Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About athorat
athorat
Communicator
Member since:
04-29-2015
06-24-2024
Community Statistics
| Posts | 180 |
| Solutions | 1 |
| Karma Given | 14 |
| Karma Received | 6 |
| Member Since | 04-29-2015 |
Activity Feed
- Posted SmartStore Retention not deleting data on Getting Data In. 10-03-2023 12:30 AM
- Posted Re: Does it make sense to use SmartStore for all data except hot and warm? on Getting Data In. 10-03-2023 12:25 AM
- Posted How to track scheduled search which are using "All Time" time window? on Knowledge Management. 06-29-2023 06:36 PM
- Posted Re: Splunk Indexer services admin bundle errors on Deployment Architecture. 08-13-2021 08:29 PM
- Got Karma for NOT Like function. 05-28-2021 12:00 AM
- Karma Re: how to find Number of files failed to ingest for a specific Index for richgalloway. 06-05-2020 12:50 AM
- Karma Re: Search head's authentication credentials rejected by peer. I've re-added peers 4 times and this keeps happening! for gozulin. 06-05-2020 12:48 AM
- Karma Re: How to find the oldest log indexed in the indexer instances ? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: How to find the oldest log indexed in the indexer instances ? for woodcock. 06-05-2020 12:48 AM
- Got Karma for Re: Search head's authentication credentials rejected by peer. I've re-added peers 4 times and this keeps happening!. 06-05-2020 12:48 AM
- Karma Re: Applying Quarantine .... Removing quarantine for mmensch. 06-05-2020 12:47 AM
- Karma Re: Why is Splunk not starting on Linux with permission denied errors after upgrading to 6.2.0? for fabioportes. 06-05-2020 12:47 AM
- Karma Re: How to filter data in a search using the AND condition? for Richfez. 06-05-2020 12:47 AM
- Karma Re: How to calculate the difference between the counts from multiple searches? for somesoni2. 06-05-2020 12:47 AM
- Got Karma for How to change the ownership of dashboards to a specific user in the system?. 06-05-2020 12:47 AM
- Got Karma for How to change the ownership of dashboards to a specific user in the system?. 06-05-2020 12:47 AM
- Got Karma for Why is my inputlookup search not pulling a field from a CSV file needed to populate a timechart?. 06-05-2020 12:47 AM
- Got Karma for NOT Like function. 06-05-2020 12:47 AM
- Karma Re: indexing congestion consistenly happening for yannK. 06-05-2020 12:46 AM
- Karma Re: Merging two chart together for MuS. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-24-2015
04:15 PM
Awesome.
debug/refresh works.
Earlier the reports and alerts were not showing up and it does now.
Three Birds in a stone.
Thanks,
Anil.
... View more
07-24-2015
03:51 PM
Hi Some
I did copy all the files from the local of search app.
That file shows the entries for views and lookup permissions.
Does it have to do anything with restart? We had not stopped splunk when we copied the files over.
As I mentioned earlier the dashboard were not visible till today since we copied the files yesterday afternoon.
Do you think of any other reason?
Thanks (Y)
... View more
07-24-2015
12:15 PM
2 Karma
So we had to move dashboards from the Search app to Respective Project apps.
Using the steps available from forums, we copied the files from the Local directory under the Search App and used that under a specific app.
We did not restart Splunk when we did the change, so the dashboards were not reflecting immediately I guess. So now all of a sudden we see those dashboards under the app, but the ownership shows nobody.
How do we change the ownership of the dashboards to a specific user in the system?
... View more
07-14-2015
11:54 AM
Hi ,
We have many dashboards where they have more than 10 panels and each panel has it own search string. The common aspect in all the searches is indexn and sourcetype.
When the dashboard is refreshed, I think it runs 10 searches from each panel. Instead of doing this, is there a way we can use the index and sourcetype once and run the rest of the part locally?
