Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Noah_Woodcock
Noah_Woodcock
Path Finder
Member since:
09-20-2015
06-05-2020
Community Statistics
| Posts | 17 |
| Solutions | 3 |
| Karma Given | 9 |
| Karma Received | 17 |
| Member Since | 09-20-2015 |
Activity Feed
- Got Karma for BUG: Single-Value visualization Viz w/ Trellis clipping text: CSS work-around?. 06-05-2020 12:51 AM
- Karma How can I see what Searches/Stories from "ES Content Update" App are viable in my environment? for woodcock. 06-05-2020 12:50 AM
- Got Karma for Re: How can I see what Searches/Stories from "ES Content Update" App are viable in my environment?. 06-05-2020 12:50 AM
- Got Karma for Re: How can I see what Searches/Stories from "ES Content Update" App are viable in my environment?. 06-05-2020 12:50 AM
- Got Karma for Re: How can I see what Searches/Stories from "ES Content Update" App are viable in my environment?. 06-05-2020 12:50 AM
- Karma What *exactly* are the rules/requirements for using "|tstats append=t"? for woodcock. 06-05-2020 12:49 AM
- Karma Bulk rename of all fields that come from calling "| lookup"? for woodcock. 06-05-2020 12:49 AM
- Karma Re: How to create tag cloud drilldown? for woodcock. 06-05-2020 12:49 AM
- Karma Re: Is it normal for Splunkd to attempt to terminate the McAfee Processes? for MonkeyK. 06-05-2020 12:49 AM
- Karma Re: How do I use a comparison search to find all devices not reporting to Splunk? for woodcock. 06-05-2020 12:49 AM
- Karma Re: What is multithreaded ingestion? for felipesewaybric. 06-05-2020 12:49 AM
- Karma Re: How to keep configuration/settings persistent even after the server reboots? for woodcock. 06-05-2020 12:49 AM
- Got Karma for Is there a User/Developer "Rules for Good Splunking" Style Guide?. 06-05-2020 12:49 AM
- Got Karma for Re: Bulk rename of all fields that come from calling "| lookup"?. 06-05-2020 12:49 AM
- Got Karma for Re: Bulk rename of all fields that come from calling "| lookup"?. 06-05-2020 12:49 AM
- Got Karma for Re: Bulk rename of all fields that come from calling "| lookup"?. 06-05-2020 12:49 AM
- Got Karma for Is there a User/Developer "Rules for Good Splunking" Style Guide?. 06-05-2020 12:49 AM
- Got Karma for Re: Can you compress Splunk reports before sending them as email attachments?. 06-05-2020 12:49 AM
- Got Karma for Re: How to get non-abbreviated time-zone?. 06-05-2020 12:49 AM
- Got Karma for Re: Why is my JSON regex expression not working properly?. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 1 | |||
| 2 | |||
| 3 |
03-24-2020
12:13 PM
1 Karma
Check out this run-anywhere example dashboard XML. You might have to adjust your browser's zoom but on my laptop, on all zooms, it is clipping both the label of the trellis and the value . How can I fix this?
