Comparing week-over-week results
Comparing week-over-week results is a pain in Splunk. You have to do absurd math with crazy date calculations for even the simplest comparison of a single week to another week.
No more. I wrote a convenient search command called timewrap that does it all, for arbitrary time periods, over *multiple* periods (compare the last 5 weeks). Compare week-over-week, day-over-day, month-over-month, quarter-over-quarter, year-over-year, or any multiple (e.g. two week periods over two week periods). It also supports multiple series (e.g., min, max, and avg over the last few weeks).
After a ‘timechart’ command, just add “| timewrap 1w” to compare week-over-week, or use ‘h’ (hour), ‘m’ (month), ‘q’ (quarter), ‘y’ (year).
I’m done my part. Now do yours — download …
My experience of building Splunk application
I joined Splunk a couple weeks ago and my first challenge was to learn everything I could about how to build Splunk applications. The best way of doing that is just to write your own application – and this is exactly what I did.
Application which I wrote contains two parts. The first part of application is a very simple scripted input for Firebase, the second part of application is built with the Splunk Web Framework that shows you objects and their routes on Google Maps using both real-time or playback historic information.
I hope that my experience can give you some thoughts about how you can extend Splunk for your needs.…
Splunk and Ford Test Drive Open Data Development in Connected Cars
Using Ford OpenXC to gather data from connected vehicles, Splunk employees hit the streets of San Francisco in a Ford Focus Electric Vehicle and a gas-powered Ford Escape. The data was indexed, analyzed and visualized in Splunk® Enterprise and is now publicly available.
Check out the Connected Car dashboards and watch the video to see all the fun we had!
Want to know more about how we built the project? Keep reading for the technical deep dive.
OpenXC – what it is?
OpenXC is open source hardware/software that allows you to pull a wealth of data off your …
Hunk: Raw data to analytics in < 60 minutes
Update: now with UI setup instructions
Summary of what we’ll do
1. Set up the environment
2. Configure Hunk
3. Analyze some data
So let’s get started ..
Minutes 0 – 20: Set up the environment
In order to get up an running with Hunk you’ll need the following software packages available/installed in the server running Hunk:
1. Hunk bits – download Hunk and you can play with it free for 60 days
2. JAVA – at least version 1.6 (or whatever is …
Hunk is a Big Data Platform for Building Applications on Hadoop
Hunk is not only a revolutionary new software product for exploring, analyzing and visualizing data in Hadoop, it’s also a powerful platform for rapidly building applications powered by data stored in Hadoop Distributed File System (HDFS). If you’re a developer, you can build on the Hunk platform using your choice of popular languages, frameworks and tools without having to manually program MapReduce jobs. Hunk enables you to work with data in Hadoop using your existing skills and a variety of standards-based technologies. If you’re familiar with the developer platform for Splunk Enterprise, you know everything you need to know to develop with Hunk. Taking into account some of the fundamental differences between Hunk and Splunk Enterprise – the data …
Meet Your Splunk App Dev Contest Winners: Splunk for Your Car
When we announced the inaugural Splunk App Dev Contest back in June, we were looking forward to seeing great work done by Splunk developers from all over the world. We received submissions from China, South Africa, India and the United States with use cases spanning digital marketing, network monitoring, ERP management and the Internet of Things. The 1st place team (and winners of the Best App for Social Good) of Rich Acosta and Erica Feldman built a Splunk for Your Car app using an Android phone, an OBD2 Bluetooth adapter, Dropbox, Google Maps and, of course, Splunk. Splunk for Your Car provides individuals with a number of key driving metrics like Average Speed, Maximum Speed, Time Spent Driving, Distance Driven …
Still using 3rd party web analytics providers? Build your own using Splunk!
Why Build Your Own (BYO) Client-Side Analytics?
There are many 3rd party web analytics providers such as Google Analytics and Omniture SiteCatalyst. However, with the flexibility of Splunk as general purpose analytics tool, many site owners opt to build their own client-side analytics powered by Splunk. Last month we talked about how jQuery Foundation had their conference website leverage Splunk to collect & analyze all client-side events.
Compared to off-the-shelf web analytics tools, building your own client-side analytics gives you significant advantages:
- Avoid giving away your users’ data to 3rd party providers
- Own the complete raw client-side data (as opposed to an aggregation or a sampling), and access it securely – and for free
- Unlimited tracking and customization: no collection
The Splunk App for Unix 5.0 is finally here!
| history | search app=”*nix”
Those of you who have been Splunk users for more than 4 years remember the glorious launch of the original Splunk App for Unix. Back in those days, the app shipped with the core product alongside the Splunk App for Windows and had some pretty cutting edge features, including knowledge, dashboards, and saved searches with out-of-the-box email alerts (we’re still sorry, Paul S.).
Well, it took a while for us to follow up that triumphant release, but wait no longer: the new app is finally here! And oh, what’s better, the app is FREE!!! Read on for the technical details of the app.…
What’s New for Developers in Splunk 6
With Splunk Enterprise 6, we’ve delivered capabilities to bring operational intelligence to everyone across the organization. Key to driving operational intelligence across the enterprise with Splunk are, of course, developers. Developers instrument the logs, integrate the data and build the apps to make it happen. In Splunk 6 there are two great new features that make it easier for developers to quickly and efficiently build powerful Splunk apps: the Splunk Web Framework and Data Models
The Splunk Web Framework
The Splunk Web Framework, which was first made available in preview in February, enables developers to use the tools and languages they know to build Splunk apps with custom dashboards, flexible UI and custom data visualizations. Building a Splunk app …
Hunk Setup using Hortonworks Hadoop Sandbox
Hortonworks Sandbox is a personal, portable Hadoop environment that comes with a dozen interactive Hadoop examples. Recently Hortonworks and Splunk released a tutorial and video to install and connect Hunk with the Hortonworks Hadoop Sandbox
This blog summarizes the configurations used as part of the Hunk setup.
Configurations for Hadoop Provider:
|Hadoop Version||Hadoop version 1.x, (MR1)|
|Splunk search recordreader||com.splunk.mr.input.SimpleCSVRecordReader, com.splunk.mr.input.ValueAvroRecordReader|
Configurations for Hadoop Virtual Indexes:
|Path to data in HDFS||/user/hue/raanan/…|
For more Hunk details and examples go to the blog: