That happened: episode 18

This week in “That happened: notes from #splunk”, a blog about the goings-on in the Splunk IRC channel: UDP, fschange, powerpoint, and the Muppets.

Also: a very special welcome to the newest addition to the #splunk family: baby jlaw, aka Ansel! Congrats, jlaw!!!!

UDP: think of it as Splunk license savings

Sarcasm, thy name is ftk :)

<ftk> but yeah you can save 50% bandwidth going with udp because you dont have to wait for the server to acknowledge
<ftk> think of the savings
<ftk> i switched all my forwarders to udp and now i index over twice the data in half the time
<ftk> _and_ my license usage is down!
<DaGryph> XD
<sedlid> ftk: your license usage is down because you are probably missing events.
<jgedeon|w> sedlid: I think the sarcasm tag of the day just starts with ftk:  :)
<DaGryph> Or the indexer stopped talking to the license master due to some awkward situation.
<DaGryph> Like the indexer met another license master, or is being antisocial. I’ve seen it happen.

fschange and you

*Someone* sure knows how to have a good time:

<lilith> I want to monitor some configuration files for changes and THEN parse out changes
<lilith> what is the path to that?
<lilith> i see how to use fschange to detect the change event itself
<jspears> you want fullEvent = true in your fschange stanza
<jspears> that will cause the file to be indexed when it changes
<jspears> I haven’t yet worked out the “report changes when they’re noticed” thing, but it’s doable
<lilith> huh I did set…oh restart hurr
<lilith> god this stuff is the hotness
<lilith> says the guy who’s read Mastering Regular Expressions cover to cover twice for fun

cron > animated gifs > Powerpoint

Not to mention another great Cornify use case:

<Coccyx> I’m going to end up spending all day on this one slide
<cerby> just another reason to hate powerpoint! :)
<^Brian^> just add sparkly glitter things and blind the viewers
<cerby> doesn’t powerpoint support <blink>?
<jspears> animated GIF was the pinnacle of online multimedia innovation, it’s been downhill since
<Coccyx> not really powerpoint’s fault
<^Brian^> heh
<Coccyx> just takes a long time to make good slides
<cerby> cron is the pinnacle of all computing since the dawn of time…the race to the bottom of the hill is definitely on.
<jspears> cron won’t be first, it only runs at intervals
<cerby> ding! :)
<alacer> I know a few people I can replace with a cron…
<jspears> I’ve seen people replaced with cronies

So much better than Clippy

#splunk IRC: just like having your own peanut gallery:

<@jlaw> now i’m reminded of statler and waldorf.
<duckfez> are those the crazy old men muppets?
<Nerf> yup
<DaGryph> If splunkweb ever has avatars, it should be those two. right next to the search button
<@jlaw> haha
<DaGryph> adding commentary to your searches
<duckfez> I never knew their names, but man I like them
<@jlaw> “you call that a search?!”
<DaGryph> LOL

rachel perkins

Posted by