ML Archives - ISbyR https://isbyr.com/tag/ml/ Infrequent Smarts by Reshetnikov Mon, 09 Dec 2024 02:30:35 +0000 en-US hourly 1 https://wordpress.org/?v=6.7.1 Splunk Failed to apply rollup policy to index… Summary span… cannot be cron scheduled https://isbyr.com/splunk-failed-to-apply-rollup-policy-to-index-summary-span-cannot-be-cron-scheduled/ https://isbyr.com/splunk-failed-to-apply-rollup-policy-to-index-summary-span-cannot-be-cron-scheduled/#respond Wed, 14 Dec 2022 23:12:08 +0000 http://isbyr.com/?p=1003 I started playing for Splunk Metrics rollups and but then tried to step out of the box and got a “Failed to apply rollup policy to index=’…’. Summary span=’7d’ cannot be cron scheduled” error. While you can configure the rollup policies in the Splunk UI, you can also do it using Splunk’s REST API or … Continue reading Splunk Failed to apply rollup policy to index… Summary span… cannot be cron scheduled

The post Splunk Failed to apply rollup policy to index… Summary span… cannot be cron scheduled appeared first on ISbyR.

]]>
I started playing for Splunk Metrics rollups and but then tried to step out of the box and got a “Failed to apply rollup policy to index=’…’. Summary span=’7d’ cannot be cron scheduled” error.

Splunk metrics rollup configuraiton

While you can configure the rollup policies in the Splunk UI, you can also do it using Splunk’s REST API or using spunk configuration files (metric_rollups.conf).

Here is the interesting part: your rollup span value is limited only to the values available in the UI drop-down (no matter which method of configuration you are using).

The options that you can use are:

Minute SpanHourly SpanDaily SpanNotes
1m*requires limits.conf update
2m*requires limits.conf update
3m*requires limits.conf update
5m
6m
10m
12m
20m
30m
60m1h
1h
3h
4h
6h
8h
12h
24h1d
Splunk rollup spans allowed for metrics rollups

If you will try to use any other value you will see the following error in the splunkd.log: 12-12-2022 14:04:08.645 +1100 ERROR MetricsRollupPolicy [12181677 TcpChannelThread] - Failed to apply rollup policy to index='...'. Summary span='7d' cannot be cron scheduled.

This is not (as of 15/12/2022) a documented “feature”.

Other posts about Splunk

The post Splunk Failed to apply rollup policy to index… Summary span… cannot be cron scheduled appeared first on ISbyR.

]]>
https://isbyr.com/splunk-failed-to-apply-rollup-policy-to-index-summary-span-cannot-be-cron-scheduled/feed/ 0
Plotting Splunk with the same metric and dimension names shows NULL https://isbyr.com/plotting-splunk-with-the-same-metric-and-dimension-names-shows-null/ https://isbyr.com/plotting-splunk-with-the-same-metric-and-dimension-names-shows-null/#respond Wed, 05 Oct 2022 12:19:34 +0000 http://isbyr.com/?p=977 When you try plotting on a graph Splunk metric split by a dimension with the same name (as the metric itself) will show NULL instead of the dimension. The Problem Let’s rewind a little. Below is the payload that is sent to Splunk HEC and you will notice that there are 2 “statuses”: In the … Continue reading Plotting Splunk with the same metric and dimension names shows NULL

The post Plotting Splunk with the same metric and dimension names shows NULL appeared first on ISbyR.

]]>
When you try plotting on a graph Splunk metric split by a dimension with the same name (as the metric itself) will show NULL instead of the dimension.

Splunk timechart visualisation with breakdown by dimension with the same metric and dimension names will show NULL

The Problem

Let’s rewind a little.

Below is the payload that is sent to Splunk HEC and you will notice that there are 2 “statuses”:

  • "status": "success" – which is one of the dimensions and it can represent a collector/monitor status
  • "metric_name:status": 0 – which is the actual metric value that was collected by the collector/monitor
{
    "time": 1664970920,
    "event": "metric",
    "host": "host_5.splunk.com",
    "index": "d_telegraf_metrics",
    "fields": {
        "collector": "collector_a",
        "status": "success",
        "metric_name:query_time_seconds": 10.869,
        "metric_name:status": 0
    }
}

In the perfect world where you would probably rename one of these not to confuse the end-user in Splunk, but that (living in a perfect world) is not always the case.

As a result, we end up with NULLs in the graphs 🙁

The Solution

Lucky for us Splunk’s search language (SPL) is very powerful and flexible and with two little modifications to the “original” SPL (that was produced by the Metrics Analyzer), we can solve the issue.

All you need to do is :

  1. instead of prestats=true rename the metric function result using as command.
  2. update the avg function in the timechart command to use the renamed field name.

Original SPL:

original Splunk SPL that was causing NULL in graphs

Revised SPL:

fixed Splunk SPL that shows the breakdown by dimension with the same name as the metric

The Result

Splunk fixed timechart visualisation

More posts about Splunk

The post Splunk Failed to apply rollup policy to index… Summary span… cannot be cron scheduled appeared first on ISbyR.

