That happened: notes from #splunk

Welcome to the first installment of “That happened: notes from #splunk”, a blog about goings-on in the Splunk IRC channel.

What’s IRC?

IRC stands for Internet Relay Chat, a chat platform/protocol. Splunk maintains a chat channel on the EFNET IRC network, so if you want to join us, connect your IRC client to an EFNET server and join the #splunk channel.

#splunk is usually buzzing with the latest puzzler (yeah, it’s sometimes a bit like Car Talk–except that we all take turns playing Tom & Ray Magliozzi), and although we’re at our busiest during ~10am-5pm Pacific, splunkers worldwide can be found helping each other out at all hours of the (West coast) night. Some #splunk denizens are Splunk employees, but the majority chatting here are our beloved Splunk customers–sharing the joys, frustrations, and triumphs of their deployments:

<Daneel> #splunk IRC, oh how I’ve missed you.. Seriously, this chat room makes my day that much more awesome :)
<mojo> Daneel – couldn’t agree more

Irreverence is king

Help with your search? Yeah, we can do that:

<Nerf> If I want a table with columns: count(fieldA), count(field.valueB), (count(field1.valueA)/count(field1.valueB))
<Nerf> How would I do that?
<hexx_home> that 3rd column needs to be added with an eval
<hexx_home> after your | stats count
<@amrit|wrk> ur a | stats count
<^Brian^> heh
<Nerf> Ah, I figured I was missing something easy
<hexx_home> amrit|wrk: only common decency keeps me from answering that with an association between your mother and “loadjob”
<hexx_home> !spec loadjob
<@Splunky> http://www.splunk.com/base/Documentation/latest/SearchReference/Loadjob
<@amrit|wrk> should have known better.. never mess with the war horse

(Splunky is our documentation lookup robot, owned by Splunk dev amrit. Splunk Support rockstar hexx has spent a lot of time making it easy to look things up in the documentation right from your IRC window!)

We Have Opinions

Sometimes scripting leads to unusual analogies:

<^Brian^> man, python indentations are a harsh mistress
<mlanghor> yea, that kinda turns me off of python
<Drainy> its not python’s fault you choose to alternate your indentation methods
<Drainy> :)
<duckfez> nah, python indentations are just a kinky girlfriend …  shared libraries in C++ are a harsh mistress.

Answers from the past

#splunk is a hotbed of Splunk Answers karma generation–we’re either trying to beat one-another to the answer, trolling the channel for upvotes (or upgoats, as we call them–come by and ask sometime…) for the questions we’ve answered, or converting pearls of wisdom from the collective braintrust of #splunk itself into karma. Apparently this has been going on for long enough for some of us to forget:

<Drainy> well that’s awkward
<Drainy> I just hit an error on a Splunk install, googled and read the first Splunkbase answer and it has me offering advice!
<kenson> what did you advise then? =)
<Drainy> http://splunk-base.splunk.com/answers/42112/splunk-install-error-on-windows

Job satisfaction: we’re helping!

<duckfez> it’s unfortunate, the more the $DAYJOB starts to suck, the more I want to just go troll Answers and solve other peep’s issues
<mlanghor> duckfez: I get that same feeling quite often

rachel perkins

Posted by


Join the Discussion