About faguilar

faguilar · ‎12-02-2020

Hi! I had to move on using (0,0), sorry I couldn't help

faguilar · ‎12-12-2019

Hi Splunkers! Some days ago, one of my colleagues told me that "if you want to delete duplicates on your search, using a stats count by yourfield is more efficient than using dedup yourfield because it has better performance since stats doesn't have to compare ALL the elements of the search while dedup does", but he didn't give me to me any demonstration about it. Is that true? I've been digging for days on the internet, but I can't find an official answer, just some good argumented approaches: https://antipaucity.com/2018/03/08/more-thoughts-on-stats-vs-dedup-in-splunk/#.XfJoU-hKiUk https://www.reddit.com/r/Splunk/comments/91nqsc/more_thoughts_on_stats_vs_dedup_in_splunk/ Somebody even says here that stats dc(yourfield) it's even faster than a simple stats : https://answers.splunk.com/answers/483100/is-there-a-performance-impact-by-using-dedup-comma.html For me it makes completely sense, because it's easier to count (or distinct count) just elements by one unique field than check if that same element exists within ALL the data sets. So, what do you guys think? Is there any REAL performance improvement in using stats over using dedup ? Is there any official answer about this question? I'm just looking for improve my queries the best as I can. Thank you all!!

faguilar · ‎05-21-2019

Thank you @koshyk!!! Sorry I didn't saw the answer

faguilar · ‎05-21-2019

Hi @scottprigge I have the same issue here with a JSON payload, but I couldn't figure out how to extract the data on the JSON field to make the data search. Can you show me how you manage to get the data of the JSON payload within the props? one of my events: 05/18/2019 00:00:00 +0200, info_search_time=1558442780.272, application=axo, createDate="01/01/2019", description=mydesc, id=123456789, results="{\"results\":{\"myDate\":\"27/04/2019\",\"myId\":\"3215AAA_24369\",\"myClientId\":\"12345\",\"myType\":\"Total\"}}" My props.conf for this sourcetype: [extract_json] REGEX = \"(?<field>[^\"]+)\":\"(?<value>[^\"]+) FORMAT= "$1"::"$2" WRITE_META = true I couldn't make this thing work. Thank you!!

faguilar · ‎03-14-2019

Hi, @mvonal, This answer is wrong. In fact, if you go to https://crontab.guru/#0_5_*_*_7, it says "Non standard! May not work with every cron." From the Splunk documentation: https://docs.splunk.com/Documentation/Splunk/7.2.4/Alert/CronExpressions Your cron schedule for sunday, has to be like this: 0 5 * * 0 if you put a 7 on the day, splunk will go crazy, and it will repeat the alert in an infinite loop. I tell you this because I have just had this exact same problem. Sunday is 0 on the cron schedule

faguilar · ‎02-26-2019

Hi fellow Splunkers! I have a question about editing/customizing the Splunk manager menus for web editing my app files. I have my working app which includes this structure (two sql queries that I will execute within the folder myapp/bin/SQL like so: + bin .| -- + SQL .| --- | - query1.sql .| --- | - query2.sql My question is, if there is a simple and easy way of make a text editor for qyery1.sql and query2.sql from Splunk's web UI, using the Splunk's config files/xml as "parent". Like you normally modify your savedsearches using the web editor. So, in summary, I will have two screens/xml pages: - The first one, where I can see the list of available files in /myapp/bin/SQL like so: And the second one where I can modify and save any of those files, like if they where savedsearches: So I will be able to change the queries via Splunk Web just as I can modify the savedsearches. I just need an xml for listing the files and another one with a textfield editor and a save button. I can move the .sql files to other folder if necessary. I spent two days searching for some examples but I couldn't find any. Do you have any ideas or examples that I can use as a base? My main goal is to make it simple and as if it was a Splunk default configuration file. Thank you very much!

faguilar · ‎01-16-2019

Hi, I know this is an old question, but I got the same issue and this is how I solved it: First, you have to create the file authorize.conf on /detault (or /local folders), having this content: > [capability::run_script_samplePython] > > [role_admin] > run_script_samplePython=enabled Then, you can execute the command | samplePython , but be shure you are working within the search of your app. If you want to execute the command with global permissions, you'll need to change the permissions of your app (since the app access is not allowed for global execution by default). Hope it helps.

faguilar · ‎07-05-2018

Hi, I'm having some trouble with the Django inheritance on my test/production environment Splunk instances. I'm using Splunk 6.3.1 with a 3 SHs cluster architecture. I have a base_app defined with all the styles and dashboards, and my_app which inherits some of the code of the base_app. Within django/base_app/templates/configuration_panels i have an html with a table, called riesgo.html, which draws a table with background colors. I have the same structure in django/my_app/templates/configuration_panels with the file riesgo.html too wich draws a table without background colors. The problem here and the weird thing is that, having the same files (for both the base_app and my_app) in the testing environment and in production, Splunk is drawing the my_app/riesgo.html (one without background colors) file. And, with THE SAME files in production, Splunk is, however, drawing the base_app/riesgo.html (the one with background colors) file. My question here is: why is happening that? Is there an explicit way to tell Splunk's Django to use the son's file instead of the parent's? I don't understand why, if I'm uploading THE SAME repository in test and pro, in test uses the "good" file and in pro uses the paren'ts base file. Thank you very much. Regards.

faguilar · ‎06-15-2018

Hi, I'm working with a distributed Splunk 6.3.1 architecture with: 1 SH 1 IDX 1 HF And since one day I'm receiving this error message (which is replicating each second on splunk.log): 06-15-2018 11:06:22.950 +0200 ERROR KVStorageProvider - An error occurred during the last operation ('createIndex', domain: '5', code: '10088'): exception: cannot index parallel arrays [area] [group] Since that day, none of my custom Splunk apps work because the mongo service is down, and I'm receiving this message when I execute an | inputlookup: Error in 'inputlookup' command: External command based lookup 'kvstore_mykvstore' is not available because KV Store initialization has failed. Please contact your system administrator. Does anybody knows what is happening here or where can I found more information about this problem? In splunk.log I'm only seeing the KVStorageProvider error, and I don't know where or how I can solve this. Thank you very much!

faguilar · ‎05-29-2018

Thanks for the answer @darrenfuller, but I already know how to do it like you suggest. I need to do it in a single line, using the transliteration like in sed mode y/.

faguilar · ‎05-28-2018

For my search of example data: | makeresults | eval data="Juán Pérez Dís Tópú", data1=data | rex field=data1 mode=sed "y/áéíóú/aaeeiioouu/" | table data* This is my output: data --------------------------- data1 Juán Pérez Dís Tópú ----- Juaan Paerez Dais Taopau And if i use the command | rex field=data1 mode=sed "y/áéíóú/aaeeiioouu/" the result is: Error in 'rex' command: Failed to initialize sed. 'áéíóú' and 'aeiou' are different length.

faguilar · ‎05-28-2018

Hi @mayurr98, Thank you for your answer, but maybe I expressed my problem on the wrong way. It's not a syntax problem and I do not need to make that simple substitution (which I already know how to do), that's why I said that I used the sed y/àéíóú/aeiou/ which works for my scenario on the linux terminal. I want to substitute those characters anywhere in the string, not in that exact order. Meaning that if I have the name José González that sed y/àéíóú/aeiou/ will substitute it prefectly, just á for an a, é for a é... and so on. My problem here is that in splunk, the sed mode doesn't seems to work as the linux sed command. I will upgrade my question to avoid any ambiguity

