Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About minkyuk
minkyuk
Explorer
Member since:
06-25-2015
06-05-2020
Community Statistics
| Posts | 37 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 1 |
| Member Since | 06-25-2015 |
Activity Feed
- Karma Re: Searching through "inputlookups" - syntax error? for woodcock. 06-05-2020 12:47 AM
- Karma Re: How to edit a props.conf for an aribitrary source? for richgalloway. 06-05-2020 12:47 AM
- Got Karma for How to parse and extract unstructured .log file data in Splunk?. 06-05-2020 12:47 AM
- Posted How to edit props.conf to specify a different regex for each of three sourcetypes? on Splunk Search. 08-04-2015 08:08 AM
- Tagged How to edit props.conf to specify a different regex for each of three sourcetypes? on Splunk Search. 08-04-2015 08:08 AM
- Posted How do I automate the indexing and field extraction process? on Splunk Search. 08-03-2015 06:54 AM
- Tagged How do I automate the indexing and field extraction process? on Splunk Search. 08-03-2015 06:54 AM
- Tagged How do I automate the indexing and field extraction process? on Splunk Search. 08-03-2015 06:54 AM
- Posted Re: How to filter out rows for individual tables by Metric date? on Splunk Search. 07-28-2015 07:37 AM
- Posted How to filter out rows for individual tables by Metric date? on Splunk Search. 07-24-2015 09:09 AM
- Tagged How to filter out rows for individual tables by Metric date? on Splunk Search. 07-24-2015 09:09 AM
- Posted I have a table created for a report, but how do I delete the first two rows of the chart since they contain no data? on Splunk Search. 07-22-2015 11:55 AM
- Posted Re: What part of the dashboard HTML controls the feature to split charts in the same row? on Dashboards & Visualizations. 07-21-2015 11:51 AM
- Posted What part of the dashboard HTML controls the feature to split charts in the same row? on Dashboards & Visualizations. 07-21-2015 11:26 AM
- Tagged What part of the dashboard HTML controls the feature to split charts in the same row? on Dashboards & Visualizations. 07-21-2015 11:26 AM
- Posted Re: Controlling Date on Splunk Search. 07-20-2015 01:28 PM
- Posted Controlling Date on Splunk Search. 07-20-2015 01:17 PM
- Posted How to separate graphs from a single panel into individual panels? on Dashboards & Visualizations. 07-20-2015 09:52 AM
- Tagged How to separate graphs from a single panel into individual panels? on Dashboards & Visualizations. 07-20-2015 09:52 AM
- Posted Re: Timecharting multiple lines..! on Splunk Search. 07-17-2015 09:36 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-04-2015
08:08 AM
Hello,
I'm trying to parse three different log files with different regex.
I have three different sourcetypes for each, and I'm wondering how I can specify a different regex for each on props.conf.
Would it be as simple as
[sourcetype_one]
BREAK_ONLY_BEFORE= <regex>
[sourcetype_two]
...
Thank you, I would appreciate your ideas
Jack
... View more
08-03-2015
06:54 AM
Good morning,
For the past few days, I have been putting log files through an indexer and extracted some fields manually.
However, I want to automate this process where log files are generated automatically at a certain directory. I am stuck on how to perform this task. (Daily scheduled event perhaps?)
If anyone has any idea on this matter, I would appreciate your input.
Thanks,
Jack
... View more
07-28-2015
07:37 AM
Hi.. sorry for the late accept.
head is the function I was kind of looking for, but how could I exclude the first rows instead of returning them?
... View more
07-24-2015
09:09 AM
Hello,
I have a handful of tables that contain monthly reported data. Each table starts at a different Metric time, meaning table 1 starts the report 2015/1/1 while table 2 could be starting on 2015/3/1.
I am trying to filter out every first two rows from each table. I could manually go through every table and put
|where metric_date < ******
but I feel like there should be a way to automate this process.
Can anyone help if you have any idea?
Thank you ahead,
J
... View more
07-22-2015
11:55 AM
Hello,
I have a table I created for a report.
However, I'm trying to find a way to get rid of the first two rows of the chart, since they contain no information.
It seems like an issue that could be resolved with a quick touch, but I would appreciate any suggestions from you.
