Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About GregZillgitt
GregZillgitt
Path Finder
Member since:
01-17-2014
06-05-2020
Community Statistics
| Posts | 25 |
| Solutions | 4 |
| Karma Given | 9 |
| Karma Received | 20 |
| Member Since | 01-17-2014 |
Activity Feed
- Got Karma for Re: Commenting Search Code. 07-09-2020 11:27 PM
- Karma Re: Why are Javascript files not loading after update to Splunk 6.5.0? for skawasaki_splun. 06-05-2020 12:48 AM
- Karma Re: Why are Javascript files not loading after update to Splunk 6.5.0? for ehudb. 06-05-2020 12:48 AM
- Karma Re: Splunk DB Connect : An identity can be used by several connections for jplumsdaine22. 06-05-2020 12:48 AM
- Karma Re: Why am I unable to add my search to a dashboard panel? for cmerriman. 06-05-2020 12:48 AM
- Karma Re: POLL: How often do you update your Splunk Enterprise software in production? for bmacias84. 06-05-2020 12:48 AM
- Karma Re: POLL: How often do you update your Splunk Enterprise software in production? for horsefez. 06-05-2020 12:48 AM
- Karma Re: POLL: How often do you update your Splunk Enterprise software in production? for koshyk. 06-05-2020 12:48 AM
- Karma Re: POLL: How often do you update your Splunk Enterprise software in production? for adam_reber. 06-05-2020 12:48 AM
- Got Karma for Re: Why am I getting error "No appropriate protocol (protocol is disabled or cipher suites are inappropriate)" running a search through the Splunk Java SDK?. 06-05-2020 12:48 AM
- Got Karma for Re: How can we delete a large index from an indexer cluster?. 06-05-2020 12:48 AM
- Got Karma for Re: When I specify the time range in my dashboard panel, why does it display data for "all time"?. 06-05-2020 12:48 AM
- Got Karma for POLL: How often do you update your Splunk Enterprise software in production?. 06-05-2020 12:48 AM
- Got Karma for POLL: How often do you update your Splunk Enterprise software in production?. 06-05-2020 12:48 AM
- Got Karma for Re: How to get to grips with SPL.. 06-05-2020 12:48 AM
- Got Karma for Re: Why is my eval search returning empty field results?. 06-05-2020 12:48 AM
- Got Karma for Re: Why is my eval search returning empty field results?. 06-05-2020 12:48 AM
- Got Karma for Re: Add data with Python. 06-05-2020 12:48 AM
- Got Karma for Re: Why am I getting error "No appropriate protocol (protocol is disabled or cipher suites are inappropriate)" running a search through the Splunk Java SDK?. 06-05-2020 12:48 AM
- Got Karma for Re: Why am I getting error "No appropriate protocol (protocol is disabled or cipher suites are inappropriate)" running a search through the Splunk Java SDK?. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 2 |
02-03-2017
07:38 AM
Thanks Adam
... View more
02-03-2017
07:37 AM
|eval start=strptime("2017-02-03 09:51:54.595","%Y-%m-%d %H:%M:%S.%3N")
|eval end=strptime("2017-02-03 09:46:21,892","%Y-%m-%d %H:%M:%S,%3N")
|eval diffInSeconds=end-start
... View more
02-03-2017
06:57 AM
1 Karma
The problem is that your time-picker isn't wired up to your panel - the "earliest" and "latest" tags in the panel need to use the token produced by the time picker.
Here's an example of that:
<form>
<label>HTTP Listener Events</label>
<fieldset submitButton="false">
<input type="time" token="field1">
<label></label>
<default>
<earliest>0</earliest>
<latest></latest>
</default>
</input>
</fieldset>
<row>
<panel>
<event>
<search>
<query>index=_internal sourcetype=splunkd HttpListener | dedup message</query>
<earliest>0</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">50</option>
<option name="list.drilldown">full</option>
<option name="list.wrap">1</option>
<option name="maxLines">5</option>
<option name="raw.drilldown">full</option>
<option name="rowNumbers">0</option>
<option name="table.drilldown">all</option>
<option name="table.sortDirection">asc</option>
<option name="table.wrap">1</option>
<option name="type">list</option>
</event>
</panel>
</row>
</form>
Note the and tags in the panel. You probably have something similar to that. To fix it you can edit the xml directly, or use the gui:
You should end up with something like this:
<form>
<label>HTTP Listener Events</label>
<fieldset submitButton="false">
<input type="time" token="field1">
<label></label>
<default>
<earliest>0</earliest>
<latest></latest>
</default>
</input>
</fieldset>
<row>
<panel>
<event>
<search>
<query>index=_internal sourcetype=splunkd HttpListener | dedup message</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">50</option>
<option name="list.drilldown">full</option>
<option name="list.wrap">1</option>
<option name="maxLines">5</option>
<option name="raw.drilldown">full</option>
<option name="rowNumbers">0</option>
<option name="table.drilldown">all</option>
<option name="table.sortDirection">asc</option>
<option name="table.wrap">1</option>
<option name="type">list</option>
</event>
</panel>
</row>
</form>
... View more
02-03-2017
06:24 AM
Thanks for your input.
... View more
02-03-2017
06:23 AM
I agree - wait for x.1!
... View more
02-02-2017
10:19 AM
2 Karma
We are having an internal debate concerning the frequency with which we should update our Splunk Enterprise software in our prod environment. I'm of a mind to do it roughly quarterly, which corresponds to Splunk's normal release cadence. Our admins prefer once per year. We're currently on 6.4.1.
