Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ulikabbq
ulikabbq
Path Finder
Member since:
06-12-2014
02-23-2022
Community Statistics
| Posts | 23 |
| Solutions | 3 |
| Karma Given | 3 |
| Karma Received | 19 |
| Member Since | 06-12-2014 |
Activity Feed
- Karma Re: How to chart values only where 2 or more values are returned? for aweitzman. 06-05-2020 12:47 AM
- Karma Re: Columns into Rows for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Columns into Rows for somesoni2. 06-05-2020 12:47 AM
- Got Karma for Re: Why am I receiving no WinEventlog:Security events from the universal-forwarder?. 06-05-2020 12:47 AM
- Got Karma for Re: After upgrading from Splunk 6.1 to 6.3, why am I unable to generate a PDF with error "Splunkd daemon is not responding...The read operation timed out"?. 06-05-2020 12:47 AM
- Got Karma for After upgrading from Splunk 6.1 to 6.3, why am I unable to generate a PDF with error "Splunkd daemon is not responding...The read operation timed out"?. 06-05-2020 12:47 AM
- Got Karma for After upgrading from Splunk 6.1 to 6.3, why am I unable to generate a PDF with error "Splunkd daemon is not responding...The read operation timed out"?. 06-05-2020 12:47 AM
- Got Karma for After upgrading from Splunk 6.1 to 6.3, why am I unable to generate a PDF with error "Splunkd daemon is not responding...The read operation timed out"?. 06-05-2020 12:47 AM
- Got Karma for Re: Columns into Rows. 06-05-2020 12:47 AM
- Got Karma for Columns into Rows. 06-05-2020 12:47 AM
- Got Karma for setting colors on embed charts. 06-05-2020 12:47 AM
- Got Karma for setting colors on embed charts. 06-05-2020 12:47 AM
- Got Karma for Re: Why am I receiving no WinEventlog:Security events from the universal-forwarder?. 06-05-2020 12:47 AM
- Got Karma for How to chart values only where 2 or more values are returned?. 06-05-2020 12:47 AM
- Got Karma for Re: Why does my pivot table not have a time range filter?. 06-05-2020 12:47 AM
- Got Karma for Re: Why does my pivot table not have a time range filter?. 06-05-2020 12:47 AM
- Got Karma for Re: Why does my pivot table not have a time range filter?. 06-05-2020 12:47 AM
- Got Karma for Re: Why does my pivot table not have a time range filter?. 06-05-2020 12:47 AM
- Got Karma for Why does my pivot table not have a time range filter?. 06-05-2020 12:47 AM
- Got Karma for Re: How to configure inputs.conf on forwarder to collect Active Request and Request per second Perfmon data?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 3 | |||
| 0 | |||
| 2 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 0 |
01-22-2016
12:45 PM
I want to be able to click an ip addres in a dashboard panel and it link to http://www.tcpiputils.com/browse/ip-address/<ipaddress> where is passes the ip address and adds it to the end of the url.
Is this possible?
... View more
11-05-2015
08:59 AM
There is a issue exporting reports with subsearches to pdf. They timeout every time. Even thought the search will execute the report will never generate a pdf. I have a bug filed with Splunk on this issue. For now I was able to rewrite most of my searches to not use a subsearch and the ones I couldn't are just generating csv files for now.
... View more
10-28-2015
07:24 AM
well I changed the timeout in the web.conf to 60 sec and it doesn't seem to wait that long.
I don't have any issue exporting to any other format, but the pdf generator is not working for me on 6.3. I have about 40+ reports that are staggered throughout the night and they send pdf reports to people. Only about 10% of those worked last night, and the cpu got pegged out in the process.
... View more
ok. a couple splunk restarts seemed to clear this issue up
... View more
I am unable to generate a pdf since I upgraded from 6.1 to 6.3. I get this message when I try to export a report to a pdf:
Unable to render PDF.
Exception raised while trying to prepare "Report" for rendering to PDF. Splunkd daemon is not responding: ("Error connecting to /servicesNS/admin/search/search/parser: ('The read operation timed out',)",)
It is able to export a CSV with no issues.
When I have the report set to send an email with a PDF attachment. I get this error:
An error occurred while generating the PDF. Please see python.log for details
The python log shows a similiar error
sendemail:988 - An error occurred while generating a PDF: Failed to fetch PDF (status = 400): Unable to render PDF.
Exception raised while trying to prepare "Report" for rendering to PDF. Splunkd daemon is not responding: ("Error connecting to /servicesNS/admin/search/search/parser: ('The read operation timed out',)",)
... View more
04-30-2015
01:33 PM
this is getting me much closer
... View more
04-30-2015
11:43 AM
I have a formating question.
When I run this:
index=userdata | eval platform=case(rl_user_agent like "%iPhone%", "Mobile" ,rl_user_agent like "%iPad%", "Mobile" , rl_user_agent like "%Android%", "Mobile" , 1=1, "Full Site") | eval status=case(rl_user_status=="Guest", "Guest", rl_user_status like "%Active%", "Active Sub", 1=1, "Registered") |rex field=rl_path "[/](?<path_root>[^/]*)" | eval path_root=upper(path_root) | table status path_root platform | stats count by status path_root platform | stats list(platform) AS Platform, list(count) AS count by status path_root
I get
status : path_root : Platform : count
status1 path1 full site 12
mobile 10
status1 path2 full site 12
mobile 10
but how can I get
status : path_root : full site : mobile
status1 path1 12 10
status1 path2 12 10
... View more
02-21-2015
11:20 AM
I think it would only be a default setting if you selected it during the installation of the forwarder. Most people leave those things undefined and manually configure the inputs.conf.
