About herbie

herbie · ‎10-23-2011

Hi Aaron, I think the easiest way would be to rename all your previous sourcetypes to match your current one, then your field extraction and any other settings should apply to all your sourcetypes. Then when you search, everything will be shown as a single sourcetype. To rename sourcetypes, add the following stanza to your props.conf file, replacing the 'old-sourcetype-name' and 'new-sourcetype-name' values: [old-sourcetype-name] rename = new-sourcetype-name You'll need to add one of these for each sourcetype, you didn't mention how many there is so I'm not sure how hard this will be. The other option would be to perform your field extraction within your search, so it would look something like (replace the "regex_statement" with the one from your field extraction): index="my_index" username="someuser" | rex field=_raw "regex_statement" | stats count by url_host Hope this helps. Cheers, Ashley

herbie · ‎10-16-2011

Hi guys, Do you know if this solution still works with Splunk 4.2.1? I'm trying to use the above search but I get the following error every time: "Error in 'search' command: Unable to parse the search: 'AND' operator is missing a clause on the left hand side." Here's the search I'm using: index=prod sourcetype=odr [search index=prod sourcetype=odr | head 1 | eval earliest=relative_time(_time,"-1d") | eval latest=_time | fields earliest, latest] If I run the subsearch as a normal search the earliest & latest fields get returned correctly, but when it's a subsearch it errors out. Cheers.

herbie · ‎05-03-2011

Hi, I have the following SimpleResultsTable in a dashboard. I want to limit/reduce the width of the second column in the table, as the data can be quite long. I'd prefer if the column would wrap, but it's ok if it just cuts off the end of the text. Is there any way to do this? <module name="HiddenSearch" layoutPanel="panel_row3_col2" group="Key Transactions" autoRun="True"> <param name="search">index=svp sourcetype=odr tag::cs_uri_stem=* |stats count, avg(time_taken) as AvgResTime, p90(time_taken) as 90thPctlResTime by tag::cs_uri_stem, cs_uri_stem | rename tag::cs_uri_stem as Transaction, cs_uri_stem as URL</param> <param name="groupLabel">Key Transactions</param> <module name="JobProgressIndicator"> <module name="EnablePreview"> <param name="enable">True</param> <param name="display">False</param> <module name="SimpleResultsTable"> <param name="count">20</param> <param name="drilldown">row</param> <param name="displayRowNumbers">false</param> <param name="allowTransformedFieldSelect">True</param> <module name="HiddenSearch" layoutPanel="panel_row3_col1"> <param name="search">index=svp sourcetype=odr | stats count avg(time_taken) as AvgTimeTaken by cs_uri_stem</param> <module name="ConvertToIntention"> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="tag::cs_uri_stem">$click.value$</param> </param> </param> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> <module name="ViewRedirectorLink"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> Thanks in advance. Ashley

herbie · ‎04-27-2011

Yes, there is a couple of ways you can do this. Note that your timestamp gets put into a field called _time. If you want to use average figures over a timerange, you can use the timechart function. Eg: search command | timechart avg(pageLoadSeconds) as AvgPageLoadTime If for some reason you want to graph the raw values of pageLoadSeconds, you can just create a table with the values you want, eg: search command | table _time, pageLoadSeconds Note, the graphs in Splunk will only plot up to 1000 events, so if you use the table option you won't be able to do it over a lot of data. It's recommended to use timechart. Either of these can be used to populate a Splunk graph. Cheers, Herbie.

herbie · ‎04-26-2011

On the end of your search, add the sort function. Eg: ... | sort -pageLoadTime Cheers.

