Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About lquinn
lquinn
Contributor
Member since:
08-19-2014
06-05-2020
Community Statistics
| Posts | 113 |
| Solutions | 21 |
| Karma Given | 9 |
| Karma Received | 171 |
| Member Since | 08-19-2014 |
Activity Feed
- Got Karma for Re: Search formatting in Splunk 6.5.0 for easier readability. 09-21-2021 10:30 AM
- Got Karma for Feature Request: How to embed a dashboard (not a report) that is updated every hour in a webpage?. 04-15-2021 02:01 AM
- Got Karma for Re: Search formatting in Splunk 6.5.0 for easier readability. 10-29-2020 01:17 AM
- Got Karma for Feature Request: How to embed a dashboard (not a report) that is updated every hour in a webpage?. 09-24-2020 06:29 AM
- Got Karma for Re: Search formatting in Splunk 6.5.0 for easier readability. 09-23-2020 03:33 AM
- Got Karma for Re: Search formatting in Splunk 6.5.0 for easier readability. 09-08-2020 11:15 AM
- Got Karma for Re: How to add final total count of results without adding another column?. 06-05-2020 12:48 AM
- Got Karma for Re: How to use LINE_BREAKER from one source with multiple sourcetypes?. 06-05-2020 12:48 AM
- Got Karma for Re: How to use LINE_BREAKER from one source with multiple sourcetypes?. 06-05-2020 12:48 AM
- Got Karma for Re: How to use rex command to extract value from the end of an event?. 06-05-2020 12:48 AM
- Got Karma for Re: Why does my search only give strptime output for one of three time values?. 06-05-2020 12:48 AM
- Got Karma for Re: Why does my search only give strptime output for one of three time values?. 06-05-2020 12:48 AM
- Got Karma for Re: Why does my search only give strptime output for one of three time values?. 06-05-2020 12:48 AM
- Got Karma for Re: console.log does not output - script breaks. 06-05-2020 12:48 AM
- Got Karma for Re: Search formatting in Splunk 6.5.0 for easier readability. 06-05-2020 12:48 AM
- Got Karma for Re: Search formatting in Splunk 6.5.0 for easier readability. 06-05-2020 12:48 AM
- Got Karma for Re: Search formatting in Splunk 6.5.0 for easier readability. 06-05-2020 12:48 AM
- Got Karma for Re: Search formatting in Splunk 6.5.0 for easier readability. 06-05-2020 12:48 AM
- Got Karma for Re: Search formatting in Splunk 6.5.0 for easier readability. 06-05-2020 12:48 AM
- Got Karma for Re: Search formatting in Splunk 6.5.0 for easier readability. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 2 | |||
| 4 | |||
| 1 | |||
| 0 | |||
| 0 |
07-20-2017
09:20 PM
I have deployed Splunk_TA_Nix to several Solaris 11 servers, however the bandwidth.sh script is failing since there is no -n flag for the sar command on these servers.
I have tried several other commands, dlstat, netstat etc, but have not yet found a solution.
Has anyone managed to edit this script to work successfully on Solaris 11?
Thanks. Script below:
. `dirname $0`/common.sh
HEADER='Name rxPackets_PS txPackets_PS rxKB_PS txKB_PS'
HEADERIZE="BEGIN {print \"$HEADER\"}"
PRINTF='{printf "%s %s %s %s %s\n", Name, rxPackets_PS, txPackets_PS, rxKB_PS, txKB_PS}'
# Note: For FreeBSD, bsdsar package needs to be installed. Output matches linux equivalent
if [ "x$KERNEL" = "xLinux" ] ; then
CMD='sar -n DEV 1 2'
FILTER='($0 !~ "Average" || $0 ~ "sar" || $2 ~ "lo|IFACE") {next}'
FORMAT='{Name=$2; rxPackets_PS=$3; txPackets_PS=$4; rxKB_PS=$5; txKB_PS=$6}'
elif [ "x$KERNEL" = "xSunOS" ] ; then
CMD='sar -n DEV 1 2'
FILTER='($0 ~ "Time|sar| lo") {next}'
FORMAT='{Name=$2; rxPackets_PS=$5; txPackets_PS=$6; rxKB_PS=$3; txKB_PS=$4}'
elif [ "x$KERNEL" = "xAIX" ] ; then
# Sample output: http://www-01.ibm.com/support/knowledgecenter/ssw_aix_61/com.ibm.aix.performance/nestat_in.htm
CMD='netstat -i -Z; netstat -in'
FILTER='($0 ~ "Name|sar| lo") {next}'
FORMAT='{Name=$1; rxPackets_PS=$5; txPackets_PS=$7; rxKB_PS=?; txKB_PS=?}'
elif [ "x$KERNEL" = "xDarwin" ] ; then
CMD='sar -n DEV 1 2'
FILTER='($0 !~ "Average" || $0 ~ "sar" || $2~/lo[0-9]|IFACE/) {next}'
FORMAT='{Name=$2; rxPackets_PS=$3; txPackets_PS=$5; rxKB_PS=$4/1024; txKB_PS=$6/1024}'
elif [ "x$KERNEL" = "xHP-UX" ] ; then
# Sample output: http://h20565.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c02263324
CMD='netstat -i 1 2'
FILTER='($0 ~ "Name|sar| lo") {next}'
FORMAT='{Name=$1; rxPackets_PS=$5; txPackets_PS=$7; rxKB_PS=?; txKB_PS=?}'
elif [ "x$KERNEL" = "xFreeBSD" ] ; then
CMD='sar -n DEV 1 2'
FILTER='($0 !~ "Average" || $0 ~ "sar" || $2 ~ "lo|IFACE") {next}'
FORMAT='{Name=$2; rxPackets_PS=$3; txPackets_PS=$4; rxKB_PS=$5; txKB_PS=$6}'
fi
assertHaveCommand $CMD
$CMD | tee $TEE_DEST | $AWK "$HEADERIZE $FILTER $FORMAT $PRINTF" header="$HEADER"
echo "Cmd = [$CMD]; | $AWK '$HEADERIZE $FILTER $FORMAT $PRINTF' header=\"$HEADER\"" >> $TEE_DEST
... View more
02-23-2017
02:30 PM
I just tried your code above and it worked perfectly for me ... Is there any other part of your dashboard that could be affecting this?
