Smart AnSwerS #16

Hey Splunk community and welcome to the 16th installment of Smart AnSwerS.

It seems like there’s a national holiday for almost everything now, and corn dogs fortunately made the cut! National Corn Dog Day was this past Saturday, March 21st, but we celebrated at Splunk HQ last Thursday. Boiling hot oil was at the ready for frying up corn dogs and tater tots all afternoon? I’m sold!

Check out this week’s featured Splunk Answers posts:

How does indexer acknowledgement work with indexer clustering replication to guarantee that no data is lost?

Glenn wanted to fully understand how indexer acknowledgement worked from start to finish in an indexer cluster. He was concerned about possible data loss if the …

» Continue reading

Splunk at Gartner BI & Analytics Summit


We’re very excited to be attending the Gartner Business Intelligence & Analytics Summit this week in Las Vegas. In addition to welcoming attendees in our booth (#517), we’ll also be presenting during the following times:

Theater Session
Monday, March 30 | Showcase Theater A, Forum Ballroom | 6pm-6:20pm
Leverage Machine Data and Deliver New Insights for Business Analytics

The Big Data phenomenon is being driven by the growth of machine data. Critical insights found in machine data enable IT and Security teams to ensure uptime, detect fraud and identify threats. Today, forward-thinking organizations are discovering its value to better understand their customers, improve products, optimize marketing and drive business processes. Learn how Splunk and your machine data can deliver real-time

» Continue reading

Making a dashboard with tabs (and searches that run when clicked)

In this post I am going to walk through how to make a dashboard with content separated into tabs. Not only will the content be divided into tabs, but the searches in the panels will not execute until the tabs are clicked. This prevents the dashboard from running all of the searches at once when the view is first opened.

Using tabs in this way serves two purposes:

  1. Prevent showing too much to a user all at once; a dashboard with more than 4 panels will require scrolling and may overwhelm the user
  2. Prevent too many searches from executing at once; this will improve load times, prevent time outs, and reduce load

The best way to walk through this tutorial …

» Continue reading

Splunk the Vote: Battle For Number 10 – Cameron vs. Milband

Splunk the Vote - Cameron v Miliband

On Thursday 7th May 2015 the UK will hold a General Election to vote for the next Prime Minister.

In the run up to the vote there is going to be a series of pledges, appearances, and debates. Over the coming weeks I am going to be collecting data from various sources of media into Splunk to provide some insight into how each of the main party is faring .

On Thursday 26th March the campaign kicked off proper with the first leaders “debate” (more like interviews) with the Prime Minister, David Cameron, pitted against the Leader of the Opposition, Ed Miliband.…

» Continue reading

.conf2014 Highlight Series: Splunk Monitoring Console

Welcome back to our .conf2014 highlight series! Today, we revisit another one of our most popular sessions of last year’s conference, “Splunk Monitoring – New Native Tools for Monitoring your Splunk Deployment.”

Skill Level:
Good for All Skill Levels

Solution Area:
Splunk Admin, Deploying Splunk

Splunk Enterprise

Presentation overview:
Collecting, interpreting and reporting on what Splunk is doing, especially in a distributed Splunk deployment can be challenging for the Splunk administrator. Where is the data that I’m indexing in Splunk coming from? What searches are taking up large amounts of system resources? How are the machines that Splunk is running on performing? This session covers new native tools in the Splunk platform for performing these and other administrative activities.…

» Continue reading

Troubleshooting connectivity issues to Splunk’s API from the SDK

A common problem we see customers struggle with is how to diagnose connectivity issues with any of our SDKs. In this post, I’ll show you a few tried and true practices that can help you figure out what might be going wrong.

There are two main families of errors folks see. One has to do with general connectivity / connection info, and the other has to do with security config on the client.

General connectivity issues 

This means that you are unable to succesfully connect to the API. The best way I find to diagnose is to drop to a terminal and use curl to login to the Splunk API and see the results. The command to use is:

curl …
» Continue reading

Splunk wins Leading Edge Award from Healthcare Informatics

HCI-InnovatorAwardsWinnerSeal-2015I’m pleased to announce that Splunk was selected for the 2015 Leading Edge Award for Interoperability from Healthcare Informatics! This is truly exciting for us, as healthcare is an area that we’re deeply passionate about.

Recent headlines and legislation have forced a conversation about the best ways to rein in healthcare costs, while keeping in mind patient privacy and security concerns. From an IT perspective, it’s easier to manage costs if you have visibility into your overall operations. Having that single pane of glass view enables you to determine the gaps or overlaps in processes, technologies and controls. But oftentimes, the data resides in disparate silos across the enterprise.

Typically, healthcare organizations must use vendor-specific solutions or create their …

» Continue reading

Downhill Splunking (Part 1)

Splunk GPS

Last month I took some time off and hit the slopes in Jackson Hole, WY.

Yes, it was awesome. And yes, I want to be back there. However things need to be Splunked… starting with the data I collected whilst shredding the mountain.

I used an app called Ski Tracks to collect GPS data, and used Splunk examine it.…

» Continue reading

Splunking the Leftovers

By Billy Priest

From time to time, you may have seen me scuttling out the front door in the evening, toting a heavily loaded Instacart or caterer’s bag. You might have wondered what it was I was carrying out of the building in so carefree a manner.

Wonder no more: It’s the leftovers!

Despite detailed tracking of food and beverage consumption by floor, it’s impossible to buy exactly the right amount of food here at HQ. So when groceries arrive for the third floor, it had been my habit to simply throw away anything that had reached its “sell by” date (I got emails complaining about “expired” food if I didn’t). But since the “sell by” date is often a week or more ahead …

» Continue reading

FIRST Robotic Competition combines the excitement of sport with the rigors of science and technology


By Al Myscich

I have talked with my son’s McKinney High School FRC crew, Team 4300, about what is important during their current competition Recycle Rush. I discovered they need a way to organize the data collected during matches. Splunk could help them organize this information into user friendly dashboards that would allow them to make decisions quickly with the visualizations.

The critical data they need access to is during the autonomous period of the matches. They need to know if the other teams can move to the autozone, move totes to the autozone, move containers to the autozone, or stack totes.

The other detail they need to understand is how successful the other teams are at completing all …

» Continue reading