SPLUNK LIFE

That happened: episode 39

This week in “That happened: notes from #splunk”, a blog about the goings-on in the Splunk IRC channel: Splunk results on your iPad–or anywhere, bromance is in the air, you may want to go back to college, gems from the tip jar:

Do you use statusboard on your iPad?

Starcher wrote a cool thing!

See this blog post from #splunk denizen starcher explaining how to use Splunk alerting and Dropbox to update a dashboard in statusboard on your iPad: http://www.georgestarcher.com/?p=819.

This makes me think of another “get your Splunk on anywhere your iDevice is” project, the Splunk Everywhere utility written by David Carasso. Check out his blog post about it here: http://blogs.splunk.com/2014/01/29/splunk-alerts-and-charts-on-your-iphone/

Virtual bros

Jeffums (aka DaGryph) makes a new friend:

<DaGryph> “need” is a funny word. I NEEDed 4tb drives in a new nas for my home. lol
<dhorn> DaGryph: Home NAS is a whole nother question, lol. I have a Norco RPC-4224 full of 3TB drives with a LSI MegaRAID 9261-8i controller.
<DaGryph> dhorn: for home?!?
<dhorn> Yes. 😀
<DaGryph> It’s not often I get out-geeked, but when I do, I like it to be done in extraordinary ways
<dhorn> DaGryph: I also have 3 Dell C1100s in a Hyper-V Failover Cluster.
<DaGryph> omfg. I <3 you.
<DaGryph> I do that with two HP boxes here in the office…
<dhorn> With Hyper-V and not that ESXi nonsense??
<DaGryph> YES
<dhorn> !!!
<DaGryph> I’ve finally met someone who understands my Hyper-V-ness
<dhorn> So have I!
<dhorn> <3 Hyper-V
<automine> now kiss
<automine> :)

You know you have a serious Splunk habit

…when you consider buying a college so you can get a break on license fees
(And if you’re already at a college, check this out!)

<cerby> https://www.internet2.edu/products-services/cloud-services-applications/splunk/#service-fees
<cerby> wow.
<cerby> I uh… wow.
<cerby> I almost want to sign up.
<cerby> The pricing seems insanely cheap, even for non-internet2 members.
<Baconesq> cerby: Damn, son.
<Baconesq> cerby: Their service is cheap.
<cerby> Baconesq: no kidding!
<Baconesq> cerby: But, you have to be an educational entity to use it?
* Baconesq checks to see if we own a goddam school somewhere.
<cerby> Baconesq: ah apparently so. Damn.
<alacer> Oh, sweet. We do own a school. Actually, technically, the school owns us……..
<cerby> We partner with a school in Illinois. I wonder if we can get in on this!
<Baconesq> It might be cheaper for us to buy a technical college and use this instead of continuing our current approach.

Pro-tips from the bowels of #splunk

For more, check out http://wiki.splunk.com/Things_I_wish_I_knew_then

<dbCooper> grep x | grep -v “y” | grep z = just get splunk>
<dbCooper> or the “grep the grep grep” as I call it.

<duckfez> protip: If you replace LWF with UF on unix boxes – make sure you uninstall LWF
<duckfez> otherwise, your dense ass may just “/opt/splunk/bin/splunk start” because of tab-complete-fail

<xoff> That annoying point where you convince yourself something is horribly wrong with your splunk instance because your search no longer returns anything, and it did an hour ago…because you’re searching “last 24 hours” and your results were 25 hours ago now…

----------------------------------------------------
Thanks!
rachel perkins

Splunk
Posted by

Splunk

Join the Discussion