Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About bsonposh
bsonposh
Communicator
Member since:
12-30-2010
06-05-2020
Community Statistics
| Posts | 43 |
| Solutions | 9 |
| Karma Given | 20 |
| Karma Received | 31 |
| Member Since | 12-30-2010 |
Activity Feed
- Karma Re: REST API Modular Input: How to add an arbitrary field to results to identify the source for that data input? for Damien_Dallimor. 06-05-2020 12:49 AM
- Karma Re: Metric Store for richgalloway. 06-05-2020 12:49 AM
- Karma Re: How to combine multiple reports into one report from same index? for woodcock. 06-05-2020 12:49 AM
- Got Karma for Re: Metric Store. 06-05-2020 12:49 AM
- Got Karma for Re: How to format a metrics_csv file for a metrics index?. 06-05-2020 12:49 AM
- Got Karma for Re: How to format a metrics_csv file for a metrics index?. 06-05-2020 12:49 AM
- Got Karma for Re: How to format a metrics_csv file for a metrics index?. 06-05-2020 12:49 AM
- Got Karma for Re: What happened to the Splunk App for Citrix XenApp?. 06-05-2020 12:48 AM
- Karma Re: How to Update Splunk after JavaScript Changes without Restarting Splunk for bmacias84. 06-05-2020 12:47 AM
- Karma Re: How to use a lookup in a subsearch to search raw data values to include in the main search? for somesoni2. 06-05-2020 12:47 AM
- Got Karma for Re: Powershell script output ingestion. 06-05-2020 12:47 AM
- Got Karma for Re: How do you install Splunk Add-on for Microsoft PowerShell?. 06-05-2020 12:47 AM
- Got Karma for Re: How do you install Splunk Add-on for Microsoft PowerShell?. 06-05-2020 12:47 AM
- Got Karma for Re: Nightly install of Universal Forwarder, random regmon crashes. 06-05-2020 12:47 AM
- Karma Re: Is there a way to remove the "Open in Search, Inspect, and Export" options from the bottom of the dashboard? for nfilippi_splunk. 06-05-2020 12:46 AM
- Karma Re: How to change hostname of a universal forwarder on VMs(XenDesktop Agent) for elusive. 06-05-2020 12:46 AM
- Karma Re: Installing the splunk-reskit-powershell for admoseley. 06-05-2020 12:46 AM
- Karma Re: lookups via powershell resource kit for Bulluk. 06-05-2020 12:46 AM
- Got Karma for Re: How to get data into the Citrix XenApp app?. 06-05-2020 12:46 AM
- Got Karma for Re: XenDesktop -> user experience -> no session information. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 3 |
01-15-2018
08:15 AM
1 Karma
As Rich stated... you cannot do what you want. I've fought this for months 🙂
Your best bet is using JSON via HEC but if you want to use CSV you will need 1 line for each metric in the format specified in the doc.
... View more
01-05-2018
07:31 AM
I do believe they will enable this feature for v.next but the problem is one of cost. The currently implementation of perfmon data uses CSV which has a significantly lower data cost than metrics which is billed by each metric.
I believe the intent is to address this.
... View more
12-06-2017
11:30 AM
You can do something like this... I assume the REST TA provides some data back as to endpoint used.
| eval my_tag = case(<source_endpoint>,"api_1")
Actually, if that works you can likely just create a Splunk TAG for it. https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Tagsconf
... View more
12-01-2017
01:22 PM
Typo in the search but doesn't matter... you are in good hands with Gregg and Somesh
... View more
12-01-2017
01:22 PM
Type in the search but doesn't matter... you are in good hands with Gregg and Somesh
... View more
12-01-2017
12:53 PM
You are just pulling a large amount of data. You can post the job inspector report to see if that provides any insight as to why it is so slow.
You could probably use a stats command instead of dedup and table.
index=pan_logs OR index=cisco_395
(sourcetype="test" OR sourcetype="test2" OR sourcetype="test3")
(dest="a" OR dest="b" OR dest="c" OR dest= "d" OR dest="e" OR dest="f" )
| lookup test.csv IP as src
| search PCI=y
| stats values(dest_port) as dest_port values(dest) as dest values(host) as host values(rule) as rule values(action) as action by _time
... View more
11-29-2017
06:32 AM
I'm not sure how metrics react to lookups and I will research that personally but I think the best way to do what you want is to use a _dimension. In your CSV add a column called full_name and put the human readable name there.
| mstats prestats=true avg(_value) max(_value)
WHERE sourcetype=metrics_csv metric_name="*"
component_ID="a05170000001"
span=1s
by full_name
| timechart avg(_value) AS "Avg",
max(_value) AS "Max" by full_name
With this process there are less "pieces" to break and you don't have to maintain the lookup and with the way, metrics are charged.. it's free.
Update on lookup:
I think the reason it isn't working is that mstats doesn't return metadata like sourcetype, source or host (the information used for automatic lookup.) If you added sourcetype as part of the "by" statement it may work but again, I think your best option is to add it as a dimension. The performance impact of splitting by sourcetype isn't worth it IMO.
