Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About arkadyz1
arkadyz1
Builder
Member since:
09-08-2014
02-20-2024
Community Statistics
| Posts | 182 |
| Solutions | 28 |
| Karma Given | 84 |
| Karma Received | 66 |
| Member Since | 09-08-2014 |
Activity Feed
- Got Karma for Re: Custom search command called multiple times. 01-05-2023 12:40 PM
- Karma Re: Securing HTTP Event Collector for ischoenmaker. 04-27-2022 05:56 AM
- Posted Re: Is it possible to access _internal index of a search peer? on Splunk Search. 08-25-2021 08:51 AM
- Posted Is it possible to access _internal index of a search peer? on Splunk Search. 03-22-2021 11:57 AM
- Got Karma for Re: How to remove the "| Splunk" addition and the green arrow icon from the title in our browser tab in Splunk 6.2?. 02-11-2021 05:48 PM
- Got Karma for Re: How do you use value or capture groups as regex's curly bracket number parameter?. 09-30-2020 05:12 AM
- Karma Re: Splunk not picking up on timezone set within props for FrankVl. 06-05-2020 12:50 AM
- Karma Re: How come our tstats with datamodel does not group by field? for woodcock. 06-05-2020 12:50 AM
- Karma Re: How do you use value or capture groups as regex's curly bracket number parameter? for woodcock. 06-05-2020 12:50 AM
- Karma Re: Is there a function that randomly shuffles results? for woodcock. 06-05-2020 12:50 AM
- Karma Re: Is there a function that randomly shuffles results? for martinpu. 06-05-2020 12:50 AM
- Got Karma for Re: How do you use value or capture groups as regex's curly bracket number parameter?. 06-05-2020 12:50 AM
- Got Karma for Re: How do you use value or capture groups as regex's curly bracket number parameter?. 06-05-2020 12:50 AM
- Karma Re: Running one of two searches based on time picker selection for niketn. 06-05-2020 12:49 AM
- Karma Re: multivalue in a sub search not working as expected. for maraman_splunk. 06-05-2020 12:49 AM
- Got Karma for How to stop custom search command from calling multiple times?. 06-05-2020 12:49 AM
- Got Karma for How to stop custom search command from calling multiple times?. 06-05-2020 12:49 AM
- Karma Re: Is their any other way to calculate the starttime and endtime for my data? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: How to optimize a search for a non-prefixed wildcard (field=*suffix)? for gabriel_vasseur. 06-05-2020 12:48 AM
- Karma Re: how to display unique values only from one particular multi-value field for hgrow. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-25-2021
08:51 AM
Sorry, haven't visited Splunk community for a long time - way too much work in other projects. I tried to run it as an admin, so can definitely access all indexes. I can see results from the local _internal index, just not from the search peers.
... View more
03-22-2021
11:57 AM
Not sure that I've picked the correct location - moderators, please move. I found that I cannot normally run a search on index=_internal and get results from my search peers. Any setting to enable it? Or should I somehow "externalize" the desired data, say, by copying them into a summary index?
... View more
Labels
- Labels:
-
other
02-27-2019
06:11 PM
When more than one regex matches, values from which are you getting? The last one (alphabetically)? Or multivalue?
If it's just a single value, I'd suggest naming and ordering the stanzas in such a way that the preferred one goes last. And listing them in the same (reverse in terms of priority) order in props.conf . If it becomes a multivalue, try adding MV_ADD=false (though I doubt it will help).
... View more
02-20-2019
08:44 AM
It seems like they want to react to something quickly. The question is: how quickly? They must have some "reaction time" allowed.
Another question: what are they using to launch the searches? Some kind of Splunk SDK? If yes, any searches, either one shot or regular, have "earliest_time" and "latest_time" keyword attributes that can be added. I did it in Python but I'd assume it's true in any SDK.
If they need it on a dashboard, many elements can have a refresh value. On the top level ( form or dashboard tag), there is a refresh attribute which has a numerical value in seconds. A similar attribute can be in many other elements, such as table or chart .
... View more
02-20-2019
08:09 AM
Anything that ends at "rt" is a real-time search. Ask yourself this: how "continuous" do you want it to be? If you want granularity up to, say, 2 seconds, you can have a bigger base search of -5m to -2s, then add to it with smaller -4s to -2s searches running every 2 seconds.
On forms and dashboards, you can set a refresh time separately on each element or globally at the top level.
... View more
01-18-2019
10:08 AM
At this point, I would go over to the universal forwarders and check how the timestamp is generated (is it in the . format?) and any timezone settings there, including timezone setting of the OS.