<dashboard>
<label>Trellis Scaling Example</label>
<row>
<panel>
<single>
<search>
<query>| makeresults
| eval _raw="aShortName bThisIsMediumName cThis_Name_Is_Somewhat_Long dThis_Is_An_Absolutely_Absurdly_Long_Stinking_Name
24D 15H 0M 16D 4H 5M 13D 17H 45M 0D 0H 0M"
| multikv forceheader=1
| fields - _time linecount _raw
| eval foo="bar"
| untable foo asset count
| xyseries foo asset count
| fields - foo</query>
<earliest>-24h</earliest>
<latest>now</latest>
</search>
<option name="trellis.enabled">1</option>
</single>
</panel>
</row>
</dashboard>
... View more
10-11-2018
01:14 PM
3 Karma
This does it nicely:
|rest/servicesNS/-/DA-ESS-ContentUpdate/saved/searches splunk_server=local
| search eai:acl.app="DA-ESS-ContentUpdate" OR request.ui_dispatch_app="DA-ESS-ContentUpdate"
| dedup id
| table eai:acl.app eai:acl.owner eai:acl.sharing disabled title description cron_schedule allow_skew dispatch.earliest_time dispatch.latest_time alert_severity search
| rename dispatch.* AS *
| rename eai:acl.* AS *
| table owner sharing title search description*
| sort 0 title
| streamstats count AS Serial
| rex field=search max_match=0 "sourcetype[\s\r\n=\"]+(?<sourcetype>[^\)\r\n\s]+)"
| eval sourcetype=mvdedup(sourcetype)
| rex field=search max_match=0 "[\s\r\n]+datamodel[\s\r\n=\"]+(?<datamodel>[^\)\r\n\s\.]+)"
| eval datamodel=mvdedup(datamodel)
| eval which="DA-ESS-ContentUpdate"
| append [
|tstats count WHERE index=* earliest=-7d@d BY sourcetype
| search sourcetype!="*too_small"
| table sourcetype
| eval which="sourcetypes"]
| append [
|rest/servicesNS/-/Splunk_SA_CIM/data/models splunk_server=local
| search eai:acl.app="Splunk_SA_CIM"
| dedup id
| table eai:acl.app eai:acl.owner eai:acl.sharing disabled title acceleration acceleration.backfill_time eai:data
| rename eai:acl.* AS * eai:data AS definition_JSON
| sort 0 title
| streamstats count AS Serial
| search acceleration=1
| table title
| rename title AS datamodel
| eval which="datamodels"]
| multireport
[ stats dc(title) AS titleCount list(*) AS * dc(which) AS whichCount BY datamodel
| search whichCount>1 ]
[ stats dc(title) AS titleCount list(*) AS * dc(which) AS whichCount BY sourcetype
| search whichCount>1 ]
| streamstats count AS Serial
| foreach * [ eval <<FIELD>> = mvdedup(<<FIELD>>) ]
| rename COMMENT AS "Remove what is below to see them as groups of searches; below splits it out as 1 search/event"
| eval tuple = mvzip(title, mvzip(search, description, ":::"), ":::")
| fields - title search description
| mvexpand tuple
| rex field=tuple "^(?<title>.+?):::(?<search>.+?):::(?<description>.+)$"
| fields - tuple
| rename Serial AS GroupMembership
| streamstats count AS Serial
... View more
09-16-2018
07:21 PM
Blog post
This blog post has good information!
... View more
09-16-2018
07:19 PM
AppExporter
That is a tool that I use for situations like this.
... View more
09-16-2018
07:17 PM
1 Karma
My favorite tool for problems like this is Regex101.com
At least take a look 🙂
... View more
09-06-2018
09:23 AM
1 Karma
Hopefully I can explain this in a clear way. I am going to post the pictures below, so please take a look at them, as they will be necessary to understand my question.
The way I have my dashboard set up is that the Split-Shift View checkbox is only be valid if the Today or Yesterday radio button is selected. Whenever This Hour , This Week , or This Year is selected, it deselects/clears the Split-Shift View checkbox. This all works fine.
I need to code the flip-side. I would like to make it so that if any thing other than Today or Yesterday is selected when the Split-Shift View box is selected, it automatically selects the Today radio button. We have tried just about everything to make this work and the main problem is that it appears that the change stuff is broken for checkbox field controls because it always hits the first condition .
... View more
09-04-2018
08:18 PM
1 Karma
See if this helps your problem:
https://splunkbase.splunk.com/app/4030/
... View more
09-04-2018
07:54 PM
1 Karma
You can also scrape things like wikipedia and make your own lookups with apps like these:
https://splunkbase.splunk.com/app/4146/
https://splunkbase.splunk.com/app/3226/
https://splunkbase.splunk.com/app/635/
... View more
09-04-2018
07:53 PM
@woodcock provided what I would recommend as well.
... View more
08-03-2018
08:46 PM
predictions are the way to go.
