Atlanta Splunkers: User Group This Wednesday!

If you are in the metro Atlanta area, be sure to attend the Splunk User Group happening tomorrow, Wednesday Dec 3rd at 11:30 AM in Dunwoody. Lunch will be served. Topics include:

  • What’s new in Splunk 6
  • App development best practices
  • Exploration of various techniques to get data out of other systems
» Continue reading

Cisco is bringing the Network to the Application—what does that mean in Machine Data terms?

This is a great day for computer networks! Today, Cisco announced their new Application Centric Infrastructure, which consists of a new Nexus 9000 switch product line, the Application Policy Infrastructure Controller (APIC), and major enhancements to their NX-OS embedded operating system. If you want to read between the lines of the press releases, the terms you need to understand are “open” and “ecosystem”. It’s these terms that are most interesting to us at Splunk, and help to paint a picture showing how our technologies and Cisco’s can combine in the future.

So let’s parse things a bit to help you understand how Open and Ecosystem will lead to greater operational intelligence for your data center. Open is about accessibility and …

» Continue reading

Export Search Results with PowerShell

A while back, I wrote an introduction to how you could play with our C# SDK from PowerShell. And just the other day, Adrian wrote a post talking about how you could export really large result sets to CSV, using the REST API. It was a good read, but there was one problem: this was a somewhat Windows-centric post (talking about SharePoint data in his case), but he used curl to get the data out! We can most certainly do better than that for our Windows community, so that’s what I’m here to help solve.

What I ended up doing was to take an example from our dev docs about the search/jobs/export REST endpoint that looks like this:…

» Continue reading

In Atlanta? Learn about Splunk at two events this week!

If you are in the Metro Atlanta area, be sure to check out these two events:

  • Thursday, September 12, the Metro Atlanta Splunk User Group has its first official meeting! Our own Paul Sanford will be speaking. Free lunch!
  • Friday, September 13, the Atlanta Systems Management User Group has an all-day meeting with several sessions. This user group focuses on Microsoft System Center technologies, and Hal Rottenberg will be talking about analyzing System Center Configuration Manager agent logs using Splunk. (And of course, there will also be free food.)

We hope to see you there!…

» Continue reading

Getting Data from Collectd or Graphite into Splunk

I just went through a quick exercise to see how I might get data from a system using collectd into Splunk. In fact, it was so quick, I saved enough time to write a blog post about it. :) Anyone who’s messed with collectd will already be very familiar with RRDtool and RRD databases. If that’s where your thought process went when you saw the title of this blog post: stop. Once the data is in RRD, it’s already stale. Nothing wrong with RRD, it’s great stuff, but tossing things there and then going through a batch process to export from there into Splunk is wholly unnecessary. (On the other hand, if you’ve already got a lot of RRD files, there’s …

» Continue reading

Playing with the Splunk C# SDK–from PowerShell

As those who know me know, I Am Not A Developer. I could convincingly play one on TV, but that’s not the point. The point is this: I don’t have a copy of Visual Studio, and I don’t want to! When in Windows, PowerShell is my language of choice (and for good reason). This blog post will show you, in pretty short order, how to take the newly released Splunk SDK for C#, and use it to connect to a Splunk search head or indexer, but doing so from PowerShell instead of C#.

First, let me acknowledge that we do have a very cool Splunk PowerShell Resource Kit that you can download today. It includes over 40 PowerShell-Splunk cmdlets …

» Continue reading

Learn More about PowerShell and Modular Inputs

For over five years, I have been working with co-host Jonathan Walz on the PowerScripting Podcast, a weekly Internet radio show. The primary topic of the show is the Windows PowerShell scripting language. We like to talk about news, tips, and resources related to the PowerShell community, but the biggest part of most shows is the interview. We’ve had a wide variety of guests on the show, ranging from prolific scripters who enjoy sharing their work, to PM’s, architects, and engineers from largest software and hardware vendors in the world, including Microsoft, IBM, Intel, NetApp, and more.

Recently, we caught up with Joel Bennett, a Windows PowerShell MVP awardee, who also happens to be my teammate on Splunk’s …

» Continue reading

Working with Splunk Indexes using Windows PowerShell

In my last post, I talked about a way to use PowerShell to ease the installation of our Splunk App for VMware. This time, we’ll be using PowerShell in a much different way. As you might already know, the Splunk dev team has made a very robust set of REST API hooks for the product. What you may not know is that this enabled some other talented guys to build a PowerShell module which you can use not only to get data into and out of Splunk, but also to manage your Splunk infrastructure.

Now in my case, I have a goal in mind. I want to answer this question:

How much disk space is being consumed by

» Continue reading

Scripting Your Way with Splunk for VMware

As you might have heard, we recently released a new product: Splunk for VMware.

As you are going through the install guide, you’ll come to a step where you are required to assign a list of twelve privileges to a user account by using the vSphere Client. In order to save time and to reduce the risk of errors due to manual entry, I wrote a script that does the work for you. This script is especially useful if you have multiple vCenter servers and will need to apply the permission across several datacenters.

The script was tested against vSphere 5 with vCenter Server. This script will not work against an ESXi environment without vCenter, due to the …

» Continue reading