acharlieh

| noop | stats count | fields 
| eval num=mvrange(0,40,1) | mvexpand num 
| eval _time=relative_time(now(),"-".num."d@d")
| eval day=strftime(_time,"%A - %F") 
| timechart span=w count,list(day)

Have your search time range be at least: earliest=-40d@d latest=now otherwise you confuse the embedded bucket command by presenting data that's not in the time range.

acharlieh

index=yourindexes sourcetype=access_combined uri_path=/login
| eval _time=relative_time(_time,"@m") 
| stats count by clientip,_time 
| where count > X 
| appendpipe 
  [ dedup clientip
  | map 
    [ gentimes increment=1m 
      [ noop 
      | stats count 

acharlieh

perl -ne " if (/^(version\s+'\d+\.\d+\.)(\d+)('.*)/) { \$fix = \$2 + 1; print \"\$1\$fix\$3\n\" } else { print }" metadata.rb

acharlieh

import java.net.URI;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

//You'll need: https://github.com/OfficeDev/ews-java-api/

import microsoft.exchange.webservices.data.core.ExchangeService;
import microsoft.exchange.webservices.data.core.PropertySet;
import microsoft.exchange.webservices.data.core.service.folder.Folder;
import microsoft.exchange.webservices.data.core.service.item.Item;

acharlieh

# -*- mode: ruby -*-
# vi: set ft=ruby :

@boxes = {
  centos510: {box:'opscode_centos-5.10_provisionerless',box_url:'http://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_centos-5.10_chef-provisionerless.box'},
  centos65: {box:'opscode_centos-6.5_provisionerless',box_url:'http://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_centos-6.5_chef-provisionerless.box'},
}

Vagrant.configure('2') do |config|
  config.berkshelf.enabled = false

acharlieh

# -*- mode: ruby -*-
# vi: set ft=ruby :

@boxes = {
  centos510: {box:'opscode_centos-5.10_provisionerless',box_url:'http://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_centos-5.10_chef-provisionerless.box'},
  centos65: {box:'opscode_centos-6.5_provisionerless',box_url:'http://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_centos-6.5_chef-provisionerless.box'},
}

Vagrant.configure('2') do |config|
  config.berkshelf.enabled = false

acharlieh

require 'chef-vault'
data = JSON.parse(File.open('data_bags/cerner_splunk/license_secrets_keys.json').read())

keys = (data['clients'] + data['admins']).inject({}) do |m,c|
  pem = (c == 'knife_workstation') ? 'fake-key.pem' : "pems/#{c}.pem"
  private_key = OpenSSL::PKey::RSA.new(File.open(pem).read())
  m[c] = private_key.private_decrypt(Base64.decode64(data[c]))
  m
end

acharlieh

require 'json'

# Cookbooks from a folder (like when you do a berks vendor)
# json = Dir.glob('./*/metadata.json').collect do |file|

# Cookbooks from a node cache
json = Dir.glob('/var/chef/cache/cookbooks/*/metadata.json').collect do |file|
  hash = JSON.parse(File.read(file))
  { hash['name'] => hash['version'] }
end.reduce({}, :merge).to_json

acharlieh

| gentimes increment=1s 
    [ makeresults 
    | addinfo 
    | rename info_max_time -> end info_min_time -> start 
    | fields start end 
    | convert timeformat="%m/%d/%y:%H:%M:%S" ctime(*) as * 
    | format "" "" "" "" "" ""] 
| rename starttime -> _time 
| fields 
| bin span=1h _time as hourly 

acharlieh

Keybase proof

I hereby claim:

• I am acharlieh on github.
• I am acharlieh (https://keybase.io/acharlieh) on keybase.
• I have a public key ASCTCJPIiM2QV1Bq-J5ffyxWr3k473iamt6WWV4ohHZusAo

To claim this, I am signing this object: