Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About 606866581
606866581
Path Finder
Member since:
03-13-2013
06-05-2020
Community Statistics
| Posts | 42 |
| Solutions | 2 |
| Karma Given | 34 |
| Karma Received | 5 |
| Member Since | 03-13-2013 |
Activity Feed
- Karma Re: hide the Splunk App navigation bar for renjith_nair. 06-05-2020 12:50 AM
- Got Karma for Why does Fillnull not work without specifying a field?. 06-05-2020 12:49 AM
- Karma Re: Can you regex or wildcard props Sourcetype stanzas? for ben_leung. 06-05-2020 12:48 AM
- Karma Re: How to expand macros in a Splunk search? for hrottenberg_spl. 06-05-2020 12:48 AM
- Karma Re: How to expand macros in a Splunk search? for yahuja_splunk. 06-05-2020 12:48 AM
- Karma Re: Will CSV files produced by the outputcsv command be replicated by the search head cluster? for woodcock. 06-05-2020 12:48 AM
- Karma Re: After upgrading to 6.5.0, KV Store will not start for jcrabb_splunk. 06-05-2020 12:48 AM
- Karma Re: Unable to use stats on summary index for somesoni2. 06-05-2020 12:48 AM
- Karma Re: Searching across clustered and standalone indexers for somesoni2. 06-05-2020 12:48 AM
- Karma Is there a way to display more than 20 charts at a time using new trellis layout? for ksarpol. 06-05-2020 12:48 AM
- Karma Re: What is the best way to count the number of times a field has been changed or toggled? for niketn. 06-05-2020 12:48 AM
- Karma Re: What is the best way to count the number of times a field has been changed or toggled? for somesoni2. 06-05-2020 12:48 AM
- Got Karma for Will CSV files produced by the outputcsv command be replicated by the search head cluster?. 06-05-2020 12:48 AM
- Got Karma for Re: Will CSV files produced by the outputcsv command be replicated by the search head cluster?. 06-05-2020 12:48 AM
- Got Karma for Re: Will CSV files produced by the outputcsv command be replicated by the search head cluster?. 06-05-2020 12:48 AM
- Karma Re: Why does "mvexpand X" remove events with X=NULL? for woodcock. 06-05-2020 12:47 AM
- Karma Re: Why is my Splunk forwarder not extracting CSV file fields? for Jeremiah. 06-05-2020 12:47 AM
- Karma Re: How to embed an image in a simple XML dashboard with HTML? for joshd. 06-05-2020 12:47 AM
- Karma Re: Use subsearch result as fulltext search in outer search for marcoscala. 06-05-2020 12:47 AM
- Karma Re: Values(x) showing too many results. Is there a way to limit the number of results to a field? for templets. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-11-2020
02:29 PM
I'm not sure what your particular use case is, but to me it seems like this would be a simpler way to create the same table without needing to |append
sourcetype=source1 OR sourcetype=source2 OR sourcetype=source3 OR sourcetype=source4
| eval Id=coalesce('Properties.Id',Id)
| stats count by Id sourcetype
| xyseries Id sourcetype count
| fillnull source1 source2 source3 source4 value="Not exists"
| sort Id
... View more
05-11-2020
02:02 PM
It looks like you're overwriting the value of Properties.Id with this command:
| eval Properties.Id=if(sourcetype="source4",Id,null())
Your 3 original sources will now lose their Properties.Id field
Take a look at the coalesce eval command https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/ConditionalFunctions
... View more
07-27-2018
06:11 AM
I had to use ..... | rename correlation_id as query]
... View more
07-26-2018
03:24 AM
Hi @burwell,
I'm having a really bad time trying to configure Splunk to use a Kerberos Keytab to authenticate my Impala connection. I'm able to get it working with a temporary kerberos ticket (kinit) but for our use case we need to use a keytab file. You mentioned keytab in a few of your comments, did you get it working with a keytab, or are you only using a cached ticket?
