Comparing week-over-week results
Comparing week-over-week results is a pain in Splunk. You have to do absurd math with crazy date calculations for even the simplest comparison of a single week to another week.
No more. I wrote a convenient search command called timewrap that does it all, for arbitrary time periods, over *multiple* periods (compare the last 5 weeks). Compare week-over-week, day-over-day, month-over-month, quarter-over-quarter, year-over-year, or any multiple (e.g. two week periods over two week periods). It also supports multiple series (e.g., min, max, and avg over the last few weeks).
After a ‘timechart’ command, just add “| timewrap 1w” to compare week-over-week, or use ‘h’ (hour), ‘m’ (month), ‘q’ (quarter), ‘y’ (year).
I’m done my part. Now do yours — download …
Experimental App Helps Find Other Splunkbase Apps
I’ve recently developed a Splunk app called “splunkbase“. It looks at your Splunk installation and suggests apps on splunkbase.com relevant to your data. It analyzes your indexed data, as well as data in your file system not yet indexed. It also suggests apps based on what other Splunk users have installed at similar installations — sort of like how Amazon will suggest items to purchase based on what other users similar to you have purchase.
The app is simple to run — it’s just one dashboard, with several reports that suggest apps.
Security: At no time is any of your data uploaded or forwarded on. The signatures of all free splunkbase apps are included with this app so …
The 2nd Annual APAC Partner Kick Off
Before we knew it, it is almost time for our 2nd annual APAC partner kick off that will fall on 19th till 21st March 2013 at magnificent Bali, Indonesia. As a preview to all the partners who will be attending this kick off with us, we have lined up a series of rock solid business and technical tracks that will definitely keep their time away from the beaches and bars. I’m sure the partners will gain tremendous values out from these three days.
There are close to 30 tracks that will be delivered, and topics range from global deployment considerations to Splunk modular inputs and SDK to even a rare chance to hear what our legal has to say about …
Splunking Exchange in a Simple XML World
With the release of Splunk 5.0, the Simple XML language we use to define the dashboards and forms for an app was greatly extended. So, we were given a challenge – could a reasonably complex app, such as the Splunk App for Microsoft Exchange – be represented using only Simple XML?
Splunk App for Active Directory and the Top 10 Issues
I work a lot with the various people who plan, deploy and support the Splunk App for Active Directory. Some issues come up quite frequently and I thought it would be a good idea to give you a roadmap of things to check as you deploy your environment. I’ll go through the issue and how to check for it so that you can make your roll-out as smooth as possible.
Analyzing Flurry data
Have a mobile app that sends data to Flurry? Would you like to do some custom analysis on that data? Splunk to the rescue!
The new Flurry App for Splunk provides a scripted input that automatically extracts events from an existing Flurry account.…
Announcing the Splunk App for *Nix 4.6
Quick Tips from .Conf 2012 – Microsoft Solutions
I’ve just got back from .Conf 2012 in Las Vegas, and it was a great conference. I had a great time and met some great customers. We had a booth in the Splunk Labs area demonstrating both the Splunk for Microsoft Exchange app and the Splunk for Microsoft Windows Active Directory app. We spoke to a lot of customers, many of whom were implementing the apps, and even more thought they should be implementing them after seeing the demo. We did two very technical sessions on best practices for deploying each app. We found that too many gigabytes give you a hangover. And yes the rumors are true, there was a monkey.
While at the booth and after the sessions, I answered some fairly common questions, so I’m going to start blogging a little more frequently to share those questions and of course my answers. My first one is this: “How do I alter the Splunk_TA_windows to log to winevents (as recommended) instead of main?”
Speech-to-text with Splunk: converting natural language into Splunk search commands
Is that possible at all? At Splunk, we are constantly experimenting ways to make Splunk more usable. This new approach allows users to “talk” to Splunk (with a microphone) and transforms natural language into Splunk search command.
Notice the small little microphone icon in the textfield? That small little icon unlocks a huge potential to make splunk more user friendly.
Interested to learn more about this concept app?
Come join us at the Chalk-talk session on
Monday, September 10, 2012
5pm – 7pm
Gracia Commons, Level 3 Cosmopolitan Hotel…
Visualizing your Splunk /etc/apps directory
Here’s a thought. “Visualizing the content in the /etc/apps directory of your Splunk instance”. Is that possible with Splunk? There’s an app for that.
Here’s a sneak preview of the app …
Come join us and learn more in the Developing on Splunk sessions at .conf!…