About jeffa

jeffa · ‎09-30-2013

This answer is consistent w/ what I'm seeing in my environment. Thanks!

jeffa · ‎09-26-2013

I currently have summary searches that are writing data to summary indexes, and have been doing so for years. My disk space constraints allow me to maintain just over a year of indexed data, and as the index(es) grow, old data rolls off via max index size settings. However, my summary indexes contain (reportable) summarized data from before the earliest index data. In fact, I have about three years’ worth of summarized data (with significantly less disk utilization than the original data). In Report Acceleration, one specifies the (preset) time frame over which to maintain the summarized data. Summarized data that is older than the time frame specified is trimmed. But how does that work for the “All Time” constraint? Does the summarized data get removed when index data is removed due to size constraints, or is the summarized data retained and reportable?

jeffa · ‎09-25-2013

I did some experimentation with this and found that pointing the pan_index macro at the default index did allow me to view logs and dashboards from logs stored in the default index instead of the pan_logs index. However, the app author has stated that “Though keep in mind that this isn't really a supported configuration…” and that the configuration may cause issues w/ future releases. The reason I originally asked the question is that up till now, I have used the index size limit of the default index to control disk utilization. Rather than putting the Palo Alto logs in the default index, the better answer was to implement “Volume settings” (indexes.conf) and place the default index, pan_logs index (and any other index that I want to control) into the same “volume”.

jeffa · ‎09-05-2013

According to the setup documentation, the input for Splunk for Palo Alto Networks should write to the pan_logs index, however, I would prefer that it write to the default index. My hope is that making this change is as easy as updating the `pan_index` macro to point to the default index rather than pan_logs, but are there any other considerations?

jeffa · ‎09-05-2013

Environment: Windows Splunk 5.0.4 Splunk for Palo Alto Networks 3.3.1 I am looking to install the Splunk for Palo Alto networks in an environment where Splunk has no access to the outside world. That being said, geolocation, wildfire, and pretty much everything that needs to talk to a third party will not work. Are there steps I can take to disable the attempts to query the outside world? Attempts to access disallowed locations are logged/alerted on, and I would like to remove as much noise as possible. I also get the following errors when I access the app because I have not installed the geolocation modules (because they wouldn’t work anyway). And the start page just hangs at "Loading...". How do I prevent these pop-ups? And is there a workaround for the PAN Overview page? Splunk encountered the following unknown module: "GoogleMaps" . The view may not load properly. Splunk encountered the following unknown module: "GeoDrilldown" . The view may not load properly.

jeffa · ‎05-04-2012

Brilliant! That did the trick.

jeffa · ‎05-04-2012

That search still doesn't produce any charting results. I have played w/ bucketing and eval but no luck.

jeffa · ‎05-04-2012

I'm sure there is an easy answer for this and I'm going feel silly when I see it. I have a scripted input that pulls volume data for several volumes every 5 minutes. I would like to see the change in used terabytes of the combined volumes over time (each volume has a used_tb key/value pair in the log). For short timeperiods, I can do... ... | timechart span=5m sum(used_tb) but when once I need to go beyond the last 24 hours, this breaks down. I can do... ... | timechart span=1h min(used_tb) by volume and then use an area graph in stacked mode to get the idea, but I can't get an accurate measure when I hover over the graph (the pop up is for the individual volumes). I thought that nesting the functions... ... | timechart span=1h sum(min(used_tb) by volume) would work, but this produces no values. What really easy thing am I missing here?

jeffa · ‎09-02-2011

Multiple panels are a key requirement. Ultimately I want to email this dashboard as a PDF, so no user interaction will be possible for that.

jeffa · ‎08-31-2011

Thanks for the suggestion on the ui examples app. I may be missing something, but I don't see what I'm looking for in those examples. I may need to be wording this better, but what I want to do is populate a dashboard with a dynamically generated set of panels. The number of panels (changed disks) and set of changed disks will be different from day to day.