Adam
... View more
07-17-2018
09:24 AM
I use kinesis heavily to pull a wide variety of logs from AWS. However I've noticed the timestamps within the logs are being ignored. Some of the events don't have timestamps and so the automatic _time is acceptable, however when my log starts with
2018-07-17T16:10:00Z
I'd expect _time to be the same (adusted for timezone), however the AWS Add-on set _time to be 16:11:56 which appears nowhere in the log.
So it appears kinesis has some internal logic for calculating the timestamp and ignores the timestamp at the start of the log.
Has anyone else had this issue or found a solution?
... View more
04-27-2018
04:12 AM
1 Karma
Hi, If I try to run this search, the value of my_null_field doesn't change to "?"
| makeresults
| table _time my_null_field
| fillnull value="?"
The fillnull documentation says that if you don't specify a field it should apply to all fields. Strangely when I specify that field it works!
| makeresults
| table _time my_null_field
| fillnull my_null_field value="?"
Even if I do
| eval my_null_field = null()
before the fillnull, it's still not adding the question mark.
Does anyone know if I'm missing something or if this is a bug? Cheers
... View more
Labels
- Labels:
-
other
02-17-2017
05:33 AM
Hi Everyone,
I've been using Splunk for a few years but I'm looking for a nice way to capture the number of times a user has changed a particular setting. For simplicity sake the setting can be 1 or 0.
2017-02-17 01:00:00 IP=1.1.1.1 Setting=0
2017-02-17 02:00:00 IP=1.1.1.1 Setting=0
2017-02-17 03:00:00 IP=1.1.1.1 Setting=1
2017-02-17 03:00:00 IP=2.2.2.2 Setting=0
2017-02-17 04:00:00 IP=2.2.2.2 Setting=1
2017-02-17 05:00:00 IP=1.1.1.1 Setting=0
2017-02-17 05:00:00 IP=1.1.1.1 Setting=0
I'm looking to produce a table to summarize this which will look like:
IP, Times toggled
1.1.1.1, 2
1.1.1.1, 1
The dataset is too large to use transaction so I'm hoping there's a nifty command that I can use which caters for this.
Thanks!
... View more
- Tags:
- stats
- streamstats
11-15-2016
01:29 AM
It appears we meet all of these criteria. We have replication factor 2, they are all separate machines running Splunk 6.4 on the same OS. The deployer is an indexer, indexer cluster master node, and our licence server, but it is not a search head itself.
... View more
11-14-2016
09:12 AM
4 Members in total:
Captain:
dynamic_captain : 1
elected_captain : Wed Oct 12 09:49:16 2016
id : 2D8B0803-3A46-4B1C-80FB-3A883E4FFD8D
initialized_flag : 1
label : SHT45
maintenance_mode : 0
mgmt_uri : https://SH45:8089
min_peers_joined_flag : 1
rolling_restart_flag : 0
service_ready_flag : 1
Members:
SHR45
label : SHR45
mgmt_uri : https://SHR45.com:8089
mgmt_uri_alias : https://111.111.111.45:8089
status : Up
SHT45
label : SHT45
mgmt_uri : https://SHT45.com:8089
mgmt_uri_alias : https://111.111.112.45:8089
status : Up
SHR44
label : SHR44
mgmt_uri : https://SHR44.com:8089
mgmt_uri_alias : https://111.111.111.44:8089
status : Up
SHT45
label : SHT44
mgmt_uri : https://SHT44.com:8089
mgmt_uri_alias : https://111.111.112.44:8089
status : Up
... View more
11-14-2016
08:55 AM
I created a new file: /opt/splunk/etc/shcluster/apps/my-app/local/limits.conf with the stanza:
[default]
max_mem_usage_mb = 500
... View more
11-14-2016
08:51 AM
I do supply the full url of a SH member, yes
... View more
11-14-2016
08:04 AM
Hi all,
I've had a search head cluster running for a few months but haven't needed to use the deployer until recently. I have made a minor configuration change on the deployer in .../shcluster/apps/.../local/limits.conf and then tried to apply the bundle with:
splunk apply shcluster-bundle -target https://:8089 -preserve-lookups true
It runs for exactly 6 minutes before coming back with one of the below error messages. I suspect it is exceeding a timeout because it fails at such a round number:
Error while deploying apps to target=https://:8089 with members=4: Error while updating app=$USERS on target=https://:8089: Error in JSON response: Unexpected EOF
Error while creating deployable apps: Error clearing old_staging_area="/opt/splunk/var/run/splunk/deploy.3fb473d4b630bdf2.tmp": No such file or directory
If anyone has any suggestions for how to troubleshoot this issue please let me know. Thanks.
