Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About mikelanghorst
mikelanghorst
Motivator
Member since:
11-03-2010
08-29-2025
Community Statistics
| Posts | 286 |
| Solutions | 20 |
| Karma Given | 360 |
| Karma Received | 229 |
| Member Since | 11-03-2010 |
Activity Feed
- Got Karma for Re: What are the ports that I need to open?. 04-16-2025 05:18 AM
- Posted Re: Splunk 9.3+ Deployment on CIS Red Hat 9 level 1 image - No GUI on Deployment Architecture. 04-02-2025 03:34 PM
- Karma Re: Splunk 9.3+ Deployment on CIS Red Hat 9 level 1 image - No GUI for jwestbank. 04-02-2025 03:33 PM
- Got Karma for Re: What are the ports that I need to open?. 01-06-2025 02:51 AM
- Posted Re: Why is Powershell input not receiving data? on Getting Data In. 05-10-2022 02:21 PM
- Posted Why is Powershell input not receiving data? on Getting Data In. 05-10-2022 09:48 AM
- Got Karma for Re: What are the ports that I need to open?. 03-17-2022 07:11 AM
- Got Karma for Re: What are the ports that I need to open?. 08-18-2021 05:28 AM
- Got Karma for Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?. 07-19-2021 09:48 AM
- Got Karma for Re: What are the ports that I need to open?. 07-28-2020 03:20 AM
- Got Karma for Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?. 07-13-2020 10:52 PM
- Karma Re: Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist" for LukeMurphey. 06-05-2020 12:49 AM
- Karma Re: New forwarder: An Admin password is required??? for xpac. 06-05-2020 12:49 AM
- Karma Re: Where to add certificate info for port 8089? for dwaddle. 06-05-2020 12:48 AM
- Karma Re: what could be the reason for some splunk sessions observed to be in the DDMMYYYY format ( ideally it is in MMDDYYYY format)? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: How to upgrade Splunk forwarders from a deployment server installed on a separate VM? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: What are my options to specify the user to start splunk service as on linux for yannK. 06-05-2020 12:48 AM
- Karma Re: Community Supported apps - should they have an external repo for the community to assist in improving? for Damien_Dallimor. 06-05-2020 12:47 AM
- Karma Re: Filtering out 90% log events from indexing for dshpritz. 06-05-2020 12:47 AM
- Karma Re: Splunk installed failed to create splunk account on RHEL for grijhwani. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 2 |
07-20-2011
09:50 PM
1 Karma
If it actaully stops indexing, then it's definitely a bug, assuming there isn't caused by something else. They have always said that only searching would be affected. What is being logged in $SPLUNK_HOME/var/log/splunk/splunkd.log?
... View more
07-20-2011
07:51 AM
3 Karma
You can simply null-queue the event with the header. Look for the section titled: "Filter event data and send to queues" here in the docs
http://www.splunk.com/base/Documentation/4.2.2/Deploy/Routeandfilterdatad
... View more
07-19-2011
10:10 PM
Are you intending to have the fschange configuration in etc/system/local/inputs.conf? I've always seen the inputs.conf get created with the shortname already. Put everything else in a different file.
... View more
07-19-2011
10:01 PM
This is working fine on my linux host, and on Solaris for me. 4.2.1 as well.
... View more
07-15-2011
11:33 AM
1 Karma
damn IE not having my credentials cached...
... View more
07-15-2011
11:31 AM
2 Karma
There could be a few reasons as to the speed, disk IO on the forwarder, cpu, etc.
However the first thing I would look at is the limits.conf file. The universalForwarder has limits for how much data it can send at a time, this may be the cause of the perceived slowness.
http://www.splunk.com/base/Documentation/4.2.2/Admin/Limitsconf
[thruput]
maxKBps =
* If specified and not zero, this limits the speed through the thruput processor to the specified
rate in kilobytes per second.
* To control the CPU load while indexing, use this to throttle the number of events this indexer
processes to the rate (in KBps) you specify.
On a universal forwarder, this is set to 256 by default.
... View more
07-13-2011
03:03 PM
A deployment server would make the process of getting the configs to the individual servers easier.
You'll be best off by using a single windows host to configure manually first: http://www.splunk.com/base/Documentation/4.2.2/Data/MonitorWMIdata create a directory under that forwarders etc/apps. Then once you have it working on that host copy the directory you have to a deployment server then push it out from there.
... View more
07-13-2011
02:34 PM
1 Karma
Best for this issue is to just create a temp index and clean the data during the date rollbacks.
