TIPS & TRICKS

That happened: episode 37

This week in “That happened: notes from #splunk”, a blog about the goings-on in the Splunk IRC channel: the Joy of Splunking, discovering the nerds are all around you, a panel of experts:

#splunk can be our little secret

ElSplunk discovers the Joy of mvcount:

<ElSplunk> i have a value in the format [a,b,c,d…..]  – I need to count the delimited entries in this.. any straightforward function??
<madscient> ElSplunk: mvcount(split(foo,”,”))
<madscient> ElSplunk: more precisely  –  | eval count=mvcount(split(foo,”,”))
<ElSplunk> thanks awesome @ madscient
<madscient> ElSplunk:  np.  any typos included at no additional charge.
<duckfez> madscient: they aren’t mistakes – just happy little syntactical accidents
<pie|ia> haha
<pie|ia> madscient, the Bob Ross of #splunk
<madscient> now we just need to add some props stanzas, but we’ll make them happy stanzas….

Find your tribe

#splunk gets you:

<xoff> heh
<duckfez> xoff: shouldn’t you change your nick to “xon” before you transmit?
<duckfez> (sorry for the bad flow control puns)
<xoff> duckfez: TWO POINTS! Finally, someone who gets it! :)
<xoff> duckfez: my personal website motto is “Xon, Xoff…go with the flow”
<duckfez> I always preferred RTS/CTS myself, but if you don’t have 2 extra pins
<jspears> if someone interrupts you, you should stop in mid-sentence and just loudly say “collision, collision, collision…”
<xoff> LOl
<xoff> So happy to find my people!
<duckfez> jspears: I’ve been known to do that.  Just stop talking, and wait
<duckfez> each time I get interrupted, I wait twice as long as before
<jrodman> jspears: EXPONENTIAL BACKOFF?
<jspears> jrodman: I think the backoff algorithm was duckfez’s
<duckfez> “I don’t always get interrupted in conversations.  But when I do, I use exponential backoff”
<jrodman> i think next time this happens i’ll just step away from the table

Where the ninjas are

Straight to the source:

< AlexNinja> Hi, any Splunk Expert on Windows installation over there?
< mlanghor> don’t know about expert, what’s the issue?
< edrabbit> I wrote the installer for the Universal Forwarder for windows. :)
< edrabbit> depending on what part of installation I might be able to help
< cynica_f> this is why i love this channel

----------------------------------------------------
Thanks!
rachel perkins

Splunk
Posted by

Splunk