Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About jameshgibson
jameshgibson
Path Finder
Member since:
09-14-2012
06-05-2020
Community Statistics
| Posts | 37 |
| Solutions | 5 |
| Karma Given | 54 |
| Karma Received | 30 |
| Member Since | 09-14-2012 |
Activity Feed
- Got Karma for Re: How to use "collect" and keep the timestamp and field extractions of the event?. 03-17-2025 06:05 AM
- Got Karma for Re: How to extract the key value pairs?. 10-01-2023 06:49 PM
- Karma Re: How to submit a search and setup associated alert via Splunk REST API? for martin_mueller. 06-05-2020 12:47 AM
- Karma Why ampersand does not render in the navigation menu? for splunkmasterfle. 06-05-2020 12:47 AM
- Karma Re: How can I share a lookup script with other apps? for dwaddle. 06-05-2020 12:47 AM
- Got Karma for How can I share a lookup script with other apps?. 06-05-2020 12:47 AM
- Got Karma for How can I share a lookup script with other apps?. 06-05-2020 12:47 AM
- Got Karma for How can I share a lookup script with other apps?. 06-05-2020 12:47 AM
- Karma JavaScript To create a saved search for qfjp. 06-05-2020 12:46 AM
- Karma Re: minmum time to refresh? for sdaniels. 06-05-2020 12:46 AM
- Karma Re: minmum time to refresh? for Drainy. 06-05-2020 12:46 AM
- Karma Average of unknown number of fields for helge. 06-05-2020 12:46 AM
- Karma Re: Average of unknown number of fields for lguinn2. 06-05-2020 12:46 AM
- Karma Upgrading a splunk server hardware for freeborn. 06-05-2020 12:46 AM
- Karma Re: Upgrading a splunk server hardware for MuS. 06-05-2020 12:46 AM
- Karma Re: Line breaking with custom regex for bmacias84. 06-05-2020 12:46 AM
- Karma Re: Time convertion of big amount of seconds for jonuwz. 06-05-2020 12:46 AM
- Karma Dynamic renaming of column header in a table for chrismorris. 06-05-2020 12:46 AM
- Karma Re: version of linux for grijhwani. 06-05-2020 12:46 AM
- Karma Re: How to save a filtered set of events to a seperate index? for Ayn. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 3 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 2 |
02-12-2015
03:02 AM
thanks works perfectly
... View more
02-11-2015
03:20 AM
3 Karma
I have a lookup script that is placed in my apps bin folder. How can I use this external lookup from other apps?
Whenever I try despite setting the lookups sharing to global I get the message lookup script not found. When running the lookup in the app with the script it works fine though.
... View more
11-21-2014
07:15 AM
1 Karma
I managed to clear this message by deleting all the serverclasses and then re-adding them. This removed the messages and got the apps downloading again.
My guess is SPlunk gets confused as to what has changed on the forwarder(s) and isn't logging the error back correctly.
... View more
11-03-2014
03:47 AM
for those of you wondering why this doesn't work when you copy and paste it's because the answers regex have had the backslashes removed when it was posted. Put a backslah before the . and b and w in the regexes and it will work once properly indented.
... View more
05-22-2014
01:38 AM
You first need to sort the processes by %_Processor_time before using top. Something like
| sort - %_Processor_Time | top Process limit=10
The top command just gives you the first 10 lines of the results.
... View more
05-21-2014
08:13 AM
2 Karma
You need to set this up on the indexer not the forwarder as that's where these rules are applied.
... View more
05-21-2014
08:09 AM
I think your looking for this information. Here's the specific quote:
6.x search heads are compatible with 6.x and 5.x search peers, in a non-clustered environment. The search head must be at the same or higher level than the search peers:
A 6.x search head is compatible with a 5.x search peer.
A 5.x search head is not compatible with a 6.x search peer.
Search peers here mean your indexers
... View more
05-21-2014
07:59 AM
7 Karma
You can just add this to your search:
| extract pairdelim="\"{,}" kvdelim=":"
... View more
05-16-2014
03:41 AM
agreed this was a nice feature
... View more
07-25-2013
01:35 AM
your welcome, please feel free to vote the answer up or accept 😉
... View more
07-23-2013
04:30 AM
You need to set a few more options, here is an example that would schedule the job to run every 10mins over the previous month.
opts = { name: "searchname",
search: "* | head 10",
is_scheduled: 1,
cron_schedule: "*/10 * * * *",
'dispatch.earliest_time': '-1mon@d',
'dispatch.latest_time': 'now',
};
mySavedSearches.create(opts, function(err, newSearch) {
console.log("created!");
});
... View more
07-23-2013
01:17 AM
if the log file contained paramater=value then Splunk should parse out the fields automagically for you yes. If you can't change the log format then it may be worth setting up some field extractions.
