Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About fox
fox
Path Finder
Member since:
05-10-2010
06-05-2020
Community Statistics
| Posts | 33 |
| Solutions | 4 |
| Karma Given | 18 |
| Karma Received | 10 |
| Member Since | 05-10-2010 |
Activity Feed
- Got Karma for How do I remotely watch the Splunk conference live?. 06-05-2020 12:46 AM
- Got Karma for Re: How to associate related fields in different log files to form a statistic table. 06-05-2020 12:46 AM
- Got Karma for Re: How to associate related fields in different log files to form a statistic table. 06-05-2020 12:46 AM
- Karma Extract Timestamp from logs that don't contain any Year reference for lmeur. 06-05-2020 12:45 AM
- Karma Multiple Values per Event - transforms.conf regex for lohans. 06-05-2020 12:45 AM
- Karma Missing data - Splunk is showing random gaps in the 'indexed data' timeline and safeService warning in Splunkd.log for mctester. 06-05-2020 12:45 AM
- Karma Is it possible to use wildcards in sourcetype props.conf stanzas for Glenn. 06-05-2020 12:45 AM
- Karma Seeing recurring error "Timeliner - Failed to rm dir" even though permissions are correct... for tmeader. 06-05-2020 12:45 AM
- Karma Change Logo on Login Screen for wildbill4. 06-05-2020 12:45 AM
- Karma Need simple search help for jayrodef. 06-05-2020 12:45 AM
- Karma Programming business rules inside Splunk for fduprat. 06-05-2020 12:45 AM
- Karma Re: Extract Timestamp from logs that don't contain any Year reference for Ant1D. 06-05-2020 12:45 AM
- Karma Does combining startswith and maxspan in a transaction work? for chris. 06-05-2020 12:45 AM
- Karma Re: Multiple Sources on a single host for dwaddle. 06-05-2020 12:45 AM
- Karma Re: Is there a way to restore hot buckets? for Genti. 06-05-2020 12:45 AM
- Karma Is there a way to restore hot buckets? for Michael. 06-05-2020 12:45 AM
- Karma Increase chart image size for bsteelz93. 06-05-2020 12:45 AM
- Karma Re: What sort of regular expressions does splunk use? for ftk. 06-05-2020 12:45 AM
- Karma How do you override "source" on a oneshot? for Ron_Naken. 06-05-2020 12:45 AM
- Karma Re: How do I configure Splunk to filter out events I don’t want to index? for Mick. 06-05-2020 12:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 |
10-12-2012
05:56 AM
2 Karma
search log1 | join type=left b [search log2] | table a b c
... View more
10-12-2012
05:54 AM
a simple join query posted into a summery index for quick post processing...?
... View more
01-12-2012
09:26 AM
This can be resolved by restructuring the search. Simply add a stats command stage to help the timechart command on it's way. It fixes the issue.
... View more
09-13-2011
03:36 AM
Running 4.2.1, we are monitoring many csv files that differ on listed fields. We have splunk configured to dynamically read the header row for field names. (props.conf: CHECK_FOR_HEADER=TRUE) and this works brilliantly! However we are not seeing the events split correctly - splunk is indexing 256 rows to one event. This is a .csv file with a clear event new line separation...
Has anyone else done this successfully?
Any ideas?
... View more
- Tags:
- csv
09-13-2011
03:26 AM
Running 4.2.1 this can be enabled by removing any expired licenses via the Manager. Worked a treat.
... View more
07-06-2011
01:56 AM
Can I license pool with peers on splunk version 4.1?
... View more
- Tags:
- license
05-10-2011
02:02 AM
Is it possible to open up your filter or are there lots of files in this directory? I preferred your second approach, but with a more simple regex like .*log for example. You could also try the line in the input file: "crcSalt = <SOURCE>"
... View more
05-05-2011
03:27 AM
search earliest=-24h should do the trick - there is good documentation on this and other time commands in the search pdf file downloadable from the splunk website.
... View more
03-30-2011
12:52 PM
are you on Windows?
We have found some permissioning issues with Windows installations and have manually changed permissions on all sub directories and files...
... View more
03-29-2011
01:41 PM
1 Karma
index= | eval user_device=userid."_".deviceid | timechart span=1h count by user_device
... View more
03-23-2011
10:04 AM
1 Karma
here's some advanced xml that works well for sizing, you could also try specifying 100% rather than pxs
<param name="savedSearch">20.2 Farm errors by asset</param>
<module name="TimeRangePicker">
<param name="searchWhenChanged">True</param>
<param name="default">Last 24 hours</param>
<module name="HiddenChartFormatter">
<param name="charting.chart">pie</param>
<module name="EnablePreview">
<param name="enable">True</param>
<param name="display">False</param>
<module name="JobStatus" />
<module name="FlashChart">
<param name="width">100%</param>
<param name="height">400px</param>
</module>
<module name="ViewRedirectorLink">
<param name="viewTarget">flashtimeline</param>
<param name="popup">True</param>
</module>
</module>
</module>
</module>
</module>
... View more
03-22-2011
11:10 PM
Does the startswith value work better if you use an eventtype? Rather than a search string?
... View more
03-22-2011
02:36 PM
Don't think that this is possible, however one work around would be to fire the results of all required searches into a summary index and then place one results search to email directly from the summary index.
... View more
03-22-2011
02:21 PM
1 Karma
try this:
index=..... search | timechart limit=0 count by source....
this will include all and bucket the 11th onwards into OTHER.
or if you still want to take advantage of the OTHER bucket but increase visibility:
index=..... search | timechart limit=40 count by source....
by default limit is set to 10 (however this can also be adjusted in a system conf file.)
... View more
03-22-2011
02:14 PM
sounds like a long time, however it is hard to compare as it all depends on your hardware and any concurrent processes running...
tips for speed: always explicitly name the index first and then any other known filters such as sourcetype and source. then reduce the to only the fields that you need (...|fields + ....) this reduces the work load for following piped operations. Then i would build the search up incrementally to see if any one operation is the beast.
If you still need to improve - you may want to consider adding a metadata extracted field at index time...
... View more
03-22-2011
02:07 PM
It seems for now that there is no way of disconnecting the TZ from a timestamp. I have effectively designed the architecture to resolve this issue. There will be a different instant of the application per region and timestamps will be indexed with the correct TZ to allow future scalability...
... View more
03-22-2011
09:40 AM
Re your alert results... I am not sure how you are deleting the warnings? The best way to run it is to run the search for the alert every 10 mins and make the search look back over 11 minutes (to be on the safe side) -11m . Now you will only see an alert for a warning that happened in the last 10 minutes and if you then enter a new file without errors, the alert will not return any results...
hope this helps
... View more
03-22-2011
09:32 AM
if this works try this:
index=main (ERROR OR WARNING) | timechart count by source
Then select the 'show report' icon.
This will give you the number of ERRORS OR WARNINGS over time per file, so that you can see the bad files from the good...
... View more
03-22-2011
09:28 AM
...this is assuming that you have used the default index, which is called main. If not just substitute 'main' for the name of your index.
... View more
03-22-2011
09:26 AM
try this in your search text box to see all lines/events with the word ERROR OR WARNING in:
index=main (ERROR OR WARNING)
... View more
