Splunk

Microsoft Teams is a web application that needs a browser as a runtime environment. In order to keep things simple - at the expense of disk space - the Teams installation package contains not only the actual web app but also all components that are needed to run it, including Chromium. When you launch Teams, you’re really launching the Chromium browser, which then executes the embedded Teams web app. Teams’ browser-based architecture presents challenges when you want to count the number of Teams instances that are running or when you need to find out how many instances of Teams have been started. This article presents multiple ways to determine accurate application usage data.

Splunk search results can be exported from the UI as CSV, JSON, and XML, but not as HTML. This article presents a PowerShell script that converts exported search results from JSON into an HTML table for use with documentation, blogs, etc.

When sizing a new environment it is tempting to use averages. It seems the logical thing to do. But it also guarantees a bad user experience. Example: Sizing an RDS or XenApp Farm Let’s say you’re tasked with building a new Citrix XenApp farm. Being a diligent IT person you set up a pilot: one or two machines with all the right software and settings. Then you carefully select a group of pilot users in such a way that they represent the organization’s employee types statistically correctly. Then you let them work on the new platform, ironing out bugs and such. At the end of that period, you have a great new platform. But there is one big question left: how many servers to buy?!

This article is based on my Splunk .conf 2015 session and is the second in a mini-series on Splunk data model acceleration. Make sure to read parts 1 and 2 first.

This article is based on my Splunk .conf 2015 session and is the second in a mini-series on Splunk data model acceleration. Make sure to read part 1 first. Under the Hood HPAS Population The high-performance analytics store (HPAS) is populated by scheduled searches that run every 5 minutes. The HPAS spans a user-defined time range. Old events are purged automatically by a maintenance process that runs every 30 minutes.

This article is based on my Splunk .conf 2015 session and is the first in a mini-series on Splunk data model acceleration. Why Accelerate? Have you ever seen this? Splunk is great and very fast with needle in a haystack searches, e.g. find a specific keyword in millions of events. It is not so fast with searches that perform calculations on millions of events, e.g. the sum or average of fields.

Citrix Synergy, E2EVC and BriForum are just around the corner. I will be presenting at each of these conferences. Here are a few tidbits to whet your appetite. Citrix Synergy Orlando Having spent the majority of the past weeks preparing my sessions it feels good to finally be able to present! I will be on stage at next week’s Citrix Synergy Orlando three days in a row, starting Tuesday, May 12th at 2 PM with SYN502 - I’ve got 99 problems, and folder redirection is every one of them. That session is a follow-up to the last year’s very successful folder redirection presentation, and I am co-presenting with the awesome Aaron Parker (@stealthpuppy) and Shawn Bass (@ShawnBass).

One of the (many) great things about Splunk is that data, once indexed, is not being tampered with. Of course, you can choose for how long you want to retain your data, but Splunk won’t go and average multiple older events into one, because that would flatten peaks and remove potentially important detail.

Splunk’s Universal Forward has the neat capability of executing arbitrary scripts while capturing their output and sending that to Splunk. This feature allows you to turn any executable, batch file or PowerShell script into a Splunk data source, making the data collection options basically limitless. This post explains a few tricks that are difficult to find otherwise.

In version 2.1 uberAgent collects detailed ICA, PCoIP, and RDP remoting client properties. Yes, that is right, we have added support for VMware Horizon View to our user experience and application performance monitoring product. Read on for more goodness!

The most important change in version 2.0 of uberAgent is the new architecture. In addition to that we have made many other improvements, significantly reducing the agent’s footprint while increasing the quality of the collected data.

You have probably heard of Splunk, but can you describe what it does to a colleague in a few sentences? That is not easy. Splunk does not belong in any traditional category but stands apart from the crowd. That makes it interesting, but also the explaining harder. Here is my attempt.

This is a collection of useful tips and resources for developing Splunk apps. For an explanation of the available app types please see my earlier article on the topic. Splunk Search References and Guides Splunk publishes two excellent resources for learning and working with its search processing language (SPL):

When you start with developing apps for Splunk the first big question you hit is a bit unexpected: which technology do you work with, which app type do you choose?

Splunk has a very extensive REST API - which is just a fancy way of saying that many of its capabilities are accessible via standard HTTP(S) requests. While much of the API is well documented, submitting data from C# to Splunk is kept a bit vague. Since I had to do that recently in order to implement an event generator for uberAgent I thought I might share my two solutions, both with and without the Splunk SDK for C#.

Application startup duration is an essential component of user experience. If you want to make sure that UX on your Windows machines is acceptable you need to monitor the time it takes for applications to start up. That, however, is not exactly easy - without uberAgent for Splunk.

Whether user profiles are loading slowly or group policy processing is taking too long - uberAgent for Splunk tells you exactly what is causing slow logons. uberAgent always supported a broad range of platforms, from physical PCs through virtual desktops to Citrix XenApp. Today we add RES Workspace Manager to that list!

uberAgent has been pretty good at monitoring applications for some time. It is capable of auto-grouping processes to applications and showing IOPS and other stats per application in addition to per process. All this gets even better today: beta 2, available now, adds application usage metering to the feature list.

Who said that end users get all the pretty UIs? Administrators are as happy as anyone to replace ugly consoles with good-looking HTML5 that runs on a smartphone just as well as on a PC.

uberAgent for Splunk monitors Windows machines. It does not try to display as much data as possible but focuses on visualizing what is actually going on instead. In the last post we gave you a glimpse of the information it can display about user sessions and logon times. Today we are going to talk about machines, processes and applications.

uberAgent for Splunk takes Windows monitoring a step further. uberAgent does not just collect data - it gives you the information that matters. Other monitoring products rely on the performance counters built into Windows. uberAgent has its own metrics, covering key aspects of user experience and system performance.