herbie · ‎04-26-2011

Hi All, I'm looking for a bit of advice on how to extract Websphere logs from an IBM Z10 Mainframe running z/OS. The logs don't actually get written to a file, they are stored in a 'console'. To get these logs out, we can run a script to export them to file. Due to the size & number of the logs, our z/OS administrators are reluctant to download the whole files regularly due to the overhead it will have on the mainframe, so their solution is to export the last 10000 lines every hour to reduce this overhead. If we do this, each log file that gets exported will be overwritten each time, and the file will only ever be a maximum of 10000 lines. I understand that we may miss data doing this, but my main concern is how Splunk will handle the log file being overwritten each time. In most cases, the overwritten log will contain lines that were there in the previous hour (but not all of them), and a whole heap of new lines. From my understanding, Splunk will try to work out where it was up to previously, but I don't think it will be able to as the start of the file has changed. Therefore, it would just re-index the whole log file, causing duplicate data to be stored in Splunk. So, these are my questions: 1. Is my understanding above correct? 2. Is there any way of getting Splunk to recognise the duplicate data before indexing? 3. Has anyone else been able to successfully obtain logs from z/OS and index them into Splunk? I've seen a couple of posts in Answers about this, but there doesn't seem to be a definitive way of doing it. It would be great if there was a mainframe agent. Any advice on this would be greatly appreciated. Thanks, Ashley

herbie · ‎02-23-2011

Ah, that makes sense, thanks for the explanation.

herbie · ‎02-22-2011

That works, such a simple thing, thankyou so much. I don't really understand that value though. According to the documentation, the 'charting.axisLabels' parameter defines whether it's a numeric, category, or time axis. So when the value is'#axisLabelsY', what is that defining?

herbie · ‎02-22-2011

Hi Guys, I've created a new overlay with the help of another Answers question (http://answers.splunk.com/questions/9053/example-of-chart-overlay), and everything is working perfectly except that I can't figure out how to get the axisLabels on the second Y axis to display. Below is my xml. It's the axisLabelsY2 that aren't displaying. Thanks in advance! Ashley <view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html"> <label>PROD - ODR Hits vs Response Time</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module> <module name="Message" layoutPanel="messaging"> <param name="filter">splunk.search.job</param> <param name="clearOnJobDispatch">True</param> <param name="maxSize">1</param> </module> <module name="TitleBar" layoutPanel="viewHeader"> <param name="actionsMenuFilter">dashboard</param> </module> <module name="TimeRangePicker" layoutPanel="viewHeader"> <param name="searchWhenChanged">True</param> <param name="selected">Year to date</param> <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Search Query - URI's can be added to the cs_uri_stem field." autoRun="True"> <param name="search">index=summary source="prod - odr hits by url - daily summary" cs_uri_stem=* | timechart span=1d sum(count) as count, avg(AvgResTime) as ResTime | `lineartrend(_time,count,counttrend)` | `lineartrend(_time,ResTime,restrend)` | timechart span=1d sum(count) as Hits, sum(counttrend) as HitsTrend, sum(ResTime) as AvgResTime, sum(restrend) as ResTimeTrend</param> <module name="SearchBar" layoutPanel="panel_row1_col1"> <param name="field">cs_uri_stem</param> <param name="label">Modify Search String</param> <param name="useAssistant">true</param> <param name="autoOpenAssistant">true</param> <module name="HiddenChartFormatter"> <param name="charting.legend.placement">top</param> <param name="charting.chart">column</param> <param name="charting.chart.columnAlignment">.5</param> <param name="charting.axisX">time</param> <param name="charting.axisY">numeric</param> <param name="charting.axisY2">numeric</param> <param name="charting.axisTitleX.text">Date</param> <param name="charting.axisTitleY.text">Hits</param> <param name="charting.axisTitleY2.text">Average Response Time</param> <param name="charting.axisLabelsY2">#axisLabelsY2</param> <param name="charting.axisLabelsY2.axis">@axisY2</param> <param name="charting.axisLabelsY2.placement">right</param> <param name="charting.data0">results</param> <param name="charting.data0.jobID">@data.jobID</param> <param name="charting.data1">view</param> <param name="charting.data1.table">@data0</param> <param name="charting.data1.columns">[0,1]</param> <param name="charting.data2">view</param> <param name="charting.data2.table">@data0</param> <param name="charting.data2.columns">[0,2]</param> <param name="charting.data3">view</param> <param name="charting.data3.table">@data0</param> <param name="charting.data3.columns">[0,3:4]</param> <param name="charting.chart.data">@data1</param> <param name="charting.chart2">line</param> <param name="charting.chart2.axisY">@axisY</param> <param name="charting.chart2.data">@data2</param> <param name="charting.chart3">line</param> <param name="charting.chart3.axisY">@axisY2</param> <param name="charting.chart3.data">@data3</param> <param name="charting.layout.charts">[@chart,@chart2,@chart3]</param> <param name="charting.layout.axisTitles">[@axisTitleX,@axisTitleY,@axisTitleY2]</param> <param name="charting.layout.axisLabels">[@axisLabelsX,@axisLabelsY,@axisLabelsY2]</param> <module name="YAxisRangeMinimumFormatter" layoutPanel="panel_row2_col1" group="Y Axis Minimum"> <param name="default"></param> <module name="YAxisRangeMaximumFormatter" layoutPanel="panel_row2_col2" group="Y Axis Maximum"> <param name="default"></param> <module name="ChartTypeFormatter" layoutPanel="panel_row2_col3" group="Hits Chart Type"> <param name="default">column</param> <module name="FlashChart" layoutPanel="panel_row3_col1" group="ODR Hits vs Response Times"> <param name="height">600px</param> </module> </module> </module> </module> </module> </module> </module> </module> </view>

