Skip to content

Instantly share code, notes, and snippets.

@Zohorul
Zohorul / dashboard.xml
Created September 25, 2021 03:50 — forked from thinkerbot/dashboard.xml
Splunk examples
<?xml version="1.0"?>
<form>
<label>The Battle Overview</label>
<searchTemplate><![CDATA[
index=thebattle | rex field=uri "/battle/(?<thing>[^?]+)(\?color=(?<color>\w+))?" | eval color=if(isnull(color), "", color) | eval strategy=color.thing | stats count by date_hour, bytes, clientip, strategy
]]>
</searchTemplate>
<fieldset>
<input type="time">
<label/>
This is a Gist of useful Splunk Queries.
@Zohorul
Zohorul / AWSDevOpsStudyNotes
Created April 25, 2020 02:37
AWS DevOps Engineer Professional Study Notes
CI & CD:
========
2 core software development processes
CI process of automating regular code commits followed by an automated build and test process designed to highlight intergration issues early.
Additional tooling and functionality provided by Bamboo, CruiseControl, Jenkins, Go and TeamCity etc.
workflow based
CD takes the form of a workflow based process which accepts a tested software build payload from a CI server. Automates the deployment into a working QA, Pre-prod or Prod environment.
AWS CodeDeploy and CodePipeline provide CI/CD services
Elasticbeanstalk and CFN provide functionality which can be utilized by CI/CD servers.
@Zohorul
Zohorul / README.md
Created April 23, 2020 04:53 — forked from androchentw/README.md
How to make fake data in Splunk using SPL

How to make fake data in Splunk using SPL

Sometimes, you need to fake something in Splunk. Might be during development and you don't feel like writing a real search, but you really need a number for a dashboard panel to look right. Maybe you are helping someone with a hairy regex, and you don't want to index data just to test it on your instance. Whatever the reason, here are some searches that have helped me out.

Note that when using these techniques, you are not going through the indexing

@Zohorul
Zohorul / splunk.txt
Created April 14, 2020 18:45 — forked from albertzsigovits/splunk.txt
Splunk SPL cheatsheet
# SPL cheatsheet:
# Additional resource: http://www.bbosearch.com/searches
########################################################
- List users and corresponding roles:
=====================================
| rest /services/authentication/users splunk_server=?
| fields title roles realname
- List indexes:
@Zohorul
Zohorul / cheatsheet.md
Created April 14, 2020 18:43 — forked from domanchi/cheatsheet.md
[splunk cheatsheet] Splunk snippets, because their syntax is so confusing. #splunk

Splunk Queries

I really don't like Splunk documentation. Why is it so hard to find out how to do a certain action? So this is a cheatsheet that I constructed to help me quickly gain knowledge that I need.

Analysis

Events over time

index="my_log"
@Zohorul
Zohorul / Splunk.md
Created April 14, 2020 18:41 — forked from sfloess/Splunk.md
Splunk Tips and Tricks

Splunk

Helpful tips and tricks for Splunk.

Formatting

Splunk uses the | ("or bar") as a means to break up statements. Instead of using one long string of statements, consider deliminating | [statement] on seperate lines.

Example

@Zohorul
Zohorul / setting-up-lamp-ec2.md
Created February 10, 2020 23:38 — forked from keithweaver/setting-up-lamp-ec2.md
Setting up a LAMP stack on Amazon Web Services (AWS) EC2

Setting Up EC2

  1. Sign into AWS
  2. Open EC2
  3. Click Instances on Left Side
  4. Click "Launch Instance"
  5. Select "Amazon Linux AMI 2016.09.1 (HVM), SSD Volume Type"
  6. Select Free Tier
  7. Click review and launch
  8. Press Launch
@Zohorul
Zohorul / installAndConfigureTomcat8.sh
Created October 10, 2019 01:51
Install and configure Tomcat8 on an Amazon Linux AMI using Java OpenJDK 1.8 that starts on reboot.
#!/bin/bash
mkdir /opt/tomcat
yum update -y
yum install java-1.8.0-openjdk-devel httpd24 git -y
service httpd start
chkconfig httpd on
yum remove java-1.7.0-openjdk -y
# calling the version may ensure that java recognizes 1.8 as the new defaut
java -version
echo "JAVA_HOME=/usr/lib/jvm/java-1.8.0-openjdk/jre" | \