Posted on

Doing an join on two different indexes in Splunk

I know this in probably covered somewhere in some document or blog post or support site somewhere…….but I couldn’t find it. At least not a down and dirty simple way to start so here is my way to do it. Thanks to Maggie Kostiew for giving me the “search” parameter. The hard part was the “[ search” part. That was shown no where. So I hope this help some new guy like me somewhere. 

index="device_list"
| table serialNumber, manufacturer, modelName, hardwareVersion, softwareVersion, wanAccessType, macAddress, pppUsername
| join inner serialNumber
    [search index="device_op" error=* | table serialNumber, error]

Posted on

Setting a field in json as your _time field in Splunk

A problem I have been encountering is trying to set a date field within my json response file as the _time field in my Splunk data upon import. I have read lots of posts on it and found that less is more when it comes to accomplishing this. Adding the following stanza in a props.conf file in the /opt/splunkforwarder/etc/system/local folder accomplished this. As you can see by the path is is on the Splunk Univeral Forwarder.

The json file is created by a python script file that hits an API and returns the data (more on that later). The date field is the second date field in the json string. So Splunk was grabbing the first one and sometimes it was taking the file creation date and time.

After trying several different variations of the stanza the below code finally worked. I hope this helps you!

[source::/data/logs/prod.json]
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N
TIME_PREFIX="lastInformTime": "
MAX_TIMESTAMP_LOOKAHEAD = 24
MAX_DAYS_HENCE = 10

Here are some of the other answers I tried.

How to configure Splunk to set _time to a specific field?
We ended up using the following – base search | eval _time=strptime(eventStartTime,”%Y-%m-%d %H:%M:%S.%N”) Which works perfectly. Is there a way to set it up in the configuration, so eventStartTime is assigned to _time?
How to change the _time to values inside the event data?
I want to make area graphs of data usage on individual servers based on the timestamp given in the event data and not the default _time values. This is an example of an event: 2017-06-29 19:32:57.254, DBNAME=“BRMTPRD”, SNAPDATE=“2017-06-18 03:00:32.0″, TSTYPE=“REDO”, TSNAME=“ONLINEREDOSTBY”, ALLOCAT…
Use default fields – Splunk Documentation
Fields are searchable name-value pairs in event data. When you search, you’re matching search terms against segments of your event data; you can search more precisely by using fields. Fields are extracted from event data at either index time or search time. The fields that are extracted automaticall…
Posted on

Looking for a standup desk for your home office

I recently decide to purchase a standup desk for my home office. I researched a couple of different brands but I decided to go with a Varidesk from Office Depot due to availabilty. Other desks would have taken months to be delivered and Office Depot had mine to me in 3 day’s.

VARIDESK ProDesk Electric Height-Adjustable Desk, 48"W, Reclaimed Wood

I have had it now for three weeks and couldn’t be happier with it. Setup was a breeze. No fumbling with a dozen different screws and trying to hold the pieces together. Just 4 screws to secure the legs to the top after they have been slid into place (in fact I didn’t even put the screws in till yesterday). The brace slide onto the legs with a wedge to hold it in place. They supply a nice rubber mallet to tap the brace into place and you can use it for computer repair later 🙂 . It’s a very solid piece of furniture. You can have preprogramed heights so at the touch of a button you are standing or sitting.

Posted on

Groups in Outlook

In order to access your Contact Groups you must click on the people icon in the left hand navigation pane.

To create a new group click on the New Contact Group. This will create the group in your local contacts.
You can search from an existing group by searching in the contacts.
This will bring up your group and you can double click on it to modify it.
From here you can add or remove people from your group.
Make sure you select From Outlook contacts to get your local contacts list.
Posted on

Interesting Read.

5 SharePoint problems that spur customers to leave the platform
SharePoint has been around for more than 15 years and deployments still number in the millions, but a number of SharePoint problems may inspire some users to move on. Here are five of them.
Posted on

Modern SharePoint and Office 365 Development

I finished the Modern SharePoint and Office 365 Development course at Critical Path Training last week. Ted Pattison is a great teacher an I got a lot out of it. I would enthusiastically recommend Critical Path Training for your SharePoint and MS365 training.

Modern SharePoint and Office 365 Development
Course Overview (PDF) Download Student Files (ZIP) Modern SharePoint and Office 365 Development is an Read more