About mchandx

mchandx · ‎05-04-2012

I have resolved this issue. It had nothing to do with Splunk, but rather a feature of the environment it is in.

mchandx · ‎05-04-2012

I'll give this a try. Unfortunately, there is no way to know until midnight. I will also try to specify the time perameter as "rt@d-4h" and see if that helps. I'll post back tomorrow with my results.

mchandx · ‎05-04-2012

This seems to only change the display. Does this also change the way the application works?

mchandx · ‎05-04-2012

I have a graph that displays the license usage for the day. I have the time parameter say to "@d" because I only want to see for the current day. The problem I am having is that the counter resets at 12:00AM GMT-1. I am in GMT-5, so the counter resets at 8:00PM local time. I want the counter to reset at 12:00AM GMT-5 or 5:00AM GMT. Here is a copy of my search: index=_internal source=*metrics.log group=per_index_thruput series!=_* | eval totalMB = round(kb/1024, 2) | chart sum(totalMB) as total Time is set to rt@d to rt

mchandx · ‎04-30-2012

Hello, I have a request that I cannot seem to figure out. What I need to do is monitor the license usage on a per subnet basis (ex. daily license usage for 192.168.*), then break it down to the host level. For example, lets say I have 5 hosts: 192.168.1.1, 192.168.2.4, 192.168.7.8, 192.168.42.12, 192.168.87.16. I need to have a search scan the entire 192.168.0.0/16 range, then break the report down to license usage per host. (Sorry, having a bit of a problem expressing my thoughts) The twist is from that search, I need to set up an alert to report when a host goes over x% license usage. I am not exactly sure how to do this. I have a search that reads total number of logs from all hosts, one that shows the top reporting hosts, and one that shows the total daily license usage. Any advice is welcome. Please do not reference this thread as this doesn't do what I want it to do. Thanks in advance!

mchandx · ‎04-30-2012

Sorry for the delay. I have resolved this issue. There was an issue with the formatting. Here is the correct syntax: index=_internal source=*metrics.log group=per_index_thruput series!=_* | eval totalMB = round(kb/1024, 2) | chart sum(totalMB) as total

mchandx · ‎04-30-2012

Believe that I may have this resolved. index=_internal source=*metrics.log group=per_index_thruput series!=_* | eval totalMB = kb/1024 | chart sum(totalMB) as total

mchandx · ‎04-30-2012

I have tried this before as this is what is in the documentation, but it displays the incorrect information.

mchandx · ‎04-30-2012

Hello, I am writing a search to integrate with my dashboard. Goal: Display current license usage in megabytes as an integer in a "Single Value" type graph. Error: When I run the search, I get "N/A" back. Current Search: index=internal source=metrics.log group=per_index_thruput series!= | eval totalMB = kb/1024 | chart sum(totalMB) as total Any help is appreciated!

mchandx · ‎04-25-2012

Tried that; no luck. It would need to be edited to series!=_ but even that didn't fix it. Also, now the search is returning "N/A"

mchandx · ‎04-25-2012

I have read through the related answers to questions similar to this one, but I just can't make it work for some reason. I am running the following search: index=internal source=*metrics.log group=per_index_thruput series!=* | eval totalMB = kb/1024 | chart sum(totalMB) as total and displaying it as a single value on a dashboard. It returns a value with a ton of decimal places and I would like to have it rounded to 2 places. Any help is greatly appreciated 🙂 Referenced: http://splunk-base.splunk.com/answers/45110/round-splunk-license-usage http://splunk-base.splunk.com/answers/8046/rounding-decimal-places

mchandx · ‎04-20-2012

I tried that, and this is what I got: http://i42.tinypic.com/3480l6o.png The blacked out sections are hosts

mchandx · ‎04-20-2012

That is essentially what I am looking for. I want to graph the amount of logs indexed per host since midnight of the current day, graphed by hosts. So the graph the x-axis would show time and the y-axis would be an integer of how many total logs generated by the entire network. That integer would then be broken down by hosts. Here's a picture kind of showing the look that I am trying to achieve: http://1.bp.blogspot.com/-OmyYzNNKZE0/Tmls2yFeGcI/AAAAAAAAABY/uCzqQxB3ZDE/s1600/Selection_015.png

mchandx · ‎04-20-2012

Hello, I need to create a stacked area graph displaying all data for all hosts in the environment. I have the visualization created, but I do not know the proper syntax.

Posts	14
Solutions	3
Karma Given	0
Karma Received	27
Member Since	‎04-11-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Incorrect Time Range for @d

License usage by subnet

Real-time License Monitoring Search Error

How to round decimal places?

Display data from all host in timeline

Re: Incorrect Time Range for @d

Re: Incorrect Time Range for @d

Re: Incorrect Time Range for @d

Incorrect Time Range for @d

License usage by subnet

Re: How to round decimal places?

Re: Real-time License Monitoring Search Error

Re: Real-time License Monitoring Search Error

Real-time License Monitoring Search Error

Re: How to round decimal places?

How to round decimal places?

Re: Display data from all host in timeline

Re: Display data from all host in timeline

Display data from all host in timeline