]]>
https://isbyr.com/splunk-failed-to-apply-rollup-policy-to-index-summary-span-cannot-be-cron-scheduled/feed/ 0
Splunk Failed to apply rollup policy to index… Summary span… cannot be cron scheduled https://isbyr.com/splunk-failed-to-apply-rollup-policy-to-index-summary-span-cannot-be-cron-scheduled/ https://isbyr.com/splunk-failed-to-apply-rollup-policy-to-index-summary-span-cannot-be-cron-scheduled/#respond Wed, 14 Dec 2022 23:12:08 +0000 http://isbyr.com/?p=1003 I started playing for Splunk Metrics rollups and but then tried to step out of the box and got a “Failed to apply rollup policy to index=’…’. Summary span=’7d’ cannot be cron scheduled” error. While you can configure the rollup policies in the Splunk UI, you can also do it using Splunk’s REST API or … Continue reading Splunk Failed to apply rollup policy to index… Summary span… cannot be cron scheduled

The post Splunk Failed to apply rollup policy to index… Summary span… cannot be cron scheduled appeared first on ISbyR.

]]>
I started playing for Splunk Metrics rollups and but then tried to step out of the box and got a “Failed to apply rollup policy to index=’…’. Summary span=’7d’ cannot be cron scheduled” error.

Splunk metrics rollup configuraiton

While you can configure the rollup policies in the Splunk UI, you can also do it using Splunk’s REST API or using spunk configuration files (metric_rollups.conf).

Here is the interesting part: your rollup span value is limited only to the values available in the UI drop-down (no matter which method of configuration you are using).

The options that you can use are:

Minute SpanHourly SpanDaily SpanNotes
1m*requires limits.conf update
2m*requires limits.conf update
3m*requires limits.conf update
5m
6m
10m
12m
20m
30m
60m1h
1h
3h
4h
6h
8h
12h
24h1d
Splunk rollup spans allowed for metrics rollups

If you will try to use any other value you will see the following error in the splunkd.log: 12-12-2022 14:04:08.645 +1100 ERROR MetricsRollupPolicy [12181677 TcpChannelThread] - Failed to apply rollup policy to index='...'. Summary span='7d' cannot be cron scheduled.

This is not (as of 15/12/2022) a documented “feature”.

Other posts about Splunk

The post Splunk Failed to apply rollup policy to index… Summary span… cannot be cron scheduled appeared first on ISbyR.

]]>
https://isbyr.com/splunk-failed-to-apply-rollup-policy-to-index-summary-span-cannot-be-cron-scheduled/feed/ 0
Plotting Splunk with the same metric and dimension names shows NULL https://isbyr.com/plotting-splunk-with-the-same-metric-and-dimension-names-shows-null/ https://isbyr.com/plotting-splunk-with-the-same-metric-and-dimension-names-shows-null/#respond Wed, 05 Oct 2022 12:19:34 +0000 http://isbyr.com/?p=977 When you try plotting on a graph Splunk metric split by a dimension with the same name (as the metric itself) will show NULL instead of the dimension. The Problem Let’s rewind a little. Below is the payload that is sent to Splunk HEC and you will notice that there are 2 “statuses”: In the … Continue reading Plotting Splunk with the same metric and dimension names shows NULL

The post Plotting Splunk with the same metric and dimension names shows NULL appeared first on ISbyR.

]]>
When you try plotting on a graph Splunk metric split by a dimension with the same name (as the metric itself) will show NULL instead of the dimension.

Splunk timechart visualisation with breakdown by dimension with the same metric and dimension names will show NULL

The Problem

Let’s rewind a little.

Below is the payload that is sent to Splunk HEC and you will notice that there are 2 “statuses”:

  • "status": "success" – which is one of the dimensions and it can represent a collector/monitor status
  • "metric_name:status": 0 – which is the actual metric value that was collected by the collector/monitor
{
    "time": 1664970920,
    "event": "metric",
    "host": "host_5.splunk.com",
    "index": "d_telegraf_metrics",
    "fields": {
        "collector": "collector_a",
        "status": "success",
        "metric_name:query_time_seconds": 10.869,
        "metric_name:status": 0
    }
}

In the perfect world where you would probably rename one of these not to confuse the end-user in Splunk, but that (living in a perfect world) is not always the case.

As a result, we end up with NULLs in the graphs 🙁

The Solution

Lucky for us Splunk’s search language (SPL) is very powerful and flexible and with two little modifications to the “original” SPL (that was produced by the Metrics Analyzer), we can solve the issue.

All you need to do is :

  1. instead of prestats=true rename the metric function result using as command.
  2. update the avg function in the timechart command to use the renamed field name.

Original SPL:

original Splunk SPL that was causing NULL in graphs

Revised SPL:

fixed Splunk SPL that shows the breakdown by dimension with the same name as the metric

The Result

Splunk fixed timechart visualisation

More posts about Splunk

The post Plotting Splunk with the same metric and dimension names shows NULL appeared first on ISbyR.

]]>
https://isbyr.com/plotting-splunk-with-the-same-metric-and-dimension-names-shows-null/feed/ 0