Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ConnorG
ConnorG
Path Finder
Member since:
09-03-2014
06-05-2020
Community Statistics
| Posts | 34 |
| Solutions | 3 |
| Karma Given | 24 |
| Karma Received | 10 |
| Member Since | 09-03-2014 |
Activity Feed
- Got Karma for Difference in Size Between Events. 09-19-2020 07:08 PM
- Karma Re: Benefits of Using a Forwarder? for ddrillic. 06-05-2020 12:47 AM
- Karma Re: I'm indexing thousands of events from Sonicwall in Splunk 6.3, but why are summary dashboards not showing any data? for grantsmiley. 06-05-2020 12:47 AM
- Karma How can I add icons that replace the cell.value on my table without using rangemap? for sfatnass. 06-05-2020 12:47 AM
- Karma Re: After adding logging statements into Python script and running it via Splunk CLI, why are there no log messages in python.log? for jkat54. 06-05-2020 12:47 AM
- Karma What's your best Humans vs Zombies query? for Runals. 06-05-2020 12:47 AM
- Karma Re: Difference in Size Between Events for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Difference in Size Between Events for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Difference in Size Between Events for j4adam. 06-05-2020 12:47 AM
- Karma How to customize or change the default footer in Splunk Web? for fdi01. 06-05-2020 12:47 AM
- Karma Re: How to create a graph showing values for each percentile from 0 to 100? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Can someone show an example of sending data through TCP to a Splunk server using the C# SDK? for s2_splunk. 06-05-2020 12:47 AM
- Karma Re: Benefits of Using a Forwarder? for thomrs. 06-05-2020 12:47 AM
- Karma Re: How to set up an alert every time someone tries to access the configuration terminal on cisco routers to make changes? for mikaelbje. 06-05-2020 12:47 AM
- Karma Re: Splunk SDK: Is there a way to set the time of an event created from Submit? for Damien_Dallimor. 06-05-2020 12:47 AM
- Got Karma for Splunk SDK: Is there a way to set the time of an event created from Submit?. 06-05-2020 12:47 AM
- Got Karma for Re: How to calculate splunk data size injected per day or time based on forwarders. 06-05-2020 12:47 AM
- Got Karma for Can someone show an example of sending data through TCP to a Splunk server using the C# SDK?. 06-05-2020 12:47 AM
- Got Karma for Re: Can someone show an example of sending data through TCP to a Splunk server using the C# SDK?. 06-05-2020 12:47 AM
- Got Karma for Re: Collecting to a summary index not working. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 1 |
07-18-2017
12:41 PM
Was this done by importing the default logging levels? Or is there another setting to reset that I'm missing here?
... View more
11-16-2016
12:28 PM
Many applications provide a public facing API that you can pull data from. One of my favorites is Zillow. Just google around and you'll find plenty of things that you can load into Splunk.
... View more
12-29-2015
08:50 AM
Yes I noticed this, but if you read further down it also states that
"You can also just call logging directly and your logs will appear in python.log"
As I followed in my example.
... View more
12-29-2015
06:12 AM
1 Karma
I'm trying to debug a Python script and in doing so placed some logging statements into the script.
Following these posts for the basics:
Logging from Python in Splunk
Python logging in splunk
I'm going off the simple statement here
"You can also just call logging directly and your logs will appear in python.log:"
logging.warning("Something bad happened: %s", "out of memory")
so my code looks just like
import logging
logging.info("message here")
Running it using the Splunk CLI command:
splunk cmd python ./confcheck_correlation_searches.py
And yet still nothing in python.log. Any ideas what I'm missing here?
... View more
10-20-2015
10:48 AM
Sticking to the old format would give us:
var tables = ['web_stat_page_tbl', 'web_diag_tran_tbl', 'web_diag_comp_tbl', 'web_stat_tran_tbl'];
for(i = 0; i < tables.length; i++) {
mvc.Components.get(tables[i]).getVisualization(function(tableView) {
// Add custom cell renderer
tableView.addCellRenderer(new CustomRangeRenderer());
// Add custom row renderer
tableView.addRowExpansionRenderer(new CustomRowRenderer());
});
}
... View more
10-20-2015
10:43 AM
2 Karma
I fixed it after referencing the example dashboards app. Below you can find my code.
6.2.4 code:
var tables = ['web_stat_page_tbl', 'web_diag_tran_tbl', 'web_diag_comp_tbl', 'web_stat_tran_tbl'];
for(i = 0; i < tables.length; i++) {
mvc.Components.get(tables[i]).getVisualization(function(tableView) {
// Add custom cell renderer
tableView.table.addCellRenderer(new CustomRangeRenderer());
// Add custom row renderer
tableView.table.addRowExpansionRenderer(new CustomRowRenderer());
// Force the table to re-render
tableView.table.render();
});
}
6.3.0 code:
var tableElement = mvc.Components.getInstance("web_stat_page_tbl");
tableElement.getVisualization(function(tableView) {
// Add custom cell renderer, the table will re-render automatically.
tableView.addCellRenderer(new CustomRangeRenderer());
tableView.addRowExpansionRenderer(new CustomRowRenderer());
});
... View more
10-20-2015
10:10 AM
Below is the table object in a debug view coming from Splunk 6.2.4. Here we can see the addRowExpansionRenderer is still listed under the object.