I'm especially interested in what other large shops - with clustered indexers and search heads - are doing. I'll "vote up" every answer!
... View more
01-27-2017
02:55 PM
Are you asking how to create a search that extracts fields from your events, or how to display the output of the search in a dashboard? Or both?
Obviously the logging you've shown is not sufficient to distinguish between uploads and downloads.
... View more
01-27-2017
12:40 PM
Have you tried just using curl?
curl -ku 'admin':'changeme' https://myserver:8089/servicesNS/admin/search/search/jobs/export -d search="|inputcsv foo.csv | blah" -d output_mode=csv
... View more
01-27-2017
07:09 AM
Is MCEPO a local service account or is it AD/LDAP?
Have you tried connecting with a database browser like Toad or DBVisualizer? I usually test that way before I configure Splunk, since it's generally easier to troubleshoot connection problems using a purpose-built tool.
... View more
01-27-2017
06:59 AM
Something else to try:
search * | head 1 | append [|inputcsv foo.csv | blah ] | blah
Might run into issues if your csv is large (e.g. >50K rows)
... View more
01-27-2017
05:43 AM
1 Karma
Search command primer: http://docs.splunk.com/Documentation/Splunk/6.5.2/Search/Usethesearchcommand
Search tutorial: http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchTutorial/WelcometotheSearchTutorial
... View more
01-26-2017
01:55 PM
Oh crap, that's right.
How about putting the "|inputcsv..." in a macro? Then...
search `foo` | blah blah...
... View more
01-26-2017
01:51 PM
Try wrapping your python script with a shell script (.e.g. test.sh). Your ".py" file is not a standalone executable any more than is a ".java" or ".class" file. If you were running it from the command line you would say "python test.py", not just "test.py". If however you had a "test.sh" Bash script which contained "python test.py", then you could run
"test.sh" as an executable, assuming you had set the permissions correctly and your PATH included your PYTHON home.
... View more
01-26-2017
01:36 PM
ok, how about
search index=* | head 1 | eval foo="deleteme" | inputcsv ... | blah blah blah| search NOT foo="deleteme"
(just out of curiosity)
... View more
01-26-2017
01:32 PM
Can you load metrics.log into vi and search there?
I just ssh'd into one of our forwarders and it worked for me...
$ grep -i "name=thruput" metrics.log
01-26-2017 15:16:23.841 -0600 INFO Metrics - group=thruput, name=thruput, instantaneous_kbps=0.202834, instantaneous_eps=0.257975, average_kbps=19.430535, total_k_processed=4248380.000000, kb=6.290039, ev=8.000000, load_average=2.010000
01-26-2017 15:16:54.829 -0600 INFO Metrics - group=thruput, name=thruput, instantaneous_kbps=0.219149, instantaneous_eps=0.613138, average_kbps=19.427809, total_k_processed=4248386.000000, kb=6.791016, ev=19.000000, load_average=1.610000
01-26-2017 15:17:25.829 -0600 INFO Metrics - group=thruput, name=thruput, instantaneous_kbps=0.209961, instantaneous_eps=0.258064, average_kbps=19.425083, total_k_processed=4248392.000000, kb=6.508789, ev=8.000000, load_average=1.500000
... View more
01-26-2017
01:23 PM
Try this:
"search | inputcsv ..."
... View more
01-26-2017
12:41 PM
If I understand your question:
strptime() creates a time object from a string. For output or string conversion, you format time objects via strftime() or the convert command. So...
Created=strptime(Created,"%Y-%m-%dT%H:%M:%S.%3N%z")
... basically takes the current value of "Created", which is a string, and replaces that field with a time object. The time object doesn't have a "format" per se.
Here are a few example conversions:
eval dayofweek=strftime(_time,"%w")
eval hour=strftime(_time,"%H")
eval yymmdd=strftime(tstamp,"%y%m%d")
eval minute=strftime(_time,"%y%m%d%h%M")
truncate time to the current minute, then convert to epoch format string:
eval trunc_minute=strftime(strptime(strftime(_time,"%y%m%d%H%M"),"%y%m%d%H%M"),"%s")
the more succinct way:
eval trunc_minute=strftime(relative_time(_time, "@m"),"%s")
... View more
01-26-2017
09:32 AM
Try this:
| jirarest jqlsearch "type = (typename) AND \"Environment Type\" = (environmenttype) AND (\"Environment Name\" in ((environmentname1), (environmentname2), (environmentname3)) OR \"Environment Name\" is EMPTY) AND createdDate >= startOfMonth()" | eval Created=strptime(Created,"%Y-%m-%dT%H:%M:%S.%3N%z") | eval _time=Created
That'll take care of charting. To get from _time to your preferred display format:
strftime(_time,"%d-%b-%Y")
... View more
01-26-2017
06:37 AM
2 Karma
What do you see if you leave off the eval and table commands? How about just leaving off the eval? Sounds to me like the strptime function isn't matching the values in "Created", which should have strings looking like "24:01". If this is true then the effect of the eval command would be to set the Created field null, which you are then putting into a table. Test this:
...eval Created2=strptime(Created, "%d:%m") | eval Created2=coalesce(Created2,"FOOBAR!")|table Created Created2
... View more
01-26-2017
06:12 AM
1 Karma
The Splunk Python SDK contains a script called "upload.py" in the root of the "examples" directory. Should be just what you're looking for. Have a look: https://github.com/splunk/splunk-sdk-python/blob/master/examples/upload.py
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma from
Karma given to
