Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About Ant1D
Ant1D
Motivator
Member since:
08-25-2010
05-17-2021
Community Statistics
| Posts | 319 |
| Solutions | 19 |
| Karma Given | 26 |
| Karma Received | 96 |
| Member Since | 08-25-2010 |
Activity Feed
- Got Karma for Where is the Splunk Forwarder older versions page?. 11-18-2021 11:36 AM
- Got Karma for Users who are logged in right now. 09-29-2020 09:39 AM
- Karma Re: Message "Eventtype 'wineventlog-ds' does not exist or is disabled" appears in splunk app for *nix for tsweet_splunk. 06-05-2020 12:48 AM
- Karma Re: Where is the Splunk Forwarder older versions page? for Richfez. 06-05-2020 12:48 AM
- Got Karma for Re: As a Splunk admin user, why am I unable to access the roles menu ("Access controls")?. 06-05-2020 12:48 AM
- Got Karma for Where is the Splunk Forwarder older versions page?. 06-05-2020 12:48 AM
- Got Karma for Where is the Splunk Forwarder older versions page?. 06-05-2020 12:48 AM
- Got Karma for Where is the Splunk Forwarder older versions page?. 06-05-2020 12:48 AM
- Got Karma for Where is the Splunk Forwarder older versions page?. 06-05-2020 12:48 AM
- Got Karma for Where is the Splunk Forwarder older versions page?. 06-05-2020 12:48 AM
- Got Karma for Where is the Splunk Forwarder older versions page?. 06-05-2020 12:48 AM
- Got Karma for Where is the Splunk Forwarder older versions page?. 06-05-2020 12:48 AM
- Got Karma for Where is the Splunk Forwarder older versions page?. 06-05-2020 12:48 AM
- Karma Re: Can SSL configuration be applied on Splunk Universal Forwarders? for mmccullough_mer. 06-05-2020 12:47 AM
- Karma Re: How can we find all the searches, Alerts, Dashboard and ... created (saved) by a user? for mparks11. 06-05-2020 12:47 AM
- Karma Unable to add TCP Data Inputs in Splunk Cloud for bobbyavn. 06-05-2020 12:47 AM
- Got Karma for Is it possible to run dashboard panel searches in a staggered sequence instead of all at once?. 06-05-2020 12:47 AM
- Got Karma for Can SSL configuration be applied on Splunk Universal Forwarders?. 06-05-2020 12:47 AM
- Got Karma for Is it possible to enable License Usage logging on a license slave?. 06-05-2020 12:47 AM
- Got Karma for Is it possible to run dashboard panel searches in a staggered sequence instead of all at once?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 9 | |||
| 1 | |||
| 0 | |||
| 4 | |||
| 1 |
10-22-2014
06:17 AM
1 Karma
Can SSL configuration be applied on Splunk Universal Forwarders? My understanding is that it was only available on Splunk Heavy Forwarders in the past.
Can someone who has done this before kindly confirm.
Thanks in advance for your help.
... View more
10-06-2014
01:19 AM
Yes this command will show me the inputs that Splunk is currently monitoring. It does not indicate if one of these monitored inputs is no longer being indexed for any given reason.
... View more
10-03-2014
09:32 AM
Hey,
Is there an event in splunkd.log which identifies when a stanza defined in inputs.conf which is not disabled is no longer being indexed?
Thanks in advance for your help
... View more
09-23-2014
06:39 AM
Thanks Martin. I will give this a try and update this thread once I have. While it is not ideal, it is a workaround of sorts which is better than nothing 🙂 Not convinced I will be able to use this in a form with token inputs.
In Advanced XML it's easy to do via the EnablePreview module.
It would be interesting to know if anyone has had some trouble with this and what they did to fix that.
... View more
09-23-2014
03:33 AM
Hi,
I was just asked if there was an option to disable the results preview for a chart for which I replied "Yes, there is". We just want to see the final chart with the full results instead of watching the chart build the results in stages as it loads.
So...using Simple XML I added the charting.data.preview property to the end of the attributes that sit within chart tags but it did not disable the results preview:
<option name="charting.chart">column</option>
<option name="charting.axisTitleX.text">Time</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Count</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.data.preview">false</option>
Note: Some of the options were added to the XML by default when making chart changes using the Splunk UI. I am using Splunk v6.0.1.
My understanding according to the Chart Config Reference is that chart data preview is set to false by default so it should not be necessary for me to set the above option for it to work.
Any ideas why my chart continues to preview results? Could one of the other chart properties be the cause? Thanks in advance for your help.
... View more
09-17-2014
09:14 AM
Hi Koorosh, can you edit your question to include an example error message that you are receiving?
You might be able to change the owner of the objects by editing the local.meta file in the Splunk App where these objects reside. There will be a line (owner = ) under each object.
For example if you created dashboards etc inside the default search app, there would be a corresponding $SPLUNK_HOME/etc/apps/search/metadata/local.meta file containing information about the owners of your savedsearches, dashboards (views) etc. which you can amend.
To be safe, make sure that you copy this file before making any changes.
