Category Archives: Splunk

Splunk 取得License使用量

Posted on 2013 年 02 月 07 日 by cowman.chiang

假設是要取得目前使用量 index=internal source=*metrics.log group=per_index_thruput NOT (series=* OR series=*summary) starttime=02/07/2013:00:00:00 | timechart span=1d sum(eval(kb/1024)) AS “MB indexed” by series 基本上就是限制starttime的起始為當日的00:00:00 (starttime format為 %m/%d/%Y:%H:%M:%S) 如果是要取得最近幾天的License Usage index=_internal source=*license_usage.log type=RolloverSummary earliest=-7d | eval GB = b/1024/1024/1024 | eval _time = _time – 43200 … Continue reading →

Posted in Splunk | Leave a comment

Splunk Mail2000 Log Source Type

Posted on 2013 年 01 月 23 日 by cowman.chiang

vim /opt/splunk/etc/system/local/props.conf [mail2000_access] NO_BINARY_CHECK = 1 pulldown_type = 1 [mail2000_imap] NO_BINARY_CHECK = 1 pulldown_type = 1 [mail2000_imss] NO_BINARY_CHECK = 1 pulldown_type = 1 [mail2000_login] NO_BINARY_CHECK = 1 pulldown_type = 1 [mail2000_mailer] NO_BINARY_CHECK = 1 pulldown_type = 1 [mail2000_pop3] NO_BINARY_CHECK = … Continue reading →

Posted in Linux, Splunk | 1 Comment

[Splunk] 修改Google MAP模組圖示的Height值

Posted on 2013 年 01 月 17 日 by cowman.chiang

vim /opt/splunk/etc/apps/maps/default/data/ui/views/maps.xml 搜尋 ( 在module name=”GoogleMaps” 階層內) 預設值為 500px 可以視需要修改

Posted in Linux, Splunk | Leave a comment