About Nicholas_Key

Nicholas_Key · ‎10-27-2014

You are welcome! Please try out the steps and let me know if they aren't working.

Nicholas_Key · ‎10-26-2014

Here are the steps to configure your Universal Forwarder to forward events to your online sandbox instance: Enable receiver in your online sandbox instance in https://prd-something-something.splunk6.splunktrial.com/en-US/manager/search/data/inputs/tcp/cooked Then configure your Universal Forwarder with the following commands: ./splunk add forward-server input-prd-something-something.splunk6.splunktrial.com:9997 ./splunk add monitor Now perform a search and you'll be able to see some events in your online sandbox instance

Nicholas_Key · ‎04-05-2014

I kept getting this error from the storage/passwords endpoint when doing a POST with web framwork toolkit to create new creds entry into app.conf: HTTP 400 Bad Request -- In handler 'passwords': could not parse name. Use format: <username> OR <realm>:<username> This is the sample code that I have (adapted from http://dev.splunk.com/view/SP-CAAAETW#setupform) from splunkdj.setup import forms class UserSetupForm(forms.Form): name = forms.CharField( label="Username", endpoint="storage/passwords", entity="credential", field="name", max_length=100) password = forms.CharField( label="Password", endpoint="storage/passwords", entity="credential", field="password", max_length=100) I got this error when I used entity="*" HTTP 404 Not Found -- In handler 'passwords': Could not find object id=:*: I got this error when I used entity="_new" IllegalOperationException : Cannot update the name of an Entity via the REST API. Help?

Nicholas_Key · ‎10-22-2013

How do I add the SearchBar and FlashTimeline into my dashboard? Given this simple XML <dashboard> <label>Dummy dashboard</label> </dashboard> In Splunk 5.x, with Advanced XML, this is achievable with <module name="SearchBar" layoutPanel="mainSearchControls"> What are the elements I need to add between dashboard element to display the following in Splunk 6?

Nicholas_Key · ‎10-10-2013

gfuente, please let me know if it works for you. Thank you for trying it.

Nicholas_Key · ‎10-10-2013

Yes, it is possible to send data from iOS to Splunk Enterprise. Please follow the steps described in this article: http://blogs.splunk.com/2013/08/26/analyzing-ios-data-with-splunk-enterprise/ However, this app is not a Splunk-supported solution.

Nicholas_Key · ‎02-12-2013

Hi Nawneel, thank you so much for the interest on the app. The "Splunk for Facebook" app contains several deprecated implementations and is no longer maintained and, unfortunately, is removed.

Nicholas_Key · ‎04-05-2012

Thanks, Matt! I'll try this out and let you know how it turns out.

Nicholas_Key · ‎04-05-2012

Splunk Ninjas, It seems that I'm unable to remove "other" in my pie chart when I do this: index=facebook sourcetype="facebook_stream_table" stream_attribution="*" | eval stream_attribution=if(stream_attribution=="", "None", stream_attribution) | chart count over stream_attribution useother=false Also I'm seeing this message "The following options were specified but have no effect when a split-by clause is not provided:useother" Then I tried index=facebook sourcetype="facebook_stream_table" stream_attribution="*" | eval stream_attribution=if(stream_attribution=="", "None", stream_attribution) | chart count over stream_attribution limit=1000 useother=false and I get this message "The following options were specified but have no effect when a split-by clause is not provided:limit, useother" I'm unable to get any results when I drilldown with stream_attribution=other since there isn't such value in sourcetype=facebook_stream_table I also took a look at this http://splunk-base.splunk.com/answers/30018/useotherf-in-a-pie-chart but it doesn't work. Splunk version: 4.3.1, MacOSX

Nicholas_Key · ‎04-03-2012

Thank you so much for the suggestion, Leo! Now that the data is indexed into Splunk effortlessly, it's time to do more correlation and statistics!

Nicholas_Key · ‎03-26-2012

How do I use Splunk REST API with Free License (since user login credentials are not required with Free License)?

Nicholas_Key · ‎03-23-2012

How does the 'optimized' splunk search string (without using JOIN) looks like for the following search string? SELECT column_name(s) FROM table_name1 INNER JOIN table_name2 ON table_name1.column_name=table_name2.column_name

Nicholas_Key · ‎03-17-2012

This is a wall to gather feedback and interesting ideas from you (the end users) about features you want to see implemented in this app to make it more exciting! Post your thoughts here. Link it, tweet it, retweet it, pass this question around. Keep the ideas coming in! The app is available at: http://splunk-base.splunk.com/apps/splunk+for+facebook

Nicholas_Key · ‎03-14-2012

Mike, may I know which Splunk version are you using? And on which platform?

