northben's blog

How to onboard log file with two different line-breakers

Categories:

Recently, a client asked for help onboarding this Mulesoft/Sitecore log file onto Splunk. This application log file appears quite complex at first glance.

Sample data

ManagedPoolThread #0 05:27:44 WARN  Failed to create counter 'Sitecore.System\Events | Events Raised / sec'. Sitecore has no necessary permissions for reading/creating counters.

Workaround for brew cask pin

Categories:

I'm a big fan of Homebrew, the package manager for MacOS. There's only one problem -- I need to keep one cask (AKA a GUI application) at a specified version because I haven't paid for the latest version.

I'm bearish on Urbit

Categories:

I keep coming across the Urbit project, and decided to investigate it for myself to learn what it's all about. I've read a bit and watched some youtube introduction videos, and decided I'm quite bearish on the project. I don't think it has a good future. Here's why.

Splunk docker container with Trunk, built with Packer and Terraform

Categories:

I don't work at Splunk anymore, but I still do some freelance consulting, and so I thought I would share one of my old side projects, Trunk.

I am providing a couple of Github repos so that you can create and run your own Splunk instance with Trunk preconfigured to index Trello webhooks in your own AWS account. When the container starts, it subscribes to open Trello boards that are accessible with the Trello credential you provide.

The Trunk app, which provides status report dashboards.

Find size of lookup files in Splunk Web

Categories:

I needed to list the lookup tables and their sizes using Splunk Web. Here's a query to do just that!

| rest splunk_server=local /services/data/lookup-table-files/
| rename eai:acl.app as app 
| table app title 
| search NOT title IN (*.kmz) 
| map maxsearches=990 search="| inputlookup $title$ 
| eval size=0
| foreach * [ eval size=size+coalesce(len('<<FIELD>>'),0), app=\"$app$\", title=$title$ | fields app title size]" 
| stats sum(size) by app title
| sort - sum(size)
 

Splunk foreach command examples

Categories:

The Splunk foreach SPL command is pretty useful for building powerful queries. Here are some examples that I've created as a reference for how to use this powerful command.

Trello Guide for IT Project Management

Categories:

I've been a Trello user and fan for a long time. The intuitive interface provides a powerful platform for managing any project in a Kanban or Scrum methodology.

 

Splunk macro to remove identical fields

Categories:

 

Suppose that you have a Splunk query that returns a result set with some duplicate fields. Would you like to remove the duplicate fields so that you can quickly identify the differenes between each result? Here's a macro to do it!

Splunk macro to remove empty fields

Categories:

If you have a Splunk query that returns empty fields, you can use this query to programatically remove these blanks.

Splunk Use Case Implementation Process

Categories:

Summary

How are use cases developed and implemented? What does it mean to tune a correlation search? This post explains a disciplined process that focuses on the early and continuous delivery of valuable use cases. You'll learn time-saving shortcuts and a systematic approach that eliminates frustration and churning.

Introduction

Pages

Subscribe to RSS - northben's blog