Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About joebensimo
joebensimo
Path Finder
Member since:
05-17-2013
06-05-2020
Community Statistics
| Posts | 39 |
| Solutions | 2 |
| Karma Given | 69 |
| Karma Received | 19 |
| Member Since | 05-17-2013 |
Activity Feed
- Karma Why does my search "tag=x NOT tag=y" returns "No results found"? for coleman07. 06-05-2020 12:47 AM
- Karma How to edit the color of a dashboard panel in Simple XML? for 70250939. 06-05-2020 12:47 AM
- Karma Is there a "What If" command for applying the cluster bundle to let you know whether it will require a restart versus a reload? for maciep. 06-05-2020 12:47 AM
- Karma Re: How to rotate a table using transpose, remove the first row, and rename the column headers? for acharlieh. 06-05-2020 12:47 AM
- Karma How to rotate a table using transpose, remove the first row, and rename the column headers? for HattrickNZ. 06-05-2020 12:47 AM
- Karma summarize directories in dispatch? for carmackd. 06-05-2020 12:46 AM
- Karma Re: Pulldown module: Statically setting two values per pulldown option for sideview. 06-05-2020 12:46 AM
- Karma Error: mvexpand output will be truncated due to excessive memory usage for erstexas. 06-05-2020 12:46 AM
- Karma stats right justify numbers for wang. 06-05-2020 12:46 AM
- Karma What is meant to clean up dispatch? for djce. 06-05-2020 12:46 AM
- Karma Re: SearchControls Module Not Taking On PostProcess Results for sideview. 06-05-2020 12:46 AM
- Karma SearchControls Module Not Taking On PostProcess Results for jpass. 06-05-2020 12:46 AM
- Karma Re: Math precision for gkanapathy. 06-05-2020 12:46 AM
- Karma Re: variables indicating the time range of the interactive search selection ? for Ayn. 06-05-2020 12:46 AM
- Karma variables indicating the time range of the interactive search selection ? for elenzil. 06-05-2020 12:46 AM
- Karma Forwarding summary index from search head to Indexer for Splunk_U. 06-05-2020 12:46 AM
- Karma multiple forwarder instances on same server for bob87. 06-05-2020 12:46 AM
- Karma Re: Forwarding summary index from search head to Indexer for itinney. 06-05-2020 12:46 AM
- Karma any way to create an alternate name or alias for an index? for mrjlam. 06-05-2020 12:46 AM
- Karma Search results may be incomplete, peer 's search ended prematurely for kaizidorfa. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 3 |
06-11-2015
06:04 AM
1 Karma
Deleting data from an index does not impact accelerated search results. In order to get the accelerated search results to update, acceleration must be removed from the search and then added back to the search.
... View more
04-27-2015
10:08 PM
I have this same problem with v6.0. It appears that NOT does not work with tags. 😞
... View more
07-01-2014
08:54 AM
1 Karma
This continues to be a problem. It appears that Splunk's functionality to index large lookup files on disk has been broken for over a year. Is this broken? Or is there something special that needs to be done to make it work?
... View more
06-30-2014
11:32 AM
1 Karma
I have this problem too. Switching to multi-select will require I change hundreds of queries on dozens of dashboards -- and give users the option of doing things they should not do: select multiple items in cases they should only select one.
... View more
06-20-2014
02:03 PM
This only works if the value for which you want to filter is constant. The mvfilter command won't accept field names as part of the boolean expression other than the multi-value field being filtered.
... View more
05-29-2014
12:23 AM
2 Karma
It appears that this occurs when databases are added the the UI. The UI appears to add them to local/database.conf for whatever application was active before selecting Settings > External Data bases. To make the error go away, I moved the contents of database.conf into the dbx/local/database.conf file.
... View more
05-25-2014
04:06 PM
I am getting this same error when using a MySQL database. I've been using DBX without problem with PostgreSQL databases for months, but attempting to use MySQL database give me this error.
... View more
03-18-2014
11:36 PM
In your example, are the 09:00 and 18:00 elapsed time or time of day?
... View more
03-11-2014
09:26 AM
3 Karma
This appears to only be a limitation in the user interface. I have successfully added (and use) calculated fields that use split by directly adding them to a props.conf file.
For example:
[source::users*ly]
EVAL-userid = split(userid," ")
... View more
03-09-2014
08:30 PM
I too am having this problem when I use split is calculated fields. Eg: split(field," ")
... View more
02-27-2014
11:13 PM
The scope of "data analysis and operational intelligence" is huge -- too huge to provide much helpful information without better understanding your needs.
What specific problems do you want to solve? What questions do you think Splunk might help you answer?
