Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About chengka
chengka
Explorer
Member since:
03-10-2014
02-25-2022
Community Statistics
| Posts | 33 |
| Solutions | 0 |
| Karma Given | 3 |
| Karma Received | 2 |
| Member Since | 03-10-2014 |
Activity Feed
- Posted Re: Splunk for mathematical difference in stats? on Splunk Search. 02-25-2022 07:14 AM
- Karma Re: Splunk for mathematical difference in stats? for ITWhisperer. 02-25-2022 07:09 AM
- Karma Re: Splunk for mathematical difference in stats? for yuanliu. 02-25-2022 07:09 AM
- Posted Re: Splunk for mathematical difference in stats? on Splunk Search. 02-24-2022 10:00 AM
- Posted How to use Splunk for mathematical difference in stats? on Splunk Search. 02-07-2022 09:41 AM
- Karma Feature Request: How to embed a dashboard (not a report) that is updated every hour in a webpage? for lquinn. 06-05-2020 12:47 AM
- Got Karma for How to alter or create dashboards using Sideview Utils in advanced XML if dashboards in Splunk 6.2 use Simple XML?. 06-05-2020 12:47 AM
- Got Karma for How do I index files which do not grow, just change?. 06-05-2020 12:47 AM
- Posted Is mgmtHostPort secure? on Security. 06-21-2019 08:59 AM
- Tagged Is mgmtHostPort secure? on Security. 06-21-2019 08:59 AM
- Tagged Is mgmtHostPort secure? on Security. 06-21-2019 08:59 AM
- Posted Re: How to create alerts based on 2 sourcetypes and condition? on Splunk Search. 06-13-2019 09:32 AM
- Posted How to create alerts based on 2 sourcetypes and condition? on Splunk Search. 06-13-2019 08:32 AM
- Tagged How to create alerts based on 2 sourcetypes and condition? on Splunk Search. 06-13-2019 08:32 AM
- Tagged How to create alerts based on 2 sourcetypes and condition? on Splunk Search. 06-13-2019 08:32 AM
- Tagged How to create alerts based on 2 sourcetypes and condition? on Splunk Search. 06-13-2019 08:32 AM
- Posted Re: Did 6.2.2 close a loophole or break HTML links to reports? on Dashboards & Visualizations. 07-17-2017 11:07 AM
- Posted Re: Did 6.2.2 close a loophole or break HTML links to reports? on Dashboards & Visualizations. 07-17-2017 11:04 AM
- Posted Re: Did 6.2.2 close a loophole or break HTML links to reports? on Dashboards & Visualizations. 07-17-2017 10:45 AM
- Posted Re: Did 6.2.2 close a loophole or break HTML links to reports? on Dashboards & Visualizations. 07-17-2017 09:20 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 |
02-24-2022
10:00 AM
Thank you I appreciate the help. I was too literal. The timestamp will be a real date/time. How do I structure this where clause to be the latest?(all events will present the same date/time for each "interval", as described that would be a day) | where timestamp="today_timeStamp"
... View more
- Tags:
- Thank
02-07-2022
09:41 AM
Hello, I would like to try using Splunk to calculate the difference in numbers from one sample to the next. Here is some theoretical log entries.
The data indexed will look like this:
yesterday_timeStamp clusterId=abc, topicName=mytopic, partition=0, lastOffset=100
yesterday_timeStamp clusterId=abc, topicName=mytopic, partition=1, lastOffset=200
today_timeStamp clusterId=abc, topicName=mytopic, partition=0, lastOffset=355
today_timeStamp clusterId=abc, topicName=mytopic, partition=1, lastOffset=401
The number of events in the last 24 hours would be partition 0(355-200=155), partition 1(401-200=201) Sum of partitions for topic(mytopic) = 155+201=356 There will be many topicName(s) and possible different numbers of partition(s) per topicName. Can I use splunk to calculate the numbers of events per partition and topic since yesterday?
... View more
Labels
- Labels:
-
stats
06-21-2019
08:59 AM
Hello,
As most large companies do these days, I've been placed on a naughty list for my lab instance of Splunk, running on winServer. I've tracked it down to the mgmtHostPort.
How do I secure that port to use SSL/TLS?
FYI, my web interface is secured and using port 8000, it's this darn internal mgmt port.
Per the doc, I disable it via service.conf, Splunk basically is not usable for searching.
... View more
06-13-2019
09:32 AM
Thanks, that does work. I had hoped to do something like that, but I was not sure how to address the values returned by Stats. I thought it was some count prefixed name. Now I see its quite simple, just use the column name. Since I created this question, I continued to search via google and I saw a simple subsearch would work, since they are on the same host.