jeffa · ‎08-30-2011

Is it possible to dynamically populate a dashboard/view with panels/charts based on search results? For example, I track disk utilization across my systems w/ Splunk, and I'd like to be able to create a dashboard of disk utilization graphs only for disks whose utilization has changed by a specified amount. In other words, of our 100+ disks, only 10 or so will have changed utilization over the last week, but the set of changed disks will not be the same from day to day. So, I want one panel/chart per disk (with a few items for that disk charted). The number of disks, as well as which disks should be charted would be dynamic. So, if I have 5 servers w/ C: drives, and only servers 1 and 4 have significant change in the last week, I want the view/dashboard to display two graphs/panels, one for the disk on server 1, and one for the disk on server 4. If the next week, servers 3-5 have disks w/ significant change, I want the view/dashboard to display three graphs/panels, one for server3, one for server4, one for server5

jeffa · ‎08-01-2011

Precisely what I was looking for. Thanks! (Original) (Edit) Actually...this is close, but I noticed that the "score" doesn't drop off when the transaction completes.

jeffa · ‎07-25-2011

I have a query that creates a transaction and then calculates the concurrency for the transactions based on the duration calculated by the 'transaction' command... sourcetype="mySourcetype" (startEventText) OR (endEventText) | transaction host custID startswith="startEventText" endswith="endEventText" | concurrency duration=duration I would like to chart the number of concurrent transactions over time, but when I use a standard "| timechart span=1m max(concurrency)", I see the concurrency results at the time a particular transaction started, but not for subsequent time spans. In my scenario, a transaction may take several minutes (up to hours), and I'd like a visual representation of how many of these transactions are happening at any given timespan (not just the timespans where a transaction started). [How] Can this be done?

jeffa · ‎07-21-2011

That does get me all of the customer IDs that have logs in either the first time period, the second time period, or both time periods. But what I'm looking for is only search for CustIDs w/ logs in both time periods, therefore, not showing any CustIDs that only have logs in one time period or the other (but not both).

jeffa · ‎07-21-2011

I'm trying to identify the source of a performance slow down that has occurred twice over the last two days. Each slow down occurred over a five minute period, once two days ago, once this morning (at different times of the day). I suspect some user activity, but have not been able to identify the particular user. I'd like to be able to narrow my search results to only users w/ activity during both time periods. The logs that I'm looking at have a "CustID" field. So, what I'd like to be able to do is something like... sourcetype=MySourceType CustID="Any customer w/ activity in both time periods" ... How would I go about this? Would it be possible to timechart the results and overlap the times?

jeffa · ‎06-13-2011

I am seeing the same issue. Any update as to the cause?

jeffa · ‎04-29-2011

Nick, were you able to work around this using delims, or other? Having the same issue w/ a scripted input.

jeffa · ‎08-13-2010

That looks better...thanks. Might I ask how you added the literal tabs? I couldn't find a reference to it, and when I hit the Tab key, I go to the next input box.

jeffa · ‎08-10-2010

You are correct Lowell...correcting the timestamp after Splunk "recognizes" it will not be helpful

jeffa · ‎08-10-2010

You mention to 'Try using "\t" as your separator'...I have already tried \t, are you recommending that I use the quotes?

Posts	23
Solutions	1
Karma Given	4
Karma Received	5
Member Since	‎08-05-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Report Acceleration – Does “All Time” retain summa...

How to have “Splunk for Palo Alto Networks” read f...

How to completely remove remote data functionality...

Timecharting the sum() of min()/avg()/max()

Populate Dashboard/View with Panels/Graphs based o...

Charting concurrency for all time spans

Identifying users with activity in two different t...

Pad thousandths of a second in timestamp with lead...

Re: Report Acceleration – Does “All Time” retain s...

Report Acceleration – Does “All Time” retain summa...

Re: How to have “Splunk for Palo Alto Networks” re...

How to have “Splunk for Palo Alto Networks” read f...

How to completely remove remote data functionality...

Re: Timecharting the sum() of min()/avg()/max()

Re: Timecharting the sum() of min()/avg()/max()

Timecharting the sum() of min()/avg()/max()

Re: Populate Dashboard/View with Panels/Graphs bas...

Re: Populate Dashboard/View with Panels/Graphs bas...

Populate Dashboard/View with Panels/Graphs based o...

Re: Charting concurrency for all time spans

Charting concurrency for all time spans

Re: Identifying users with activity in two differe...

Identifying users with activity in two different t...

Re: populate_lookup creates a gziped (.gz) file?

Re: is there a way that autoKV can support both sp...

Re: Pad thousandths of a second in timestamp with ...

Re: Pad thousandths of a second in timestamp with ...

Re: Pad thousandths of a second in timestamp with ...