Category Archives: 工具軟體

Splunk – Transaction 查詢一段相近時間之累積資訊

Posted on 2013 年 02 月 21 日 by cowman.chiang

sourcetype=”來源型態” | rex “(?i) .? User (?P<pop3_failed_id>[^.]+) login failed.” | search pop3_failed_id=”” | transaction 判斷資訊 maxevents=2000 keepevicted=true | concurrency duration=duration | eval duration=tostring(duration,”duration”) 原理有點像是將所有事件跑過一次，然後把相近時間的判斷資訊放在同一筆事件中 一般預設單筆事件僅顯示500筆資訊 但是有時候可能會是好幾萬筆資訊就會被拆成好幾筆事件，將造成事件數字判讀上的不便 因此可以進行下面的動作 將 /opt/splunk/etc/apps/search/default/data/ui/views/flashtimeline.xml 檔案複製到 /opt/splunk/etc/apps/search/local/data/ui/views/flashtimeline.xml 編輯 /opt/splunk/etc/apps/search/local/data/ui/views/flashtimeline.xml 搜尋 在下面插入 數字 會變成 數字 full report_builder_format_report … Continue reading →

Posted in Splunk | Leave a comment

Splunk Lincese Warning 次數

Posted on 2013 年 02 月 19 日 by cowman.chiang

除了可以到 “管理員=>授權” 去查看外 還可以搜尋 “index=_internal licensemanager” 根據搜尋的結果看 Audit:[quotaExceededCount=1 的數量 所以便可以擷取欄位 將 (?i) Audit:[quotaExceededCount=(?P[^,]+) 存為記得的名稱以便後續搜尋

Posted in Splunk | Leave a comment

Splunk CLI With Script

Posted on 2013 年 02 月 08 日 by cowman.chiang

因為 Splunk CLI 一樣需樣登入 所以可以先在 Script 檔案中預先輸入帳號、密碼 export SPLUNK_USERNAME=帳號 export SPLUNK_PASSWORD=密碼 然後在下 Splunk 的登入、查詢等指令 /opt/splunk/bin/splunk login /opt/splunk/bin/splunk search ‘index=_internal source=*metrics.log group=per_index_thruput NOT (series=_* OR series=*summary) starttime=02/07/2013:00:00:00 | timechart span=1d sum(eval(kb/1024)) AS “MB indexed” by series | fields + main | … Continue reading →

Posted in Splunk | Leave a comment

設定元件Visible屬性

Posted on 2013 年 02 月 08 日 by cowman.chiang

Sub Picture25_visible() With ActivePresentation.Slides(SlideShowWindows(1).View.Slide.SlideIndex) If .Shapes.Title.TextFrame.TextRange.Text = “Splunk 優點” Then .Shapes(“圖片 25”).Visible = -1 .Shapes(“圖片 25”).ZOrder msoBringToFront End If End With End Sub Sub Picture25_hide() With ActivePresentation.Slides(SlideShowWindows(1).View.Slide.SlideIndex) If .Shapes.Title.TextFrame.TextRange.Text = “Splunk 優點” Then .Shapes(“圖片 25”).Visible = msoFalse End If End … Continue reading →

Posted in Office, PowerPoint | Leave a comment

當投影片切換時 (VBA)

Posted on 2013 年 02 月 08 日 by cowman.chiang

Sub OnSlideShowPageChange() MsgBox ActivePresentation.Slides(ActiveWindow.Selection.SlideRange.SlideNumber).Shapes.Title.TextFrame.TextRange.Text End Sub

Posted in Office, PowerPoint | Leave a comment

Powerpoint VBA: 取得當前Slide編號

Posted on 2013 年 02 月 08 日 by cowman.chiang

主要有兩種 1. ActiveWindow.Selection.SlideRange.SlideNumber 此處主要是在一般狀態下 (非簡報播放) 適合用來Debug 2. SlideShowWindows(1).View.Slide.SlideIndex 此處主要是當簡報播放情況下 ( 所以一般Debug模式會出錯 ) 以下為實際應用 Sub Picture76_4() With ActivePresentation.Slides(SlideShowWindows(1).View.Slide.SlideIndex) If .Shapes.Title.TextFrame.TextRange.Text = “Splunk for Unix and Linux” Then .Shapes(“Picture 4”).ZOrder msoBringToFront End If End With End Sub Sub Picture76_5() With ActivePresentation.Slides(ActiveWindow.Selection.SlideRange.SlideNumber) MsgBox … Continue reading →

Posted in Office, PowerPoint | Leave a comment

Splunk 取得License使用量

Posted on 2013 年 02 月 07 日 by cowman.chiang

假設是要取得目前使用量 index=internal source=*metrics.log group=per_index_thruput NOT (series=* OR series=*summary) starttime=02/07/2013:00:00:00 | timechart span=1d sum(eval(kb/1024)) AS “MB indexed” by series 基本上就是限制starttime的起始為當日的00:00:00 (starttime format為 %m/%d/%Y:%H:%M:%S) 如果是要取得最近幾天的License Usage index=_internal source=*license_usage.log type=RolloverSummary earliest=-7d | eval GB = b/1024/1024/1024 | eval _time = _time – 43200 … Continue reading →

Posted in Splunk | Leave a comment

PowerPoint巨集，將物件移到最前面

Posted on 2013 年 01 月 31 日 by cowman.chiang

查詢物件名稱 Sub Who_AM_I() With ActiveWindow.Selection.ShapeRange(1) MsgBox .Name End With End Sub 將物件移到最前面 Sub Bringtofront() ActivePresentation.Slides(第幾張投影片).Shapes(“物件名稱”).ZOrder msoBringToFront End Sub

Posted in Office, PowerPoint | Leave a comment

Splunk Mail2000 Log Source Type

Posted on 2013 年 01 月 23 日 by cowman.chiang

vim /opt/splunk/etc/system/local/props.conf [mail2000_access] NO_BINARY_CHECK = 1 pulldown_type = 1 [mail2000_imap] NO_BINARY_CHECK = 1 pulldown_type = 1 [mail2000_imss] NO_BINARY_CHECK = 1 pulldown_type = 1 [mail2000_login] NO_BINARY_CHECK = 1 pulldown_type = 1 [mail2000_mailer] NO_BINARY_CHECK = 1 pulldown_type = 1 [mail2000_pop3] NO_BINARY_CHECK = … Continue reading →

Posted in Linux, Splunk | 1 Comment

[Splunk] 修改Google MAP模組圖示的Height值

Posted on 2013 年 01 月 17 日 by cowman.chiang

vim /opt/splunk/etc/apps/maps/default/data/ui/views/maps.xml 搜尋 ( 在module name=”GoogleMaps” 階層內) 預設值為 500px 可以視需要修改

Posted in Linux, Splunk | Leave a comment