... View more
07-22-2013
08:55 AM
the transaction command joins all the events for a particular second in a single event. So you should have 1 memoryusage and several userprocess per event, so no need to use joins/stats/etc. Give it a go anyway 🙂
... View more
07-22-2013
08:16 AM
1 Karma
Try something like:
sourcetype=whatever (memoryusage OR userprocesses) | rex field=_raw ".*memoryusage (?P< memoryusage>[0-9]+)" | rex field=_raw ".*userprocess (?P< userprocess>[0-9]+)" | transaction _time maxspan=1s | search memoryusage>10000000 | table memoryusage userprocess
formatting is a bit messed up so the < word> should really be <word>
... View more
07-22-2013
06:11 AM
6 Karma
The problem was that the _raw field came from a database and were not prefixed by a timestamp. So what I did in the end was add the following to prepend it:
my search | eval _raw=_time + ": " + _raw | collect index=summary
I don't have any way of adding the field extractions though that can be done at search time manually.
... View more
07-22-2013
03:15 AM
2 Karma
So I have used collect to save some events into a summary index. The problem is all of the timestamp information is lost which makes the info next to useless. It desides to default all the events to the search time.
It also drops all the field extractions that I set up which is a pain but can be worked around at a push.
pseudo search:
sourcetype=x my_field=name | rex=something "do_some_extractions" | collect index=summary
... View more
07-22-2013
02:10 AM
I have given it a go but the _time field doesn't get save in the index I specify. It just defaults all the events to the time I started the search. Is there something else I need to do?
... View more
07-22-2013
01:50 AM
We have a system that produces several GB of logs per day. Of that there is only maybe a few MB that contains information that is worth searching through in Splunk. What I would like to do is set up a scheduled search that saves just the events we care about to a seperate index to help improve search speeds.
I have been trying to use summary indexing for this but I seem to lose all the _time data that go with the events. Is there anyway just to save the filtered events?
... View more
- Tags:
- index
- speed
- summarized
02-20-2013
03:54 AM
The only way I have managed to get this working is by re-writing %SPLUNK_HOME%\etc\apps\search\bin\runshellscript.py
Clearly this is not a good solution and will break after any update.
... View more
02-19-2013
09:26 AM
I have spent most of the afternoon trying to work out why the script doesn't seem to work. From the logs I found in %SPLUNK_HOME%\var\log\splunk\ the commmand will never work as long as my search command contains quotes, braces, >, < or & anywhere. e.g
C:\WINDOWS\system32\cmd.exe /c " "pathtosplunk\Splunk\bin\scripts\myscript.py" "49" "index="my_index" ("some" OR "other") | rex field=blah "(?<breakage>.*)" commands" "name_of saved search" "Saved Search [nameofsavedsearch] number of events(99)" "http://path toresults" "" "path\\to\\csv" "
Is there any solution?
... View more
02-12-2013
03:37 AM
thanks for pointing me in the right direction, I am not sure how to call this from Python. I am using the splunk.binding module, any chance you could give a quick example? Thanks.
... View more
02-11-2013
02:00 AM
I have some scripts that generate a view with some saved searches based on a template. I can add in the saved searches using the rest api but I dont see anyway to add the view. Is this possible?
... View more
01-28-2013
07:49 AM
turns out this was nothing to do with any of the characters or permissions. For some reason the ending of logfileprefix* was causing the problem (despite working on non network folders). I swapped this to use a whitelist instead...which didn't work. Finally I added a blacklist which did.
The final working config looks similar to:
[monitor://\\myserver\tempfolder$\Logs]
disabled = false
followTail = 0
sourcetype = mysourcetype
whitelist =
blacklist = (something|BLAH\-[0-9]+)
index = tmp
... View more
01-11-2013
09:30 AM
1 Karma
can you not change the regex to:
(?i)^([^*#]\d+\s+|(?:)[^\-]*\i{2}\d+\s+)(?P<a>[^]+)
this should match (?P<a>[^]+) when preceded by either (?i)^[^*#]\d+\s+ or (?i)^(?:)[^\-]*\i{2}\d+\s+
that is assuming you are missing a closing [ and ) in the expressions in your question.
... View more
01-11-2013
08:52 AM
gave changing the user account a bash, but no change unfortunatly
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma given to
| User | Karma Count |
|---|---|
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
