About thesteve

thesteve · ‎08-19-2014

Have you ever had one of those days where your brain isn't working right? I installed the Add-on for Unix/Linux, not the App for Unix/Linux.

thesteve · ‎08-19-2014

It does, but it's grey (I remember it being blue) and the only option is "Splunk for Unix Add-on: Setup". I've gone into that page and saved changes, and tried restarting splunk

thesteve · ‎08-19-2014

I've installed the Splunk for Unix app via the web interface. (fresh splunk 6.1 installation on Ubuntu 14.04 with Splunk for Unix and Linux 5.0.3) On the home page, I get the link for setup which takes you to the page to enable or disable scripts and inputs. I don't see how to get to the app. I've installed this before and I remember it being straightforward, I'm missing a step. If I go to http://localhost:8000/en-US/app/Splunk_TA_nix it just redirects to http://localhost:8000/en-US/app/Splunk_TA_nix/setup. It's the only page I can get to. Restarting splunk has no effect.

thesteve · ‎05-06-2014

Well, now I don't know for sure if it would have worked. 🙂 I had inadvertently changed some search parameters when I replaced the app name in my templates and I think that might have been what I was fighting.

thesteve · ‎05-06-2014

hmph. That didn't quite work out. I did a "find-in-files" and found a lot of references to the old app name and replaced them, but that still didn't work. It's early enough now that I just grabbed the few files I did build and re-created the app from scratch.

thesteve · ‎05-06-2014

I started to build an app using the legacy XML style. While building it, I decided to move forward using the newer web framework. I'm currently wondering about re-naming my new web framework application and deleting my existing one. Is it a matter of renaming the directories? mv original_name legacy_original_name mv new_name original_name It seems pretty straightforward, but I'm concerned I might be missing something.

thesteve · ‎05-06-2014

Thank you for that! I had the same issue with 6.1 only I was receiving "Invalid Language Specified" Restarting the splunk web service resolved the problem.

thesteve · ‎05-04-2014

looks like while I was typing this out @Iguinn came in with the extra information I was missing.

thesteve · ‎05-04-2014

Now that you've shown me the light, I found this answer very helpful: http://answers.splunk.com/answers/86/how-do-i-share-all-of-the-field-extractions-defined-in-a-given-app-with-all-other-apps

thesteve · ‎05-04-2014

I have not yet moved my searches, eventtypes, and tags into the app, so that's my first problem - I was simply executing a search from the search and reporting app. I defined the extractions by directly writing to props.conf and I did not edit permissions. I see now when I edit permissions that I can make them visible to all apps or just specific to my app. I think that was the key setting that I was missing.

thesteve · ‎05-04-2014

Adding my own partial answer here... When I created my first view for the app, the field extractions became visible within the app context. (I defined the XML in http://splunkserver/en-US/manager/launcher/data/ui/views then set the app to visible in http://splunkserver/en-US/manager/search/apps/local then changed context by going into Apps->MyApp from the top left menu) The field extractions are no longer visible in the default view. I suppose that makes sense, but I do wonder about the purpose in defining a view-less application. There may be a way to shift your app context without opening up an app, but it is not apparent to me. My basic view definition is as follows. <view> <label>Basic Search View</label>  <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/>  <module name="SearchBar" layoutPanel="mainSearchControls"> <module name="EventsViewer"/> </module> </view> I'm leaving this as unanswered for the time being in hopes that someone might provide a more complete answer, but if not this should be a reasonable starting point for the next person in my shoes.

thesteve · ‎05-04-2014

I decided to take some of the work I've been doing and move it into an app. I haven't made any UI changes at this point. I'm simply moving my inputs, transforms, and props into an app directory tree. My field extractions were defined previously in etc/users/username/search/local/props.conf I moved them into the equivalent stanzas in etc/apps/appname/local/props.conf. I restarted splunk and performed a quick search to verify that the fields were still present in search results but they are not. EDIT: As part of troubleshooting, I moved the index I was using to the etc/apps/appname/local/indexes.conf, and restarted splunkd but that did not resolve my problem. I do see the field extractions listed under my App Context.