herbie · ‎02-21-2011

Hi Guys, This thread was really helpful, I'm trying to do the same thing. I'm trying to graph HTTP Hits vs Response Times in an overlayed chart. The only problem I'm having is that the Yaxis 2 doesn't show up on the right, and I noticed it doesn't show in the picture above either. I've been playing around with the charting.axisLabelsY2.* values but can't seem to get it to appear. Do you know if there's any way to get the second Y axis to show? Thanks Ashley

herbie · ‎02-16-2011

No, I didn't need to restart anything, just update the dashboard through the Manager and it should pick it up straight away. Not sure why it's not working for you???

herbie · ‎02-14-2011

I've sort of found a solution. If you are using advanced XML to create the dashboard/chart, there is a param called 'maxResultCount' which tells it how many results can be plotted per series. This sits under the FlashChart module. The strange thing is that the Splunk documentation on this says the default is 250, not 1000. Be careful though, the documentation says changing it can cause unexpected UI behaviour, and I've noticed that when you use it with a large number your browser starts using heaps of memory (I had it up to 500MB, and it wasn't responding very well). Here's an example of the module in my XML, you can see where the maxResultCount parameter sits: <module name="HiddenPostProcess" layoutPanel="panel_row1_col1" group="JVM Heap Usage" autoRun="True"> <param name="search">table _time T_Total T_Used N_Total N_Used</param> <param name="groupLabel">JVM Heap Usage</param> <module name="ViewstateAdapter"> <module name="JobProgressIndicator"> <module name="EnablePreview"> <param name="enable">True</param> <param name="display">False</param> <module name="HiddenChartFormatter"> <param name="charting.chart">line</param> <param name="charting.axisTitleX.text"></param> <param name="charting.axisTitleY.text"></param> <param name="charting.chart.nullValueMode">connect</param> <module name="FlashChart"> <param name="width">100%</param> <param name="height">400px</param> <param name="maxResultCount">10000</param> </module> <module name="ViewRedirectorLink"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> </module>

herbie · ‎02-14-2011

Hey Alex, I've sort of found a solution. If you are using advanced XML to create the dashboard/chart, there is a param called 'maxResultCount' which tells it how many results can be plotted per series. This sits under the FlashChart module. The strange thing is that the Splunk documentation on this says the default is 250, not 1000. Be careful though, the documentation says changing it can cause unexpected UI behaviour, and I've noticed that when you use it with a large number your browser starts using heaps of memory (I had it up to 500MB, and it wasn't responding very well).