faguilar · ‎05-25-2018

Hi! Can somebody please explain me WTF is happening here? My question is quite simple. I want to substitute [áéíóú] for [aeiou], using one single rex (anywhere on the string, but making a direct match between á and a, é and é, and so on. Like "José Ramón González" will be "Jose Ramon Gonzalez" I already know how to do that with 5 regex and using a string replace. But I need to do that using one single rex (you can using sed without any problems). I found out that in sed mode, doing this: y/àéíóú/aeiou/ (transliteration in sed) you can do that perfectly (you can try sed y/àéíóú/aeiou/ on the linux terminal). However, the magic comes in Splunk. I have this Splunk regex: | rex mode=sed field=name2 "y/á/a/" And the result (in Splunk 6.3.1 and 7.1.1) is: Error in 'rex' command: Failed to initialize sed. 'á' and 'a' are different length. Ok... WTF!? Hoever I decided to try something like this: | rex mode=sed field=name2 "y/á/aa/" And the result is this one: WTF!?? I think is a encoding thing (UTF-8 to UTF-16) but I don't know how to solve this. Can somebody please help me? Is there a way to explicitlly tell splunk the encoding I'm using and I want to use in the regex? I already have defined the extraction as UTF-8. Why does this works perfectly in linux, but not in Splunk?? As you can check here: http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/rex Splunk supports that /y sed subsitution. Thank you

faguilar · ‎05-25-2018

Thank you for the explanation, I will make the extraction later. Regards!

faguilar · ‎05-24-2018

Thank you for your answer @HiroshiSatoh, but I don't understand your explanation. On my props.conf I'm using the replace-blanks stanza to substitute those blanks by the characters "-----". I'm doing that at indexing time, and, as you can see on the screenshots, the data is being indexed with those characters (you can see that on the content of the _raw fields and also on the source data). However, eventhough the data is indexed with "----", splunk doesn't seem to recognize those characters and sees and uses those fields as empty values. Maybe is a bug for that version? I don't know how splunk behaves in more recent versions in this scenario

faguilar · ‎05-22-2018

Hi Splunkers! I have an issue with Splunk 6.3.1 and the indexed data from a CSV file. On my CSV file (separed by semicolons) y have some null fields, wich I don't want to index in Splunk as null, like so: NAME;SURNAME;ID;BIRTHPLACE;BIRTHDATE;COUNTRY;POSTCODE;ADDRESS NAME1;SURNAME1;ID1;;BIRTH1;;;ADDRESS1 NAME2;SURNAME2;ID2;;BIRTH2;;;ADDRESS2 NAME3;SURNAME3;ID3;;BIRTH3;;;ADDRESS3 NAME4;SURNAME4;ID4;;BIRTH4;;;ADDRESS4 So, I defined on my props.conf the following properties to avoid null values (and use null values like I want), like this: SEDCMD-replaceblanks=s/^(?=;)|(?<=;)(?=;|$)/-------/g I indexed my data, and y can show my data in the _raw and source data perfectly like this: But when I want to work with the data (make stats or concatenate strings), Splunk is telling me that the values are empty! Eventhough the values are stored with my custom data values!! I made a simply table to show the content and this is the result... As you can see, the values and the data are indexed perfectly but Splunk does not see it properly. Do you know why I'm having this trouble? Is this a bug? Thank you very much!

faguilar · ‎03-26-2018

Thank you very much John. This first approach using multivalue fields on the wordlist: | fields name,blacklist_name | makemv delim="," blacklist_name | mvexpand blacklist_name | fuzzy wordlist=name compare_field=blacklist_name Was the one I was using, but I have a lot of fields so the query is quite heavy, that's why I asked you about a more efficient way of doing this. But I understand better now how the fuzzy search works and thank you again for your answer, I'll check if maybe I can execute that query as a savedsearch so it will be scheduled during the idle hours of my Splunk instance, so the impact on the overall performance is smaller.

faguilar · ‎03-23-2018

Btw John, is there an efficient way to check name1 -> blacklist_name1,blacklist_name2...blacklist_nameN, name2 -> blacklist_name1,blacklist_name2...blacklist_nameN, ... nameN -> blacklist_name1,blacklist_name2...blacklist_nameN, and so on? That's what I really need, to check each one of the names' values in the name field with all the names in the blacklist_name field, one at a time Thanks!

