That happened: episode 20

This week in “That happened: notes from #splunk”, a blog about the goings-on in the Splunk IRC channel: Genius capes, paranoia and underpants, brief interludes.

For real IT Superheroes

Cerby has a brainwave:

<cerby> Capes.
<cerby> Forget t-shirts.
<cerby> Forget coffee mugs.
<madscient> whoa. capes.
<amrit|wrk> i don’t understand
<amrit|wrk> oh!
<amrit|wrk> capes!
<cerby> Splunk needs to create Splunk capes
<amrit|wrk> yes
<amrit|wrk> YES
<cerby> Splunk> Yes, I am here to save the day.
<cerby> Get on that.
<^Brian^> cerby: the winnar is you!
<cerby> I’ll be your Splunk cape beta tester.
<derkferz> well, “be an IT superhero” is one of their marketing sayings
<amrit|wrk> that is genius
<amrit|wrk> i have forwarded said request
<derkferz> ergo, capes are apropos
<madscient> what better opportunity to bring back the “Splunk > IT Proctology”  tagline.
<@hexx0> Splunk> EVERYONE BACK THE F*&;% OFF, I KNOW EVAL()
<amrit|wrk> hahaha
<^Brian^> madscient: hahah
<cerby> madscient: AHAHAHAHAHA

Regex paranoia: approved

The real question here: if Superman is so smart, why does he wear his underpants on the outside?

<axisys> how to index config files? there is no timestamp…
<ftk> axisys: CHECK_METHOD = modtime in props.conf
<ftk> and datetime_config=none
<duckfez> axisys: DATETIME_CONFIG = current ?
<ftk> axisys:
<ftk> [some_config]
<ftk> BREAK_ONLY_BEFORE=alasdjfoaisjdfoasdhjfoajsdfoj
<ftk> MAX_EVENTS=200000
<ftk> CHECK_METHOD = modtime
<ftk> pulldown_type = true
<ftk> LEARN_MODEL = false
<jrodman> i approve of this message
<jrodman> the paranoid in me suggests prepending the letter q or z to the BREAK_ONLY_BEFORE regex
<jrodman> but it proably doesn’t matter
<ftk> jrodman: i usually set it to something nonsensical thats not gonna show up in the config. like supermanwearsundieswtf
<jrodman> yes!

Brief interludes

Splunk Support love, app authoring tips, Splunkbase accomplishment, and fanboy angst:

<jspears> I just requested a reset license via support web and got the license email in one minute
<pie|train> BAM
<jspears> who has support like that?  insane :)

<mojo> How much effort does it take to go from a dashboard to an app?
<BSonPosh> 34 joules
<BSonPosh> although that is completely based on your ability to cut/paste

<@hexx0> for some reason, I find black metal to be the most appropriate music to listen to when writing advanced XML

<^Brian^> one day, we’re going to use the wrong regex..and Cthulhu is going to finally rise and make us all go mad

<Drainy> Hey, I just met you, and this is crazy, but heres my answer, upgoat maybe?
<Drainy> http://splunk-base.splunk.com/answers/52227/multiple-timezones-search-worldwide
<@Splunky> Drainy’s URL: “Multiple Timezones, search worldwide – Splunk Community”

<derkferz> I feel so accomplished when gerald upgoats one of my answers

<mlanghor> so…would it make me a nerd to ask Carasso for a signed copy? http://www.splunk.com/goto/book

rachel perkins

Posted by


Join the Discussion