... View more
02-12-2017
03:52 PM
In the license usage logs there is a field called idx which denotes the index that the data is being written to. Doing a sum of the bytes field (b) by idx will give you the license usage per index:
index=_internal source="*license_usage.log" | stats sum(b) by idx
If you wanted to know the total for the five indexes, simply search for these indexes before doing the sum:
index=_internal source="*license_usage.log" idx="index1" OR idx="index2 OR idx="index3" OR idx="index4" OR idx="index5" | stats sum(b)
Similarly, "h" is the host field in the license_usage logs.
... View more
02-08-2017
04:32 PM
Can you post an example event please? One that should be filtered out by the second regex command but is not?
... View more
01-24-2017
02:42 PM
It came up as an error for your div tag because it was expecting your input tags to be closed first. Sometimes you can get away with not closing the input tags but I guess you can't in this instance.
... View more
01-24-2017
02:15 PM
1 Karma
Try closing your input tags, just above the div in question. So the div would become:
<div id="frm" style="width: 300px; height: 100px; float: left;">
Usernames (separate by comma): <input type="text" id="uname"/>;
<input id="unameSubmit" type="button" value="Submit" onclick="httpPost('http://www.mysite.com');"/>
</div>
... View more
01-23-2017
09:45 PM
1 Karma
If a line chart is the end goal, you could use concurrency to find the number of overlapping events, along with gentimes to create an event for every second. You will need to adjust the parameters of gentimes depending on the time you want your graph to show. This will not however list each individual id, only a count of the number of id's. Try the following search:
<your_current_search> | table id, current_time, end_time | eval starttime=strptime(current_time,"%Y/%m/%d %H:%M:%S") | eval endtime=strptime(end_time,"%Y/%m/%d %H:%M:%S") | eval duration = endtime-starttime | append [|gentimes start=01/21/2017:13:00:00 end=01/21/2017:15:00:00 increment=1s | eval type="gentimes" | eval duration=1] | concurrency start=starttime duration=duration | where type="gentimes" | eval concurrency=concurrency-1 | rename starttime AS _time | timechart span=1s max(concurrency) AS "Number of Id's"
... View more
01-22-2017
01:42 PM
Have you set up inputs on the forwarder, to tell it what to forward?
... View more
01-19-2017
07:21 PM
This works for HTML dashboards not XML. Not quite so simple I don't think if you want to keep it as XML ...
... View more
01-19-2017
06:36 PM
If you just want to do this in a HTML dashboard you can simply include the above css within style tags after your header. You can edit the source code straight from the Splunk UI. So something like this ...
<style>
.single-value .single-result {
font-size: 18px !important;
}
</style>
... View more
01-19-2017
06:29 PM
Is it a HTML dashboard or XML?
... View more
11-03-2016
09:54 PM
If I'm understanding you correctly, you would like to remove all events that do not have a matching ip from the lookup? The purpose of a lookup is to enrich your data with extra information that is contained within fields in your lookup. It will not filter your events if they do not match. In order to do this you could simply append "| search oe=" to the end of your search. Then only events with the field *oe, which has come from your lookup, will be retained.
... View more
11-03-2016
07:02 PM
Do you have any errors in your search.log? Or any that come up when you click on view results for the saved search?
... View more
11-03-2016
03:11 PM
Does this happen when you open the CSV in excel, or was the CSV saved from excel? Sometimes it does some weird auto-formatting stuff on dates ...
Do you just want to reformat it as YYYY-MM-DD?