faguilar · ‎03-23-2018

Thank you very much John! I'll check it out on my Splunk instance and I'll tell you if it works as expected! 🙂

faguilar · ‎03-22-2018

Hi, I'm using the fuzzy search app for Splunk (https://splunkbase.splunk.com/app/3109/) on my splunk 6.3.1 instance and I need to make a similar match between names. I have this table: name blacklist_name ------------------------- name1 blacklist_name1 name2 blacklist_name2 name3 blacklist_name3 name4 blacklist_name4 name5 blacklist_name5 ... ... And I'm using this fuzzy search SPL: ... | table name blacklist_name | fuzzy wordlist=name type=simple compare_field=blacklist_name output_prefix="fuzz" delims="(\\\\)" | table name target_name fuzz* The thing is, using that query, the fuzzy search is comparing just by the string "name" instead of each of the values of that field (name1, name2 ... nameN). Is there a way to tell the search that the "wordlist" are all the values of the "name" field? Do you know another way of doing this match? I'm looking for similar name values' on my blacklist for all the values on the name field. Thank you very much! Regards

faguilar · ‎01-19-2018

Hi Splunkers! I'm having trouble with the Splunk JMX App. I used to work with version 3.0.2 but I needed to make an update to the current version 3.1.0 due to my clients' needs. The thing is that, I had a lot of dashboards using tags for the values of the previous 3.0.2 version for the field source, like: source=service:jmx:rmi://myhost1/jndi/rmi://myhost1:port/jmxrmi source=service:jmx:rmi://myhost2/jndi/rmi://myhost2:port/jmxrmi And, since the update, as pointed out here: http://docs.splunk.com/Documentation/AddOns/released/JMX/Releasehistory#New_Features, now the source field from JMX connection string (e.g., service:jmx:rmi:///jindi/rmi://127.0.0.1:8888/jmxrmi) has changed to to JMX MBean ObjectName (e.g., kafka.server.ReplicaManager.UnderReplicatedPartitions). So, now, my source fields are like this: source=java.lang:type=Memory source=java.lang:type=OperatingSystem And my dashboards doesn't show info anymore, since I'm using the tags for that previous values of source, like "Area1" for myhost2, "Area2" for myhost2 and so on. I need to recover this, because there are like A LOT of monitoring info from A LOT of computers. So, my main question here is: Is there a way to "recover" in the current 3.1.0 version, the values of the source field like in the previous 3.0.2 version?? Or maybe there are still there but in another java bean or property and I need to configure de JMX sourcetype to take those values in the xml conf?? Is this possible or is a matter of the app and the development and it can't be changed anymore?? Thank you very much!

faguilar · ‎11-21-2017

@niketnilay, it looks like the preformance is better with <done> than with <progress> so i think I'll be using that. And I will dig deeper onto this issue, checking the job inspector, I'll update if I find something. I'm marking your answer as correct, because I think is the best approach I can obtain. Again, thank you very much for your help!

faguilar · ‎11-21-2017

Hi @niketnilay and thank you again for your help! I followed all the steps you told me and it looks like the behaviour is the same: the panel stays in blank, and it loads properly after digging into the dashboard's source. I was thinking about maybe it was a problem of the browser (I'm using Google Chrome). But I checked with Firefox and Edge and the behaviour is the same. However, I just discovered something weird by accident. When I hit the dashboard to open the drilldown, if I wait like, 10 seconds without open the new tab, after that time, it looks like the panel loads correctly! Really, this is driving me crazy, becuase I don't know where "the problem" (if any) is, and how to solve it. Could you check in your local instance for this same behaviour? Thank you very much! Regards

faguilar · ‎11-20-2017

Hi @niketnilay, and thank you again for your support. I've tried all the steps you told me, but unfortunately, it still doesn't work... The same problem again, the first time the panel is shown in blank, it only loads the map after going into the dashboard source. I've tried to access using Firefox and Edge instead of Chrome, but the behavior is the same. Could you check it in your own Splunk instance? Because I don't know what else to do... ;( And I'm thinking that maybe this is a Splunk bug... Thank you again! Best regards

