Back to the Blog

Passing Time

Posted by Rupak Pandya on Thursday, April 4, 2013 - 13:00 Operational Intelligence, Best Practices Best Practices, Big data, Machine data, props.conf, Splunk, Web Analytics, XML

System monitoring dashboards are something we are often asked to provide for our clients. Normally, this is a pretty straight forward task, but on a recent client engagement, I was presented with one requirement that was a bit out of the ordinary. This client was looking to monitor a set of ten desktops with a real-time dashboard that would display in their office. They wanted to see all of the standard metrics like cpu, memory, and disk. If there was a spike in a time chart for say % CPU Usage, they wanted to be able to click on the spike and drill down into another view. They wanted the...

read more

OH NO!! Splunking log files with multiple formats?? No problem!

Posted by Rupak Pandya on Thursday, January 24, 2013 - 14:07 Operational Intelligence, Best Practices Big data, Data Inputs, Machine data, props.conf, Splunk, Timestamps, Web Analytics

I was recently at a client site  for a two-week engagement assisting them with ramping up their Splunk installation, and I came across something particularly interesting. One of the log files the client wanted to index in Splunk contained four different log formats with four different timestamps. Take a look at a sample of the log:

The Seven Dwarfs of Data On-boarding in Splunk

Posted by Rupak Pandya on Thursday, July 26, 2012 - 10:45 Operational Intelligence, Best Practices Analytics, Big data, Data Inputs, Indexing, Machine data, Operational Intelligence, props.conf, Splunk

In my time working with and using Splunk, I have learned a few tricks and tips to make the Splunk experience even better. This post assumes you are familiar with a few Splunk keywords. If you are having trouble following along, take a look at this link and look up the terms: http://docs.splunk.com/Splexicon. If you have never seen Splunk before, I suggest taking a look at the Splunk Tutorial to familiarize yourself with the product: ...

read more
Stay In Touch