thesteve · ‎04-28-2014

I haven't experienced this particular problem, but I have had a similar one in the past that took weeks to track down. (if only we had splunk back then... ) We had a firewall in place that would, after a period of inactivity, stop forwarding data on a given open port. To the client it looked like it was sending data, on the server it looked like no data was being sent. It was only when we correlated the lost connection with a 30 minute inactivity period that we were able to figure things out. We had assumed that a firewall issue would mean a blocked port, not a non-forwarded port. The final solution for us was to use TCP Keep-alives configured at the OS level. As a temporary solution, we wrote a small script that generated a small amount of activity every 29 minutes. I'm not saying this is your problem, but it's worth spending a few minutes looking into.

thesteve · ‎04-27-2014

I have a logfile which contains a set of performance related transactional data. I'm having trouble wrapping my brain around a proper search that will allow me to easily see transactions that are abnormally long. Transactions are grouped together by name, thread id, and client-thread id (with a + or - indicating the start or end of the transaction) Here's an example of what I'm looking at: timestamp thread:123 client-thread:128 +login fred timestamp thread:124 client-thread:132 +login lisa-hannigan timestamp thread:123 client-thread:128 -login fred timestamp thread:123 client-thread:127 +search fred searchstring timestamp thread:145 client-thread: +flushcache flush system cache timestamp thread:124 client-thread:132 +search lisa-hannigan searchstring timestamp thread:126 client-thread:139 +search lisa-hannigan searchstring timestamp thread:145 client-thread: -flushcache timestamp thread:123 client-thread:127 +search fred searchstring timestamp thread:145 client-thread: +buildcache build system cache timestamp thread:124 client-thread:132 -search lisa-hannigan searchstring timestamp thread:126 client-thread:139 -search lisa-hannigan searchstring timestamp thread:145 client-thread: -buildcache build system cache I've built a regex that extracts the field data I need, but I'm having trouble wrapping my brain around a search string that will wrap the transactions appropriately. My "action" field contains +login/-login, +search/-search, etc. I need to group these together: somehow pair up the +action and the -action, and I also need to match on both thread id and client thread id (which may be null). My field data looks like: threadid=123 clientthread=128 action=+login for the first line. I can adjust this if necessary. I'm wondering if this might be easier if I separate that out into action=login and actionstartend=+ . I only show 4 action types here, but there are about 130 different actions, so I'd rather not have to do a search per action (i.e. login, search, flushcache, buildcache)

thesteve · ‎04-26-2014

Great idea! Thanks!

thesteve · ‎04-25-2014

It didn't work for me. I have "Application is Starting up" and "Application child is Starting up" messages, so I'm wondering if that might be a problem. In either instance, using your search I don't see any duration values. I appreciate the insight though. I'm going to look into streamstats a bit more now.

thesteve · ‎04-25-2014

I had a log file go crazy. It shot up to 400MB before I noticed and of course that pushed me over the daily limit. I'm wondering what the options are from here. Moving forward, I can limit the index size of that particular log (and others), but what about the rest of today? Does this mean that I can't index anything else until after midnight? Can I possibly delete the abnormally large index and continue? The warning message I received said to "correct this before midnight". I have corrected the issue that caused this so it won't happen again, but is there any way to undo things such that I see normal behavior for the remainder of the day? I'm not interested in the large set of data that was indexed. The root cause was detected and eliminated.

thesteve · ‎04-25-2014

The following search command yielded the results I was looking for: index="myIndex" sourcetype="mySourceType" | transaction startswith="Application is Starting up" endswith="Application is Ready" | timechart avg(duration) The search itself groups all of the log entries between start and end, and automatically calculates the duration from beginning to end. I did have to add the duration field to the results list by clicking the arrow on the left of the search result row and selecting the field to see it.

thesteve · ‎04-25-2014

I have an application log that has two log lines I'm interested in trending. The first line is: timestamp Application is Starting up The second line is timestamp Application is Ready I'd like to : Be able to search for these pairs (transactions?) Run a report that will show me T2(Ready)-T1(Starting) over time. In other words - I want to be able to see if the startup time is getting longer, or if there is a particular instance where the startup time is abnormally long. Note: The second log line does not necessarily immediately follow the first. It is likely that there are other log messages in between.