Jack
... View more
07-21-2015
11:51 AM
Hello, I could resort to simple XML, but I think my HTML code seems to be correct but still giving my panels in separate rows... Thank you
<div id="panel1" class="dashboard-cell" style="width: 50%;">
<div id="charts" class="dashboard-panel clearfix">
<!--
<div class="panel-element-row">
<div id="element1" class="dashboard-element chart" style="width: 100%">
<div class="panel-body"></div>
</div>
</div>
-->
</div>
</div>
<div id="panel2" class="dashboard-cell" style="width: 50%;">
<div id="charts" class="dashboard-panel clearfix">
<!--
<div class="panel-element-row">
<div id="element2" class="dashboard-element chart" style="width: 100%">
<div class="panel-body"></div>
</div>
</div>
-->
</div>
</div>
</div>
... View more
07-20-2015
01:17 PM
Hi, I have a column of timestamp in YYYY-MM-DD format.
I'm trying to limit it by specific date, and I feel like there should be some handy way to do this.
Would anyone be able to help?
Thank you,
Jack
... View more
- Tags:
- date
07-20-2015
09:52 AM
Hello,
So I have a single panel on a dashboard with 10 different graphs of used MB , by each "host".
This panel is created from a single .csv table.
My goal is to separate the 10 graphs into 10 individual panels, with a table attached below each panel.
Any Idea how I could edit my dashboard in this matter?
I am relatively new to Splunk, I would appreciate any input from you
Jack
... View more
07-17-2015
09:36 AM
Thank you, got it to work.
By any chance, I'm getting OTHER field since I have 10+ different datacenters, but how could I drill-down or change settings to prevent Splunk from making OTHER automatically
... View more
07-17-2015
09:33 AM
My datacenter string is already "Seoul, Korea" so I'm assuming it's treated as one..
... View more
07-17-2015
09:14 AM
Hello, I have a question regarding timecharting multiple lines on one chart by Datacenter, but x-axis being Metric time and Y-axis being usedpct.
DATACENTER METRIC_DATE USEDPCT
Seoul, Korea 1393390800.000 59.1
Busan, Korea 1393390800.000 5.6
Seoul, Korea 1393477200.000 62.4
Busan, Korea 1393477200.000 5.31
Seoul, Korea 1393563600.000 59.4
Busan, Korea 1393563600.000 3.66
...
How could I accomplish this?
|inputlookup foo.csv|timechart span=86400s max(USEDPCT) by DATACENTER gives me no result for some reason
I would appreciate your help-
Jack
... View more
- Tags:
- timechart
07-15-2015
10:37 AM
Hello, sorry for the lack of details.
I meant to say that I need an individual chart for every host. And for each host, the information is extracted by a python script which I timechart it.
So, I want a dashboard of 50 individual charts.. each one for different host.
but I only have a list of hosts and a python script. For example,
| lp_py disk HOSTNAME | timechart used_mb
would give me a single chart for a host.
But If I were to repeat this for every host on the list I have, I can't think of any other methods than to hardcode.
Do you have any idea?
... View more
07-15-2015
07:46 AM
Hello-
Right now I'm trying to figure out how I could put multicharts on dashboard if I have two objects given:
A list of host (1 column), and a script that takes in the name of one host and make a chart out of it.
If I were to loop through the process of putting every host in a list through the script and chart it out and put them on dashboard,
How could I accomplish this in a wiser way than to hardcode it? (50+ hosts in a list)
Thank you for your time,
Jack
... View more
- Tags:
- chart
- dashboards
07-08-2015
11:48 AM
I still need to read the first line to record the Timestamp, however.
Could I use any variation?
... View more
07-08-2015
07:51 AM
Hello-
I'll jump into the main part.
Here is a snippet:
Tue 2015 15:00:23
ZGD-OCU-QQQ
POS-BKD-AKD
COK-ZPP-AKF
DISK-------USAGE-------HOST
My multikv extraction thinks "ZGD-OCU-QQQ" is my "fields".
It definitely is correctly extracting the information, but I'm trying to find a way to skip 3 lines-rows- after the timestamp to extract correct fields.
I would appreciate any help..!
J
... View more
- Tags:
- multikv
07-07-2015
07:02 AM
like, index setting section?
... View more
07-07-2015
07:00 AM
Sorry, but do you mean at time of "Adding Data?"