Nicholas_Key · ‎11-29-2010

I don't think you want to use "iconify". index=<index_name> | iconify img because it's only showing small distinct shaped and colored icons for each img

Nicholas_Key · ‎10-06-2010

I would like to know if there is a way to create new buckets at a defined interval, say a 5 minutes interval? I have been trying to tar an index at every 5 minutes using a cron job but it seems that the size of the tarball increases over time. For example: The first 5 minutes: 1MB - in a tarball with a unique time-based ID The second 5 minutes: 2MB (fresh 1MB + previous 1MB) - in another tarball with a unique time-based ID The third 5 minutes: 3MB (fresh 1MB + previous 2MB) - in another tarball with a unique time-based ID The fourth 5 minutes: 4MB (fresh 1MB + previous 3MB) - in another tarball with a unique time-based ID The fifth 5 minutes: 5MB (fresh 1MB + previous 4MB) - in another tarball with a unique time-based ID ... ... ... Ideally, I would want to see: The first 5 minutes: 1MB - in another tarball with a unique time-based ID The second 5 minutes: 1MB (fresh 1MB) - in another tarball with a unique time-based ID The third 5 minutes: 1MB (fresh 1MB) - in another tarball with a unique time-based ID The fourth 5 minutes: 1MB (fresh 1MB) - in another tarball with a unique time-based ID The fifth 5 minutes: 1MB (fresh 1MB) - in another tarball with a unique time-based ID ... ... ... Is there a documentation I can look at? What is the conf file that I should configure and how should the stanza look like? Nicholas

Nicholas_Key · ‎09-28-2010

Thanks! I'll try this out.

Nicholas_Key · ‎09-28-2010

[1] I would like to know if I can tar an index from a Splunk instance and then untar it into other Splunk instance? [2] Would untar'ing the index overwrites the already existing events of that other Splunk instance?

Nicholas_Key · ‎09-18-2010

I didn't find it mentioned anywhere in the documentation. I might have overlooked it. http://www.splunk.com/base/Documentation/latest/admin/Propsconf

Nicholas_Key · ‎09-13-2010

Hi all, I have the following output from a Perl script that runs every 5 mins: 09-13-2010 16:21:20 - Inventory Report DATACENTER, CLUSTER, VMHOST, VM PPD, DNSAS-Cluster1, dnsas-esx1, dnsa-secweb1 PPD, DNSAS-Cluster1, dnsas-esx1, dnsasval1-dev9 PPD, DNSAS-Cluster1, dnsas-esx1, ddist3-dev9 PPD, DNSAS-Cluster1, dnsas-esx1, dmplupe1-dev9 PPD, DNSAS-Cluster1, dnsas-esx1, dnsasext1-dev9 ... ... ... (520 lines) And this is how my props.conf looks like: [source::vm_inventory] SHOULD_LINEMERGE=True BREAK_ONLY_BEFORE_DATE=True TIME_FORMAT=%m-%d-%Y %H:%M:%S However the events got truncated into 256 line chunks. Am I missing anything here? Or should I do it this way? [source::vm_inventory] TRUNCATE = 0 LINE_BREAKER = (?!)

Nicholas_Key · ‎08-29-2010

Hi all, I'm trying to forward my summarized events from an indexer (machine1) to multiple indexers (machine2 and machine 3) and I'm seeing this error message at machine2 and machine3: received event for unconfigured/disabled index='summary_forwarders' with source='source::All forwarders - regenerator summary index' host='host::machine1' sourcetype='sourcetype::stash' I'm really sure that I'm not using summary_forwarders in any way. Any idea why this happens?