... View more
02-27-2014
11:02 PM
1 Karma
In my experience, with Splunk v5.0.x, there is no explicit time for which the search head and peers continue to work after a master goes down. I've had them continue to work, but also had them fail in under a half hour. As the document says, "treat a downed master as a serious failure" and start fixing the problem immediately.
Also, with Splunk v5.0.x, I've found that bringing the master back online may put the cluster in a bad state for a while.
The most common problems I've seen when a master is down is that searches return incomplete data; however, I've also see a cluster become completely unsearchable.
In my experience, v5 handles clustering very poorly. I highly recommend you upgrade to v6.
... View more
12-17-2013
01:52 PM
Also, "history" suffers from the same problem as the "Jobs" page: it doesn't contain the full history. Viewing a dashboard with an auto-refresh can quickly blow through all the history that is retained for "history".
... View more
12-17-2013
12:09 PM
1 Karma
It appears that "history" only returns search history for the current user. Is there a way in 5.x to get history for all users?
... View more
12-08-2013
07:41 PM
According to the documentation, and direction I got from Splunk support when I inquired, a v5 search instance won't work with v6 indexers. Have you found mixing search and indexer versions like this to work?
... View more
12-08-2013
02:45 PM
3 Karma
Why is creating fields not an option? Even if you don't want fields for all searches, you can create per-search fields using the rex command.
You should be able to do something like:
... | rex field=_raw "^[^ ]+ [^ ]+ [^ ]+ (?<free_text>.+)" | top limit=10 free_text
... View more
12-08-2013
02:14 PM
Do the main and subsearch both return the expected results when run separately?
... View more
12-08-2013
01:53 PM
I have some saved accelerated searches that generated graphs that are displayed on some of our reports to alert users of gaps and overlap in summary indexes used to generate the results of their queries. As gaps are later filled in, the gaps in the graphed accelerated search are also filled in. However, when overlap is deleted, the data points in the graph don't drop when the data behind them is no longer there.
It appears that accelerated searches only fill gaps when data changes but they don't remove results from data later deleted. Is this so?
If so, Is there some other method (easier than scheduled searches filling summary indexes) that can be used to quickly (in seconds) make gaps and overlaps in summary indexes obviously visible?
The quickest I've found so far is to do a query like this:
index=*-hourly | timechart minspan=1h dc(info_search_time) by source
However, this is still way too slow without using acceleration. And when I use acceleration, overlaps remain in the results of this query even after they are deleted from the summary indexes.
... View more
12-08-2013
01:46 PM
I do the following to make realtime searches perform. This does result in a bit of a delay -- which is ok for most the my needs.
Rather than realtime, create scheduled searches that run once per minute and aggregate the data of a single minute (usually -2m@m to -1m@m, in order to allow sufficient indexing time -- you may need more or less depending on indexing latency) using stats or sistats, and save the results of these scheduled searches into a summary index.
Create a saved search that references the summary indexes rather than the raw logs.
Run the saved searches as realtime searches.
... View more
12-06-2013
09:16 PM
Does this work? The docs say that sort by is applied to the results after deduping. However, if the docs are correct, making sort by part of dedup doesn't make sense.
... View more
10-03-2013
11:40 AM
Has this been fixed?
What is the impact on search while the restart is going on? Are incomplete results returned?
... View more
09-28-2013
05:43 AM
This may be the same issue I'm encountering. In my case, stats is not aggregating properly or consistently. I get multiple result lines for items in the by part of the stats command. I can make the issue go away by performing the search over a smaller data set with less variation in the by fields or by including fewer or different aggregate functions and/or fields on which the aggregate functions are applied -- leading me to believe this is triggered by a combination of factors. I've spent many many hours unsuccessfully trying isolate the combination of conditions that trigger this issue.
... View more
09-19-2013
08:54 AM
Summary index does not handle the time as I want. It aggregates by whatever time I tell it to -- or by the entire range of the summary-index-generating query.
I group by time because I often need/want to group results by time periods shorter than the period over which the summary index query runs. Eg, I have summary index generating queries that run daily and generate aggregated data by hour.
Report acceleration doesn't work for my queries due to the calculations that are in the building of the summary indexes.
... View more
09-19-2013
08:53 AM
sistats limits what I can do with the summary index data when I query it. sistats doesn't give me the flexibility I need. Therefore, I use stats.
The main difference between sistats and stats is that sistats keeps/saves the minimum data needed to generate the specific statistics specified, while stats saves the results of each specified statistic.
... View more
09-18-2013
11:59 PM
This seems to explain what I am seeing with multiplication. I just did some additional tests with a variety of precisions. It appears Splunk is using digits of precision and not digits after the decimal point. It doesn't matter where the decimal point is located.
However, for division, I seem to get more digits of precision than any of the input values -- which is probably what I want it to do.
Thanks!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
