About uthornander_spl

uthornander_spl · ‎10-28-2025

Neither the "Audit Trail Documentation" nor the "What's new" links work https://help.splunk.com/?resourceId=SplunkCloud_Security_audit_logs_v2_overview https://help.splunk.com/?resourceId=r3812a4ea-8fbd-4509-a497-b59fa816d6d0

uthornander_spl · ‎07-11-2025

There currently is an issue with NF 9 and STREAM 8.1.5. I suggest downgrading until there's a newer release.

uthornander_spl · ‎06-02-2025

Hi @KayeChapman Lantern is great - there is only one things missing - dates on the articles! When were they written and for what version of the platform?

uthornander_spl · ‎01-23-2025

uthornander_spl · ‎01-23-2025

Hi Trying to display some data with single value (and sparkline) with the single value viz. I want to break the result up over "countries", but nothing comes out. I get a sparkline, but the rest are all zero's | gentimes start=01/01/2024 end=01/31/2024 increment=1d | eval _time=starttime | eval countries="Sweden,Finland,Estonia,Lithuania,Norway,Latvia" | makemv delim="," countries | mvexpand countries | eval value=round(random() % 100, 0) | streamstats count | sort countries | timechart span=1d avg(value) by countries Dashboard

uthornander_spl · ‎05-28-2024

Does anyone know how this will integrate with "Private" channels in Slack? https://splunkbase.splunk.com/app/5846

uthornander_spl · ‎04-04-2024

Nope - 👎

uthornander_spl · ‎02-12-2024

Why does the URA not update itself efter a scan? I've had several apps installed for more than 2 weeks, and still I get the same message: ---------------------------------------- Details This newly installed App has not completed the necessary scan. Version 1.1.6 Application Path /opt/splunk/etc/apps/it_essentials_learn Required Action Please check again in 24 hours when the necessary scan is complete. --------------------------------------- Even if I force a scan, nothing changes.

uthornander_spl · ‎01-16-2024

This is very neat @ITWhisperer - but I have 2 more questions with regards to your answer. Where are the colours defined (i.e. are there more, like pink and purple)? Is Trellis limited to the number of graphs it can create (I can't get more than 12 for some reason).

uthornander_spl · ‎06-21-2023

September 26 in Malmö - and another pending in Göteborg.

uthornander_spl · ‎06-21-2023

Hi Just to make it clear - these pages are for texting - a bit tighter target than what you have in the public Slack. If you want to know about the meetings (live) we have then you should sign up here: https://usergroups.splunk.com/stockholm-splunk-user-group/ If you want to have a wider chit-chat - then Slack is your choice: https://splunk-usergroups.slack.com

uthornander_spl · ‎08-19-2022

Great prezo - but how do I get the content from the links shown?

uthornander_spl · ‎11-12-2020

Is it so that you have to have numerical values for all the data in a bubble chart? I've got a table with 4 columns, but only one of them contains numbers. I want the Y-axis to be the product_name, the X-axis to be the Country and the size of the bubble to be the sum(product_price) for the product. Looking around there seems to have been an issue before: https://community.splunk.com/t5/Splunk-Search/Bubble-Charts-input-data-structure-lacking-documentation/m-p/94620#M24419 <option name="charting.axisY">category</option> But that does nothing, I still get the axises with numbers and not the text and all the bubbles piled up in the corner.

uthornander_spl · ‎06-16-2020

It is around the corner - should be in *NIx TA 8.1. https://splunkbase.splunk.com/app/833/ that is imminent.

uthornander_spl · ‎09-19-2019

Check this answer out: https://answers.splunk.com/answers/511410/how-to-calculate-the-round-trip-time-by-the-modulo-1.html

uthornander_spl · ‎09-10-2019

What is it that you want to do with Chrony that you can't do today? I hadn't heard about it before but to the best of my understanding, there shouldn't be any difference to Splunk. If it's just the matter of the time logs, you should be able to ingest them just as you ingest any other data.

