Where should I install Splunk App for AppDynamics and Splunk Add-on for AppDynamics ? Add-on @ Indexer and App @ Search Head? Much appreciated! ... View more

Hello, Say for example a five 50MB sample.log.gz (250MB) and if decompressed, it becomes five 600MB (3GB) sample.log and these are being indexed per day. What is the best way to index logs in this case? compressed or just raw logs? And what's the difference in terms of speed and impact with default UF thruput? Much appreciated! ... View more

Hello, Here's our Splunk setup: 3 Indexers (not clustered) 1 Search Head/Deployment Server 1 Log Server (acts like Heavy Forwarder) All Splunk instances are reporting to Deployment Server and indexes are app-based. Log Server is basically a log server where other integrations that doesn't require Forwarder use this to dump their logs and we push an application from Deployment server to monitor the logs in the Log server. Questions: 1. Where should I enable HEC? This will be my first time using an HEC and I'm not sure if I'll enable it to Log server or Deployment Server. 2. If I will enable it to our Log Server, will there be API logs that will be dumped/generated somewhere that I can just monitor using deployed monitor apps from Deployment Server? 3. If I will enable it to our Deployment Server, my concern here is if it will generate actual logs which should be done in Log Server and if it will not generate logs on the server, what is the behavior of the API logs upon enabling it to Deployment server? 4. Will the API logs directly be indexed on the defined index? (i.e. index=api_logs) 5. High level explanation for Indexer Acknowledgement? Can someone kindly answer all my 5 questions? PS. Already read this btw: http://dev.splunk.com/view/event-collector/SP-CAAAE73 Much appreciated! ... View more

Hello, So I followed this doc below: http://docs.splunk.com/Documentation/MLApp/2.2.0/API/CorrelationMatrix Now I am getting this error upon following the example search: Error in 'fit' command: (ImportError) cannot import name BaseAlgo Below is the splunkd error in debug mode: 05-12-2017 16:22:38.972 +0800 ERROR ChunkedExternProcessor - stderr: (ImportError) cannot import name BaseAlgo 05-12-2017 16:22:38.973 +0800 ERROR ChunkedExternProcessor - stderr: Traceback (most recent call last): 05-12-2017 16:22:38.973 +0800 ERROR ChunkedExternProcessor - stderr: File "/appl/splunk/etc/apps/Splunk_ML_Toolkit/bin/cexc/init.py", line 127, in run 05-12-2017 16:22:38.973 +0800 ERROR ChunkedExternProcessor - stderr: while self.handle_chunk(): 05-12-2017 16:22:38.973 +0800 ERROR ChunkedExternProcessor - stderr: File "/appl/splunk/etc/apps/Splunk_ML_Toolkit/bin/cexc/init.py", line 254, in _handle_chunk 05-12-2017 16:22:38.973 +0800 ERROR ChunkedExternProcessor - stderr: ret = self.handler(metadata, body) 05-12-2017 16:22:38.973 +0800 ERROR ChunkedExternProcessor - stderr: File "/appl/splunk/etc/apps/Splunk_ML_Toolkit/bin/fit.py", line 182, in handler 05-12-2017 16:22:38.973 +0800 ERROR ChunkedExternProcessor - stderr: return self.setup() 05-12-2017 16:22:38.973 +0800 ERROR ChunkedExternProcessor - stderr: File "/appl/splunk/etc/apps/Splunk_ML_Toolkit/bin/fit.py", line 117, in setup 05-12-2017 16:22:38.973 +0800 ERROR ChunkedExternProcessor - stderr: algos = __import_("algos", fromlist=["*"]) 05-12-2017 16:22:38.973 +0800 ERROR ChunkedExternProcessor - stderr: File "/appl/splunk/etc/apps/Splunk_ML_Toolkit/bin/algos/CorrelationMatrix.py", line 1, in 05-12-2017 16:22:38.973 +0800 ERROR ChunkedExternProcessor - stderr: from base import BaseAlgo 05-12-2017 16:22:38.973 +0800 ERROR ChunkedExternProcessor - stderr: ImportError: cannot import name BaseAlgo 05-12-2017 16:22:38.973 +0800 ERROR ChunkedExternProcessor - Error in 'fit' command: (ImportError) cannot import name BaseAlgo Things I already checked: - Installed Python for Scientific Computing properly with respect to its OS architecture and not renamed it. - Splunk runs with the same user who installed the app. Any idea guys? Much appreciated! ... View more

Hello Splunkers! So I want to add an algorithm to Machine Learning Toolkit. Is the Finished Example below the link, which is the CorrelationMatrix, is the algorithm for pearson, kendal, and spearman? http://docs.splunk.com/Documentation/MLApp/2.2.0/API/CorrelationMatrix Would like to validate this to you guys as I'm not sure if I'm understanding it right. Much appreciated! ... View more