TIPS & TRICKS

That happened: episode 41

This week in “That happened: notes from #splunk”, a blog about the goings-on in the Splunk IRC channel: how to hire a ninja, the usual assortment of bad jokes, blame-based dashboarding:

I will find you, and I will splunk you

Must have a very particular set of skills

<Baconesq> We are trying to write a job req for a “splunk person
<Baconesq> Why is this so hard?
<cerby> Baconesq: because there aren’t enough of us. :)
<xoff> “Must be rockstar, like Pie.”
<xoff> (and Bacon)
<snowmizer> baconesq: can I work from iowa
<xoff> Baconesq: seriously, I wouldn’t mind a copy of what you come up with. There is potential for more Splunk people here.
<aernan> working with splunk is pretty fun. I could see a big beneft for most companies to have someone to do splunk
<xoff> aernan: I’m so far down the Splunk rabbit hole I’m writing an app to graph how far I’ve come.
<xoff> Baconesq: “Splunk user. Must have own cape” probably doesn’t cut it, eh?
<dragonrol> i like it
<Baconesq> Must speak regex, but still be able to communicate with humans.

Threefer Thursday

Snippets from the collective consciousness:

<^Brian^> dhorn: god hates udp 😛
<xoff> ^Brian^: The actual message was “god doesn’t hate udp” but it lost a few packets

<Baconesq> Javascript is that awkward girl from high school that turned out to be super-hot when she grew up.
<Baconesq> Nobody really noticed her back then, everyone was chasing after her cousin, Java.

<DaGryph> OH: There are lines. At Splunk, we help you cross them.
<jtrucks> DaGryph: and then graph and chart the lines and the crossing adventure

Shame-based education

The LART, in dashboard form:

<N00BZ> WHY CANT I HAVE NICE THINGS!!! :'( Why do my users try to keep bringing down our search head…
<HarriSeld> I like a pie chart on the main app page that shows worst searches, expensive searches, and most errors. A wall of shame, if you will
<N00BZ> HarriSeld : +1 on that plan!
<HarriSeld> but still most keep trying crazy searches or bad regex or missing key things in props.conf to parse data faster.
<Splunker0> Harriseld: I think there is an app with that
<HarriSeld> i want it more self-serve and agile but it makes me cringe when i see some of the apps. rawr
<Splunker0> There are searches that have the longest; most expensive, I think it’s part of the SOS app?
<HarriSeld> yeah SoS
<Splunker0> You could pull out the saved search and logic, put it in any other view
<N00BZ> I’ll make it a monthly report and send a company wide email to really make it good…ok….maybe too far…
<@piebob> ooh make an app out of it “Splunk Shamebot”
<HarriSeld> I have my prototype wallof shame. not purty enough yet
<@piebob> and put it on apps.splunk.com
<HarriSeld> Congratulations, you are our worst searcher! please click here for a link to splunk education
<N00BZ> HA

----------------------------------------------------
Thanks!
rachel perkins

Splunk
Posted by

Splunk