If so, you could try just using the replace command instead of fieldformat:
| replace "* 00:00:00.0" with "*" in DATE_OF_BIRTH
... View more
11-02-2016
02:59 PM
3 Karma
I believe it will be because epoch time is calculated as the number of seconds since 1st Jan 1970. The two dates that are not being converted occur before this time, so the value would be negative, which is not supported by Splunk. What are you trying to achieve by converting the timestamps to epoch?
Might be worth taking a look at this answer:
https://answers.splunk.com/answers/214742/can-splunk-strptime-work-with-the-date-before-1970-1.html
... View more
11-01-2016
08:55 PM
So I had a bit of a play around with this data set. I got part way to the answer. When I converted the timestamp to epoch it seemed to give the expected result using the following:
base_search | eval Time=_time | streamstats count by shift reset_on_change="Time=1478020440"
However when trying to use the _time field, it did not give the same result. I also had problems when using strings in general. Perhaps you can only use numbers?? Anyone else have a solution for use where the field value is a string?
... View more
11-01-2016
07:51 PM
Firstly, after the "stats count(status) as TOTAL_FAILURES" part at the beginning of your search, you will only be left with one field, TOTAL_FAILURES, which will have a numeric value of the number of events which contain the field status. The status field will no longer exist so all other evals after that won't work.
... View more
11-01-2016
04:31 PM
1 Karma
You could just append a stats count search to your current search. Its not as efficient as the above suggestions but might work as a quick fix if the above is too complicated. A little frustrating that you have to do the same search twice though ...
your_base_search | table field1, field2 | append [ your_base_search | stats count | eval field1="TOTAL EVENTS" | rename count AS field2 ]
An alternative would be to create a count column but then remove it by adding the total count and label to one of your other columns:
your_base_search | eval count=1 | addcoltotals labelfield=field1 label="TOTAL EVENTS" | eval field2=if(field1="TOTAL EVENTS",count,field2) | fields - count
... View more
11-01-2016
02:58 PM
If you just want to go to the other dashboard, you don't need any of the part from the ? onwards, only the dashboard name. Give the following a try:
<link>/app/search/secure_5__backend_exceptions__callout_logs</link>
If this doesn't work, check that the url is correct for your dashboard. Do this by navigating to that dashboard and seeing what the url is when you are on that page - it should be exactly as above after http://your-splunk-server:8000/en-US/
... View more
10-31-2016
05:57 PM
Yep, you're right, those two fields definitely should be matching! You should post that as the answer and accept since that solves your issue.
... View more
10-31-2016
03:19 PM
Note: My error was fixed as of 6.5, didn't test on 6.4.
... View more
10-31-2016
03:18 PM
I saw this same error fairly recently on a version of Splunk 6.3. I used the following search for my dropdown:
| inputlookup mycsv.csv | table MyField
I eventually found that the reason for the ever spinning circle was that I had some empty field values in my csv. I tried using fillnull in my search, so that there were no null fields, but I still encountered the same issue. Finally I manually edited the csv and replaced the blank field values with zeros and it worked.
Any chance you have any blank field values in the data that you are searching?
The way I found this was because there was a javascript error when I clicked on the dropdown. You probably have the same - if the above is not relevant to you, perhaps you could let us know the javascript error, assuming there is one? (Found by opening developer tools in your browser)
... View more
10-31-2016
02:51 PM
Its the & that is not allowed. Are you trying to specify the time picker settings for the secure_5_backend_exceptions_callout_logs dashboard, or do you just want to be taken to that page?
... View more
10-30-2016
06:19 PM
4 Karma
You need to include a drilldown option in your xml which specifies where you want the user to be redirected. The below lines need to be within the chart tags. So if you want users to be redirected to dashboard 2, you need to replace the following with the correct URL for dashboard 2:
<drilldown>
<link>/app/your_app/dashboard_2</link>
</drilldown>
The following example is taken from the Splunk 6 Dashboard examples app (might be really useful to look at https://splunkbase.splunk.com/app/1603/). It redirects the user to the search page which displays a timechart for the the number of events in the _internal index from the past hour:
<drilldown>
<link>/app/search/search?q=index%3D_internal%20earliest%3D-h%20%7C%20timechart%20count</link>
</drilldown>
Full chart example:
<chart>
<search>
<query>index=_internal |stats count by source</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">line</option>
<drilldown>
<link>/app/search/my_other_dashboard</link>
</drilldown>
</chart>
... View more
10-27-2016
05:42 PM
Try just listing the event codes in your whitelist settings like this:
whitelist1 = 4723,4724,4727,4728,4731,4732,4735,4737,4738,4739,4740,4754,4755,4756,4764,4767,4777,4780,4816,4864,4865,4866,4867,4882,4885,4890,4892
whitelist2 = 4896,4906,4907,4908,4912,4960,4961,4963,4965,4962,4976,4977,4978,4983,4984,5027,5028,5029,5030,5035,5037,5038,5122,5123,5124,5376,5377
whitelist3 = 5453,5480,5483,5484,5485,6145,6273,6274,6275,6277,6278,6279,6280,24586,24592,24593,24594
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma given to
