Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About ddrillic
ddrillic
Ultra Champion
Member since:
12-26-2014
Friday
Community Statistics
| Posts | 2291 |
| Solutions | 53 |
| Karma Given | 336 |
| Karma Received | 291 |
| Member Since | 12-26-2014 |
Activity Feed
- Posted Hierarchy within the waslogs monitor stanzas on Getting Data In. Friday
- Karma Re: Time format in props with INDEXED_EXTRACTIONS = csv for PickleRick. a week ago
- Posted Re: Time format in props with INDEXED_EXTRACTIONS = csv on Getting Data In. a week ago
- Karma Re: Time format in props with INDEXED_EXTRACTIONS = csv for PickleRick. a week ago
- Karma Re: Time format in props with INDEXED_EXTRACTIONS = csv for livehybrid. a week ago
- Karma Re: Time format in props with INDEXED_EXTRACTIONS = csv for PickleRick. a week ago
- Posted Time format in props with INDEXED_EXTRACTIONS = csv on Getting Data In. 2 weeks ago
- Got Karma for Re: Scaling the Deployment Server (Old Way, new Way). 2 weeks ago
- Posted Re: Can I ingest a comma separated text file as a csv file? on Getting Data In. 2 weeks ago
- Posted Can I ingest a comma separated text file as a csv file? on Getting Data In. 2 weeks ago
- Posted Re: Scaling the Deployment Server (Old Way, new Way) on Deployment Architecture. 2 weeks ago
- Karma Re: Tips on how to create props.conf on Splunk cloud for tscroggins. 12-30-2025 01:54 PM
- Karma Re: Tips on how to create props.conf on Splunk cloud for richgalloway. 12-30-2025 01:54 PM
- Posted Re: Tips on how to create props.conf on Splunk cloud on Getting Data In. 12-30-2025 09:17 AM
- Posted Re: Tips on how to create props.conf on Splunk cloud on Getting Data In. 12-29-2025 05:22 PM
- Posted Re: Tips on how to create props.conf on Splunk cloud on Getting Data In. 12-29-2025 07:04 AM
- Posted Re: Tips on how to create props.conf on Splunk cloud on Getting Data In. 12-28-2025 01:57 PM
- Karma Re: Tips on how to create props.conf on Splunk cloud for tscroggins. 12-28-2025 01:57 PM
- Posted Re: Tips on how to create props.conf on Splunk cloud on Getting Data In. 12-24-2025 04:32 PM
- Karma Re: Tips on how to create props.conf on Splunk cloud for bowesmana. 12-24-2025 04:31 PM
05-30-2019
08:47 AM
1 Karma
When our automated process detects a server which got retried, we would like to to remove this server from the serverclass.conf file.
However we are not sure how to mark easily this server as out in serverclass.conf -
We have, let's say -
[serverClass:test]
whitelist.0 = serverA
whitelist.1 = serverB
whitelist.2 = serverC
whitelist.3 = serverD
So, serverC got retired, for example. Can we simply comment it? meaning, is it allowed to skip numbers?
[serverClass:test]
whitelist.0 = serverA
whitelist.1 = serverB
#whitelist.2 = serverC
whitelist.3 = serverD
Or maybe mark it as a dummy
[serverClass:test]
whitelist.0 = serverA
whitelist.1 = serverB
whitelist.2 = dummy - non existent server name
whitelist.3 = serverD
... View more
05-30-2019
08:34 AM
Looking at | inputlookup dmc_forwarder_assets.csv | stats count by status and 25K are missing and 8K are active, in our case.
Is there a schedule search which adds regularly new phoned home forwarders to the lookup table?
What's the proper way to handle deletions from this lookup?
... View more
- Tags:
- ms
05-30-2019
06:44 AM
For reference @chrispounds, this beautiful answer by @acharlieh at What is the basic difference between the lookup, inputlook and outputlookup commands
... View more
05-30-2019
06:34 AM
A starting point can be at Using Syslog-ng with Splunk
... View more
05-29-2019
03:08 PM
Are these Cisco Meraki Firewall logs on disk already?
... View more
05-29-2019
01:23 PM
@jeremyjh, extra information at Configure automatic key-value field extraction
KV_MODE = none
-- Disables field extraction for the source, source type, or host identified by the stanza name. Use this setting to ensure that other regular expressions that you create are not overridden by automatic field/value extraction for a particular source, source type, or host. Use this setting to increase search performance by disabling extraction for common but nonessential fields. We have some field extraction examples at the end of this topic that demonstrate the disabling of field extraction in different circumstances.
... View more
05-29-2019
08:17 AM
Where is your deploymentclient.conf on the forwarder? Is it under $SPLUNK_HOME/etc/system/local ?