uthornander_spl · ‎11-20-2018

Ok - that is as you say not exactly what I was trying to do but anything that makes it roll is better than something that doesn't move 🙂 Thanks!

uthornander_spl · ‎11-19-2018

Sure - Here we go: <input type="time" searchWhenChanged="true" token="time"> <label>Time picker</label> <default> <earliest>-7d@h</earliest> <latest>now</latest> </default> </input> <input type="radio" token="resetTokens" searchWhenChanged="true"> <label></label> <choice value="reset">Reset Inputs</choice> <choice value="retain">Retain</choice> <default>retain</default> <change> <condition value="reset"> <set token="indx">*</set> <set token="resetTokens">retain</set> </condition> </change> </input> <panel> <title>Index size</title> <chart> <title>Index sizes over time</title> <search> <query>index=_internal source=*license_usage.log type=Usage | eval MB = b/1024/1024 | timechart span=1d useother=0 sum(MB) by idx | rename idx as Index, sum(MB) as Megabyte | sort – Megabyte</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisTitleX.text">Time</option> <option name="charting.axisTitleY.text">MB</option> <option name="charting.chart">area</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="refresh.display">progressbar</option> <drilldown> <set token="indx">$click.name2$</set> <set token="form.resetTokens">retain</set> </drilldown> </chart> </panel> <panel> <title>Sourcetype size</title> <chart id="detail" depends="$indx$"> <title>Sourcetype detail for $indx$ index</title> <search> <query>index=_internal source=*license_usage.log type=Usage idx=$indx$ | eval MB = b/1024/1024 | timechart span=1d useother=0 sum(MB) by st | rename st as SourceType, sum(MB) as Megabyte | sort – Megabyte</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.text">Time</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">MB</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="refresh.display">progressbar</option> </chart> </panel>

uthornander_spl · ‎11-18-2018

OK - so slightly different approach - but I'm getting a problem with line 8 (Unexpected element after document end) and my XML'ish isn't good enough to crack that. What am I not seeing?

uthornander_spl · ‎11-18-2018

Hi I have 2 graphs where the first graph feeds a token that populates the second graph. If nothing, in the first (left) graph is clicked, I have the right graph populated with all the values from the left graph. But, I can't find a way to unset the token by clicking in the white space in the left graph after having clicked a particular value. I'm guessing some should do the trick, but I can't get anything to play ball! <form> <label>License Galore</label> <init> <set token="index">*</set> </init> <description>all you ever wanted to know about license use</description> <fieldset autoRun="true" submitButton="false"> <input type="time" searchWhenChanged="true" token="time"> <label>Time picker</label> <default> <earliest>-7d@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <title>Index size</title> <chart> <title>Index sizes over time</title> <search> <query>index=_internal source=*license_usage.log type=Usage | eval MB = b/1024/1024 | timechart span=1d useother=0 sum(MB) by idx | rename idx as Index, sum(MB) as Megabyte | sort – Megabyte</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisTitleX.text">Time</option> <option name="charting.axisTitleY.text">MB</option> <option name="charting.chart">area</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="refresh.display">progressbar</option> <drilldown> <set token="index">$click.name2$</set> </drilldown> </chart> </panel> <panel> <title>Sourcetype size</title> <chart id="detail" depends="$index$"> <title>Sourcetype detail for $index$ index</title> <search> <query>index=_internal source=*license_usage.log type=Usage idx=$index$ | eval MB = b/1024/1024 | timechart span=1d useother=0 sum(MB) by st | rename st as SourceType, sum(MB) as Megabyte | sort – Megabyte</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.text">Time</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">MB</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> </form>

uthornander_spl · ‎08-31-2018

So how did you get the other timers in (and preferably coded in another color)?

