This week in “That happened: notes from #splunk”, a blog about the goings-on in the Splunk IRC channel: UDP, fschange, powerpoint, and the Muppets.
Also: a very special welcome to the newest addition to the #splunk family: baby jlaw, aka Ansel! Congrats, jlaw!!!!
UDP: think of it as Splunk license savings
Sarcasm, thy name is ftk
<ftk> but yeah you can save 50% bandwidth going with udp because you dont have to wait for the server to acknowledge
<ftk> think of the savings
<ftk> i switched all my forwarders to udp and now i index over twice the data in half the time
<ftk> _and_ my license usage is down!
<sedlid> ftk: your license usage is down because you are probably missing events.
<jgedeon|w> sedlid: I think the sarcasm tag of the day just starts with ftk:
<DaGryph> Or the indexer stopped talking to the license master due to some awkward situation.
<DaGryph> Like the indexer met another license master, or is being antisocial. I’ve seen it happen.
fschange and you
*Someone* sure knows how to have a good time:
<lilith> I want to monitor some configuration files for changes and THEN parse out changes
<lilith> what is the path to that?
<lilith> i see how to use fschange to detect the change event itself
<jspears> you want fullEvent = true in your fschange stanza
<jspears> that will cause the file to be indexed when it changes
<jspears> I haven’t yet worked out the “report changes when they’re noticed” thing, but it’s doable
<lilith> huh I did set…oh restart hurr
<lilith> god this stuff is the hotness
<lilith> says the guy who’s read Mastering Regular Expressions cover to cover twice for fun
cron > animated gifs > Powerpoint
Not to mention another great Cornify use case:
<Coccyx> I’m going to end up spending all day on this one slide
<cerby> just another reason to hate powerpoint!
<^Brian^> just add sparkly glitter things and blind the viewers
<cerby> doesn’t powerpoint support <blink>?
<jspears> animated GIF was the pinnacle of online multimedia innovation, it’s been downhill since
<Coccyx> not really powerpoint’s fault
<Coccyx> just takes a long time to make good slides
<cerby> cron is the pinnacle of all computing since the dawn of time…the race to the bottom of the hill is definitely on.
<jspears> cron won’t be first, it only runs at intervals
<alacer> I know a few people I can replace with a cron…
<jspears> I’ve seen people replaced with cronies
So much better than Clippy
#splunk IRC: just like having your own peanut gallery:
<@jlaw> now i’m reminded of statler and waldorf.
<duckfez> are those the crazy old men muppets?
<DaGryph> If splunkweb ever has avatars, it should be those two. right next to the search button
<DaGryph> adding commentary to your searches
<duckfez> I never knew their names, but man I like them
<@jlaw> “you call that a search?!”