Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About ddrillic
ddrillic
Ultra Champion
Member since:
12-26-2014
Saturday
Community Statistics
| Posts | 2285 |
| Solutions | 53 |
| Karma Given | 332 |
| Karma Received | 290 |
| Member Since | 12-26-2014 |
Activity Feed
- Karma Re: Tips on how to create props.conf on Splunk cloud for tscroggins. a week ago
- Karma Re: Tips on how to create props.conf on Splunk cloud for richgalloway. a week ago
- Posted Re: Tips on how to create props.conf on Splunk cloud on Getting Data In. a week ago
- Posted Re: Tips on how to create props.conf on Splunk cloud on Getting Data In. a week ago
- Posted Re: Tips on how to create props.conf on Splunk cloud on Getting Data In. a week ago
- Posted Re: Tips on how to create props.conf on Splunk cloud on Getting Data In. 2 weeks ago
- Karma Re: Tips on how to create props.conf on Splunk cloud for tscroggins. 2 weeks ago
- Posted Re: Tips on how to create props.conf on Splunk cloud on Getting Data In. 2 weeks ago
- Karma Re: Tips on how to create props.conf on Splunk cloud for bowesmana. 2 weeks ago
- Karma Re: How to upgrade OpenSSL on Splunk servers? for PickleRick. 2 weeks ago
- Karma Re: How to specify an index when deploying the Splunk Universal Forwarder on a Windows domain? for Wander. 2 weeks ago
- Posted Re: how to monitor switch, router, firewall, etc? on Getting Data In. a month ago
- Posted Re: Data Onboarding CPU consumption 150% system stuck. on Getting Data In. a month ago
- Posted Re: Forward ingested data on Splunk Cloud Platform. 11-30-2025 03:24 PM
- Posted Re: How to rename dynamic fields ? on Splunk Search. 11-28-2025 02:49 PM
- Karma Re: High Percentage of Small Buckets on Indexer – Mostly on _internal Index for richgalloway. 11-28-2025 02:28 PM
- Karma Re: Does the REST API allow to retrieve the XML source code of Classic Dashboards? for livehybrid. 11-19-2025 02:16 PM
- Karma Re: Does the REST API allow to retrieve the XML source code of Classic Dashboards? for bowesmana. 11-19-2025 02:15 PM
- Got Karma for Re: Who should be the owner of my Saved Search and Reports in Splunk?. 11-19-2025 02:40 AM
- Posted Re: uberAgent on Getting Data In. 11-13-2025 01:46 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-12-2019
09:46 AM
One of our clients wonder which solution is more loosely coupled – the Universal Forwarder or HEC.
I see the decoupling with the Universal Forwarder solution as the writer to the logs and the reader (UF) are completely independent of each other.
However, I'm not sure about the HEC solution.
From Loose coupling
-- In computing and systems design a loosely coupled system is one in which each of its components has, or makes use of, little or no knowledge of the definitions of other separate components. Subareas include the coupling of classes, interfaces, data, and services.1 Loose coupling is the opposite of tight coupling.
... View more
07-12-2019
09:23 AM
What about - | tstats count where index="wineventlog" by host ? works for me ...
... View more
07-12-2019
07:20 AM
1 Karma
A good demo is at DB Connect
... View more
07-11-2019
03:30 PM
Most of the data should be under splunk/var/run/splunk/dispatch .
-- In the dispatch directory, a search-specific directory is created for each search or alert. Each search-specific directory contains several files including a CSV file of the search results, a search.log file with details about the search execution, and more. These are 0-byte files.
You can read about at Dispatch directory and search artifacts
The bottom of the page speaks about -
-- Clean up the dispatch directory based on the age of directories
... View more
07-11-2019
08:01 AM
We use the following in order to assess the search proficiency of our users -
-- Search Proficiency: A measure of how effectively saved searches are written by our users using our SPL language over the selected timeframe. It is calculated by measuring the number of events scanned (Scanned_Count) and the number of events brought back off disk (Event_Count). [Search Proficiency = (Event_Count / Scan_Count) * 100%]
Does it make sense? Can we improve on that?
... View more
- Tags:
- measure
07-10-2019
12:37 PM
Makes perfect sense @richgalloway - thank you.