Here is the same object in 6.3. No mention of RowExpansionRenderer anywhere.
... View more
10-20-2015
08:09 AM
After upgrading to Splunk 6.3, it seems the previous web framework for Javascript does not work properly.
My jscript is getting a TypeError: tableView.table.addRowExpansionRenderer is not a function error when being run under a 6.3 instance.
The code I'm using is expanding upon the concepts provides here
Anyone know if there were changes to the web framework and how to accommodate those changes?
... View more
10-12-2015
11:51 AM
You can use this view to see which sources are using up a large amount of volume on your Splunk server.
http(s)://your_server/en-GB/app/search/indexing_volume
If you are sending perfmon stats from each host you may want to change the interval the metrics are sent at. I've got my boxes all sending stats every 20 seconds (as seen below) and that works just fine. I believe the default for the Windows App is 10 seconds. Below is an example from inputs.conf
[perfmon://CPU Load]
counters = % Processor Time;% User Time
instances = _Total
interval = 20
object = Processor
index=pt_infra_monitoring
... View more
09-30-2015
07:24 AM
I went ahead and threw together a modification to the update_lookup.js file. The addition is an UpdateAll button that when pressed will update all visible rows.
Though I need your help. I'm having an issue.
Once the updates are pushed the rows don't actually show the changes until the web page is reloaded. I believe this is due to the context being pushed to only the children of the row that the button was clicked. Any assistance will be great.
View my code here:
https://github.com/ConnorRules/SideView---Lookup-
... View more
09-28-2015
01:44 PM
A recommendation for something to add to the Lookup Updater is the ability to update all changes. Only being able to change one row at a time is rather a pain when you need to make many changes.
Really love the view though. Thanks for putting this out there.
... View more
09-08-2015
07:03 AM
1 Karma
You'll need to use javascript if you're looking to use icons without rangemaps. Below you'll find a segment of my code that is placing icons in a table. Instead of a rangemap you'll see that this is choosing the icon based on conditionals and the cell value itself.
Go here if you have never used javascript with dashboards before. My code is expanding upon these concepts.
var CustomRangeRenderer = TableView.BaseCellRenderer.extend({
canRender: function(cell)
{
return _(['SLA']).contains(cell.field);
},
render: function($td, cell) {
var template_settings="";
console.log("cell: ", cell);
if (cell.field === 'SLA') {
var value = cell.value;
if( value == '-1') {
$td.addClass('nopadding').addClass('range-cell').addClass('range-na');
// $td.text(value);
$td.text('N/A');
var msg='No Response Time SLA defined for this transaction.';
template_settings = '<div class="data-box" data-toggle="tooltip" data-placement="left" title="'+msg+'"><div class="sla-good" style="background-color:#222222; width:100%"></div></div>';
}
else if ( value == '0') {
$td.addClass('nopadding');
var msg='Transactions failed response time SLA as defined in terms of 90th percentile';
template_settings = '<i class="icon-alert-circle" title="Failed"></i>';
}
else {
$td.addClass('nopadding');
var msg='Transactions passed response time SLA as defined in terms of 90th percentile';
template_settings = '<i class="icon-check-circle" title="Passed"></i>';
}
}
$td.html(_.template(template_settings));
//$td.children('[data-toggle="tooltip"]').tooltip();
}
});
... View more
09-04-2015
11:41 AM
@demodav you can find my solution here:
https://github.com/ConnorRules/Dynatrace-Plugin-Splunk-Forwarder/blob/master/src/com/compuware/SplunkForwarder.java
The parts you'll want to look at in particular are:
line 106 - setting up the login arguments
line 113 - creating a service instance that is connected to the splunk server
line 184 - getting the output stream to a specific index
line 214 - writing to that stream
Should be pretty self explanatory. Let me know if you have any questions.
... View more
08-13-2015
02:17 PM
Hey Woodcock,
I'm using a similar syntax and noticed that this:
"timechart span=1w sum(a) AS sumA BY b | eval sumA=sumA/total"
works and this:
"timechart span=1w sum(a) AS sumA | eval sumA=sumA/total"
does not.
Is there any specific reason that this is the case? Hard coding a number in place of total works in all cases.
