Digital Resilience Pays Off
Download this e-book to learn about the role of Digital Resilience across enterprises.
Either way, #splunk = support group
*** jtrucks has joined #splunk
<jtrucks> I was having withdrawal.
<kkolb> hi jtrucks
<@amrit|wrk> addict
<jtrucks> amrit|wrk: yes
<@amrit|wrk> that’s why the download’s free 😉
<jtrucks> haha
<jtrucks> that first … always is :
<jtrucks>
<jtrucks> come on, it’s 500MB free!
<jtrucks> you can do it
<jtrucks> everyone is doin’ it.
<@amrit|wrk> and 500mb should last you forever, right?
<jtrucks> oh man yeah
<kkolb> and then one day…you’re HOOKED
<jtrucks> Oh, you like that cloudy stuff…
<jtrucks> well, lemme show you this thing I have under my coat.. SplunkStorm.
<jtrucks> you’ll NEVER have to pay for it and you get a whole GB!
<jtrucks> 😉
—-
<glitch_> Another question for the geniuses! “index=unix_idx earliest=-2d latest=@d splunk_server=splunxindexer NOT host=splunkindexer | chart count by splunk_server” Every time I run this, the count decreases. I was hoping for the total events for yesterday. Which should be static. What’d I miss?
<glitch_> ah, right. Regardless, 2days ago to midnight should still be static.
<glitch_> d’oh! missing @d on the earliest.
<glitch_> why is it I have to pull out half my hair, then pull out my laptop, skirt around the firewall and open a console irc app, fight with proxies and connect up to all’y’all to see my own mistake?
Regexes and namechecking my blog will get you a long way:
<rayutsw> what’s the easiest way to say, “Never line break this input”
<^Brian^> “never line break this input or else”
<duckfez> rayutsw: one way is to give it a completely insane LINE_BREAKER, like LINE_BREAKER=([\r\n]*)NeverGonnaGiveYouUpNeverGonnaLetYouDownNeverGonnaRunAroundAndDesertYou
<Yorokobi> If that doesn’t make the “That Happened” blog, I’m gonna be upset. Too funny, duckfez
<DaGryph1> Now I have that song stuck in my head!!!
<duckfez> Achievement Unlocked -> IRC Rickroll
—
<rayutsw> duckfez: you going to be around in a couple hours? I need some of your regexfu after I return from hooters
<automine> regex and hooters?
<automine> this really is a great channel
Splunk> it’s magic, you wouldn’t understand*
<axisys> how do I modify this to show when count is higher than 100?
<axisys> sourcetype=jumpsshd “invalid user” | rex field=_raw “invalid user (?<user>.*) from (?<srcip>.*) port” | search user=”*” srcip=”*” | stats count by srcip
<jspears> | search count > 100
<axisys> jspears: so simple yet I did not think of it
<axisys> jspears: thanks
<jspears> I know, it’s hard to think in terms of Splunk magic
<axisys> jspears: magic indeed
<jspears> when I found out you can remove fields from a timechart the same way, I got vaporlock for a second
<axisys> lol
—
<Arsenius> love it how splunk sometimes looks like magic 😀
<Nerf> s/sometimes //
—
<^Brian^> disturbing thought. I’m writing up an email on the pipeline process and splunk, and how things get applied. And the first thing I thought of was a gastric metaphor
<automine> well, it’s food metaphor for the state of the data, so…
<^Brian^> Splunk> The intestines for your data
<^Brian^> Splunk> Absorbing the goodness from your logs
<automine> yeah, that could get pretty gross
<automine> null queueing
<^Brian^> it could go downhill fast
<Yorokobi> Here is an apropos moment to, once again, state that Splunk poops magic.
<Yorokobi> Back reference: http://blogs.splunk.com/2013/02/06/that-happened-episode-29/
*cf cerby’s custom-embroided Splunk shirt, 2012.
----------------------------------------------------
Thanks!
rachel perkins
The Splunk platform removes the barriers between data and action, empowering observability, IT and security teams to ensure their organizations are secure, resilient and innovative.
Founded in 2003, Splunk is a global company — with over 7,500 employees, Splunkers have received over 1,020 patents to date and availability in 21 regions around the world — and offers an open, extensible data platform that supports shared data across any environment so that all teams in an organization can get end-to-end visibility, with context, for every interaction and business process. Build a strong data foundation with Splunk.