... View more
08-25-2016
02:08 AM
Thank you Somesh, I changed my summary indexer to use stats instead of sistats so I now have the flexibility to use latest() and values() reliably
... View more
08-24-2016
07:53 AM
The count(Cust_ID) column is 0. Everything after the by clause is populating in the stats table, so this is consistent with what I've observed above. Ultimately I want to get the latest(Last_IP), but it suffers from the same problem.
... View more
08-24-2016
05:41 AM
I've created a summary index to keep track of my customer IDs and what their last IP address was, however I'm getting very strange behaviour while trying to use the fields.
This search runs successfully and produces a full set of results:
index=last_ip_summary | table Last_IP Cust_ID
This search runs successfully and produces a full set of results:
index=last_ip_summary | stats count by Last_IP Cust_ID
But this search only gives me the Last_IP field in the table, the other column is totally blank
index=last_ip_summary | stats values(Cust_ID) by Last_IP
Surely this is impossible? Every event in the summary index has a Last_IP and a Cust_ID.
My summary index is populated with .... | sistats count by Cust_ID Last_IP
Any help would be greatly appreciated
... View more
06-15-2016
05:41 AM
Thanks Gregg, this is probably the best workaround we were able to come up with
... View more
06-15-2016
04:55 AM
2 Karma
http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Outputcsv
Updates to $SPLUNK_HOME/var/run/*.csv using the outputcsv command are not replicated across the cluster.
This answered my question
... View more
06-15-2016
02:17 AM
1 Karma
Hi all,
I currently have 1 search head running all my scheduled searches. Some of these searches use the outputcsv command to export Splunk results for use in other systems. Will these CSV files be replicated by the search head cluster? I won't be able to control which search head produces the CSV, so I need to know if Splunk deals with this or not.
I've searched through the documentation, but haven't found anything explicit. Any help would be greatly appreciated!
Thanks
... View more
03-30-2016
07:12 AM
I can't believe I missed it, It was right there! Thanks for your time
... View more
03-30-2016
06:50 AM
I'm not sure how that would appear in server.conf. http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configuremulti-clustersearch doesn't mention how standalone servers are taken into consideration.
... View more
03-30-2016
06:29 AM
2, search factor 2. But would this make a difference?
... View more
03-30-2016
06:26 AM
4, and each cluster will be managed by the 2 standalone indexers. This adds another level of complexity unfortunately
... View more
03-30-2016
06:18 AM
Hi,
I've been reading related questions on this topic but I fear they're outdated as of 6.3.
Can I configure a search head to search across, say, 2 clusters and 2 standalone indexers?
I'm struggling to find documentation that confirms or disproves this possibility.
Thank you
EDIT : I should point out that we plan to use the 2 standalone indexers to manage the 2 clusters.
... View more
02-02-2016
07:54 AM
The forwarder was running 4.2. Doh!
I've upgraded it and the problem is resolved. Thanks
... View more
02-02-2016
04:35 AM
Hi,
I've configured my forwarder's /etc/system/local/props.conf as such:
[mysourcetype]
INDEXED_EXTRACTIONS=CSV
FIELD_QUOTE="
FIELD_DELIMITER=,
outputs.conf is:
[default]
host = hostname23
[monitor:///qwerty/*]
index = myindex
disabled = false
followTail = 0
sourcetype = mysourcetype
And my indexer has its props.conf as:
[mysourcetype]
INDEXED_EXTRACTIONS=CSV
FIELD_QUOTE="
FIELD_DELIMITER=,
However, the events aren't being treated as CSVs, but rather, a generic log, so my headers have appeared as an actual event.
Any help is appreciated!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