... View more
07-13-2011
02:33 PM
Yea, our use case here is pretty unique I think. Thanks for the help, just needed to verify that I wasn't missing something. DATETIME_CONFIG=current would cause confusion as well due to the hours being offset as well.
Temp index it is.
... View more
07-12-2011
10:18 AM
The issue I really have here isn't the actual switch during a single DST change. The problem is dealing with a set of servers that might create logs for a 3 day period 10,15, maybe 20 times. We actually set the date/time of the servers for the Thursday before the time change, setup our data and let it run thru Sunday morning (while it's actually Mon-Thursday in September). Once we reach Sunday, the dates on the servers are reset to that Thursday and the whole process started over.
Any ideas other than using a temp index?
... View more
07-11-2011
04:37 PM
1 Karma
If you have the *nix app running, and lsof enabled, you might be able to track it down by starting with the following search:
index=os sourcetype=lsof UDP | multikv | search
That will search for lsof events that contain UDP, break it into individual lines, then filter only those with destination IP.
... View more
07-11-2011
02:28 PM
splunk (our internal domain gets appended) resolves internally to this host. Both the short and fqdn is in /etc/hosts on this server as well.
... View more
07-11-2011
02:22 PM
Here is the last request in the console:
GET https://splunk/en-US/custom/pdfutils/pdfdownload/status?report=bdee0d54-2fc0-4f7b-869d-2ba444ae706f
200 OK
17ms
common.min.js (line 2598)
ParamsHeadersResponseHTMLJSON
{"report": "bdee0d54-2fc0-4f7b-869d-2ba444ae706f", "finished": true, "success": false, "error": "Splunkd response status: 400"}
splunkd_access.log:
127.0.0.1 - - [11/Jul/2011:14:22:07.388 -0700] "POST /services/pdfserver/renderpdf HTTP/1.1" 400 322 - - - 282ms
... View more
07-11-2011
02:12 PM
Twice a year we have a set of servers used for testing our apps during DST time changes. About 2 months before we will set the time a couple of days before the time change, let the apps roll thru it then reset the time to before the change. Repeat many times. Trying to keep all the events straight could get confusing. Having the users search by index time, or forcing those events to be set to index time could be difficult as well. Typically we'll offset by 12hrs so that 2am is 2pm, but it's not always the case.
What would you recommend to keep events from these servers straight? I'm thinking maybe just set those hosts to put everything in a different index and clean it, but doesn't seem ideal either.
... View more
- Tags:
- timestamp
07-11-2011
09:15 AM
1 Karma
The only time I've seen this an issue with data taking too long to get there was with previous versions and trying to monitor a directory with too many files/subdirectories. Is your monitor stanza set overly broad then trying to whitelist down?
... View more
07-11-2011
09:12 AM
The issue I'm referring to is the app "PDF Download Extension" provided by ziegfried. I didn't realize the "Ask Developer" button just put a post in General Answers. The PDF Report Server application works fine with scheduled e-mail reports. (Other than a chart width issue I'm currently in touch with support about).
... View more
07-11-2011
09:12 AM
Ziegfried - the Splunk version is 4.2.1 build 98164 on Oracle Linux 5.5 64bit. The PDF Report server is 1.2, on the same host. The dashboard I'm trying to test this on is just a simple 2 chart page, which I'm able to send via e-mail successfully. I get the same error when I try and download PDF on any page.
... View more
07-08-2011
11:23 AM
I've installed the PDF Download app you provided but I haven't been able to get it to work yet. I just get a pop-up message of "PDF Generation Failed". Haven't found any log messages yet. The Splunk Supplied PDF Report server works.
... View more
06-25-2011
10:28 PM
1 Karma
I'll do so as well. We're beginning to rollout iPads to all of our upper management as well. Having better support of non-flash users would be great.
... View more
06-22-2011
08:34 AM
A bug/issue I found is in the netstat.sh. For Linux it returns all open connections, for Solaris I'm only getting a couple ports.
... View more
06-08-2011
10:37 AM
3 Karma
Since upgrading to 4.2.1 from 4.1 my PDF reports of dashboard views has been broken. They are only about 60% of report object. This was working fine, displaying the full chart in the width of the page.
Anyone know how to fix this?
... View more
02-07-2011
06:48 PM
The lower throughput can be modified by changing adding an etc/system/local/limits.conf to override the default limiter if desired.
There are a few other subsystems that are disabled on a lwf, such as udp/tcp inputs.
... View more
01-20-2011
07:18 PM
Thanks for the response jrodman, I'll submit that request today.
... View more
- « Previous
- Next »
