About pde

pde · ‎10-20-2010

Makes sense. Thanks!

pde · ‎10-20-2010

I have a configuration with two lookups on the same source of data. One lookup associates a numeric field, AccountID, with a two letter CHAINCODE. The second lookup associates the CHAINCODE with a CHAINNAME, which is a string of arbitrary length. I then have a search that looks like this: host=*prod* sourcetype="statslog" getsingleavailability | chart count, avg(exec_time) as avg_exec by CHAINNAME | eval round_exec=round(avg_exec) | fields CHAINNAME, count, round_exec | sort - round_exec | rename ACCT_NAME as Hotel, round_exec as "Average Avail Response Time (ms)", count as Transactions, CHAINNAME as Chain When I run this search from the toolbar or as a saved search, realtime results are displayed as expected. If I add a panel containing this realtime saved search to a simple dashboard, the results panel never gets past "Waiting for search preview results". If I modify the search so it charts by CHAINCODE (from the first lookup) instead of CHANNAME (from the second), results do get displayed in the realtime dashboard view. Any clues?

pde · ‎10-05-2010

For monitoring & troubleshooting mapreduce jobs and for monitoring/troubleshooting of hadoop clusters overall. My thinking is around a Hadoop app that would compliment and augment hadoop/ganglia.

pde · ‎10-05-2010

I'd be interested in talking about saved searches, etc around hadoop logs. Anybody got a head start? Thanks!

pde · ‎09-27-2010

I have the following: <module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True"> <param name="search">source="*stats.log" host="*prod*"</param> <param name="earliest">rt-60m</param> <param name="latest">rt</param> <module name="HiddenPostProcess" layoutPanel="panel_row1_col1_grp1" group="Look to Book Ratio"> <param name="search">search transactionType="*" | streamstats count(eval(transactionType LIKE "%LSRQ")) as look count(eval(transactionType LIKE "BOOKRQSS%")) as book | eval lookbook=round(look/book) | rangemap field=lookbook severe=1001-100000 elevated=501-1000 low=0-500</param> <module name="SingleValue"> <param name="field">lookbook</param> <param name="afterLabel">:1</param> <param name="classField">range</param> </module> </module> </module> I've read several answers here about the idiosyncrasies of using search in HiddenPostProcess modules, but still can't work out why I keep getting "Invalid field" in my SingleValue pane. What have I missed? As an aside: the group="Look to Book Ratio" never seems to produce a label on the panel in column 1, but always does for column 2 and column 3. Weird. Thanks

pde · ‎09-22-2010

Even better: http://answers.splunk.com/questions/6152/is-there-a-solaris-smf-manifest-for-splunk

pde · ‎09-20-2010

I too am confused by this, and had prepped a similar question to ask today. viz: splunk search "index=_internal group=per_source_thruput startdaysago=7 | search series!=_audit | search series!=_internal| eval mb=kb/1024 | timechart span=24h sum(mb)" _time sum(mb) --------------------------- ---------------- 2010-09-13 00:00:00.000 UTC 14809.2371215655 2010-09-14 00:00:00.000 UTC 29875.8677501412 2010-09-15 00:00:00.000 UTC 27406.2832803688 2010-09-16 00:00:00.000 UTC 24142.7509880746 2010-09-17 00:00:00.000 UTC 17106.6712883842 2010-09-18 00:00:00.000 UTC 12746.2103596422 2010-09-19 00:00:00.000 UTC 11789.9047690882 2010-09-20 00:00:00.000 UTC 7635.3662614736 splunk search "index=_internal group=per_host_thruput startdaysago=7 | search series!=_audit | search series!=_internal| eval mb=kb/1024 | timechart span=24h sum(mb)" _time sum(mb) --------------------------- ---------------- 2010-09-13 00:00:00.000 UTC 21261.2567443395 2010-09-14 00:00:00.000 UTC 43388.2257661322 2010-09-15 00:00:00.000 UTC 39761.4269084810 2010-09-16 00:00:00.000 UTC 36302.4305372761 2010-09-17 00:00:00.000 UTC 21945.8210183508 2010-09-18 00:00:00.000 UTC 15710.3877687852 2010-09-19 00:00:00.000 UTC 14434.0866328664 2010-09-20 00:00:00.000 UTC 9864.3470373860 splunk search "index=_internal group=per_index_thruput startdaysago=7 | search series!=_audit | search series!=_internal| eval mb=kb/1024 | timechart span=24h sum(mb)" _time sum(mb) --------------------------- ---------------- 2010-09-13 00:00:00.000 UTC 21597.3036532481 2010-09-14 00:00:00.000 UTC 43716.7592166314 2010-09-15 00:00:00.000 UTC 40024.8323074539 2010-09-16 00:00:00.000 UTC 36338.9201157089 2010-09-17 00:00:00.000 UTC 22110.1538692767 2010-09-18 00:00:00.000 UTC 15788.8380199687 2010-09-19 00:00:00.000 UTC 14401.9610850464 2010-09-20 00:00:00.000 UTC 9783.0207494820 splunk search "index=_internal source=*license_audit.log startdaysago=7 | eval mb=todaysBytesIndexed/1024/1024 | timechart span=24h sum(mb)" _time sum(mb) --------------------------- ------------ 2010-09-13 00:00:00.000 UTC 2010-09-14 00:00:00.000 UTC 43975.131533 2010-09-15 00:00:00.000 UTC 43700.125997 2010-09-16 00:00:00.000 UTC 40018.480144 2010-09-17 00:00:00.000 UTC 36322.960874 2010-09-18 00:00:00.000 UTC 22099.668832 2010-09-19 00:00:00.000 UTC 15779.367283 2010-09-20 00:00:00.000 UTC 14394.497048 How can there be so much variation among these results?

