Technological Actions

Excursions in Tech

VMWare Router

Lately, I’ve been finding myself building more and more complex environments in VMWare, simulating complex scenarios that have networking requirements above and beyond a mere LAN Segment. For example, as an SE, suppose I want to more closely mirror a customer environment, when simulating a deployment change. If you want to maintain the IPs of […]

Where To Find Configuration Files in Splunk

If you’ve added an input, savedsearch, or any manner of other config through the ui, you might have a lot of trouble finding the configuration file later. If you’re on Unix, the easiest way is to do a search #/opt/splunk/etc/: egrep -R MySearchName . ./users/jsmith/launcher/local/savedsearches.conf:[MySearchName] If you’re on Windows.. well, frankly I’d download unxutils and […]

Why Rename your Fields in Splunk

A piece of advice for those starting out in Splunk: Always Rename Your Fields It’s slightly more accurate to say “always rename your fields after aggregation functions (e.g., stats, timechart)” but that lacks the zing. Why is this so important? The biggest reason is that it will just consistently make your life easier. If your […]

Overview of Timechart

Getting comfortable with timechart is key to getting comfortable with Splunk. It’s the core of your first reports in the system. Take a look at the below posts for a shortcut to going from basic to advanced with timechart: Basic Syntax Advanced Statistics Analyzing Trends (Comparing Summarized Hours, Days, or Etc.) Using Eval Within Timechart […]

Timechart Versus Stats

Timechart and stats are very similar in many ways. They have access to the same (mostly) functions, and they both do aggregation. The biggest difference lies with how Splunk thinks you’ll use them. Timechart is much more user friendly. You can run a | timechart span=1d sum(MB) by series and it will create take each […]

Using Eval Within Timechart (or Stats)

Taking the game up another level, the ability to use eval statements within Timechart increases flexibility immensely. Suppose you have a health page where you can look at one server out of twenty, or one partner out of seven, or any other scenario where you’re comparing one fungible element to the average of others. Without […]

Analyzing Trends with Timechart in Splunk

One of the most useful theories to get when using timechart is generalizing data to a certain level of granularity, and then tracking changes over time. A good example of this is looking at the hourly amount by Splunk, but viewed on a per day basis. Splunk is going to toss many events per hour. […]

Timechart Advanced Statistics

In the last post (Overview of Timechart Syntax in Splunk), we covered the basics of Splunk’s timechart Syntax. This post will cover some of the more advanced statistical functions of timechart. The statistical functions are really the core of timechart (along with the core of Stats — see Timechart Versus Stats). Check out the full […]

Overview of Timechart Usage in Splunk

Timechart is one of the most essential functions in Splunk. Unfortunately for those starting out, getting access to its many wonders is a bit hard to do. The official documentation (timechart, functions available to timechart) ┬áis great once you’ve got your feet firmly in the water — this blog post (and the links at the […]

How To Get Better Timechart Bins in Splunk

The Problem A pet peeve of mine in Splunk is its tendency to summarize data too much when putting it in a Timechart. It makes for smoother flowing (and I suppose more executive-friendly) charts. For example, with one of my data sources, I have data points every ten minutes (result of a script). If I […]