... View more
07-20-2015
01:31 PM
1 Karma
There's a few paragraphs in the documentation that may shed some light:
If you apply the collect command to events that do not have timestamps, it designates a time for all of the events using the earliest (or minimum) time of the search range. For example, if you use collect over the past four hours (range: -4h to +0h), it assigns a timestamp four hours previous to the time the search was launched to all of the events without a timestamp.
If you use collect with an all-time search and the events do not have timestamps, Splunk Enterprise uses the current system time for the timestamps.
... View more
07-15-2015
01:11 PM
1 Karma
What's the purpose of "index=* AND index=_*" ?
... View more
05-12-2015
01:50 PM
I have a similar compression percentage as ibondarets.
Guess that means our data is actually larger once indexed.
... View more
05-11-2015
02:08 PM
Check if the events are indexed under main. That way we know the data is coming through.
There's also more locations that inputs.confs can reside. Look into the etc\apps\ directory. Most of my forwarders use the Splunk_TA_windows app for a lot of my windows log monitoring.
... View more
05-08-2015
10:13 AM
There's some more info in this post here:
http://answers.splunk.com/answers/4162/size-limit-for-an-event.html
... View more
05-08-2015
08:48 AM
You're assumption is correct. So you're saying that the data in index1 can be searched faster?
This data is coming from a custom made script. If the trade off for larger file size is quicker results then I will leave the formatting as is. Otherwise if there were no pros to having the events formatted as such I would change it to be simpler.
Thanks for the heads up. Are there any reference docs available related to this?
... View more
05-08-2015
08:41 AM
I believe there is a character limit for events. So even if there were a handful of rogue events that still couldn't account for the tenfold size increase.
... View more
05-08-2015
08:39 AM
There are more field extractions occurring in the heavier events. So that could possibly be the case.
... View more
05-08-2015
08:11 AM
That is coming from the Indexes view in the Splunk Settings. "Current size in MB"
... View more
05-08-2015
08:05 AM
1 Karma
I have two indexes that contain different sets of events.
Index 1
Event Count – 23,952
Current Size – 19
Index 2
Event Count – 431,026
Current Size – 20
The size is the same, but the number of events is drastically different. This would make sense except that the events in both indexes are generally the same length. Any explanation for the difference in size here?
Index 1 - Event Example
{"time":"Fri Apr 03 17:57:08 CDT 2015","web_request_response_time":"0.45356011390686035","application":"node_count":"1","DataType":"PurepathData","state":"OK","cpu":"0.448837012052536","System Profile":"c_prodissue","breakdown":"CPU: 0.449 ms, Sync: -, Wait: -, Suspension: -","agent":"_JavaApp06_sin@sin:1547","root_path_thread_name":"http-apr-169.97.17.67-11000-exec-2","time":"Fri Apr 03 17:57:08 CDT 2015","response_time":"0.45356011390686035","execsum":"0.45356011390686035","name":"/SUI/monitoring","exec":"0.45361328125"}
{"time":"Fri Apr 03 17:57:03 CDT 2015","web_request_response_time":"0.5128860473632812","application":"applic","node_count":"1","DataType":"PurepathData","state":"OK","cpu":"0.5083289742469788","System Profile":"_uat_prodissue","breakdown":"CPU: 0.508 ms, Sync: -, Wait: -, Suspension: -","agent":"UAT_JavaApp05_sin@sin:28893","root_path_thread_name":"http-apr-169.97.17.62-11000-exec-17","time":"Fri Apr 03 17:57:03 CDT 2015","response_time":"0.5128860473632812","execsum":"0.5128860473632812","name":"/UI/monitoring","exec":"0.512939453125"}
Index 2 - Event Example
System_Profile=Monitoring #document dynatrace version=6.1.0.8054 systemprofile capture=true modifiedby=E745984 repositoryaccess=true incidentrules incidentrule flags=1 id=Host Disk Unhealthy incidentdashboardname=Incident Zero Conf Dashboard timeframe=10 actions actionref bundleversion=0.0.0 execution=begin key=com.dynatrace.diagnostics.plugins.EmailNotification refaction=com.dynatrace.diagnostics.plugins.EmailNotification rolekey=com.dynatrace.diagnostics.plugins.EmailNotificationAction roletype=1 severity=informational smartalert=false type=Email Notification property key=from typeid=string value=
System_Profile=Monitoring #document dynatrace version=6.1.0.8054 systemprofile capture=true modifiedby=E745984 repositoryaccess=true incidentrules incidentrule flags=1 id=Host Network Unhealthy incidentdashboardname=Incident Zero Conf Dashboard timeframe=10 actions actionref bundleversion=0.0.0 execution=begin key=com.dynatrace.diagnostics.plugins.EmailNotification refaction=com.dynatrace.diagnostics.plugins.EmailNotification rolekey=com.dynatrace.diagnostics.plugins.EmailNotificationAction roletype=1 severity=informational smartalert=false type=Email Notification property key=bcc typeid=string value=
... View more
