About peterkn

peterkn · ‎06-17-2020

You're an absolute champion. Due to the nature of the data in the file I'm not legally allowed to share it's content unfortunately. For those who are interested, instead of modifying/creating props.conf, I changed the timestamp setting from when adding a new file to an index (Settings>Add Data>Upload), select the sourcetype (csv in my case), under Source Type there is a dropdown for Timestamp, my defaulted to "Automatic" so I changed it to "Current", upon clicking "Next" it will ask me to save, select yes, overwrite. This setting will apply to all input monitors, please make sure you restart Splunk. Thanks again @rnowitzki

peterkn · ‎06-16-2020

Hi, I have a data input (Directory Monitor) for /opt/splunk/data/test Everyday a new csv file is copy pasted in this directory, and Splunk would start indexing them. However all rows in this csv file are indexed with different timestamp (_time) values. Eg the file has 3382 events indexed, but doing a index=caseload host=XXXX source="/opt/splunk/data/test/testfile.csv" | stats count by _time would yield something like _time count 2015-04-17 04:56:49 22 2016-01-08 19:51:49 33 2016-01-18 12:20:09 11 2016-02-07 21:15:09 18 shouldn't it be all current time which is "2020-06-17 10:10:10" for instance, instead of various different timestamps, I'm thinking it is trying to find some value per row that represents a timestamp and parse it, but I don't even see any "2015-04-17" in those 22 rows. How do I make all the Directory Monitors to index each event using current timestamp?

peterkn · ‎04-06-2020

I have followed up until I checked my cert and it is still valid: [root@splunk auth]# openssl x509 -enddate -noout -in ./server.pem notAfter=Apr 6 10:27:22 2023 GMT Both checks failed /opt/splunk/bin/splunk _internal call /services/server/info |grep -i kvstore <s:key name="kvStoreStatus">failed</s:key> /opt/splunk/bin/splunk search "| rest /services/server/info splunk_server=* | fields splunk_server, kvStoreStatus" splunk_server kvStoreStatus -------------------------------- ------------- splunk.****.com failed Any help is greatly appreciated ....

peterkn · ‎04-06-2020

I've tried this method, as well as the link below but without luck https://answers.splunk.com/answers/655729/kv-store-errors-kv-store-changed-status-to-failed-1.html Any help would be eternally appreciated ...

peterkn · ‎07-19-2018

Hi, Is there an easy way to have a "temporary memory" that stores some variables when a query runs, and after each run it updates these variables so we can present these to the end users? An example might be the total number of users per month, and the total number of users per year. Instead of searching for users per month, we can check these "temporary" variables to update the total count, which would save a lot of resoures and load time on the end user. Any help is appreciated.

peterkn · ‎01-19-2016

Basically I would like to save/store the result to Splunk so that I can use it at a later time for other purposes Let's assume that I have the following table: Let's say we are in December 15, if we look at the column December 2015, we can see that it is missing a value because we are in Dec-15, so the results are not available yet. Let's jump through time and pretend that we are now in January and the value is calculated as "2". This number "2" is calculated based on user input of December 15. I would like to "freeze off" this number and remove the calculation so that this number stays the same as time goes on. An approach I thought of is to save this number to Splunk somehow (I have not figured this out yet). Another approach is to save the user input at the time the user types in, and the calculation will be based on this user input for that particular month. Any help/suggestion is greatly appreciated.

peterkn · ‎01-19-2016

On the same issue, I did use your approach and it works, so thanks. How do I use Predict for more than 1 column. Say I have another column called "Number of jobs available" or "Unemployment Rate", how do I predict these columns as well? Do I have to manually write the predict clause for each of the column? As I have about 10 columns I need to use the Predict function for.

peterkn · ‎01-18-2016

I have looked at the predict cause and the "x11", however, I'm still struggling to find the right searcg to get the data I want. Say I have 2 columns Report_Date Population 11/01/2015 122 22/02/2015 125 09/04/2015 141 14/05/2015 155 I would like to use the predict command to get the population at X date (say 01/01/2016). What should my search be? Any help is greatly appreciated.

peterkn · ‎01-10-2016

It does help me get to compare the dates, especially with the max(dt) as latest . Many thanks.

