Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About kalibaba2021
kalibaba2021
Path Finder
Member since:
11-09-2021
09-15-2023
Community Statistics
| Posts | 12 |
| Solutions | 0 |
| Karma Given | 7 |
| Karma Received | 1 |
| Member Since | 11-09-2021 |
Activity Feed
- Posted Ingesting metrics into Splunk Core Cloud vs Splunk Observability Cloud on Getting Data In. 09-15-2023 01:31 PM
- Tagged Ingesting metrics into Splunk Core Cloud vs Splunk Observability Cloud on Getting Data In. 09-15-2023 01:31 PM
- Tagged Ingesting metrics into Splunk Core Cloud vs Splunk Observability Cloud on Getting Data In. 09-15-2023 01:31 PM
- Tagged Ingesting metrics into Splunk Core Cloud vs Splunk Observability Cloud on Getting Data In. 09-15-2023 01:31 PM
- Tagged Ingesting metrics into Splunk Core Cloud vs Splunk Observability Cloud on Getting Data In. 09-15-2023 01:31 PM
- Posted Re: max recommended of indexes on a single indexer in AWS on Deployment Architecture. 06-27-2023 08:32 AM
- Posted Re: max recommended of indexes on a single indexer in AWS on Deployment Architecture. 06-27-2023 08:31 AM
- Karma Re: max recommended of indexes on a single indexer in AWS for VatsalJagani. 06-27-2023 08:28 AM
- Karma Re: max recommended of indexes on a single indexer in AWS for isoutamo. 06-27-2023 08:27 AM
- Posted Re: max recommended of indexes on a single indexer in AWS on Deployment Architecture. 06-27-2023 07:04 AM
- Karma Re: max recommended of indexes on a single indexer in AWS for isoutamo. 06-27-2023 06:43 AM
- Posted What is the max recommended of indexes on a single indexer in AWS? on Deployment Architecture. 06-26-2023 02:45 PM
- Karma Re: What is Splunk database engine? for isoutamo. 05-31-2023 07:23 AM
- Posted Re: What is Splunk database engine? on All Apps and Add-ons. 05-31-2023 07:22 AM
- Karma Re: What is Splunk database engine? for tnesavich_splun. 05-31-2023 07:21 AM
- Posted Re: What is Splunk database engine? on All Apps and Add-ons. 05-31-2023 06:33 AM
- Got Karma for Re: How to avoid a join in a lookup search. 03-13-2022 05:58 PM
- Posted Re: How to avoid a join in a lookup search on Splunk Search. 03-10-2022 06:11 AM
- Tagged Re: How to avoid a join in a lookup search on Splunk Search. 03-08-2022 05:05 PM
- Tagged Re: How to avoid a join in a lookup search on Splunk Search. 03-08-2022 05:05 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-15-2023
01:31 PM
I am searching far and wide for recommendations, best practices, even just conversations on this topic - all for naught. Here's my big dilemma that I would love to get something other than "It Depends" answer to: Which platform is more appropriate for Metrics: Splunk Cloud or Splunk O11y ? I am not an expert in Splunk, but know that there are certain challenges with metrics indexes in Splunk Core/Cloud . And, I can also see there are Metrics Rules in O11y that help with filtering, and some pre-built dashboards. But I still am lost for direction. Short of actually ingesting the same amount of metrics into both Platforms and seeing what comes out...do I want to do that ? Well, "that depends"! 🤔 Any guidance deeply appreciated.
... View more
06-27-2023
08:32 AM
@isoutamo - thanks very much for the info!
... View more
06-27-2023
08:31 AM
@VatsalJagani - thank you for the info!
... View more
06-27-2023
07:04 AM
isoutamo, thank you for the quick response. we plan on restoring data from the archive S3 bucket into this splunk instance, only on a per-need basis. So, very large amount of data will be ingested in a relatively short time period, but only rarely. Exact volume of data is unknown, but 50 - 100 TB's is possible. But, not on continuous basis, so "per-day" metric will only apply during this rare ingestion event. Neither redundancy not fast searches are of major concern. what I gather from your response is: at least ONE Indexer Cluster with 2 large nodes to start with . Is it needed to have a dedicated Search Head, or can I install SH on one of the nodes in the said Cluster ?
... View more
06-26-2023
02:45 PM
Hello Community,
I am looking at deploying Splunk Enterprise on AWS on a HEFTY EC2 compute-optimized instance, and attached EBS. i'd like to maximize the # of indexes on this EC2 since search performance is of no concern .
I see the default index size is 500 GB, but I also know I can configure indexes.conf to whatever I want.
For example, if I think I'll have ~ 97 TB of data I could say maxVolumeDataSizeMB = 102603162 on a single BIG indexer . But off course just because I can doesn't mean I should.