... View more
07-10-2019
12:28 PM
On the SH I see -
[shclustering]
....
replication_factor = 3
What is the replication_factor in this context?
In the indexer cluster, we have a replication and search factor of 2.
... View more
- Tags:
- replication
07-09-2019
07:36 AM
The following seems to work for me @FrankVl as the period doesn't always exist -
^\d{4}\s+\S+\s+\d+\s+\d{2}\:\d{2}\:\d{2}\s+([a-zA-Z\-0-9]+)
... View more
07-09-2019
07:11 AM
Thank you @richgalloway for all your help - it was interesting to see these *.bundle files on the forwarder ; -)
... View more
07-08-2019
05:38 PM
*Will it always be .domain.com?
Yup
*If so you should be able to use REGEX In syslog or Splunk. I assume you want to do it in syslog?
It's a good question @jkat54 - I guess that syslog is the right place.
... View more
07-08-2019
02:20 PM
Thank you @woodcock.
... View more
07-08-2019
02:19 PM
Much appreciated @MuS.
... View more
07-08-2019
02:07 PM
Not sure about the terminology but I see the following -
/monitor/splunkforwarder-linux/var/run/<app>
$ \ls -tlr
total 1252
-rw-------. 1 splunknu dce 1239040 May 16 11:15 Splunk_TA_nix-1558023151.bundle
-rw-------. 1 splunknu dce 40960 Jun 14 09:38 <app>-1560523046.bundle
And by removing this *.bundle file, the deployment server sends a new one.
... View more
07-08-2019
10:40 AM
I still needs some help to remove the domain name in the REGEX part ; -)
... View more
07-08-2019
10:35 AM
2 Karma
The following worked -
destination d_xxxxx { file("/data/xxxxx/$(uppercase ${HOST})_syslog.log" create_dirs(yes) owner(id) group(zzzzz) template("${FULLDATE} $(uppercase ${HOST}) ${FACILITY} ${PRIORITY} ${PROGRAM} ${MSG} \n")); };
log { source(s_udp514); filter(f_xxxxx); destination(d_xxxxx); flags(final); };
For the file name as well as within the template for the host name - no double quotes ; -)
Thank you @jkat54 !!!
... View more
07-08-2019
06:48 AM
1 Karma
Gorgeous @jkat54 and @FrankVl - as @jkat54 assumed, I do use the syslog daemon to receive this data and write it to disk, for Splunk to read it from file.
I'll try the uppercase function....
Are you also telling me that we can't make conversions using the REGEX command?
... View more
07-06-2019
06:47 PM
1 Karma
Our syslog data looks like - # 2019 Jun 25 17:54:30 xxx-yyy-zzz-8 daemon info DataCollector .
In transforms.conf we have -
[host_override]
REGEX = ^\d{4}\s+\S+\s+\d+\s+\d{2}\:\d{2}\:\d{2}\s+(\S+)\s+
DEST_KEY = MetaData:Host
FORMAT = host::$1
However, our device host names come as -
xxx-yyy-zzz-8 or
xxx-yyy-zzz-8.domain.com or
XXX-YYY-ZZZ-8
So, we would like to normalize the device name to be of upper case and without the domain part, meaning XXX-YYY-ZZZ-8 is the preferred format.
What should I do?
... View more
07-05-2019
08:09 AM
@MuS , so I see indexes with Average Usage % of zero and I wonder what it means. Does it mean that no queries were issued against them in a certain time frame? If so, what's the time frame?
I just wonder if these indexes are good candidates to be removed from the system...
... View more
07-04-2019
05:41 PM
I see the following -
What is the Average Usage % and the 90th Percentile Usage % of the indexes in the Monitoring Console?
... View more
- Tags:
- monitoring
07-03-2019
01:40 PM
You are not missing much ; -)
The Splunk community does seem to agree that a solid, extremely large serverclass.conf is the right design choice, even though the UI stirs you to the app based serverclass.confs .
We ended up speaking about it recently at Do big implementations break down the serverclass.conf into multiple files?
... View more
07-03-2019
10:08 AM
Go please to the bin directory and run ./splunk start as the proper Unix user. Let's see how it behaves ; -)
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Saturday
|
Karma from
Karma given to