peterkn · ‎01-05-2016

I need to do calculations on fields where the Date is 3 years ago. However, there is a twist. I need to find this field where it was 3 years ago, and then minus the same field, but 3 years and 1 month ago. Let's assume we have 2 fields with the following data REPORT_DATE POPULATION 11/12/2012 200 29/12/2012 195 2/01/2013 190 30/1/2013 215 5/02/2013 222 11/02/2013 230 28/02/2013 235 26/03/2013 240 I would like to calculate the numbers dropping off which is the population of today's date, but 3 years ago minus today's date day, but 3 years and 1 month ago. Let's say today's date is the 6th of January 2016. The number dropping off for January 2016 is the Population that was 3 years ago (30/1/2013) takes the population of 3 years one month ago (29/12/2012), so 215 - 195 = 20. Please notice that for each month there could be 1,2 or even 3 REPORT_DATE values, we just want to take the latest date of that month (say for December 2012, we get the 29/12/2012 instead of the 11/12/2012). We do the same calculation for February and March. So the result would be Jan Feb Mar -5 7 5 I have managed to get the current date 3 years ago, but I'm struggling to get the value of the latest day of that date 3 years ago (29 instead of 11 for example) and perform the calculation. Any help is greatly appreciated.

peterkn · ‎11-26-2015

Say in table A I have just 1 column result: Animal: Chicken Chicken Cow Cat Cow Cow Dog My query of "stats count by Animal" Would return me with: Chicken 2 Cow 3 Cat 1 Dog 1 Now I have table B Animal Name Age: Cat Mick 3 Cat Dog Mike 1 Dog Moose I would like to join the results to make a multi-column bar graph (or a stacked bar graph) with the following result (Animal,Animal Count, Has_name, Has Age) Cow 3 X Y, Cat 1 X Y, Dog 1 X Y where X is the number of the respective animal instance that appear in table B with a Name specified. Y is with an Age specified So the final table would be Cow 3 0 0, Cat 1 1 1, Dog 1 2 1 and as a result, the multi-column graph would have 3 grouped columns of Cow, Cat and Dog. Any suggestion/help is greatly appreciated.

peterkn · ‎10-01-2015

For instance, I have ALL, PROG_A and PROG_B as the available choices for the field Program. How can I make it display as ALL, Function_A and Function_B instead?

peterkn · ‎10-01-2015

I would like to give user access to a number of specified Dashboard only. Example: user A and B can only see Dashboard 1, 3 User C can only see Dashboard 5. Any help is appreciated.

peterkn · ‎07-27-2015

I have Splunk Enterprise deployed on an Amazon EC2 instance. When I enable Splunk Web, I get this error: "The minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch." How do I change the minimum free disk space?

peterkn · ‎07-20-2015

Thank you for your help. Will do. Cheers.

peterkn · ‎07-15-2015

I'm quite new to Splunk and I have been looking for different resources to help me getting a better understanding of it. I have got Splunk Enterprise deployed on an AWS Amazon server. I have got a dashboard set up with multiple queries to display different graphs with drop-down menu. My biggest question is to have the dashboard displayed as a webpage (html) where a user can log in, look at different graphs(one user can see graph A while another can see graph B), select different search fields. I could have Python as the back-end code to manage the log-in validation, display different fields. If anyone could point me to the right direction I'd be greatly appreciated.

Posts	16
Solutions	0
Karma Given	6
Karma Received	0
Member Since	‎07-15-2015

Online Status	Offline
Date Last Visited	‎10-07-2021 12:17 AM

Different timestamp values for the same file index...

Temporary Memory

How to save results for later use.

How to write a search to get a predicted value bas...

How to perform calculation on a field with a date ...

Joining 3 sets of results from 2 indexes to graph

How to make an alias for different options in Mult...

How to specify which users can see which dashboard...

How to change the free disk space limit of Splunk ...

How to make Splunk Enterprise a web-based instance...

Re: Different timestamp values for the same file i...

Different timestamp values for the same file index...

Re: After upgrading to 6.5.0, KV Store will not st...

Re: How to resolve issues with mongod startup such...