About pwmcity

pwmcity · ‎08-31-2015

It could be an issue with mv .... the problem is that since there are multiple empRef values per event, it means now you have a 'multivalue' field. If you look up the available mv commands (http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Commandsbycategory) and search for mv ... you'll see a few commands there. You could try | mvexpand empRef | stats count by empRef Aside from that, have you gone into verbose mode and checked to see if your empRef field is actually being populated?

pwmcity · ‎08-25-2015

Not sure what's going on there, but your regex has gotten overly complicated! Is it that you're trying to capture multiple empRef in a single event? The Rex command defaults to 1, so you can set that with max_match=0 for unlimited. I put your example string into splunk, to see if it was the way splunk handles double-quotes... but that's not the case and it worked fine, it produces a field 'var' with your example data, and a field 'empRef' with the expected 2 values index=_internal | eval var="[{\"friendlyName\":\"\",\"empRef\":\"012/AB00000\"},{\"friendlyName\":\"\",\"empRef\":\"023/AB11111\"}]" | rex field=var "\"empRef\":\"(?<empRef>[^\"]*)\"" max_match=0

pwmcity · ‎08-25-2015

Did it work? What's the error? regex appears to work: https://regex101.com/r/uP9iB9/1

pwmcity · ‎08-24-2015

Sounds like there is an EBS, but maybe something went wrong, didn't attach, and so the Splunk installation defaulted to the ephemeral storage ... which can happen! Maybe try again?

pwmcity · ‎08-24-2015

oh the marketplace AMI? I looked at that once and based on how old it is and the terrible reviews, decided to build my own. Considering it's their official AMI, they sure have done a terrible job maintaining it. How's your linux / aws foo? Can you SSH onto the box and run a 'df -h' to check disk space, and a 'mount -l' to see your mounts

pwmcity · ‎08-24-2015

If you actually want to use this, you'll need to allocate more disk. I recommend using an EBS, not the ephemeral disk that comes attached by default. Once attached / formatted / mounted, install / move your splunk instance to wherever your EBS is mounted. If you don't care about any of that and are okay with potentially losing your data / config... then just up the limit, see here: http://answers.splunk.com/answers/214804/the-minimum-free-disk-space-5000mb-reached-for-opt.html

pwmcity · ‎08-24-2015

You need to use the rex command http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/rex ... | rex field=_raw "\"empRef\":\"(?<empRef>[^\"]*)\" (disclaimer: regex untested!)

pwmcity · ‎07-30-2015

When you're on the visualizations tag (you can see the graph), look for the formatting options, there's an option to stack there. I'd say you're better to go with your first option though, that way you can have your 'ok's stacked as blue, and your 'nok's stacked as red.... which is more alarming to see than a gap in blue

pwmcity · ‎07-30-2015

Looks like you might have the Windows TA installed, it collects data with those sourcetypes http://docs.splunk.com/Documentation/WindowsApp/4.7TA/User/AbouttheSplunkTechnologyAdd-on(TA)forWindows

pwmcity · ‎07-30-2015

this is because you're removing the eventId in the first stats, try : | stats dc(detail.ipAddress) by eventId | stats count Also, know that that instead of this: | stats count(eventId) | rename count(eventId) AS "Registrations" you can do this: | stats count(eventId) AS "Registrations" And as far as performance, just try both and inspect the time taken

pwmcity · ‎07-30-2015

Any resolution?

pwmcity · ‎07-28-2015

Just to clarify, did you want to do this at index time? I'm told you have splunk parse json quite easily, I haven't tried but it's worth researching?

pwmcity · ‎07-28-2015

Have you tried using fields ? Try appending: | fields - AppName You could probably also replace table with fields, something like: | fields custonernumber AverageResponseTime MaxResponseTime MinResponseTime

pwmcity · ‎07-03-2015

Answered my own question.. append this after timechart ... | eval _lower="1" | eval _predicted="2" | eval _upper="3"

pwmcity · ‎06-10-2015

Did you by chance figure this out? I'm trying to add 'Domain Users' but can't seem to get Splunk to find it. I'm told it lives in "CN=Users,DC=our,DC=domain,DC=net" ... but still no go!