I know subsearches are frowned on, but the logs are small and I am only searching for 1 hour. Is my solution horrible in comparison?
index=stats (sourcetype=services History Service) NOT [search index=stats sourcetype=logs_sl "org.apache.coyote.AbstractProtocol start" | fields host]
... View more
06-13-2019
08:32 AM
Hello,
I currently have alerts based on the count of services performed in the last hour. We see that < 40 indicates an issue we need to address, so I constructed a simple alert, run every hour and sends a page to support when results are less than 40.
If the count of results form (sourcetype=services History Service) < 40 per hour, alert:
index=stats (sourcetype=services History Service) OR (sourcetype=logs_sl "org.apache.coyote.AbstractProtocol start")
But if the server restarts, the alert condition is usually met and we get alerted which we do not want because the server restarted likely explains the lack of results.
So I want to construct a search that meets the conditions
if History < 40 and no server restart, then alert (could be stated, if the server restarted, do not alert)
sourcetype=services History Service < 40 AND
sourcetype=logs_sl "org.apache.coyote.AbstractProtocol start" = 0
^ This is the restart statement
I feel like I'm overthinking this, but how do I construct a search from 2 sources, that have a conditional test like this, which can be used as an alert?
... View more
07-17-2017
11:07 AM
Sorry, I can't figure out how to use this darn editor..
Search QMGR Log
change
@go?s=
to
/app/EQS/search?s=
... View more
07-17-2017
11:04 AM
By looking at the resulting v6.6.1 URL and creating a custom drilldown I was able to figure out something that works.
This is a 6.6.2 link to a report Search my Log
It seems the @go, which determined current context, has changed or its no longer supported.
... View more
07-17-2017
10:45 AM
I also want to mention, I want the link to open in Search mode, not as a report.
... View more
07-17-2017
09:20 AM
I meant v6.6.2, not v6.2.2. My prod env is v6.6.1, the issue is occurring in v6.6.2.
... View more
07-17-2017
08:17 AM
Hello,
I use HTML panels to provide simple navigation to commonly used reports, dashboards and views. None of my links to reports are working after migrating from v6.2.0 to v6.2.2.
This is a snippet of what I use.
<li>
<p>This is a link to a report <a href="@go?s=$MY Log Search" target="_blank">Search my Log</a>
</p>
</li>
The report "$MY Log Search" is fine, the report is listed in reports and I can open it. Clicking in the link in 6.2.2. returns
"The view you requested could not be found."
I still have 6.2.0 in my prod system. I can see the URL's are different. The resulting URL for the working system ends in
/search?s=%MY%20Log%20Search
After upgrading to 6.2.2 I the URL ends in
/@go?s=QMGR%20Log%20Search
I don't really know CSS nor HTML, this is just something I located ages ago and I can't locate a good reference.
Did 6.2.2 close a loophole, or is something broken by 6.2.2?
Can someone point me to doc on how I should refer to a report via HTML panels?
... View more
03-01-2017
12:01 PM
That worked! I added some OR statements to the where, so I can see other relevant fields that identify the resource. Thank you!
... View more
03-01-2017
08:38 AM
The idea of value counts was the way I was thinking. I tried your solution and it doesn't find any results, buy trimming back the search I can see that it lists the values, but the where clause doesn't return any data. Maybe I need to reencode the untabled data as MV..
temp fieldname fieldvalue
1 EventName ChangeObject
1 EventTime 02/23/2017-09:07:47
1 MQCA_ALTERATION_DATE 2017-02-23
1 MQCA_ALTERATION_TIME 09.01.47 09.07.47
1 MQLONG MsgSeqNumber 1(0x00000001) 2(0x00000002)
... View more
03-01-2017
08:13 AM
Thank you for your patience. I ran the search and it returns all fields, not only those that are different. This is what I saw when I tried this solution from another thread.
source="splunkanswers.txt" index=testing | stats values() AS * count() AS count* dc() AS dc | foreach count* [eval '<>'=if(($<>$=$dc<>$), null(), $<>$)] | fields - count* dc* | table *
Here is partial result exported to csv. Several of the fields shown only have 1 value.
EventName EventTime MQCA_ALTERATION_DATE MQCA_ALTERATION_TIME MQLONG MsgSeqNumber date_hour date_mday
ChangeObject 02/23/2017-09:07:47 42789 09.01.47 09.07.47 1(0x00000001) 2(0x00000002) 9 23
... View more
03-01-2017
07:45 AM
Thank you, I will try it, but I don't see any colons in my field names, just the separator.