... View more
05-27-2019
05:18 PM
A related thread at Is it safe to delete .bundle files ?
... View more
05-24-2019
12:27 PM
Just keep in mind that in serverclass.conf there is the restartSplunkd capability -
restartSplunkd = true | false
* If true, restarts splunkd on the client when a member app or a directly
configured app is updated.
* Can be overridden at the serverClass level and the serverClass:app level.
* Defaults to false
It's being used also for a restart of a set of forwarders, when needed.
... View more
05-24-2019
10:08 AM
Can you please check the source code of your dashboads and see whether you have something like <dashboard refresh="X"> or <form refresh="30"> ?
... View more
05-23-2019
02:16 PM
I see @brenthale ; - ) I had a similar case at Does a dashboard keep refreshing itself by default?
Does it make sense?
... View more
05-23-2019
12:00 PM
What exactly is refreshing? maybe a screen-shot...
... View more
05-23-2019
07:47 AM
Really interesting @jkat54.
... View more
05-23-2019
07:35 AM
ms:iis:auto doens't work for us while ms:iis:default with TZ adjustment works - weird.
... View more
05-22-2019
09:20 AM
A colleague said -
When it comes to the IIS TA, only one of the sourcetypes will actually work on the indexers whereas the second sourcetype needs to have either the TA or a separate props.conf deployed to the forwarder since it’s using INDEXED_EXTRACTIONS .
Deploying the full TA is overkill, IMO. Just need to throw in the following into a new props.conf for the forwarder and you’re all set.
INDEXED_EXTRACTIONS = w3c
TIMESTAMP_FIELDS = date, time
... View more
05-22-2019
09:17 AM
Looks the same as the file itself above...
... View more
05-22-2019
08:32 AM
1 Karma
For some reason, the _time for the ms:iis:auto events are taken from the file change/create time, which seems to be either the creation or the daily rotation time.
In the file itself the date/stamp look just fine -
2017-07-01 00:00:00 10.106.180.47 GET /cl_includes/sitemin....
2017-07-01 00:00:00 10.106.180.47 GET /cl_includes/common_....
2017-07-01 00:00:00 10.106.180.47 GET /cl_includes/images/....
2017-07-01 00:00:00 10.106.180.47 GET /health.html - 443 -....
2017-07-01 00:00:01 10.106.180.47 GET /health.html - 443 -....
2017-07-01 00:00:06 10.106.180.47 GET /health.html - 443 -....
2017-07-01 00:00:06 10.106.180.47 GET /health.html - 443 -....
... View more
05-21-2019
01:07 PM
If you look at the Cluster Master, Indexer clustering view and then Indexes, you can see the Replicated Data Copies and the Searchable Data Copies. It shows that the moment you have one replicated data copy which becomes one searchable data copy, this data is searchable.
Btw, do you really need a replication factor of 3?
... View more
Gorgeous stuff as usual @rob_jordan - your visios are legendary ; -)
... View more
05-21-2019
10:43 AM
2 Karma
A similar case at $SPLUNK_HOME not set
It speaks about ./splunk envvars which shows all the environment variables.
... View more
05-21-2019
08:31 AM
Wow, very elaborate process @koshyk ; -)
... View more
05-21-2019
08:28 AM
For the record, we are "stuck" here in our place with sslCertPath for backward compatibility since we still have forwarders older than 6.5.2. They will not work with clientCert .
... View more
05-21-2019
08:06 AM
Our SE said -
It’s out of scope of the tool.
What btool does is pretty simple under the covers. We have in our configuration files .spec files. .spec files define what values can and cannot be loaded into Splunk. The definitions here are pretty simple. Usually it’s something like.
[stanza1]
setting1 = string
setting2 = blob
setting3 = int
setting4 = string
When you run btool, we’re taking all the configurations that will be loaded into Splunk and checking if the stanza and setting combination are valid and if the type of value you’ve given is of the type defined.
In your example, Splunk has loaded a valid config like this
[monitor://] : ignoreOlderThan : = : string
Btool doesn’t have the capability of checking any more than that. For that you’d need a “fuzzing” tool or “debugger” in programming terminology. I’m not aware of any for Splunk specifically though.
... View more
05-21-2019
07:06 AM
There is a bit of a commotion here because we had stanzas like the below one, which throw errors in _internal. Interestingly, ./splunk btool check doesn’t catch it, which makes it difficult to detect it automatically.
[monitor:///<path>]
disabled=0
ignoreOlderThan=7d # test
sourcetype = <sourcetype>
index=<index name>
The error is ERROR TailingProcessor - Invalid value '7d # test'
... View more
05-21-2019
06:16 AM
You should contact Splunk Support for such a case.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Friday
|
Karma from
Karma given to
