Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About cschmidt0121
cschmidt0121
Path Finder
Member since:
12-13-2012
06-05-2020
Community Statistics
| Posts | 14 |
| Solutions | 2 |
| Karma Given | 2 |
| Karma Received | 7 |
| Member Since | 12-13-2012 |
Activity Feed
- Karma Extracting fields from undelimited binary data? for rapple1066. 06-05-2020 12:46 AM
- Karma Re: Events Being Passed to Custom Commands More Than Once for dart. 06-05-2020 12:46 AM
- Got Karma for Re: Getting a count of the number of fields associated with a sourcetype. 06-05-2020 12:46 AM
- Got Karma for Re: Getting a count of the number of fields associated with a sourcetype. 06-05-2020 12:46 AM
- Got Karma for Re: Getting a count of the number of fields associated with a sourcetype. 06-05-2020 12:46 AM
- Got Karma for Re: Cannot start splunk - shellscript error in mac OSX. 06-05-2020 12:46 AM
- Got Karma for Re: Extracting fields from undelimited binary data?. 06-05-2020 12:46 AM
- Got Karma for Re: Extracting fields from undelimited binary data?. 06-05-2020 12:46 AM
- Got Karma for Re: Query is not fully resolved in dashboard. 06-05-2020 12:46 AM
- Posted Re: Events Being Passed to Custom Commands More Than Once on Splunk Dev. 12-16-2013 12:03 PM
- Posted Re: Events Being Passed to Custom Commands More Than Once on Splunk Dev. 12-16-2013 11:32 AM
- Posted Re: Query is not fully resolved in dashboard on Dashboards & Visualizations. 12-06-2013 12:55 PM
- Posted Events Being Passed to Custom Commands More Than Once on Splunk Dev. 12-06-2013 12:18 PM
- Tagged Events Being Passed to Custom Commands More Than Once on Splunk Dev. 12-06-2013 12:18 PM
- Tagged Events Being Passed to Custom Commands More Than Once on Splunk Dev. 12-06-2013 12:18 PM
- Tagged Events Being Passed to Custom Commands More Than Once on Splunk Dev. 12-06-2013 12:18 PM
- Tagged Events Being Passed to Custom Commands More Than Once on Splunk Dev. 12-06-2013 12:18 PM
- Posted Re: Python SDK: Is it possible generate a Splunk alert based on a triggered python script on Alerting. 07-03-2013 12:06 PM
- Posted Re: Getting a count of the number of fields associated with a sourcetype on Splunk Search. 06-21-2013 10:42 AM
- Posted Re: Getting a count of the number of fields associated with a sourcetype on Splunk Search. 06-21-2013 10:17 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
12-16-2013
12:03 PM
Ooooh. I see. Thank you very much for the response.
... View more
12-16-2013
11:32 AM
Yeah that certainly makes sense. I'm still confused as to why Splunk runs the command multiple times in the first place, though, if it's just going to discard the results of the first two runs.
Thanks for the link to the new SDK examples; I'm looking over them now.
... View more
12-06-2013
12:55 PM
1 Karma
In Splunk known issues: "eval $foo$ tokens don't work in Simple XML, searches fail with error Search query is not fully resolved. (SPL-74498)"
Looks like it has to do with this?
eval f=if("$company$"=="*","All Companies",Co_Name)
... View more
12-06-2013
12:18 PM
I've been working with custom commands for a while, and I've noticed some weird behavior regarding how events are passed into commands. It is my understanding that regardless of whether a command is declared to be streaming or not, Splunk may choose to send events to the command in chunks instead of one large set. So what I would expect to see is something like this:
For a total of 15,000 events piped into custom command "cmd"...
Splunk sends cmd events 0-5000
cmd completes and outputs results
Splunk sends cmd events 5001-10000
cmd completes and outputs results
Splunk sends cmd events 10001-15000
cmd completes and outputs results
However, by having my command log the events it receives, I instead see something that resembles this:
Splunk sends cmd events 0-5000
cmd completes and outputs results
Splunk sends cmd events 0-10000
cmd completes and outputs results (these results OVERWRITE previous results!)
Splunk sends cmd events 0-15000
cmd completes and outputs results (these results OVERWRITE previous results!)
So events 0-5000 end up being passed to the command 3 times, and events 5001-10000 are passed twice. Is this intended behavior? If so, can anyone explain why?
... View more
07-03-2013
12:06 PM
Your could make a search that alerts every time it is run and run that from the Python script. Of course that wouldn't be able to receive input based on the commands run by the script.
If you're just looking for an e-mail alert, it might be easier to just e-mail directly from the Python script.
... View more
06-21-2013
10:42 AM
That didn't even occur to me! Thanks for the heads up.
... View more
06-21-2013
10:17 AM
3 Karma
Both answers so far work great, but to do this one sourcetype at a time would take me forever. I solved this by writing a shell script the uses the CLI to do two things:
1) Enumerate all sourcetypes.
2) Count the number of fields for each sourcetype.
It looks like this:
#!/bin/bash
# Clear fields.txt
> fields.txt
echo "Building sourcetype list."
splunk search "| metadata type=sourcetypes index=* | table sourcetype" -uri https://hostname:8089 -maxout 10000 -earliest_time '-7d'| tail +3 > sourcetypes.txt
echo "Done."
while read st; do
echo "Counting fields for $st."
echo -n $st >> fields.txt
echo -n ": " >> fields.txt
# The search returns with some weird leading whitespace, so I use sed to
# get rid of it.
splunk search "sourcetype=$st | head 250 | fieldsummary | stats count" -uri https://hostname:8089 | tail -1 | sed 's/^[ \t]*//' >> fields.txt
done < sourcetypes.txt
... View more
06-20-2013
02:42 PM
Yeah, I definitely think the least painful solution to this is to simplify your data before it makes its way into Splunk. It looks like Splunk is trying and failing to parse the data - for example, isn't there a huge chunk of data missing? I count 36 bytes (minus all of the /x's) in each event in your screenshot. There should be a LOT more, correct?
... View more
06-20-2013
02:09 PM
Is that how you want the data to look in splunk? If not I highly recommend setting up an input like the blog post Ayn suggested. Parse the data with a python script and output it as with human readable timestamps, fields, etc. To be honest, I have no clue how that Splunk excerpt could possibly represent the raw data.
... View more
06-19-2013
02:38 PM
If it doesn't, post an example of one of the raw events and I can try to fix my regex.
... View more
06-19-2013
01:58 PM
1 Karma
Do you have administrative access to the machine you're installing it on? Try running it with sudo.
... View more
06-19-2013
01:49 PM
I'm pretty sure you should be editing TIME_FORMAT, not TIME_PREFIX. Not only that, you aren't specifying which fields are year, month, etc.
... View more
06-19-2013
01:42 PM
You could probably do something crazy like eval _time=ID. Since time is internally just an integer anyway, this probably will work. Of course after you do that the timestamps will be horribly off, but they should at least be ordered as the IDs were.
... View more
06-19-2013
01:35 PM
2 Karma
Couldn't you just do this with a rex extraction?
Something like:
rex field=_raw "(? .{2})(? .{2})(? .{4})(? .{8})(? .{8})(? .{8})(? .{8})(? .{8})... etc
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma from