... View more
02-28-2017
02:25 PM
Thank you. I saw that answer in another thread, but it doesn't work for me. I get this error. I don't even have that field.. stumped..
Failed to parse templatized search for field 'counttag::eventtype'
... View more
02-28-2017
01:49 PM
I missed an , should be "| stats values() AS *"
... View more
02-28-2017
01:47 PM
Hello,
I'm looking events that track changes to a configuration. The first event is the "before" state the newest event is the "after" state. There events are in json format and there are > 80 fields. I have a search that will display all of the values for each field present, but it's not practical to display a table with 80 columns and expect the user to locate the columns with multiple values.
Here are 2 very sanitized events.
After Mod Event --
{
"EventTime" : "02/23/2017-09:07:47",
"EventName" : "ChangeObject",
"EventType" : "Configuration",
"MQLONG MsgSeqNumber" : "2(0x00000002)",
"MQCA_ALTERATION_DATE" : "2017-02-23",
"MQCA_ALTERATION_TIME" : "09.07.47",
}
Before Mod Event --
{
"EventTime" : "02/23/2017-09:07:47",
"EventName" : "ChangeObject",
"EventType" : "Configuration",
"MQLONG MsgSeqNumber" : "1(0x00000001)",
"MQCA_ALTERATION_DATE" : "2017-02-23",
"MQCA_ALTERATION_TIME" : "09.01.47",
}
This stats command gives me the values for each field.
... | stats values(*) AS *
All I want to see are the fields that are different, in this case the "MQLONG MsgSeqNumber" and "MQCA_ALTERATION_TIME". Amny of the fields are all text. Again, there can be over 80 continually changing fields, so I can't write anything that lists specific fields. This seems like something that should be fairly common, but I can't find any threads that answer my specific need.
Hoping someone can share what they've done or tackle this challenge 🙂
... View more
- Tags:
- compare
08-17-2016
01:20 PM
I installed the app. The doc says:
"After the Splunk platform indexes the events, you can analyze the data using the prebuilt panels included with the add-on. "
Should there be a presence in the list of Apps, which will include the panels? I'm logged in as an admin and I do not have an Apache app listed. I see fields and lookup, but I don't see any panels .
... View more
01-22-2016
03:03 PM
I need to locate and alert on counts that are not within predicted bounds. It seems simple enough using predict, but predict does not include any information regarding the source. Here is a run anywhere search which illustrates my concern
index=_internal sourcetype=splunkd_access* | timechart span=1d count as Gets | predict Gets | eval queueManager=if(1=1, mq_ir360_qmgr,"no") | rename upper95(prediction(Gets)) as ceiling | rename lower95(prediction(Gets)) as floor | eval excession=if(Gets > ceiling, "100", "0") | eval recession=if(Get < floor, "-100", "0") | table _time Gets, sourcetype
As you can see, there is no mention of the sourcetype in the results. I plan to use this within a map loop to check thousands of different hosts and I need to know which host contains an outlier. I tried to add information, but it is not in the pipe, so I can't(see second example) .
How would I get the sourcetype in my output?
... View more
11-30-2015
11:04 AM
Ok, my bad. I had a space between the [ and the sourcetype! It works via the UF once I removed the space.
... View more
11-17-2015
12:45 PM
Reviving this thread. I have exactly the same issue as OP. I upgraded the UF to v631 and added a stanza to props.conf, however the events are still not showing any fields. Now I have this same information in the props.conf of the indexer(v630) and the UF(v631). Am I missing something?
[ connections_mq]
SHOULD_LINEMERGE=false
INDEXED_EXTRACTIONS=csv
NO_BINARY_CHECK=true
CHARSET=UTF-8
KV_MODE=none
category=Structured
description=MQ Connections
disabled=false
pulldown_type=true
HEADER_FIELD_LINE_NUMBER=3
MAX_TIMESTAMP_LOOKAHEAD=1
... View more
10-29-2015
09:05 AM
Wow, so simple and I tried lots of complicated permutations. Thank you.
... View more
10-29-2015
08:53 AM
I've read several questions about using cron to schedule searches and I haven't seen a format the specifies every 12 hours at 6am and 6pm. I tried a few things like
0 6/12 * * * and even 0 (6,18) * * * to no avail.
Can it be done?
... View more
- Tags:
- cron
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-25-2022
10:40 AM
|
