By Splunk May 21, 2014
This week in “That happened: notes from #splunk”, a blog about the goings-on in the Splunk IRC channel: how to hire a ninja, the usual assortment of bad jokes, blame-based dashboarding:
I will find you, and I will splunk you
Must have a very particular set of skills…
<Baconesq> We are trying to write a job req for a “splunk person”
<Baconesq> Why is this so hard?
<cerby> Baconesq: because there aren’t enough of us. 
<xoff> “Must be rockstar, like Pie.”
<xoff> (and Bacon)
<snowmizer> baconesq: can I work from iowa
<xoff> Baconesq: seriously, I wouldn’t mind a copy of what you come up with. There is potential for more Splunk people here.
<aernan> working with splunk is pretty fun. I could see a big beneft for most companies to have someone to do splunk
<xoff> aernan: I’m so far down the Splunk rabbit hole I’m writing an app to graph how far I’ve come.
<xoff> Baconesq: “Splunk user. Must have own cape” probably doesn’t cut it, eh?
<dragonrol> i like it
<Baconesq> Must speak regex, but still be able to communicate with humans.
Threefer Thursday
Snippets from the collective consciousness:
<^Brian^> dhorn: god hates udp 😛
<xoff> ^Brian^: The actual message was “god doesn’t hate udp” but it lost a few packets…
—
<Baconesq> Javascript is that awkward girl from high school that turned out to be super-hot when she grew up.
<Baconesq> Nobody really noticed her back then, everyone was chasing after her cousin, Java.
—
<DaGryph> OH: There are lines. At Splunk, we help you cross them.
<jtrucks> DaGryph: and then graph and chart the lines and the crossing adventure…
Shame-based education
The LART, in dashboard form:
<N00BZ> WHY CANT I HAVE NICE THINGS!!! :'( Why do my users try to keep bringing down our search head…
<HarriSeld> I like a pie chart on the main app page that shows worst searches, expensive searches, and most errors. A wall of shame, if you will
<N00BZ> HarriSeld : +1 on that plan!
<HarriSeld> but still most keep trying crazy searches or bad regex or missing key things in props.conf to parse data faster.
<Splunker0> Harriseld: I think there is an app with that
<HarriSeld> i want it more self-serve and agile but it makes me cringe when i see some of the apps. rawr
<Splunker0> There are searches that have the longest; most expensive, I think it’s part of the SOS app?
<HarriSeld> yeah SoS
<Splunker0> You could pull out the saved search and logic, put it in any other view
<N00BZ> I’ll make it a monthly report and send a company wide email to really make it good…ok….maybe too far…
<@piebob> ooh make an app out of it “Splunk Shamebot”
<HarriSeld> I have my prototype wallof shame. not purty enough yet
<@piebob> and put it on apps.splunk.com
<HarriSeld> Congratulations, you are our worst searcher! please click here for a link to splunk education
<N00BZ> HA
----------------------------------------------------
Thanks!
rachel perkins