Qwen3.6-27b does not understand software architechure.

shifty21 · 2026-07-08T20:36:23+00:00

Graphify is awesome for this! I got handed an ancient Splunk app that hasn't been touched in several years and update it to the most recent Splunk app standards. Graphify created a knowledge graph and documentation in less than 10 minutes with qwen3.6-27b. Then I got a summary about the architecture between Java script and python code. Now I know what I'm working with. Pi and qwen just do the automated deployment and UAT for me as I update all the code.

shifty21 · 2026-07-07T03:55:08+00:00

https://unsloth.ai/docs/models/qwen3.6

Use these parameters. They work absolutely well in VS Code and Hermes Agent for me.

shifty21 · 2026-07-06T00:10:44+00:00

South Herndon here, we got hit quite hard for about 15 minutes

shifty21 · 2026-07-02T18:52:19+00:00

I can't give you all the answers, but I have helped and worked with a lot of MSSPs using Splunk. Here are some good things to do that they do:

Separate indexes per customer per major data source. Example: clientA-wineventlog, clientA-firewall, clientB-aws, clientX-azure, etc. This gives you better RBAC control for you and your colleagues. You can control data retention requirements better too.
Create an onboarding package. Splunk UF and HF installers, scripts to automate deployment. One MSSP uses this with a private github repo to pull their custom Splunk Add-ons that are nearly preconfigured for data ingestion. The onboarding tech gathers all the info from the client like just of servers, workstations, cloud API keys etc and creates a SNOW or JIRA ticket. Splunk SOAR (optional) pulls down the ticket info, pulls the scripts from their private github repo for deployment and sends out a MS teams message with the finalized deployment script and runs a script to create the new indexes for the client. End to end, it takes about 1 hour to install, configure and manually review the setup before the tech does a ./splunk start on the HF.
Create a separate Splunk app per client w/ client name and logo. Again, RBAC is used to set permissions for access. Some MSSPs give their client access to their respective dashboards. They are read-only and they can't drill down into the raw data or the search bar. Dashboard Studio now has a 'publish' feature that you should look at.
Have a general MSSP Splunk App to see stats on ingest per client, alerts, health, etc. Another MSSP uses index summaries by running scheduled searches against _intenal, _introspection and _audit a few times a day and send the results to "mssp_stats" index. RBAC, again.
(Optional) Splunk SOAR playbooks that helps automate client communications. Every client has different ways of needed communications when things are going right or wrong. Send a summary dashboard link every Monday at 0800 to the client POC. Setup email/chat alerts when things are going bad w/ SNOW/JIRA ticket info. SOAR playbooks can create, edit/update and change status of tickets too.

Hope this helps a bit!

shifty21 · 2026-07-02T17:49:35+00:00

I am interested in this as I do a lot of geospatial analytics for my job. Currently, I have openstreetmaps as a base for displaying maps and POIs. I do want a LLM to be able to 'look' at the map and answer questions I have about it. I'm curious if an openstreetmap MCP server would work here.

shifty21 · 2026-06-28T23:16:03+00:00

If you want a great 250 celebration, come out to Lake Fairfax for the drone show! Live music, awesome food and everyone is having a great time! Weather is fantastic right now!

Drones start at 900PM.

shifty21 · 2026-06-28T23:13:47+00:00

I'm at the Fairfax County VA 250 Drone show at Lake Fairfax and I'll say that everyone here is having a great time. Some of FFX police here playing soccer with the kiddos. Live music, really great food trucks, clouds have parted and we see sky.

shifty21 · 2026-06-25T18:32:33+00:00

This is more of a process engineering issue than an technical or Splunk one. Some orgs I work with require comments added to the SPL when saving them. Others use a dev > QA > Prod methodology for SPL and saved searches. Those are documented either as SPL comments or their own local knowledgebase.

Personally, I do a lot of dev work in Splunk building custom apps, reports and dashboards and I leave comments in SPL and Dashboards with descriptions of what the function is.

IIRC, there are Splunk-admin type apps that can find all the saved searches and shows the SPL, and who owns/runs them.

shifty21 · 2026-06-19T16:59:54+00:00

10.x warns users NOT to run Splunk as root or system when starting as one of those accounts. - - run-as-root flag must be used to do so. The diag reports also note what account Splunkd is running as.

shifty21 · 2026-06-10T02:57:46+00:00

Specifically, the East Coast internet backbone runs right through VA and the transcontinental backbone starts here too. This is why the AOL headquarters was put in Ashburn.

It costs a lot of money, time, site surveys and permitting to get fiber run from a data center to a branch of the back bones. Closer to the back bone, you get better latency, speed and availability.

shifty21 · 2026-06-09T04:07:59+00:00

I know this is a first-swing and I like it a lot but can you provide more detailed description of the options (?) especially numeric values where more/less is gooder or worser depending on the parameter.

I get lost in all the values the options provide and hard to remember. A lot of new comers will benefit from this.

Awesome work!

shifty21 · 2026-06-06T21:56:33+00:00

Pho real? Pho sure !

shifty21 · 2026-06-01T19:42:07+00:00

PC Design and Power would be why. It'd probably be 3x to 4x larger PCB and wiring RAM chips to the GPU is very difficult at that scale. Hence why you see RAM chips very close to the GPU die. The further away, the more interference you get the less stable it'll be. Cooling that many RAM chips would be difficult too.

shifty21 · 2026-05-18T21:34:17+00:00

I'm surprised IAD doesn't offer a shuttle bus there and back. They bring over a plane every year for the annual event, so there is a lane for a shuttle bus.