... View more
06-13-2014
08:45 AM
If this is the case, then maybe it will become a feature in one of the future releases
... View more
05-30-2014
03:52 AM
Hi,
When I export to PDF the default Splunk logo appears on the bottom right of the generated PDF. I am aware that this can be hidden but instead I would like to replace this logo with my own company logo.
How can I go about getting my company logo added to Splunk generated PDFs?
Thanks in advance for your help
... View more
- Tags:
- logo
- pdf-report
05-08-2014
06:24 AM
I have found the answer:
http://technet.microsoft.com/en-us/library/cc756386(v=ws.10).aspx
An event with ID=7040 is generated in the Windows Event (System) Logs whenever a service has its start type changed.
... View more
05-08-2014
05:05 AM
Hey,
I am monitoring some Windows Event Log data and I want to see from this any events where the 'startup type' is changed (e.g. from 'Manual' to 'Disabled' OR from 'Disabled' to 'Automatic')
Is this possible? If so, how?
Thanks in advance for your help
... View more
06-13-2013
04:34 AM
Thanks for the input
... View more
06-13-2013
04:21 AM
Thanks for your feedback. I should have specified above that we would like to do this without using Splunk forwarders.
... View more
06-10-2013
04:41 AM
Hey,
How can we configure a load balancer to check that splunkd is running on a server before the load balancer forwards data to that server?
I am aware of different types of keepalive probes that load balancers can use (e.g. ICMP, TCP, UDP, HTTP) and it would be good to know how other Splunk users have approached this.
I am aware that Forwarders handle load balancing but Forwarders will not be used in this instance.
Thanks in advance for your help.
... View more
05-20-2013
06:20 AM
Hi Ayn, if I add this to web.conf and then try to run splunk restart splunkweb or splunk start splunkweb in the CLI will these commands turn splunkweb on OR will this setting in web.conf override any attempts to turn on splunkweb? Thanks
... View more
05-20-2013
04:56 AM
Hey,
Whenever I deploy application App_1 across my Indexers, the application deploys successfully however the splunkweb.exe service on each of these servers is switched back on. As these servers are used for indexing only, the splunkweb.exe service does not need to run on these servers.
Is there an attribute in my config below (taken from serverclass.conf) that can be used to prevent the splunkweb.exe service from starting each time a deployment is executed? restartSplunkWeb=false does not seem to achieve this.
[serverClass:All-Configs]
whitelist.0 = Indexer*
[serverClass:All-Configs:app:App_1]
stateOnClient=enabled
restartSplunkd=true
restartSplunkWeb=false
Thanks in advance for your help.
... View more
05-16-2013
08:55 AM
An example of a traditional load balancer here would be Cisco ACE
... View more
05-16-2013
08:47 AM
Hi I am basically saying that I do not want to use the load balancing functionality on Splunk Forwarders. I essentially want to know if someone has used an alternative to manage how data is sent to collection of forwarders
... View more
05-16-2013
08:32 AM
Hi,
I have set up a Splunk environment in which several applications will be sending data to a collection of indexers. I am considering using a traditional load balancer to manage the receiving of data by the indexers. Is this possible with a traditional load balancer or can I only do load balancing in Splunk via a Forwarder's load balancing capabilities?
Thanks in advance for your replies.
... View more
03-07-2013
02:14 AM
5 Karma
Hi splunk_zen, looking at your query, it seems that you are not bringing the _time field to the point when you need it. Add the _time field to the end of your | stats pipes.
... View more
12-12-2012
07:41 AM
A suitable, but possibly inefficient way to get around this would be to use search macros. The query that triggers the alert can be stored in a search macro. This would mean that when the alert is sent, the email will only contain the name of the search macro. This means that the search query is hidden from the email recipient.
... View more
12-04-2012
01:14 AM
It's a combination of issues. The size of some of the events, we were receiving high numbers of events containing stack traces. Also, there were a high number of UDP in-connections during peak periods which was causing the server to slow down.
... View more
12-03-2012
07:33 AM
1 Karma
Hey,
I have seen the following messages in the past when using/trying to access the Splunk UI:
Splunkd daemon is not responding...
The splunkd daemon cannot be reached by splunkweb
I would like to set up some alerts to inform me when the above events happen. How can this be done?
Does anyone have a ready-made search query for this? Is it simply the case of building search queries that look for such phrases in the internal logs (splunkd.log)?
Thanks in advance for your help.
... View more
11-20-2012
02:26 AM
I am not using any of those apps. I have a decent understanding of Splunk performance. Just looking for some tips on how I can stop the described performance issue from reoccurring. The events coming in are not large (e.g. roughly 10 field="value" pairs in each event). Most dashboards have 1 or 2 searches. Concurrent searches are also minimal.
... View more
11-20-2012
02:18 AM
1 Karma
Thanks for your comments. It's a 2.27GHz 16-core server as described above with 24GB RAM. It's indexing up to 7GB a day. The bulk of this indexing is coming from a UDP port and occasionally in busy periods (when large amounts of upcoming data is coming via this port from numerous hosts) Splunk slows down and the UI can become unavailable. I would have thought that this server would be able to handle that.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-17-2021
11:31 AM
|
Karma given to