Nicholas_Key · ‎08-21-2010

Hi all, Quick question about summary indexing: I have this configuration in the savedsearches.conf [esxtop_Group_Cpu_VM_SI] action.summary_index = 1 action.summary_index._name = summary_vmware cron_schedule = */5 * * * * description = Summary index for esxtop_Group_Cpu (VM) dispatch.earliest_time = -8m@m dispatch.latest_time = -3m@m displayview = flashtimeline enableSched = 1 realtime_schedule = 0 request.ui_dispatch_view = flashtimeline search = index="vmware" sourcetype="esxtop_Group_Cpu" | stats count by VM After waiting for 5 minutes, I tried to search index=”summary_vmware” source=”esxtop_Group_Cpu_VM_SI” | stats count by VM But I’m seeing VM count 00, search_name=esxtop_Group_Cpu_VM_SI, search_now=1282431600.000, info_min_time=1282431120.000, info_max_time=1282431420.000, info_search_time=1282431632.311, VM="net-cdp.4238", count=55 1 00, search_name=esxtop_Group_Cpu_VM_SI, search_now=1282431600.000, info_min_time=1282431120.000, info_max_time=1282431420.000, info_search_time=1282431632.311, VM="net-cdp.4239", count=55 1 00, search_name=esxtop_Group_Cpu_VM_SI, search_now=1282431600.000, info_min_time=1282431120.000, info_max_time=1282431420.000, info_search_time=1282431632.311, VM="vmware-vmkauthd.4241", count=110 1 00, search_name=esxtop_Group_Cpu_VM_SI, search_now=1282431600.000, info_min_time=1282431120.000, info_max_time=1282431420.000, info_search_time=1282431632.311, VM="vobd.4230", count=55 1 00, search_name=esxtop_Group_Cpu_VM_SI, search_now=1282431600.000, info_min_time=1282431120.000, info_max_time=1282431420.000, info_search_time=1282431632.311, VM="vobd.4231", count=55 1 00, search_name=esxtop_Group_Cpu_VM_SI, search_now=1282431600.000, info_min_time=1282431120.000, info_max_time=1282431420.000, info_search_time=1282431632.311, VM=FT, count=110 1 00, search_name=esxtop_Group_Cpu_VM_SI, search_now=1282431600.000, info_min_time=1282431120.000, info_max_time=1282431420.000, info_search_time=1282431632.311, VM=LinuxTaskMemPool, count=110 1 ... ... ... How does the search string looks like to get the values of fieldname VM, eg VM="net-cdp.4238", VM="net-cdp.4239", VM="vmware-vmkauthd.4241", VM="vobd.4230", VM=FT since index=”summary_vmware” source=”esxtop_Group_Cpu_VM_SI” | stats count by VM does not get the values of fieldname VM

Nicholas_Key · ‎08-18-2010

It appears that the raw values of CLUSTER, VMHOST and VM have a leading whitespace character. The solution is to add a trim() index="vmware" sourcetype="esxtop_Group_Cpu" host=* id=* | rex field=_raw "id=[\d]+:(?P .*)" | fields VM pct_CoStop | stats avg(pct_CoStop) by VM | join type=inner VM [search index="vmware" sourcetype="VM_Inventory" | head 1 | multikv fields DATACENTER CLUSTER VMHOST VM | table DATACENTER CLUSTER VMHOST VM | eval VM = trim(VM)]

Nicholas_Key · ‎08-18-2010

I have another thread here about doing join operation http://answers.splunk.com/questions/5756/not-getting-results-from-join