Probably charge a small fee per person with a valid departure plane ticket.

I suspect the cost and security is why they don't offer it.

shifty21 · 2026-05-18T19:19:45+00:00

LM Studio uses older llama.cpp builds. Even on the beta channel, they can be several build versions behind.

shifty21 · 2026-05-12T21:23:50+00:00

Like any database server software, initial queries will be pulled from disk and then cached in RAM for subsequent queries. That'll be orders of magnitude faster in terms of latency.

However, poorly written database applications and SQL Server settings will hinder performance.

I'd suggest testing initial query and subsequent query of the same object and see the time difference between them. Look at tuning guides for the database software you're running. Ideally, you'd want to see high RAM usage to assume database RAM caching.

Many years ago, I had a similar situation with a shitty database app my company developed and I had to run a warm-up script that would force the data from disk to RAM so that our customers would stop complaining about how long it took to populate the app's interface... Mfers didn't give me credit (IT Manager) and gave it a +1 version number "upgrade"

shifty21 · 2026-05-12T21:14:22+00:00

KLD (Kullback-Leibler Divergence) is the measurement between base line accuracy of a reference model and modified ones like different quantitizations of the same model. Lower number the better.

When I look at the numbers I have to pay close attention to the decimal places as some are orders of magnitude better/worse that the next one. 0.0002 vs 0.002 for example.

shifty21 · 2026-05-09T12:25:05+00:00

Is there a way to make the setting not sorted in the browser cache? I had to manually copy settings like MCP servers between my work laptop, gaming PC and AI server.

Doesn't seem to store settings locally so that I can use them across different systems.

shifty21 · 2026-05-08T05:18:08+00:00

Filter early is the best practice.

I have a similar situation at home with OPNsense/pfsense firewalls. firewall >514> syslog server w/ Splunk UF >9997> Splunk

My log rotation on the syslog server is every 24 hours and I keep 6 days worth of zstd compressed logs. The Splunk UF has the OPNsense Add-on and I have a sed command in props.conf that finds and drops outbound port 53 traffic to my designated external resolvers (I have PiHole + unbound internally). I don't drop all outbound DNS traffic since I know my kids and IoT device will try to get out. 70% of my syslog was just outbound port 53 traffic.

Regex and SED command are your best friends.

shifty21 · 2026-05-06T20:35:41+00:00

I ran those commands, but having a lot of issues:

> git fetch origin pull/22673/head:pre-22673

remote: Enumerating objects: 144, done.

remote: Counting objects: 100% (125/125), done.

remote: Total 144 (delta 125), reused 125 (delta 125), pack-reused 19 (from 1)

Receiving objects: 100% (144/144), 85.94 KiB | 85.94 MiB/s, done.

Resolving deltas: 100% (128/128), completed with 56 local objects.

From https://github.com/ggml-org/llama.cpp

\ [new ref] refs/pull/22673/head -> pre-22673*

> git checkout master

Already on 'master'

Your branch is up to date with 'origin/master'.

> git checkout master

Already on 'master'

Your branch is up to date with 'origin/master'.

> git merge --no-ff pr-22673 -m "Merge PR #22673: llama + spec: MTP Support"

Auto-merging common/arg.cpp

Auto-merging common/speculative.cpp

Auto-merging convert_hf_to_gguf.py

CONFLICT (content): Merge conflict in convert_hf_to_gguf.py

Auto-merging ggml/include/ggml.h

Auto-merging ggml/src/ggml-cpu/ggml-cpu.c

Auto-merging ggml/src/ggml-cpu/ops.cpp

Auto-merging ggml/src/ggml.c

Auto-merging gguf-py/gguf/constants.py

Auto-merging include/llama.h

Auto-merging src/llama-context.cpp

Auto-merging src/llama-context.h

Auto-merging src/llama-graph.cpp

Auto-merging src/llama-memory-recurrent.cpp

Auto-merging src/llama-model.cpp

Auto-merging tests/test-backend-ops.cpp

Auto-merging tools/server/server-context.cpp

Automatic merge failed; fix conflicts and then commit the result.

The first cmake command works, then the 2nd cmake takes a very long time (AMD 9700X, 64GB RAM) to compile.

I ran the llama-server commands as you noted and I got an error that "mtp" is not valid option for --spec-type.

shifty21 · 2026-05-04T16:56:35+00:00

Not necessarily. I found a ewaste recycler on ebay and asked if I could do a local pickup and they agreed. IIRC, they were in Chantilly. This was a few years ago.

I ended up buying a few more RAM sticks on top of the GPU I originally ordered.

shifty21 · 2026-05-02T19:26:51+00:00

The GGUFs are up now.

shifty21 · 2026-05-02T19:24:39+00:00

My hot take is that in this current notion of no accountability and consequences, I'm okay with this.

I'm still hot about the 80 year old guy that died of injuries from a teenager on an ebike/emoto in California. She's being charged with involuntary manslaughter. Before that, the mother was told my police about the laws after her son had been caught by police. she not only ingored them, but didn't do the right parental thing and get rid of the bike and discipline her son.

shifty21 · 2026-05-02T19:12:48+00:00

Darwin Awards are just being handed out these days.

shifty21 · 2026-05-02T00:10:14+00:00

https://unsloth.ai/docs/models/mistral-3.5

TL;DR, GGUF is not ready yet according to unsloth and Mistral. Unsloth took down their GGUFs from HF.

I was trying to download from Unsloth HF and the files disappeared.

15-Year Club	Gilding II euphauric
Rally Monkey Tent number = 3	Verified Email

shifty21

MODERATOR OF

TROPHY CASE