I see no clear recommendation of how to design multiple indexes with relation to Indexers and Search Heads. Maybe because it always depends. 🤗
In my case, since I care none for performance, can I put everything on one BIG EC2 ? Split it in 2 BIG machines ? As in, install Indexer and SH on same instance.
Thanks in advance👍
... View more
Labels
05-31-2023
07:22 AM
Thank you, that worked. https://docs.splunk.com/Documentation/Splunk/9.0.1/Indexer/HowSplunkstoresindexes
... View more
03-10-2022
06:11 AM
1 Karma
bowesmana, Yes, this is sample code since I can't post the real one due to privacy concerns. And yes, in the last clause the TtlSmallHost should be TtlLargeHost, my mistake. I believe I am getting the point though, which is: specify the fields I want to see in the report use stats early to group my data and limit the result set for splunk to process. Thank you for your help, I think I got the gist of it. Coming from a sql background I automatically used a join but then realized it is not optimal in this case in splunk.
... View more
03-08-2022
05:04 PM
Thanks for replying bowesmana, There's actually another Compute unit I forgot named Host, but essentially with same logic. SPL is: | inputlookup my_lookup | stats dc(eval(if(NodeType="A",NodeID,null()))) as TtlSmallNodes dc(eval(if(HostType="B",HostD,null()))) as TtlSmallHost by LargeComputeUnit MidComputeUnit SmallComputeUnit | join type=left [| inputlookup my_lookup | stats dc(eval(if(NodeType="A",NodeID,null()))) as TtlMidSizeNodes dc(eval(if(HostType="B",HostD,null()))) as TtlMidSizeHost by LargeComputeUnit MidComputeUnit ] | join type=left [| inputlookup my_lookup | stats dc(eval(if(NodeType="A",NodeID,null()))) as TtlLargeNodes dc(eval(if(HostType="B",HostD,null()))) as TtlSmallHost by LargeComputeUnit ] I expect to see 3 Description text columns: LargeNodeDesc MidSizeNodeDesc SmallNodeDesc , then numeric columns TtlSmallNodes , TtlMidSizeNodes, TtlLargeNodes, and similar 3 numeric columns for Hosts, grouped by their respective descriptions. Something like: LargeComputeUnitDesc MidComputeUnitDesc SmallComputeUnitDesc TotalLargeNode TatalMidSizeNodes TotalSmalNodes TotalLargeHosts TatalMidSizeHosts TotalSmalHosts g3.4xlarge C5 t2.micro 9 1 12 8 8 10 H1 M4 t2.nano 7 2 14 2 7 1 D2 X1e etc. 5 3 19 3 5 6 R5 C4 etc. 2 4 9 8 6 8 R5n R4 etc. 3 7 7 9 7 4
... View more
- Tags:
- eventstats
- join
- stats
03-08-2022
11:14 AM
I have 3 searches executing against same lookup, and since each lookup needs to be grouped by different set of fields, my search joins each result to the previous one.
I have a feeling this is not optimal, and want to rewrite it using stats , but don't know where to begin.
I want to create a report for Total number of Nodes per Node Type and Description, and this does what I want, but I am looking to optimize. Any ideas?
Code:
| inputlookup my_lookup
| stats
dc(eval(if(NodeType="A",NodeID,null()))) as TtlSmallNodes
by LargeNodeDesc MidSizeNodeDesc SmallNodeDesc
| join type=left
[| inputlookup my_lookup
| stats
dc(eval(if(NodeType="A",NodeID,null()))) as TtlMidSizeNodes
by LargeNodeDesc MidSizeNodeDesc
]
| join type=left
[| inputlookup my_lookup
| stats
dc(eval(if(NodeType="A",NodeID,null()))) as TtlLargeNodes
by LargeNodeDesc
]
... View more
11-09-2021
09:56 AM
yes, those fields are coming from the lookup file., and that makes sense. Thank you.
... View more
11-09-2021
07:12 AM
Does the Lookup cmd allow for Where clause to filter the output of Lookup? Or do I need to have an extra sub search with | inputlookup with the Where clause I need: Ex of what I'd like to do: | makeresults | eval FullName = split("First1 Last1, First2 Last2, First3 Last3",",") |mvexpand FullName | lookup MyNamesFile.csv "emp_full_name" as FullName OUTPUTNEW Phone as phone ``` HERE I WANT TO FILTER ON SPECIFIC criteria form the lookup file``` | where state="New York" and city="New York" | mvexpand phone In concept this is the type of filter I need. Obviously the above code doesn't work and I'd like to know what is the best way to achieve filtering out lookup output.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-15-2023
06:52 PM
|