uthornander_spl · ‎08-31-2018

Hi I have some proprietary log data that gives 3 different response times for each event. These are extracted into Timer1,Timer2,Timer3 What I want to achieve is to count the number of timer events that fall into a bucket where i can control the bucket size. That means that just countingh the number of 0,3 second response time events is not enough, but I also want to control so that it is counted in bucket that holds 0-1 second response times. As a twist to it, I don't know how many buckets I need, or rather I don't know how long the longest response time is, but I would like to truncated/gather up the values over a certain value.. Then I want to plot the count on the Y axis, and the buckets on the X axis. I get somewhere by using: |bin span=1 timer1 as Rtime | chart count as "Count" by Rtime But then I'm stuck.

uthornander_spl · ‎03-18-2018

Hi In the end we had to fold as they moved the application to a newer host. Another thing to consider is that it's very hard to determine the state of a JAVA application based on the JMX data alone, as you have no real clue on how the application itself is doing, just the JVM. It's a bit like looking at an ambulance and trying to determine if the patient inside is dead or not. Bur thanks for the confirmation @skoelpin that we were at least going in the right direction.

uthornander_spl · ‎03-15-2018

Hi Yes - I have a (old) major in math 🙂 Rusty as it is, I was trying to use that in MLTK just as you suggested. One of the challenges is that there is no single conclusive field that is 100% spot on. Sometimes the CPU will peak >90% and threads>300 and gCDuration will increase. Next time the CPU is idling while the thread count approaches 400 and the gCDuration is again increasing. I use jvmUptime to see when they have manually reset the JVM and that value (=result) correlates with one or more of the other ones I mentioned. There are a few others as well but not as clear as these. We have toyed with 50/50 as well as 80/20 and we can get R2 to be quite close to 1 but then the RMSE value skyrockets even though the predicted vs. the actual graphs are decent. /Confused (appreciate the feedback!)

uthornander_spl · ‎03-15-2018

I have a Java application giving me some JMX data. The application dies(freezes) on a very uneven basis. From the JMX data I've been able to see a few metrics that visually seem to indicate that there will occur a freeze. My intent is to use these parameters to predict a near future freeze. So the ones I've spotted are CPUTime and gCDuration as well as the number of gCthreads. When CPUTime is high and the gCDuration peaks when the gCthreads are more than 300, someone will notice and they will manually reset the JVM - this is the scenario I want to predict in ML. As I try different approaches in the ML toolkit, none of them see to do the trick. How do I know what model is the "right" one?

Posts	37
Solutions	1
Karma Given	34
Karma Received	5
Member Since	‎10-31-2017

Online Status	Offline
Date Last Visited	Friday

Trying to get Trellis and Single Value to play bal...

Slack integration with "Private Channels"

Upgrade readiness failing completeness update

Meetings :) not texts

Bubble chart without numbers

How do you unset a token by clicking in a graph?

Histogram and bucket size

Machine Learning and JMX data

Enforce 24 hour time format?

How to get the Multiselect input to create a searc...

Re: 🌟 From Audit Chaos to Clarity: Welcoming Audi...

Re: Issue with NetFlow v9 Templates Not Received b...

Re: What You Read The Most: Splunk Lantern’s Most ...

Re: Trying to get Trellis and Single Value to play...

Trying to get Trellis and Single Value to play bal...

Slack integration with "Private Channels"

Re: Upgrade readiness failing completeness update

Upgrade readiness failing completeness update

Re: Trellis Colors

Re: Any events in sommer,autumn 2023?

Meetings :) not texts

Re: Introducing Ingest Actions: Filter, Mask, Rout...

Bubble chart without numbers

Re: When will Chrony be supported?

Re: how to collect data for network latency betwee...

Re: When will Chrony be supported?

Re: How do you unset a token by clicking in a grap...

Re: How do you unset a token by clicking in a grap...

Re: How do you unset a token by clicking in a grap...

How do you unset a token by clicking in a graph?

Re: Histogram and bucket size

Histogram and bucket size

Re: Machine Learning and JMX data

Re: Machine Learning and JMX data

Machine Learning and JMX data

Join the Conversation