Two sample searches:
index=prod sourcetype="HADOOP:PROD:STORM" ">> WMQSpout Contract :: nextTuple :: Contract :: Emiting Message ID :" | stats count
index=prod sourcetype="HADOOP:PROD:STORM" ">> WMQInput Contract :: nextTuple :: Contract :: Emiting Message ID :" | stats count
... View more
07-07-2015
01:34 PM
settings -> All Configurations> Default has only the following stanza.
<view name="home" default="true" />
Can this not be done on a specific app instead of doing it for all the apps? Assuming this setting will change it for all the apps.
... View more
07-07-2015
01:08 PM
Would like to Hide report/pivot/search/Alerts on a specific app and keep only the dashboard option active
Is there a way to hide them using navigation menu xml
... View more
06-18-2015
11:37 AM
When I use license_usage.log I get half the amount of volume count but when I use source="*metrics.log"
I get the twice the amount of volume compared to that of license_usage.log
When I use
index="_internal" source=*license_usage.log* type=Usage | eval b=b/(1024*1024) |timechart span=d sum(b)
I get 49 GB for a specific Day
AND
When i use
index="_internal" source="*metrics.log" per_index_thruput | eval GB=kb/(1024*1024) |timechart span=d sum(GB)
I get 98GB for that same day.
So as I understand metrics.log will only return top 10 values every second and will not give precise data?
But seems to be otherwise.
... View more
06-18-2015
11:35 AM
@yannK
When I use license_usage.log I get half the amount of volume count but when I use source="*metrics.log"
I get the twice the amount of volume compared to that of license_usage.log
When I use
index="_internal" source=license_usage.log type=Usage | eval b=b/(1024*1024) |timechart span=d sum(b)
I get 49 GB for a specific Day
AND
When i use
index="_internal" source="*metrics.log" per_index_thruput | eval GB=kb/(1024*1024) |timechart span=d sum(GB)
I get 98GB for that same day.
So as I understand metrics.log will only return top 10 values every second and will not give precise data?
But seems to be otherwise.
... View more
06-18-2015
10:51 AM
I have to calculate the amount of data to be indexed on a daily basis in a custom dashboard.
I was using the following search:
index=_internal source=*metrics.log per_index_thruput | eval GB=kb/(1024*1024) | timechart span=1d sum(GB)
and now when I see the Splunk Deployment Monitor app (License Report>>Daily Volume by Week for Last 4 weeks), the indexed data is half the amount of what I am getting from this search.
I need to understand the correct amount of indexed data, so is my search not pulling the correct data or the Deployment Monitor not reflecting the right amount of data?
... View more
06-17-2015
05:30 PM
so I changed the query as per your suggestions
index="_internal" source="*metrics.log" per_index_thruput | eval GB=kb/(1024*1024) |stats sum(GB) AS sum
and in the alerts I am supposed to put the Custom condition which I did, still does not trigger the alret.
where sum > 20
I am not sure If I have the query right.
... View more
06-17-2015
04:17 PM
Hey MuS,
thanks for the reply.
So my query in the search is
index="_internal" source="*metrics.log" per_index_thruput | eval GB=kb/(1024*1024) |stats sum(GB)
and when I Save it as a alert I use
where sum(GB) > 20
So I am not getting the error which you mention its just that the email is not triggered nor do I see the alert being triggered.
Thanks,
Anil.
... View more
06-17-2015
03:42 PM
Hi Folks,
I am using the query to get the data indexed per day
index="_internal" source="*metrics.log" per_index_thruput | eval GB=kb/(1024*1024) |stats sum(GB)
And want to trigger an email when the indexed data reaches 20GB.
in custom condition I am using
where sum(GB) > 20
I am not getting an email for this alert.
Not sure what's going wrong about this one.Getting emails for other alerts.
Is the query correct?
... View more
06-16-2015
12:27 PM
How do I get the number of forwarders per index/source type along with the status (running/stopped) and the amount of data being pushed to that index per day?
