The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Michael Wilde replied to Nikita's discussion Count failures and success via transaction"How are these transactions linked together... by a field called "ID"? If so.. just build them with the field ID, and then use one of the MV commands to extract a field with success or failure in it. Paste some samples and…"
Marcelo Finkielsztein's Discussions
Encountered the following error while trying to update: In handler 'savedsearch': Argument "action.summary_index." is not supported by this handler
1 Reply
Hi,While trying to save a very simple search I ran into this:Encountered the following error while trying to update: In handler 'savedsearch': Argument "action.summary_index." is not supported by…Continue
Started this discussion. Last reply by Marcelo Finkielsztein Apr 8, 2010.
asking for OS recommendation: install on Unix or Windows?
4 Replies
Hi,I am going to use Splunk to monitor a group of log files; they are currently stored in Windows servers.Disregarding that the logging system is in Windows, I can choose between these environments…Continue
Started this discussion. Last reply by Marcelo Finkielsztein Mar 24, 2010.
Marcelo Finkielsztein's Page
Gifts Received
Marcelo Finkielsztein has not received any gifts yet
Latest Activity
Marcelo Finkielsztein replied to Marcelo Finkielsztein's discussion Encountered the following error while trying to update: In handler 'savedsearch': Argument "action.summary_index." is not supported by this handler"Amend:
I installed Splunk free version 4.0.9 build 74233 on another server and got the same error.
Any ideas !?"
Marcelo Finkielsztein posted a discussionEncountered the following error while trying to update: In handler 'savedsearch': Argument "action.summary_index." is not supported by this handler
Hi,While trying to save a very simple search I ran into this:Encountered the following error while trying to update: In handler 'savedsearch': Argument "action.summary_index." is not supported by this handler.I recently upgraded to free version 4.1 (Windows 64bit), so i suspect this is an Issue of this version.I get the same error for any search i try to save. Even one like this...[search2]search = * | head 10I tried adding a line likeaction.summary_index = 0but that did not solve it.Any help…See More
Marcelo Finkielsztein replied to Patrick Swackhammer's discussion Regex For Identifying IP Addresses (To Extract Field)"what about this?
index=* frominternet | rex field=_raw ".*?\s(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}).*\s(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}).*" | fields + IP1, IP2 | head 3
note that this search filters only lines that contain…"
Marcelo Finkielsztein replied to Patrick Swackhammer's discussion Regex For Identifying IP Addresses (To Extract Field)"just a humble note.
I *ALWAYS* write a comment beside a regex, translating it step by step into "plain human readable".
The more verbose the documentation, the better.
I find regexes very risky; this comes together with their great power,…"
Marcelo Finkielsztein replied to Marcelo Finkielsztein's discussion asking for OS recommendation: install on Unix or Windows?"I am staying on Windows, then.
Many thanks Michael.
Marcelo"
Michael Wilde replied to Marcelo Finkielsztein's discussion asking for OS recommendation: install on Unix or Windows?"stability has gotten Waaay better on windows. Performance only slightly better on unix. as far as time in the market, Windows wins over HP-UX (been available for about a month)"
Marcelo Finkielsztein replied to Marcelo Finkielsztein's discussion asking for OS recommendation: install on Unix or Windows?"Thanks.
I would not have thought of two servers. Will have to think about it.
I was more concerned about stability, bugs, ... that type of thing.
I am running already a Windows server and I have had some crashes, and non-explained failures.
Not…"
Michael Wilde replied to Marcelo Finkielsztein's discussion asking for OS recommendation: install on Unix or Windows?"64 bit is a general rule. Then, which ever indexer has the fastest disk I/O
also, you can always use both. Have forwarders send to both and use distributed search. More servers=more capability."
Marcelo Finkielsztein posted a discussionasking for OS recommendation: install on Unix or Windows?
Hi,I am going to use Splunk to monitor a group of log files; they are currently stored in Windows servers.Disregarding that the logging system is in Windows, I can choose between these environments for my Splunk installation: A) Unix - HPUX Itanium B) VMWare Windows Server 2003 64bits 4GB memoryWould you recommend one over the other?Thanks,MarceloSee More
Marcelo Finkielsztein replied to Patrick Swackhammer's discussion Regex For Identifying IP Addresses (To Extract Field)"pffff ... show me someone who says they "know everything" about regex and i will show you a liar.
glad to help :-)
Marcelo"
Marcelo Finkielsztein replied to Patrick Swackhammer's discussion Regex For Identifying IP Addresses (To Extract Field)"Have you tried something like:
\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}
meaning:
(1 to 3 digits), (then a dot), (1 to 3 digits), (a dot), (1 to 3 digits), (dot), (1 to 3 digits).
HTH
Marcelo"
Profile Information
- Are you an existing splunk user?
- Free
- What do you do for your day job?
- System Analyst
Comment Wall
- No comments yet!
© 2012 Created by Michael Wilde.
