1 Karma
You'll need to use javascript if you're looking to use icons without rangemaps. Below you'll find a segment of my code that is placing icons in a table. Instead of a rangemap you'll see that this is choosing the icon based on conditionals and the cell value itself.
Go here if you have never used javascript with dashboards before. My code is expanding upon these concepts.
var CustomRangeRenderer = TableView.BaseCellRenderer.extend({
canRender: function(cell)
{
return _(['SLA']).contains(cell.field);
},
render: function($td, cell) {
var template_settings="";
console.log("cell: ", cell);
if (cell.field === 'SLA') {
var value = cell.value;
if( value == '-1') {
$td.addClass('nopadding').addClass('range-cell').addClass('range-na');
// $td.text(value);
$td.text('N/A');
var msg='No Response Time SLA defined for this transaction.';
template_settings = '<div class="data-box" data-toggle="tooltip" data-placement="left" title="'+msg+'"><div class="sla-good" style="background-color:#222222; width:100%"></div></div>';
}
else if ( value == '0') {
$td.addClass('nopadding');
var msg='Transactions failed response time SLA as defined in terms of 90th percentile';
template_settings = '<i class="icon-alert-circle" title="Failed"></i>';
}
else {
$td.addClass('nopadding');
var msg='Transactions passed response time SLA as defined in terms of 90th percentile';
template_settings = '<i class="icon-check-circle" title="Passed"></i>';
}
}
$td.html(_.template(template_settings));
//$td.children('[data-toggle="tooltip"]').tooltip();
}
});
... View more
09-04-2015
11:41 AM
@demodav you can find my solution here:
https://github.com/ConnorRules/Dynatrace-Plugin-Splunk-Forwarder/blob/master/src/com/compuware/SplunkForwarder.java
The parts you'll want to look at in particular are:
line 106 - setting up the login arguments
line 113 - creating a service instance that is connected to the splunk server
line 184 - getting the output stream to a specific index
line 214 - writing to that stream
Should be pretty self explanatory. Let me know if you have any questions.
... View more
08-13-2015
02:17 PM
Hey Woodcock,
I'm using a similar syntax and noticed that this:
"timechart span=1w sum(a) AS sumA BY b | eval sumA=sumA/total"
works and this:
"timechart span=1w sum(a) AS sumA | eval sumA=sumA/total"
does not.
Is there any specific reason that this is the case? Hard coding a number in place of total works in all cases.
... View more
07-20-2015
01:31 PM
1 Karma
There's a few paragraphs in the documentation that may shed some light:
If you apply the collect command to events that do not have timestamps, it designates a time for all of the events using the earliest (or minimum) time of the search range. For example, if you use collect over the past four hours (range: -4h to +0h), it assigns a timestamp four hours previous to the time the search was launched to all of the events without a timestamp.
If you use collect with an all-time search and the events do not have timestamps, Splunk Enterprise uses the current system time for the timestamps.
... View more
07-15-2015
01:11 PM
1 Karma
What's the purpose of "index=* AND index=_*" ?
... View more
05-12-2015
01:50 PM
I have a similar compression percentage as ibondarets.
Guess that means our data is actually larger once indexed.
... View more
05-11-2015
02:08 PM
Check if the events are indexed under main. That way we know the data is coming through.
There's also more locations that inputs.confs can reside. Look into the etc\apps\ directory. Most of my forwarders use the Splunk_TA_windows app for a lot of my windows log monitoring.
... View more
05-08-2015
10:13 AM
There's some more info in this post here:
http://answers.splunk.com/answers/4162/size-limit-for-an-event.html
... View more