... View more
07-07-2015
06:48 AM
Do I put the line in a search head?
... View more
07-07-2015
06:34 AM
Where do I go & how should I do it?
I know what to change,
[$sourcetype]
MAX_EVENT = 100000
I would appreciate your help,
A newcomer
... View more
- Tags:
- props.conf
07-06-2015
12:04 PM
Thank you for detailed response; where could I edit props.conf?
... View more
07-06-2015
08:39 AM
Hi,
I'm trying to successfully parse out some fields from unstructured log file.
Below is a snippet:
Tue Jun 16 00:15:27 EDT 2015
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 2 0.0 0.0 0 0 ? S Jun07 0:00 [kthreadd]
root 3 0.0 0.0 0 0 ? S Jun07 1:06 \_ [mi/0]
root 4 0.0 0.0 0 0 ? S Jun07 0:15 \_ [ks/0]
root 5 0.0 0.0 0 0 ? S Jun07 0:00 \_ [mi/0]
root 6 0.0 0.0 0 0 ? S Jun07 5:27 \_ [wa/0]
root 7 0.0 0.0 0 0 ? S Jun07 1:39 \_ [mi/1]
root 8 0.0 0.0 0 0 ? S Jun07 0:00 \_ [mi/1]
root 9 0.0 0.0 0 0 ? S Jun07 0:14 \_ [ks/1]
root 10 0.0 0.0 0 0 ? S Jun07 0:01 \_ [wa1]
root 11 0.0 0.0 0 0 ? S Jun07 1:04 \_ [mi/2]
root 12 0.0 0.0 0 0 ? S Jun07 0:00 \_ [mi/2]
-----------------------------------------
Tue Jun 16 00:20:27 EDT 2015
....
Using Splunk data parser, how could I patternize and successfully get a specific column or two?
(I am looking into ways to find smart patterns using regex, or just ------------------- as a pattern)
Thanks,
Jack
... View more
07-02-2015
12:28 PM
Hello,
I am using Field Extraction to extract TWO (2) columns in a given unstructured log file.
//this is a snippet.
04/07/15 23:55:09
Device: rrqm/s wrqm/s r/s w/s rkB/s wkB/s avgrq-sz avgqu-sz await svctm %util
a1 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
a10 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
a11 0.00 3.00 0.00 2.00 0.00 20.00 20.00 0.00 1.00 0.50 0.10
a2 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
a20 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
a21 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
...
If I were to extract to columns, I would need to highlight the columns. I was wondering if I manually write my reg-ex , Will I be able to extract entire column instead of rows?
I would appreciate your help, especially I'm very curious how reg-ex works in this sense, if anybody knows.
Thank you for your time,
Jack
... View more
- Tags:
- field-extraction
07-02-2015
10:38 AM
Hello, I am a n00bie in Splunk.
So I needed some information from unstructured .log file.
I added the data through the web interface, and then used field extraction to get some fields I wanted to get.
Now, I have UNSTRUC_LOG: EXTRACT- FIRST in Field extractions list.
UNSTRUC_LOG: EXTRACT- FIRST Inline ^\d+/\d+/\d+\s+\d+:\d+:\d+\s+\w+:\s+\w+/\w+\s+\w+/\w+\s+\w+/\w+\s+\w+/\w+\s+\w+/\w+\s+\w+/\w+\s+\w+-\w+\s+\w+-\w+\s+\w+\s+\w+\s+%\w+\s+\w+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+(?P<await_svctm_sdb>\d+.\d+\s+\d+.\d+)\s+\d+.\d+\s+\w+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+(?P<await_svctm_sdc>\d+.\d+\s+\d+.\d+)\s+\d+.\d+\s+\w+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+(?P<await_svctm_sda>\d+.\d+\s+\d+.\d+)\s+\d+.\d+\s+\w+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+(?P<await_svctm_sdd>\d+.\d+\s+\d+.\d+)\s+\d+.\d+\s+\w+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+(?P<await_svctm_sde>\d+.\d+\s+\d+.\d+)
How can I manipulate / edit the fields I extracted ?
Do I use |inputlookup?
I would appreciate any input from you guys.
Jack
... View more
- Tags:
- extraction
- field
- regex
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