... View more
07-27-2018
06:43 PM
2 Karma
Like this:
... | lookup YourLookupDefinitionHere host
| rename COMMENT AS "Bulk rename of all fields from this lookup to add prefix 'CMDB_'"
| rename [| inputlookup YourLookupDefinitionHere
| head 1
| foreach * [ eval <<FIELD>> = "CMDB_<<FIELD>>" ]
| format "" "" "" "" "" ""
| rex field=search mode=sed "s/=/ AS /g"]
... View more
07-27-2018
06:42 PM
1 Karma
Like this:
... | rename * AS _HIDE_ALL_FIELDS_*
| lookup YourLookupDefinitionHere host AS _HIDE_ALL_FIELDS_host
| rename * AS CMDB_*
| rename _HIDE_ALL_FIELDS_* AS *
... View more
07-22-2018
07:21 PM
1 Karma
I am confused by some of the indexes.conf settings and how they interact. I believe that my desire is commonplace and straightforward but I keep hitting problems. I will reduce things to the simplest possible state with round numbers (this is not my actual situation but if I get a good answer here, I can take it from there):
I have a single indexer.
It has a single hot volume of 50GB .
This volume is mounted at /mnt/splunkhot .
I have no need for cold/frozen volumes.
I have no need to roll buckets based on time.
I would like to use all of my space and have it auto-roll the oldest buckets to make room for new buckets.
I have 3 index values.
The firewall index should never consume more than 70% of the entire volume (protect other index values from premature rotation if this index blows up for some reason)
The wineventlog index and os index should never consume more than 20% of the entire volume respectively.
When we grow the /mnt/splunkhot volume group, we would like to change as few configuration files as possible (so configurations with percentages are ideal, but mostly everything seems to be mb ).
I know that the indexers require at least 50MB free on the hot volume or they will stop indexing so the configurations need to ensure this is always OK.
Ideally, I'd like the colddb to be alongside the db directory (in /mnt/splunkhot ) but never ever be used, but not if it makes things more complicated.
This is linux so linking things to /dev/null is possible, if that makes things easier (i.e. the "no cold volume required" part).
Now that we have that configuration, let's say we double the disk space by adding another volume to the volume group. What settings should change and how?
If I add another index value, what should change and how?
... View more
- Tags:
- splunk-enterprise
07-04-2018
10:21 AM
I definitely think more details are needed.
... View more
08-27-2017
07:04 AM
I was leaving it unanswered for a while to get more interest. Thank you.
... View more
08-23-2017
12:34 PM
2 Karma
Would anybody care to share your Splunk "Developer/User Guide" or "Style Guide" or "Rules for Splunking" document?
I am looking for stuff that focuses on things that happen after the core infrastructure is deployed and after data is onboarded (there is much good documentation on how to do that stuff well).
I am looking for stuff like:
KO scoping guildelines (i.e. avoid "global" scope if at all possible)
Naming convention rules for KOs
Search Etiquette (e.g. Don't do "All Time", if you "outputcsv" make sure you clean it up, etc.)
How to schedule searches "nicely"
Plan your search artifact Time To Live (TTL), not just your data retention needs
If you use dynamic lookups, be sure to have a housekeeping search setup to prune it appropriately
Command Usage "Gotchas" (e.g. always do | sort 0 instead of | sort or you will lose events)
This is different from a Best Practices document but there is some overlap and I could mine from those documents, too.
I know about Aplura's and it has some stuff I will need but if you have or have seen something similar, to these, please share:
https://www.aplura.com/splunk-best-practices/
https://wiki.splunk.com/Things_I_wish_I_knew_then
... View more
09-20-2015
02:17 PM
3 Karma
I am a reasonably clever, tech-savvy young man but by no means a genius. I am a very hard worker and I am planning on building upon my college degree by learning Splunk and making it my main niche of expertise for my future as a (big) data scientist. What would you suggest that a person with plenty of time and "enough" (maybe?) money should do to get really good at Splunk? Free is great but I am willing to pay if there are good programs that give excellent results, especially if it does so in a shorter amount of time (I am willing to pay for higher quality if it is considerably better than the free resources). If I was your son, how would you advise me to go about most effectively and efficiently becoming a Splunk expert? Thank you in advance for your advice!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