... View more
02-21-2015
09:32 AM
1 Karma
set the index name to an index that exists on your system. you can set it to 'main' if you want it in the main index
... View more
02-21-2015
07:30 AM
1 Karma
Does you inputs.conf have
[WinEventLog://Security]
index = indexname
disabled = 0
if not add that in and restart the forwarder service.
... View more
12-17-2014
07:39 PM
2 Karma
Is there a way to set the colors on a chart used for embedding? I know you can do it on a dashboard, but I can't seem to find a way to do in for a report that is turned into an embedded chart.
... View more
09-10-2014
07:37 AM
4 Karma
I was creating a root search and not a root event. Once I created the data model with a root event, then the time picker became available.
... View more
09-09-2014
09:16 PM
1 Karma
This page says that all pivot tables have the time picker as a default filter. It also says you can not disable this.
http://docs.splunk.com/Documentation/Splunk/6.1.3/PivotTutorial/Createpivottable
However, when I build a data model and try to pivot off it, I do not have a time picker as a filter. What am I missing? The time picker shows up on the prebuilt data models that come with a standard install. Just not for user generated data models.
... View more
09-08-2014
01:19 PM
2 Karma
enough trial and error and I finally got it
[perfmon://W3SVC_W3WP]
index = winmon
object = W3SVC_W3WP
counters = Active Requests;Requests / Sec
instances = _Total
interval = 30
disabled = 0
... View more
09-08-2014
12:32 PM
1 Karma
I have a forwarder on an IIS web server and I want to get some info on the Active Request and Request per sec.
So I am able to get some data back with this in my inputs.conf
[perfmon://W3SVC_W3WP]
index = winmon
object = Process.*
counters = *
instances = *
but it does not have the Active Request or Request / Sec. When I try to specify Active Request in the object then it doesn't work at all.
... View more
09-04-2014
09:11 AM
1 Karma
I am using a chart function as follows:
| chart count, values(status) by user
and I only want to get back the results that have 2 or more statuses. I have tried some eval commands but I haven't gotten anything to work properly.
... View more
08-20-2014
01:07 PM
1 Karma
I got this
"Error in 'eval' command: Regex: PCRE does not support \L, \l, \N{name}, \U, or \u"
... View more
08-20-2014
12:33 PM
1 Karma
I am trying to turn my columns into rows and I have not had any luck with the xyseries command.
Here is my search:
index=loadtest source="*\\log\\home*" rps data="*" | stats avg(data) AS "Home" | join type=outer [search index=loadtest source="*log\\view*" rps | stats avg(data) AS "View"] | join type=outer [search index=loadtest source="*log\\offer*" rps | stats avg(data) AS "Offer"]
so in the results I get
Home View Offer
58 55 55
And I want to get
Home 58
View 55
Offer 55
... View more
08-04-2014
05:37 AM
yes my inputs.conf is on the forwarder. Also I have one server with an even easier inputs.conf for monitoring iis logs and I am not getting that data either. I have one install where I set the iis log directory up when I setup the forwarder and that works fine, but the manual config does not work.
here is the manual inputs.conf
[default]
host=x.x.x.x
[monitor://C:\inetpub\logs\LogFiles\W3SVC1] (the forward slashes are in the right place just not showing)
disabled = false
sourcetype = iis
index = main
I know I don't have data because I don't see my files in the data summary in the search.
... View more
08-03-2014
07:48 PM
also when I run $SPLUNK_HOME/bin/splunk list monitor on the forwarder I see the files I want.
When I run 'sudo netstat -taupen' on my indexer I see my forwarder.
What am I missing here? I have this problem on 2 servers that I have manually setup.
... View more
08-03-2014
05:40 PM
I also installed S.O.S and it sees the forwarder so I feel like there is some small detail that I am missing.
... View more
08-03-2014
05:21 PM
I have updated the errors in my post. It is D:\Splunk\ForwardTest\Test2 and I have it set to transforms.conf. (update: it seems these comment boxes don't always see my forward slashes)
I took out the " " from the transforms.conf and restarted the forwarder, but I still don't have any data in my indexer.
... View more
08-03-2014
12:37 PM
I am having trouble with manual inputs.conf.
I have been able to successfully setup a windows universal forwarder, and if I define the monitor folder during the setup, everything works fine. However, when I try to manually configure the inputs.conf in etc\system\local I am not getting data on my indexer. The splunkd.log shows me that it is adding a watch path on the manually configured path and it shows that it is connected to the indexer.
08-03-2014 14:25:27.851 -0500 INFO TailingProcessor - Adding watch on path: D:\Splunk\ForwardTest\Test1.
08-03-2014 14:25:27.851 -0500 INFO TailingProcessor - Adding watch on path: D:\Splunk\ForwardTest\Test2.
08-03-2014 14:25:28.139 -0500 INFO TcpOutputProc - Connected to idx=x.x.x.x:9997
inputs.conf
[monitor://D:\Splunk\ForwardTest\Test2]
disabled = false
sourcetype = userdata
props.conf
[userdata]
SHOULD_LINEMERGE = False
pulldown_type = 1
REPORT-getfields = userdata_fields
transforms.conf
[userdata_fields]
DELIMS="/t"
"key","date","url",
... View more
- Tags:
- inputs.conf
- search
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-23-2022
05:47 PM
|