pde · ‎09-17-2010

Interesting. The main UI displays the full event... The solution works, but is of little use to my users, who do not get shell access to the server. I suppose an enhancement is in order.

pde · ‎09-13-2010

I have records that consist of fairly large (200+ lines, > 20 Kb per record) XML documents. When I export the results of a search for these records to CSV, the _raw cell is truncated; the full record is not written to the _raw cell (note: not an Excel issue. The records are not larger than the 32K-1 byte Excel maximum, and editing the CSV directly shows that the record is indeed truncated). The records are similarly truncated in a "Show Source" view. What gives? Thanks -Pete

pde · ‎09-01-2010

Ah, jeeze, a lookup table. I should have thought of that. Thank you!

pde · ‎09-01-2010

I have a small DTrace app that monitors ARP requests and replies, producing output like this: 2010 Sep 1 03:10:08 [type=Reply][senderMAC=0:3:ba:d1:1e:17][senderIP=1.2.3.4][targetMAC=0:1:d7:3b:55:44][targetIP=1.2.3.5] I'm interested in knowing if any (senderMAC, senderIP) pair differs from previously seen instances over some period of time, in roughly the way that arpwatch would alert me of a change. Can't quite work out a strategy for this in Splunk. Any help?

pde · ‎08-27-2010

Why sure! This manifest runs splunk on solaris systems, as the user 'splunk', and grants it the net_privaddr (allowing it to bind to ports < 1024) and file_dac_read (allowing it to read any file on the system) privileges. <?xml version='1.0'?> <!DOCTYPE service_bundle SYSTEM '/usr/share/lib/xml/dtd/service_bundle.dtd.1'> <service_bundle type='manifest' name='export'> <service name='site/splunk' type='service' version='0'> <create_default_instance enabled='false'/> <single_instance/> <dependency name='fs-local' grouping='require_all' restart_on='none' type='service'> <service_fmri value='svc:/system/filesystem/local'/> </dependency> <dependency name='splunk_multi-user' grouping='require_all' restart_on='none' type='service'> <service_fmri value='svc:/milestone/multi-user'/> </dependency> <dependency name='splunk_network' grouping='require_all' restart_on='none' type='service'> <service_fmri value='svc:/milestone/network'/> </dependency> <dependency name='splunk-binary' grouping='require_all' restart_on='refresh' type='path'> <service_fmri value='file://localhost/opt/splunk/bin/splunk'/> </dependency> <dependency name='splunk-license' grouping='require_all' restart_on='refresh' type='path'> <service_fmri value='file://localhost/opt/splunk/etc/splunk.license'/> </dependency> <dependent name='splunk_multi-user-server' restart_on='none' grouping='optional_all'> <service_fmri value='svc:/milestone/multi-user-server'/> </dependent> <method_context project=':default' resource_pool=':default' working_directory=':default'> <method_credential group='splunk' limit_privileges=':default' privileges='basic,file_dac_read,net_privaddr' supp_groups=':default' user='splunk'/> <method_environment> <envvar name='HOME' value='/opt/splunk'/> </method_environment> </method_context> <exec_method name='start' type='method' exec='/opt/splunk/bin/splunk %m --accept-license' timeout_seconds='300'> <method_context/> </exec_method> <exec_method name='stop' type='method' exec='/opt/splunk/bin/splunk %m' timeout_seconds='300'> <method_context/> </exec_method> <exec_method name='refresh' type='method' exec='/opt/splunk/bin/splunk restart' timeout_seconds='600'> <method_context/> </exec_method> <stability value='Unstable'/> <template> <common_name> <loctext xml:lang='C'>splunk log server</loctext> </common_name> </template> </service> </service_bundle>

