可用性を高める為、Splunkサーバを2つ立て、 Heavy Forwarderで相互にデータを転送し合うような構成を考えています。 例えば立てるサーバをサーバA、サーバBの2つとした時、 サーバAで取り込んだデータをローカルインデックスに保存、かつサーバBに転送する。 サーバBで取り込んだデータをローカルインデックスに保存、かつサーバAに転送する。 といったことは可能でしょうか。 検証しているのですが、転送データがループしてしまうという事象が起きています。 おそらく一方向ならデータ転送が可能だと思うのですが、双方向の場合も可能でしょうか？ ... View more

Hi Splunkers, I'm afraid that the question miss the point, but I feel uneasy. I think about using shared disk to Splunk manager(Indexer) to get to auto fail-over in Splunk. I know that Splunk has the cluster configuration, but it needs 4 server(2 peers, 1 master node, 1 search heads) at minimum (Recommended configuration is 3 peers, 1 master, 1 search heads). We cannot get such a enough environment. Considering about the application redundancy, I got an idea of using clustering software(Cluster Pro, lifekeeper, and so on). Did anyone try that deployment ? Thank you for your help. ... View more

Recently I enjoy the new Splunk Application Framework. Overview of the Splunk Application Framework | Splunk I'm really looking forward to seeing the release version (Now it is beta version). It is more easy to create dashboards and apps than in advanced XML. But I got the following errors when I tried sample codes in How to create a page in HTML and JavaScript | Splunk . Again it is beta version. But if anyone knows the solution, please teach me. Thank you for your help. ... View more

Hi Splunkers, I'm now considering of backing up Splunk indexes to prepare for recovery. I know that any buckets without hot are able to back up by copy. Hot buckets are not able to copy because it's always under Splunk process (writing, and so on). So we have an option of rolling from hot to warm manually, but it may be not recommended in terms of search performance that we always do that. And there is an other way to back up hot buckets. That is a snapshot. According to Splunk documentation, it seems that snapshots enable us to get backups of hot buckets. However, we don't always have such tools or environments. Splunk clustering either. Now I want to ask everyone that how to back up hot buckets ? Giving up to backup hot buckets ? Thank you for your help. ... View more

Hi splunkers, I got the errors in "Twitter for Splunk". http://splunk-base.splunk.com/apps/56296/twitter-for-splunk And logs show. 07-06-2013 22:15:35.035 +0900 ERROR FrameworkUtils - Incorrect path to script: /.bintwitter_stream.py. Script must be located inside $SPLUNK_HOME/bin/scripts. 07-06-2013 22:15:35.035 +0900 ERROR ExecProcessor - Ignoring: "/.bintwitter_stream.py" 07-06-2013 22:15:37.626 +0900 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/twitter2/bin/twitter_stream.py" Could not get Twitter credentials from splunk. Error: No credentials supplied, please complete the Twitter app setup I also got the same question in community site, but it seems to be unsolved. http://splunk-base.splunk.com/apps/56296/twitter-for-splunk Please teach me solutions. This is a great app to demonstrate splunk.. Thanks. P.S. The error message which we should pay attention is below. 07-08-2013 12:16:41.820 +0900 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/twitter2/bin/twitter_stream.py" Could not get Twitter credentials from splunk. Error: No credentials supplied, please complete the Twitter app setup 07-08-2013 12:17:41.819 +0900 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/twitter2/bin/twitter_stream.py" Could not get Twitter credentials from splunk. Error: No credentials supplied, please complete the Twitter app setup 07-08-2013 12:18:41.818 +0900 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/twitter2/bin/twitter_stream.py" Could not get Twitter credentials from splunk. Error: No credentials supplied, please complete the Twitter app setup And then my apps configuration is default. If I add my twitter account to "Add Twitter Account Info", I got the error message in window. Encountered the following error while trying to update: In handler 'localapps': Could not validate password for id="credential::MyTwitterAccount:" Should I set my twitter account ? ... View more

Hi Splunkers, I have a question about the following XML. ＜module name="ConvertToIntention"＞ ＜param name="settingToConvert"＞index_setting＜/param＞ ＜param name="intention"＞ ＜param name="name"＞stringreplace＜/param＞ ＜param name="arg"＞ ＜param name="index"＞ ＜param name="fillOnEmpty"＞True＜/param＞ ＜param name="prefix"＞index=＜/param＞ ＜param name="value"＞$target$＜/param＞ ＜/param＞ ＜/param＞ ＜/param＞ Then I've checked that the ConvertToIntention module has a intention parameter in module references. But I couldn't get name, arg, index parameters. Where do those parameters come from ? Are there any resources ? Thank you for your help. ... View more

Hi Splunkers, I have a question about text box layout in dashboard or view. In simple XML, we can look at text box in a row as a following image. Can I change to boxes in line ? In addition, in advanced XML, we can look at that in line. Can I fix as in a row ? ... View more

Hi Splunkers, I've encounter the same problems that i cannot get search results of my custom extracted fields. I previously investigated this situation and I made a conclusion that those log records were not enough for Splunk to recognize the fields. Sample records and reference information are following. input record : 20130624090015008SOMEWORDS_A20130624090016009SOMEWORDS_B Here, I want to extract "20130624090015" as a record's time stamp and "20130624090016" as a field. So I set parameters in props.conf, transforms.conf properly.But I got no result. In details, reference to following question "How to treat the concecutive numbers event ?". Cannot search based on an extracted field | Splunk Blogs http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/ How to treat the concecutive numbers event ? - Splunk Community http://splunk-base.splunk.com/answers/92483/how-to-treat-the-concecutive-numbers-event In Splunk blog, it seems that this problem was solves in Splunk 4.3 and after. But I got this problem in Splunk 5.0.3 on Linux 64bit. So I don't know what it means. Anyway, I think there are three solutions for this problem. 1. Treat as other special fields (like host, source, and so on) 2. Search as "search sourcetype=MyEvents | search Myfield=ValidValue". 3. Specify INDEXED_VALUE = false in props.conf file Actually, 1 is not recommended by Splunk Inc and I also don't want. What do you think of 2, 3 ? Which ways are the best ? Or it was the same in internal procedures of Splunk. Thank you for your help. ... View more

Hi Splunkers, I wanna develop custom python scripts as a search command whose input data is search fields, output data is processed data by itself. Now I have a question that what is the best way of developing custom python scripts. I know that logger.info() method can write to python.log, but not do how to debug and so on. Is there anything way ? Thank you for your help. ... View more