Cool Tools

Hello, fellow Splunkers! In this post, we'll take a look at a few of the pitfalls to be aware of when using the quite powerful, but sometimes hard to troubleshoot, DB Connect (DBX) 3.1.1 application from Splunkbase. So let's jump right in, shall we?

NULL values for Timestamp

If a database table that you're importing (either rising column or batch mode) contains a column representing a timestamp, most likely you'll want to utilize that column as the timestamp of the event (database record) within Splunk, instead of using the index time as the timestamp. However, be...

If you're anything our team at Function1, you can't wait to experiment with all of Splunk 7's dynamic new features. One of these features is “Event Annotations,” a powerful tool to highlight charts. At the moment, Event Annotations can be used in time-series charts. They are relatively simple to use; all you need is a separate search on your dashboard of type=annotation, with the annotation_label defined as the field you want to show as an annotation, and the annotation_category defined as the field to group your annotations by type. There is a simple but comprehensive example in the...

“Surround yourself with the dreamers and the doers, the believers and thinkers, but most of all, surround yourself with those who see greatness within you, even when you don’t see it in yourself.” –Edmund Lee

Splunk is an extremely versatile application, dissecting everything from a small csv file to multiple terabytes of data. I am a member of Function1’s Wellness Team as well as a part of the OI Practice. This year, the Wellness Team has decided to revamp itself and I thought Splunk would be a great tool to utilize to track our progress and feedback from...

While at a client recently, I had the task of creating a dashboard with the ability to look at Linux and Windows data's highest points and averages. The Windows and Linux data needed to be viewed separately, but still have the ability to view the data in total. To accomplish this, I created a base search using six macros: two to encompass both operating systems with each calculation mode, and two per operating system for each calculation mode.My first step was to create the macros. This is done by Settings > Advanced Search > Search Macros. Once at this page, click “New”. You will be...