pde · ‎08-27-2010

Hey, Pete! You keep rambling about the SMF. Can we see your manifest?

pde · ‎08-27-2010

If you're lucky enough to be running Solaris, it's not the least hackish. Just start splunk via the SMF and add the net_privaddr privilege to your manifest: <method_credential group='splunk' limit_privileges=':default' privileges='basic,file_dac_read,net_privaddr' supp_groups=':default' user='splunk'/>

pde · ‎08-25-2010

I assume that your puppet manifest already knows when it's going to update splunk. If that's so, then just add service { splunk: ensure =>'stopped', } before you fetch your distribution file and do the pkgrm/pkgadd. One would think (though YMMV, I don't actually do this myself) that you could define a splunk package and have the splunk service subscribe to it, forcing a restart when the package is updated.

pde · ‎08-24-2010

preremove executes this: if [ -x $SPLUNK_HOME/bin/splunk ] ; then echo "Attempting to stop splunk." $SPLUNK_HOME/bin/splunk stop fi So you should be fine unless you've rolled your own SMF service, as I have. In that case, you'll need to tell puppet to disable the service before it removes the package, so the SMF doesn't attempt to restart splunk while it's being removed/reinstalled.

pde · ‎08-23-2010

Sure. What you're looking for is 'searchPostProcess'. The best way to understand this is to get the "UI Examples for 4.1" application from splunkbase. The specific technique you want is shown in the dashboard called "Using postProcess on Dashboards" under the "Advanced XML" tab.

pde · ‎08-20-2010

It's somewhat easier to convert wtmp to text using fwtmp, which is specifically designed for the purpose. On solaris, it's in /usr/lib/acct; on most linux systems, it's part of the acct (GNU account tools) package. fwtmp takes wtmp(x) on standard input and produces lines like this on stdout: pde sshd 12173 8 0000 0000 1282333385 148991 0 0 Fri Aug 20 19:43:05 2010 pde sshd 14663 7 0000 0000 1282340448 321800 0 39 adsl-68-92-27-201.dsl.rcsntx.swbell.net Fri Aug 20 21:40:48 2010 pde ts/7 pts/7 14667 7 0000 0000 1282340448 515234 0 39 adsl-68-92-27-201.dsl.rcsntx.swbell.net Fri Aug 20 21:40:48 2010 Since the wtmp format is well documented, it should be a fairly trivial exercise to extract the information you require from the text representation of the records.

pde · ‎08-18-2010

Ah, there we go. Thanks, Nick! So if I grok the example correctly, I use a series of HiddenSearch modules, and the searches have module-level locality, right?

pde · ‎08-18-2010

Or from inside splunk, go to the Launcher app; you'll find this app and the rest splunkbase in the "Browse more apps". If you're going to start working with the advanced XML, you'll find the RelaxNG schema handy. You can find it at http:// :8000/info

pde · ‎08-18-2010

I'd like to build a dashboard (or form, or view) that has three rows. Within each row are three SV panels. The SV panels in each row display three different fields from a single search, but the three rows represent three different searches. It seems that I can use a form with a searchTemplate and <searchPostProcess> elements in each SV panel on the first row, but the RelaxNG schemas for dashboard, form, and view do not seem to allow me to specify row-level searches to be leveraged by each panel in the row. As far as I can tell, my options are to end up with 7 total searches running on the page (highly suboptimal) or attempting to mash together the three (already fairly complex) searches into a single ginormous master search. Have I missed another way? Thanks

pde · ‎08-17-2010

Ah Hah. Stephen is correct, plus I was missing <option name="classField">range</option> in the definitions.