Say list of all forwarders with status and the amount of data indexed for index=DNS sourcetype=PROD:DNS
... View more
06-10-2015
12:31 AM
Hi
I have an event which has something like
/getproxy..... size:1
/getproxy..... size:10
/getproxy..... size:0
Want to calculate the total count when the size!=0 and count when size=0
using a rex in the search to extract size value
| rex "size:(?<Size>\d+)"
Any help appreciated
... View more
- Tags:
- count
06-01-2015
02:10 PM
App:Splunk DB Connect V1
While keeping the Java Path blank and Saving:
Encountered the following error while trying to update: In handler 'localapps': Error while posting to url=/servicesNS/nobody/dbx/dbx/install/java
... View more
05-28-2015
04:10 PM
@rsennett_splunk
@ppablo_splunk
Yes Got it now. Seems to be a big issue by answering using the answers text box.
Well if you see/click the link which you get in an email when someone answers your question, the fist thing which you see is, "Your Answer"
Just thinking if the Answers which a end user post might get any points? and who needs the point to solve a issues? Not sure if I do. Just a thought.
... View more
05-28-2015
03:56 PM
Okay, I see.
The comments is just for one line in width and never paid attention to that.
As far as the issue is resolved, All Good.
Thanks for looking into this
... View more
05-28-2015
03:14 PM
XML Content
<nav search_view="search" color="#65A637">
<view name="search" />
<view name="data_models" />
<view name="reports" default='true' />
<view name="alerts" />
<collection label="Ponies">
<collection label="Dashboards">
<view source="all" match="dashboard_" />
</collection>
</collection>
</nav>
... View more
05-28-2015
03:01 PM
Thanks for looking into this.
So if I understand correctly this should list all the available dashboards under the dashboard menu, like Alt_Ponies>>Dashboards>> List of all the dashboards.
So doing this, whats happening is, Dashboards menu disappears as I think it searches for,
It does not even show the Ponies>>Dashboards options
Just Search,data_models,reports and alerts
... View more
05-28-2015
02:15 PM
Not sure if the other panel has been set to use the same time picker which your first panel is using.
... View more
05-28-2015
02:07 PM
Referencing the article below, I modified the default file.
So now I have a navigation from Ponies Menu to Dashboards Option.
Now how do I set the navigation from Dashboards option to All the dashboards under it.
it should be ,
Ponies>>Dashboards >>
Dashboard A
Dashboard B
Dashboard C
Also how the Navigation Straight from Dashboards to all the underlying Dashboards.
<nav search_view="search" color="#65A637">
<view name="search" />
<view name="data_models" />
<view name="reports" default='true' />
<view name="alerts" />
<collection label="Ponies">
<view name="dashboards" />
</collection>
</nav>
http://docs.splunk.com/Documentation/Splunk/6.2.3/AdvancedDev/BuildNavigation
... View more
05-28-2015
01:53 PM
Want to install the DB Connect APP on the sandbox, but it asks for JAVA_HOME.
What would be the JAVA Path for this Sandbox?
Also the Splunk DB Connect 2 never loads the configuration Page (any issues with V2?)
Splunk DB Connect v1 loads the config page, but asks for the Java settings.
... View more
05-21-2015
04:02 PM
I am trying to use specific colours while using pie charts
Pie chart displays Response Time in milliseconds and its is divided , starting from : " < 50 ms" , "Between 50 to 100 ms" ,
"Between 100 to 250 ms" , "Between 250 to 500 ms " and " > 500 ms"
So the colours should be from green to Yellow to Amber to Orange to Red Respectively.
Can you please have a look at the below entries from the source xml and help me correct the following.
Or may be any other way to control the colours for the chart.
<option name="charting.chart.rangeValues">["< 50 ms","Between 50 ms To 100 ","Between 100 ms To 250 ms","Between 250 ms To 500 ms", "> 500 ms"]</option
<option name="charting.seriesColors">[0xbf3030,ms#ccff00,0x84e900,0xFFFF00,0xFF0000]</option>
Thanks for looking into this
... View more
- « Previous
- Next »