Nicholas_Key · ‎08-18-2010

Hi all, There are two datacubes that I want to perform a join operation. The first search string looks like this: index="vmware" sourcetype="esxtop_Group_Cpu" pct_CoStop | rex field=_raw "id=[\d]+:(?P<VM>.*)" | fields VM Wed Aug 18 11:33:55 PDT 2010 pct_CoStop=0.00, id=22:LisaSplunk4VMware Wed Aug 18 11:33:55 PDT 2010 pct_CoStop=0.01, id=21:vCenter The second search string looks like this: index="vmware" sourcetype="VM_Inventory" | head 1 | multikv fields DATACENTER CLUSTER VMHOST VM | table DATACENTER CLUSTER VMHOST VM DATACENTER CLUSTER VMHOST VM SF Intel-Hosts 10.1.6.34 perfVMFS SF Intel-Hosts 10.1.6.34 NicholasVMTest SF Intel-Hosts 10.1.6.34 Win2003_x86_template SF Intel-Hosts 10.1.6.34 LisaSplunk4VMware SF Intel-Hosts 10.1.6.34 Support_vm_debian SF Intel-Hosts 10.1.6.34 JMW Ubuntu SF Intel-Hosts 10.1.6.34 vCenter SF Intel-Hosts 10.1.6.23 perfRaw SF AMD-Hosts 10.1.12.5 Windows_2k3_64bit SF AMD-Hosts 10.1.12.5 SUDAENGW2008 SF AMD-Hosts 10.1.12.5 Windows_XP_JPN SF AMD-Hosts 10.1.12.5 Windows_XP SF AMD-Hosts 10.1.12.5 Windows_XP_dev SF AMD-Hosts 10.1.12.5 Windows_2K_i386 SF AMD-Hosts 10.1.12.5 Splunk4VMWare SF AMD-Hosts 10.1.12.4 OpenSuse_10_x86_64 SF AMD-Hosts 10.1.12.4 CentOS_3.9_i386 SF AMD-Hosts 10.1.12.4 OpenSuse_10_i386 SF AMD-Hosts 10.1.12.4 Windows_Vista_64bit SF AMD-Hosts 10.1.12.4 Solaris10_x86_64 SF AMD-Hosts 10.1.12.4 CentOS_5.3_x84_64 SF AMD-Hosts 10.1.12.4 LiveCD2 SF AMD-Hosts 10.1.12.4 CentOS_3.9_x86_64 SF AMD-Hosts 10.1.12.4 CentOS_5.1_i386 SF AMD-Hosts 10.1.12.4 Ubuntu_8.0.4_x86_64 SF AMD-Hosts 10.1.12.4 Windows_2k8_32bit SF AMD-Hosts 10.1.12.4 FreeBSD_6.4_x86_64 SF AMD-Hosts 10.1.12.4 LiveCD1 SF AMD-Hosts 10.1.12.4 Windows_2K8_64bit_JPN SF AMD-Hosts 10.1.12.4 VMware Infrastructure Management Assistant SF AMD-Hosts 10.1.12.4 CentOS_4.6_x86_64 SF AMD-Hosts 10.1.12.4 CentOS_5.1_x84_64 SF AMD-Hosts 10.1.12.4 CentOS_4.6_i386 SF AMD-Hosts 10.1.12.4 Ubuntu_8.0.4_i386 SF AMD-Hosts 10.1.12.4 Windows_2k3_32bit SF AMD-Hosts 10.1.12.4 LiveCD3 However, I'm not getting any results from the join operation that I use in this search string. index="vmware" sourcetype="esxtop_Group_Cpu" pct_CoStop | rex field=_raw "id=[\d]+:(?P<VM>.*)" | fields VM pct_CoStop | join VM [search index="vmware" sourcetype="VM_Inventory" | head 1 | multikv fields DATACENTER CLUSTER VMHOST VM | table DATACENTER CLUSTER VMHOST VM] Any thoughts? Is multikv working at all in this scenario?

Posts	61
Solutions	4
Karma Given	21
Karma Received	50
Member Since	‎02-22-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

How to forward data from Universal Forwarder into ...

Handler 'passwords': could not parse name

Add SearchBar and Flashimeline using Simple XML in...

Getting rid of "other" in pie chart

Does Splunk Free License allow usage of REST API?

Splunk search string (without using JOIN)

Features you want implemented in Splunk for Facebo...

Create new buckets at a defined interval

Tar'ing index so that it is distributable to other...

Is there a max number for MAX_EVENTS?

Re: How to forward data from Universal Forwarder i...

How to forward data from Universal Forwarder into ...

Handler 'passwords': could not parse name

Add SearchBar and Flashimeline using Simple XML in...

Re: Mobile Analytics for a Software Splunk Instanc...

Re: Mobile Analytics for a Software Splunk Instanc...

Re: Get data from public pages like Brands, Compan...

Re: Getting rid of "other" in pie chart

Getting rid of "other" in pie chart

Re: Features you want implemented in Splunk for Fa...

Does Splunk Free License allow usage of REST API?

Splunk search string (without using JOIN)

Features you want implemented in Splunk for Facebo...

Re: How can a FREE license expire?

Re: Insert image into single event with provided U...

Create new buckets at a defined interval

Re: Tar'ing index so that it is distributable to o...

Tar'ing index so that it is distributable to other...

Is there a max number for MAX_EVENTS?

Events chunked into 256 lines

Kept receiving error message at indexer

Summary indexing

Re: Not getting results from JOIN

Re: Translating an event into a table

Not getting results from JOIN