faguilar · ‎11-20-2017

Hi @niketnilay , thank you very much for your answer. None of your two approaches ( <done> nor <progress> ) worked for me. The behaviour of the dashboard is the same with both of them. The first time, it shows a blank panel, but it loads the map when I hit edit > source > cancel. Can you check out in your splunk instance for the same behaviour? The data I'm using is the one for the Splunk tutorial, I just changed the index's name. I was thinking, maybe it has something to do with the order of the map option's definitions? Mine are these: <title>Geolocalizacion de la IP $ip_src$</title> <search> <query>index="fomento" sourcetype=secure failed ip_src=$ip_src$ | iplocation ip_src | geostats count by ip_src</query> <earliest>1509922800</earliest> <latest>1510743600</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <option name="mapping.choroplethLayer.colorBins">5</option> <option name="mapping.choroplethLayer.colorMode">auto</option> <option name="mapping.choroplethLayer.maximumColor">0xDB5800</option> <option name="mapping.choroplethLayer.minimumColor">0x2F25BA</option> <option name="mapping.choroplethLayer.neutralPoint">0</option> <option name="mapping.choroplethLayer.shapeOpacity">0.75</option> <option name="mapping.choroplethLayer.showBorder">1</option> <option name="mapping.data.maxClusters">100</option> <option name="mapping.legend.placement">bottomright</option> <option name="mapping.map.center">($lat$, $lon$)</option> <option name="mapping.map.panning">1</option> <option name="mapping.map.scrollZoom">1</option> <option name="mapping.map.zoom">7</option> <option name="mapping.markerLayer.markerMaxSize">50</option> <option name="mapping.markerLayer.markerMinSize">10</option> <option name="mapping.markerLayer.markerOpacity">0.8</option> <option name="mapping.showTiles">1</option> <option name="mapping.tileLayer.maxZoom">7</option> <option name="mapping.tileLayer.minZoom">0</option> <option name="mapping.tileLayer.tileOpacity">1</option> <option name="mapping.type">marker</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </map> Thank you again!

Posts	27
Solutions	1
Karma Given	17
Karma Received	8
Member Since	‎11-17-2017

Online Status	Offline
Date Last Visited	‎10-30-2022 04:22 PM

Dedup vs. Stats performance

Custom manager menu to edit files from the UI

Template inheritance in Splunk Django not working ...

ERROR KVStorageProvider - Operation createIndex - ...

rex sed strings different length

Indexed events from CSV with NULL values not shown

How can I do a search on two fields in Fuzzy Searc...

Java JMX MBean ObjectName

Cluster Map: Problem with Zoom & Center in Dashboa...

Hide App Dropdown list menu just for one user

Re: Cluster Map: Problem with Zoom & Center in Das...

Dedup vs. Stats performance

Re: Extract JSON fields in mixed data structure wi...

Re: Extract JSON fields in mixed data structure wi...

Re: how to schedule an alert every Sunday at 5am?

Custom manager menu to edit files from the UI

Re: Script command : Error in 'script' command: Th...

Template inheritance in Splunk Django not working ...

ERROR KVStorageProvider - Operation createIndex - ...

Re: rex sed strings different length

Re: rex sed strings different length

Re: rex sed strings different length

rex sed strings different length

Re: Indexed events from CSV with NULL values not s...

Re: Indexed events from CSV with NULL values not s...

Indexed events from CSV with NULL values not shown

Re: How can I do a search on two fields in Fuzzy S...

Re: How can I do a search on two fields in Fuzzy S...

Re: How can I do a search on two fields in Fuzzy S...

How can I do a search on two fields in Fuzzy Searc...

Java JMX MBean ObjectName

Re: Cluster Map: Problem with Zoom & Center in Das...

Re: Cluster Map: Problem with Zoom & Center in Das...

Re: Cluster Map: Problem with Zoom & Center in Das...

Re: Cluster Map: Problem with Zoom & Center in Das...