pde · ‎08-17-2010

That makes sense, Stephen, thanks. Apparently though I've failed some basic grok here, because we don't get colorized with this either: | stats max(book) as book | rangemap field=book default=severe low=0-500 Gross Bookings book | stats max(cancel)| rangemap field=max(cancel) default=severe low=0-500 Cancels max(cancel)

pde · ‎08-17-2010

I have the following view: <form> <label>Booking Data</label>  <searchTemplate>source="*rvngistats.log" host="*prod*" statsLogger.com.pegs.rvng.mdb.OTAMessageListener PAYLOAD transactionType="*" | stats count(eval(transactionType LIKE "%LSRQ")) as totalCount count(eval(transactionType LIKE "BOOKRQSS%")) as book count(eval(transactionType LIKE "BOOKRQXX%")) as cancel | eval look_book=round(totalCount/book) | eval net_book=book-cancel</searchTemplate> <fieldset> <input type="time" /> </fieldset> <row> <single> <searchPostProcess>| stats max(book)| rangemap field=book default=severe low=0-500</searchPostProcess> <title>Gross Bookings</title> <option name="field">max(book)</option> </single> <single> <searchPostProcess>| stats max(cancel)| rangemap field=cancel default=severe low=0-500</searchPostProcess> <title>Cancels</title> <option name="field">max(cancel)</option> </single> <single> <searchPostProcess>| stats max(net_book)| rangemap field=net_book default=severe low=0-500</searchPostProcess> <title>Net Bookings</title> <option name="field">max(net_book)</option> </single> </row> </form> The form works as expected; the SV panels get populated with the correct numbers for book, cancel, and net_book. However, the background on the SV buttons is always blue, no matter what values are displayed. I had expected it to be green when the values are between 0 and 500, but no such luck. What have I missed?

pde · ‎08-16-2010

Yes, this is a function of the OS. In solaris, you use coreadm to instruct the system where to place core dump files. In the few versions of linux that I know anything about, it's a sysctl. You'll add, say, kernel.core_pattern=/var/core/core_%h_%e_%u_%g_%t_%p to /etc/sysctl.conf and reboot.

Posts	30
Solutions	4
Karma Given	11
Karma Received	50
Member Since	‎02-04-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Two lookups in a realtime dashboard?

Anyone splunking hadoop logs?

HiddenPostProcess: search and eval confusion

Show Source and save as CSV truncate large events?

Matching both sides of two kv pairs over time

Is there a Solaris SMF manifest for Splunk?

Dashboard with multiple searches for searchPostPro...

SingleValue not colorizing with rangemap

How can I abort a search when a subsearch returns ...

Chrome support?

Re: Two lookups in a realtime dashboard?

Two lookups in a realtime dashboard?

Re: Anyone splunking hadoop logs?

Anyone splunking hadoop logs?

HiddenPostProcess: search and eval confusion

Re: Init scripts for starting/stopping Splunk in S...

Re: Clarification on why our license is tripping

Re: Show Source and save as CSV truncate large eve...

Show Source and save as CSV truncate large events?

Re: Matching both sides of two kv pairs over time

Matching both sides of two kv pairs over time

Re: Is there a Solaris SMF manifest for Splunk?

Is there a Solaris SMF manifest for Splunk?

Re: How can I receive syslog (udp/514) events with...

Re: Does pkgrm stop a splunk forwarder in a clean ...

Re: Does pkgrm stop a splunk forwarder in a clean ...

Re: Is it possible to reuse the same raw search re...

Re: Can I Splunk my wtmp files?

Re: Dashboard with multiple searches for searchPos...

Re: Where to find UI example app?

Dashboard with multiple searches for searchPostPro...

Re: SingleValue not colorizing with rangemap

Re: SingleValue not colorizing with rangemap

SingleValue not colorizing with rangemap

Re: Can I force Splunk to drp core in a specific l...