herbie · ‎02-14-2011

I found a bit of a problem with this, the alerts work perfectly, however for some reason when I have the port set to :80 it makes the Scheduled PDF Reports fail when it tries to generate the PDF. I can't figure out why as the moment, but just thought I'd let you know in case you run into this issue as well.

herbie · ‎02-11-2011

Hi Alex, No I haven't been able to get around this, it's still a problem for me. I've had to resort to using the 'timechart bins=1000' to try to get as close as possible, but even that isn't great because it only really does rounded numbers and nothing in between (ie, it goes 1m, 5m, 30m, 1h, 1d), and won't do anything between 1h & 1d. My dashboards have a TimeRangePicker on them so the users can select their own timerange, but because of this the scale and look of the chart changes dramatically. If you find anything, please let me know. Cheers, Ashley

herbie · ‎01-31-2011

Thanks for the responses guys, both solutions work well.

herbie · ‎01-28-2011

Hey Guys, I thought this would be simple, but doesn't seem so. From our HTTP logs, I want to get a list of the top 20 hit URLs and show the average response time for each of those within the one search. Something like this: index=prod sourcetype="odr" | top limit=20 cs_uri_stem | stats avg(time_taken) by cs_uri_stem However, the time_taken field doesn't get passed to the stats command so it displays blank. Basically, this is the output I want to show: I was looking at the documentation on subsearches, but I can't figure out how to do it with that either. Any ideas? Thanks in advance.

herbie · ‎01-27-2011

I just had the same issue, and the only way I could figure it out is to use the following in alert_action.conf: hostname=host.domain.com:80 or hostname=host.domain.com: When the URL gets added to the email, you get the following (depending on which one you use): http://host.domain.com:80/app/... or http://host.domain.com:/app/... Either way, the browsers interpret the URL correctly, but it just doesn't look pretty. Hope that helps. Cheers, Ash

herbie · ‎01-07-2011

Hi Nick, thanks for your response. I understand that this command is returning all the events, as I don't actually want to average them. I'm trying to make graphs of JVM memory usage and we need to be able to accurately see when there's spikes, so when we show the graph over a longer period (ie 7 days) the averaged data becomes invalid. I don't think the limit is to do with the chart/timechart commands themselves, because I get the same result if I use the table function. When I perform the search I can see all the rows being returned, it's just that the flash chart doesn't display them all.

herbie · ‎01-06-2011

Hi, I'm trying to create a chart of results over time, however the chart only charts the first 1000 results. I'm using the following search over 1 day: index=prod sourcetype="websphere:nativestdouterrlog" | chart avg(exclusiveaccessms) over _time This returns about 6500 results across the day, and I need to create a line chart from that. I can see all the results in the table, however the chart stops at the 1000th event. I've also tried using the table & timechart functions, but both have the same problem. Is there a limit somewhere which I can change to correct this? Thanks Ashley

Posts	20
Solutions	1
Karma Given	2
Karma Received	20
Member Since	‎01-06-2011

Online Status	Offline
Date Last Visited	‎05-31-2023 02:42 AM

Limit Column Width in table

Handling of z/OS Mainframe Websphere Logs

AxisLabels on Overlay Chart

Show average response time of top 20 URLs

Chart only showing 1000 events

Re: Combine the count of multiple fields for a com...

Re: Custom Time range based on most recent event t...

Limit Column Width in table

Re: sorting based on value?

Re: sorting based on value?

Handling of z/OS Mainframe Websphere Logs

Re: AxisLabels on Overlay Chart

Re: AxisLabels on Overlay Chart

AxisLabels on Overlay Chart

Re: Example Of Chart Overlay ?

Re: Chart only showing 1000 events

Re: Chart only showing 1000 events

Re: Chart only showing 1000 events

Re: Email Alerts behind proxy not sending proper l...

Re: Chart only showing 1000 events

Re: Show average response time of top 20 URLs

Show average response time of top 20 URLs

Re: Email Alerts behind proxy not sending proper l...

Re: Chart only showing 1000 events

Chart only showing 1000 events