This week in “That happened: notes from #splunk”, a blog about the goings-on in the Splunk IRC channel: how to hire a ninja, the usual assortment of bad jokes, blame-based dashboarding:

I will find you, and I will splunk you

Must have a very particular set of skills…

<Baconesq> We are trying to write a job req for a “splunk person”

<Baconesq> Why is this so hard?

<cerby> Baconesq: because there aren’t enough of us.

<xoff> “Must be rockstar, like Pie.”

<xoff> (and Bacon)

<snowmizer> baconesq: can I work from iowa

<xoff> Baconesq: seriously, I wouldn’t mind a copy of what you come up with. There is potential for more Splunk people here.

<aernan> working with splunk is pretty fun. I could see a big beneft for most companies to have someone to do splunk

<xoff> aernan: I’m so far down the Splunk rabbit hole I’m writing an app to graph how far I’ve come.

<xoff> Baconesq: “Splunk user. Must have own cape” probably doesn’t cut it, eh?

<dragonrol> i like it

<Baconesq> Must speak regex, but still be able to communicate with humans.

Threefer Thursday

Snippets from the collective consciousness:

<^Brian^> dhorn: god hates udp 😛

<xoff> ^Brian^: The actual message was “god doesn’t hate udp” but it lost a few packets…

—

<Baconesq> Javascript is that awkward girl from high school that turned out to be super-hot when she grew up.

<Baconesq> Nobody really noticed her back then, everyone was chasing after her cousin, Java.

—

<DaGryph> OH: There are lines. At Splunk, we help you cross them.

<jtrucks> DaGryph: and then graph and chart the lines and the crossing adventure…

Shame-based education

The LART, in dashboard form:

<N00BZ> WHY CANT I HAVE NICE THINGS!!! :'( Why do my users try to keep bringing down our search head…

<HarriSeld> I like a pie chart on the main app page that shows worst searches, expensive searches, and most errors. A wall of shame, if you will

<N00BZ> HarriSeld : +1 on that plan!

<HarriSeld> but still most keep trying crazy searches or bad regex or missing key things in props.conf to parse data faster.

<Splunker0> Harriseld: I think there is an app with that

<HarriSeld> i want it more self-serve and agile but it makes me cringe when i see some of the apps. rawr

<Splunker0> There are searches that have the longest; most expensive, I think it’s part of the SOS app?

<HarriSeld> yeah SoS

<Splunker0> You could pull out the saved search and logic, put it in any other view

<N00BZ> I’ll make it a monthly report and send a company wide email to really make it good…ok….maybe too far…

<@piebob> ooh make an app out of it “Splunk Shamebot”

<HarriSeld> I have my prototype wallof shame. not purty enough yet

<@piebob> and put it on apps.splunk.com

<HarriSeld> Congratulations, you are our worst searcher! please click here for a link to splunk education

<N00BZ> HA

----------------------------------------------------

Thanks!

rachel perkins