... View more
01-18-2019
09:53 AM
Looking at Jenkins documentation, it seems like you can configure any sourcetype there. I believe an HEC input will accept any source, sourcetype, host, time etc. if they are specified in the incoming message. The only restriction is that the index (if it is set in the incoming message) should be in the list of allowed indexes (configure the token correspondingly).
Read the section named "Event Metadata" in "Format Events for HTTP event collector" within "Getting Data In" manual. There is no restriction on sourcetype there.
... View more
01-17-2019
11:10 AM
It's not clear - do you want to have both start and stop calculated within the same event, or do you group your events somehow and then one of the events in the group should provide a 'start' while another yields 'stop'? Can you show at least a small extract of the relevant fields of your data and explain what you are trying to achieve?
... View more
01-17-2019
10:54 AM
Count of all instances of each value? If yes, try | stats count by Item_Number instead of table . stats generates values in such a way that you can use this search to power a table on a form/dashboard.
... View more
01-17-2019
06:20 AM
I upvoted yours quite some time ago. Also, it's not a competition - there is more than one way to do something, and it's great. I actually learned something from your answer - never used foreach command, nor {{session_length}} syntax, and just being aware of it is great.
... View more
01-16-2019
06:54 PM
1 Karma
No, please don't. It shows the weakness anyway: how do I make it more generic and calculate the starting offset instead of hard-coding it? I actually hate seeing those constants in the code. I'd say something like
| rex field=test "(?<prefix>.{3})(?<session_length>\d)" | eval session=substr(test,1+len(prefix)+len(session_length),session_length)
is more to my liking. How's that for a solution?
... View more
01-16-2019
02:48 PM
I downvoted this post because the answer is plain wrong - please test your suggestions before posting.
here is a search i ran to check your answer:
| makeresults | eval test="abc5defghijk" | rex field=test "\d{1}+(?<sub>.\s{3})"
you can change that digit 5 inside test to any other digit you want and sub will always be "defg".
... View more
01-16-2019
02:38 PM
No, I did not hard-code the length - 5 was the length of the prefix (.{3}\d)+1 (substr is 1-based), the other 5 gets taken from session_length - look closer :). My solution will take 'defg' from 'abc4defgHijk' - please check.
Here is a search I've just run:
| makeresults | eval test="abc4defgHijk" | rex field=test "^.{3}(?<session_length>\d)" | eval session=substr(test,5,session_length)
... View more
01-16-2019
02:13 PM
Unless there are other fields in the original event, starting with a digit, correct?
I like the elegance of your answer, but what are the downsides of mine?
... View more
01-11-2019
09:41 AM
Strange - I've just tried index=_internal | timechart count on my 7.2.1 (_internal because I'm just evaluating it and there is no data on it yet) and it came out normal, _time first, count second.
Just out of curiosity, I then tried this: index=_internal | bucket _time span=10m | stats count by _time and it also worked - you then choose Timechart as your Visualization and it displays just fine.
... View more
01-11-2019
09:24 AM
2 Karma
I'm with @ccl0utierk on this one - there is no way to grab that with just one rex command. You need a longer way: extract session_length first via eval or rex command first then use | eval session=substr(test,5,session_length) (where 5 is the position where session starts, 1-based so it skips the first 4 characters) to get the session.
... View more
01-11-2019
09:16 AM
The REST endpoints under "/services" are not app-specific even though you put them you $SPLUNK_HOME/etc/apps/yourapp/bin , and they go via Splunk management port (8089 by default). This is somewhat of a problem - while your browser normally connects to http://yoursplunkhost:8000/en-US/app/yourapp , REST API calls go to https://yoursplunkhost:8089/services/yourcustomendpoint . This creates CORS problems unless you properly set HTTP headers in your custom endpoint. And it normally needs authentication, unless you set requireAuthentication = false in the endpoint's stanza in restmap.conf .
There is another way of creating custom endpoints - putting the scripts not in $SPLUNK_HOME/etc/apps/yourapp/bin , but in $SPLUNK_HOME/etc/apps/yourapp/appserver/controllers and defining it in $SPLUNK_HOME/etc/apps/yourapp/default/web.conf . This one goes through http://yoursplunkhost:8080/en-US/custom/yourapp/yourcustomendpoint and picks up the authentication of your browser page IIRC, but you'd better check the exact ways in the documentation.
... View more
01-10-2019
10:15 AM
I voted up an answer by @woodcock as it gave us the right idea. Here is the syntax that works:
| tstats count first(Package.tot_dim) AS tot_dim1 last(Package.tot_dim) AS tot_dim2
from datamodel=Our_Datamodel
where index=our_index
by Package.token
| search count=2
Now for the details: we have a datamodel named Our_Datamodel (make sure you refer to its internal name, not display name), an object named Package within it and fields named tot_dim and token . The | search count=2 addition is for illustration only - you can pipe the tstats command into many other commands.