... View more
11-27-2017
10:58 AM
3 Karma
IFAICT
You are required to have metric_timestamp, metric_name and _value... dimensions are optional
sample format: process_object_guid is a dimension
"metric_timestamp","metric_name","_value","process_object_guid"
"1509997011","process.cpu.avg","2563454144","dbd1414b-378e-48bd-9735-bc2bab1e58fa"
"1509997011","process.cpu.min","2563454144","dbd1414b-378e-48bd-9735-bc2bab1e58fa"
"1509997011","process.cpu.max","2563454144","dbd1414b-378e-48bd-9735-bc2bab1e58fa"
"1509997011","process.cpu.last","2563454144","dbd1414b-378e-48bd-9735-bc2bab1e58fa"
"1509997011","process.ram.avg","2563454144","dbd1414b-378e-48bd-9735-bc2bab1e58fa"
"1509997011","process.ram.min","2563454144","dbd1414b-378e-48bd-9735-bc2bab1e58fa"
"1509997011","process.ram.max","2563454144","dbd1414b-378e-48bd-9735-bc2bab1e58fa"
"1509997011","process.ram.last","2563454144","dbd1414b-378e-48bd-9735-bc2bab1e58fa"
"1509997011","process.disk.avg","38750","dbd1414b-378e-48bd-9735-bc2bab1e58fa"
"1509997011","process.disk.min","38750","dbd1414b-378e-48bd-9735-bc2bab1e58fa"
"1509997011","process.disk.max","38750","dbd1414b-378e-48bd-9735-bc2bab1e58fa"
"1509997011","process.disk.last","38750","dbd1414b-378e-48bd-9735-bc2bab1e58fa”
Second part of the question:
On the Universal Forwarder (UF)
inputs.conf
[monitor:///opt/metrics_data]
index = metrics
sourcetype = metrics_csv
On the Indexer
indexes.conf
[metrics]
homePath = $SPLUNK_DB/metrics/db
coldPath = $SPLUNK_DB/metrics/colddb
thawedPath = $SPLUNK_DB/metrics/thaweddb
datatype = metric
maxTotalDataSizeMB = 512000
p.s. I submitted a docs bug for clarity.
... View more
11-18-2016
05:53 AM
1 Karma
The app was deprecated for Template for Citrix XenDesktop 7 when Citrix combined XenDesktop and XenApp. AFAIK it will still work for newer versions but I am not sure it is still maintained.
@jconger may be able to provide more accurate details.
... View more
11-12-2016
11:18 AM
The only solution I found for this was to set the UF service to manual and have a script that sets the CONF files correctly and starts the service. This has to be in the base image.
Another option is to install via GPO and use deployment server for the config.
... View more
05-11-2015
09:10 AM
That is very interesting James. I presume you work for logfiller?
... View more
05-11-2015
07:46 AM
Jason... I think he is referring to this. https://splunkbase.splunk.com/app/1800/
I've not seen that before. I'll have to poke around
... View more
05-11-2015
07:40 AM
Sorry... I guess I am not sure what your after. UberAgent gives detailed logon times and User Experience metrics. I suspect your looking for UI latency and such?
I'm not sure of anything that provides this type of data for Splunk. Perhaps Jason will be of some help here.
... View more
05-11-2015
07:24 AM
Your best bet is https://helgeklein.com/uberagent-for-splunk/
... View more
04-30-2015
06:47 AM
1 Karma
Have you looked at using the PowerShell TA? https://splunkbase.splunk.com/app/1477/
When you use a batch file as a wrapper Splunk will write all the batch outputs to standard out. You can try putting @echo off on the top of the batch file but I'm not certain that will help.
... View more
04-22-2015
11:55 AM
2 Karma
The PowerShell TA uses all the native PowerShell tools so if you are able to write a PowerShell script to get the data you are interested in getting then you can install and run the script from a single install.
The only time you would need to install the PowerShell TA in multiple places is if you wanted to distribute workload or were accessing something that could not be accessed remotely.
... View more
02-27-2015
05:45 AM
1 Karma
I'd also take a look at https://helgeklein.com/uberagent-for-splunk/ it does much of what you are looking for and it doesn't require the UF.
... View more
12-22-2014
07:38 AM
Unless I misunderstand you one can be found here: https://apps.splunk.com/app/1751/#/overview
You may also be interested in UberAgent. Its a third party agent that does very detailed data collection: https://helgeklein.com/uberagent-for-splunk/
... View more
11-15-2012
11:11 AM
I will look into this.
... View more
09-25-2012
06:29 AM
You can check the inputs.conf and verify that is correct but if you are running on 4.5 I believe there is a bug in the *.path files on the TA.
In TA-XA-Server\bin*.path files make sure the script path is to the Server TA and not the Broker TA.
The License stuff is not a requirement but the licensing dashboard will not populate without it.
... View more
09-25-2012
05:50 AM
What version of XenApp? Is the collector (ta-xa-server) deployed everywhere? What happens if you run the PowerShell scripts manually? Any errors in the $Splunk_Home/var/log/splunk/splunkd.log
... View more
09-24-2012
07:33 PM
Verify that you have the TA (Collector) and the splunkforwarder on the XenApp Servers (ta-xa-broker needs to be on one and ta-xa-server needs to be on all the XenApp servers) and make sure that PowerShell execution policy is set to remotesigned.
http://technet.microsoft.com/en-us/library/ee176961.aspx
... View more
09-24-2012
11:18 AM
The indexes should be create by the app itself. If you have separate indexers and search heads just make sure the dashboard app is on both.
As for the documentation we are doing the official release of this app at Synergy Barcelona and that will include full documentation.
... View more
09-24-2012
04:32 AM
In the current release you can expect ~20-30mb per desktop per day but in the new release slated for Synergy (Barcelona) we expect a significant reduction with a goal of 5mb per desktop.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:02 AM
|
Karma given to