pwmcity · ‎06-01-2015

Just wondering if anyone knows how to graph a shaded band like you get with the predict command, but without running the predict command?

pwmcity · ‎05-21-2015

After installing the aws TA, i was able to collect some cloudwatch data, but all I get now is this: /var/log/splunk/aws_cloudwatch.log ... 2015-05-22 16:27:15,112 INFO pid=4461 tid=QueryWorkerThread-2 file=aws_cloudwatch.py:_main_work_loop:582 | Queried 631 metrics with 631 failures totaling 0 statistics in 13.279s before stalling. 2015-05-22 16:27:15,122 INFO pid=4461 tid=QueryWorkerThread-1 file=aws_cloudwatch.py:_main_work_loop:582 | Queried 638 metrics with 638 failures totaling 0 statistics in 13.282s before stalling. 2015-05-22 16:27:15,137 INFO pid=4461 tid=QueryWorkerThread-4 file=aws_cloudwatch.py:_main_work_loop:582 | Queried 538 metrics with 538 failures totaling 0 statistics in 13.307s before stalling. 2015-05-22 16:27:15,139 INFO pid=4461 tid=QueryWorkerThread-3 file=aws_cloudwatch.py:_main_work_loop:582 | Queried 601 metrics with 601 failures totaling 0 statistics in 13.304s before stalling. Ideas?

pwmcity · ‎05-19-2015

So I installed Splunk App for AWS and configured it for billing and for cloudwatch, the data is rolling in... It looks as though it has great dashboards for CloudTrail, Config, and Billing... am I missing something or am I supposed to just DIY the CloudWatch dashboards?

pwmcity · ‎03-19-2015

Hey, any updates on this? We're about to set up something similar and I'm going through the same thought process. Originally I figured having an ELB would mean managing less public IP's making security groups easier to manager. Based on dwaddle's answer below I'm thinking I'll instead expose a couple of intermediate forwarders and create an DNS A record for each, then use the Splunk built-in load balancing. Would love to hear your thoughts

pwmcity · ‎09-11-2014

Hey I'm having the exact same issues (http://answers.splunk.com/answers/154933/no-spec-file-and-invalid-key-in-stanza-when-pushing-windows-infrastructure-app-and-windows-add-on-to-cluster) Are you saying that once you comment out the invalid stanza keys (useEnglishOnly) in the default\inputs.conf (which are disabled anyway), then the other errors (no spec file) are ignored and the apps push to the cluster? I'm just trying to figure out the minimum changes required to the default app (to preserve upgrade path) that it will deploy without errors.

Posts	22
Solutions	4
Karma Given	14
Karma Received	11
Member Since	‎01-28-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How to graph a shaded area like you get with predi...

CloudWatch api "stalling"

Dashboards for AWS CloudWatch?

"No spec file" and "Invalid key in stanza" when pu...

Re: Extract Data From Event

Re: Extract Data From Event

Re: Extract Data From Event

Re: Initiating Splunk on AWS AMI, why am I getting...

Re: Initiating Splunk on AWS AMI, why am I getting...

Re: Initiating Splunk on AWS AMI, why am I getting...

Re: Extract Data From Event

Re: How do I create a stacked bar chart?

Re: Does Splunk Index Everything on the Server?

Re: Why am I getting zero results with my stats di...

Re: New TA-nix app - couldn't set locale correctly

Re: How to split a json array into multiple events...

Re: How to hide a field from the legend in a bar c...

Re: How to graph a shaded area like you get with p...

Re: Trouble authenticating ALL Active Directory us...

How to graph a shaded area like you get with predi...

CloudWatch api "stalling"

Dashboards for AWS CloudWatch?

Re: Forwarding events to an indexer cluster using ...

Re: Deploying Splunk_TA_Windows Add-on to Cluster ...