thesteve · ‎04-25-2014

I have a vendor provided log file (I have no way to change it) that has both a changing header and a changing footer. In between are log lines, 1 entry per line. The problem I am facing is that splunk is re-indexing the entire file when it gets updated, not just the newly added lines. I am parsing out the header and footer using two entries in transforms.conf. [setNull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [dateAndData] DEST_KEY = queue REGEX = ^(Fri|Sat|Sun|Mon|Tue|Wed|Thu).{22} FORMAT = indexQueue Is there anything I can do to get splunk to recognize the data that it has already indexed? The only thing I can think of at this point is writing my own script that would extract data from the file and I'd rather not do that unless it was absolutely necessary.

thesteve · ‎02-18-2014

I think < > are special characters. Try escaping them maybe? xml version[^\>]+\>\ ]+\>

thesteve · ‎02-18-2014

There's a page of documentation dedicated to just this question: http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Routeandfilterdatad If you want to filter before forwarding, you have to use a heavy forwarder. The reason for this is that a light forwarder doesn't use transforms.conf and therefore does very limited parsing of the source data before sending it on. Discard specific events and keep the rest This example discards all sshd events in /var/log/messages by sending them to nullQueue: In props.conf, set the TRANSFORMS-null attribute: [source::/var/log/messages] TRANSFORMS-null= setnull Create a corresponding stanza in transforms.conf. Set DEST_KEY to "queue" and FORMAT to "nullQueue": [setnull] REGEX = [sshd] DEST_KEY = queue FORMAT = nullQueue That does it. Keep specific events and discard the rest Here's the opposite scenario. In this example, you use two transforms to keep only the sshd events. One transform routes sshd events to indexQueue, while another routes all other events to nullQueue. Note: In this example, the order of the transforms in props.conf matters. The null queue transform must come first; if it comes later, it will invalidate the previous transform and route all events to the null queue. In props.conf: [source::/var/log/messages] TRANSFORMS-set= setnull,setparsing In transforms.conf: [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX = [sshd] DEST_KEY = queue FORMAT = indexQueue Alternatively, you can use SED command processing to replace all text in a given line with nothing (s/something//). Splunk doesn't support SED delete line commands, but it shouldn't index blank lines, so replacing a line of text with nothing should do it.

thesteve · ‎02-14-2014

Got it. Thanks!

thesteve · ‎02-14-2014

I must be blind. I'm staring at the screen and I don't see it. where is it exactly?

thesteve · ‎02-14-2014

I ran a search and noticed something unexpected in my results. Of course the error I saw was not an informative one, so I wanted to scroll up in the log a little to find what happened just prior to that event being logged. I was able to get it done by searching on index and source on a timestamp range, but it struck me that there should be a quick and easy way to "see 20 prior log lines" or "see data from this source X seconds prior to this entry". If not, is there a way for me to define an action like that?

Posts	33
Solutions	1
Karma Given	46
Karma Received	9
Member Since	‎02-08-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Getting to the Splunk for Unix app

Process for renaming an app

Search Time field extractions not working when mov...

Transactions - grouping actions and matching on mu...

What are your options when you go over the license...

How to track application startup time?

Splunk is re-indexing entire file, not just change...

What is the easiest way to find log lines precedin...

Re: Getting to the Splunk for Unix app

Re: Getting to the Splunk for Unix app

Getting to the Splunk for Unix app

Re: Process for renaming an app

Re: Process for renaming an app

Process for renaming an app

Re: Not able to open new app in splunk app framewo...

Re: Search Time field extractions not working when...

Re: Search Time field extractions not working when...

Re: Search Time field extractions not working when...

Re: Search Time field extractions not working when...

Search Time field extractions not working when mov...

Re: Splunk Stability???

Transactions - grouping actions and matching on mu...

Re: How to track application startup time?

Re: How to track application startup time?

What are your options when you go over the license...

Re: How to track application startup time?

How to track application startup time?

Splunk is re-indexing entire file, not just change...

Re: What's the best way to get rid of a header bei...

Re: Filtering fields in log before forward to inde...

Re: What is the easiest way to find log lines prec...

Re: What is the easiest way to find log lines prec...

What is the easiest way to find log lines precedin...