... View more
01-10-2019
09:57 AM
OK, we figured out the exact syntax: our datamodel has an object named "Package", which has such extracted fields as "length", "width", "height" and a calculated "tot_dim" which is a sum of the three dimensions. It also has a "token" field, which for some reason is not extracted properly, so I tested the GROUPBY syntax on some other field.
All in all, it looks like this:
| tstats count first(Package.tot_dim) AS tot_dim1 last(Package.tot_dim) AS tot_dim2
from datamodel=Our_Datamodel
where index=our_index
by Package.token
| search count=2
Shall we agree that some of Splunks intricacies are somewhat underdocumented? 🙂
Oh, and we are still in 6.6.2 - though I doubt it changes much in the latest version.
... View more
01-10-2019
07:57 AM
Could you please clarify: if our datamodel is named "Our Datamodel" with internal name Our_Datamodel , it has an event named Event and in it are a couple of fields named length and token , what would be our search string?
... View more
01-10-2019
07:07 AM
Not sure - never tried it, as we need that by/groupby anyway. I think our mistake was a wrong field notation - we did not realize that datamodel fields are referenced as datamodelname.fieldname . Thanks to @woodcock 's answer below, we realized our mistake.
... View more
01-09-2019
01:59 PM
We have an index with quite a few index-time fields, and an accelerated datamodel that adds a calculated field there. Our objective is to group by one of the fields, find the first and the last value of some other field and compare them. Unfortunately, a usual | tstats first(length) as length1 last(length) as length2 from datamodel=ourdatamodel groupby token does not work.
Just tstats using the index but not the data model works, but it lacks that calculated field that's only in the datamodel, so it does not satisfy our needs.
I can add more precise search strings as replies to clarify things if needed.
... View more
06-12-2018
08:02 AM
Thanks for the link back to your previous answer - voted that up. For some reason, strptime(strftime($job.earliestTime$,...),...) failed to work for me, so I went with the | addinfo option. That did work - especially nice because addinfo is producing times in time and not string format, so there is no guessing what to tell strptime .
... View more
06-01-2018
08:41 AM
All this is happening in Splunk 6.6.2:
I have a relatively complex form, with a timechart and a drilldown from it selection to the data table below it. I wanted to show the time interval in a table title, and tried using $start$ and $end$ (saving them in some external tokens within <selection> - to be used in <earliest> and <latest> tags of the data table search, as well as displayed in the title) for that. I also tried to use $job.earliestTime$ and $job.latestTime$ from inside <progress> tag to save them into the tokens referenced in the title.
Unfortunately, this shows the time either as -8h (if I pick "8 hours ago" from the time picker and don't make a selection within the time chart) or as an integer like 1527835260 . "No big deal", I thought and slapped an <eval token="earliest_for_display">strftime($start$,"%F %T")</eval> within the timechart's <selection> . Then I tried the same with $job.earliestTime$ inside data table search's <progress> instead of $start$ .
It seems that the eval never even tried to execute. I ended up pre-setting those tokens with "Earliest: not set yet" and "Latest: not set yet" within the form's <init> - and they never changed.
As a side note - might be helpful to some: simple strftime will not work with relatives like @d , -24h or now , so I came up with the following construct:
<eval token="earliest_for_display">strftime(case(
$job.earliestTime$=="now",now(),
match(tostring($job.earliestTime$),"^[-+@]"),relative_time(now(),$job.earliestTime$),
match(tostring($job.earliestTime$),"^\d{4}-"),strptime($job.earliestTime$,"%FT%T.%3N%:z"),
1==1,$job.earliestTime$),"%F %T")</eval>
That "^\d{4}-" is for the times I get from <selection> - they seem to be returned in that "%FT%T.%3N%:z" format.
... View more
05-21-2018
06:33 AM
How is your API organized? It can be added in more than one way: when I wrote my response, we were adding exta REST API endpoints via etc/system/local/restmap.conf - this makes them accessible through the management port (8089 by default). There you just add your header to the response:
class YourOwnAPIHandler(splunk.rest.BaseRestHandler):
def handle_POST(self):
...
self.response.setHeader('access-control-allow-origin', '*')
return
The response by paramagurukarthikeyan below shows how to do that in the custom end points created using <your_app>/default/web.conf and appserver/controllers/<your_endpoints>.py
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-20-2024
03:59 PM
|
Karma from
Karma given to
