Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About prakash007
prakash007
Builder
Member since:
11-27-2018
06-01-2022
Community Statistics
| Posts | 220 |
| Solutions | 13 |
| Karma Given | 2 |
| Karma Received | 39 |
| Member Since | 11-27-2018 |
Activity Feed
- Posted Re: Configure Universal forwarder 8.1.0 to send data over HTTP on Splunk Enterprise. 06-01-2022 11:14 AM
- Got Karma for Re: "Addon Metadata - Summarize AWS Inputs" is not enabled on Add-on instance?. 11-03-2021 09:28 AM
- Got Karma for Re: Is there a list of what each privilege/capability permits?. 08-25-2021 10:29 PM
- Got Karma for Re: Splunk Dashboard autorefresh all panels. 08-20-2021 12:56 AM
- Got Karma for Re: What are your Splunk t-shirt ideas?. 07-07-2020 02:47 AM
- Got Karma for Do we need a license for Heavy forwarder..?. 06-24-2020 01:28 PM
- Got Karma for Re: "Addon Metadata - Summarize AWS Inputs" is not enabled on Add-on instance?. 06-05-2020 12:51 AM
- Karma Re: Can you help us with the following "expandtoken" error?: "field larger than field limit (131072)" for sylim_splunk. 06-05-2020 12:50 AM
- Got Karma for Re: Defining Timestamp for HEC Input. 06-05-2020 12:50 AM
- Got Karma for Re: can't read "splunkdestinationip_withrd": no such variable. 06-05-2020 12:50 AM
- Got Karma for Re: How do I set dashboard to fast mode?. 06-05-2020 12:50 AM
- Got Karma for Re: How do you use regex on 2 fields and combine them into one field for an xyseries?. 06-05-2020 12:50 AM
- Got Karma for Re: What do we need to write in TIME_FORMAT in props.conft to extract a timestamp?. 06-05-2020 12:50 AM
- Got Karma for Re: What do we need to write in TIME_FORMAT in props.conft to extract a timestamp?. 06-05-2020 12:50 AM
- Got Karma for Re: in a Splunk Distributed Environment, what is the limit of indexers by a single dedicated search head?. 06-05-2020 12:50 AM
- Got Karma for Re: How to push out an indexer bundle after rebuilding a server?. 06-05-2020 12:50 AM
- Got Karma for Re: Can you help me extract the information I want from the following JSON data (mvzip, mvindex, split)?. 06-05-2020 12:50 AM
- Got Karma for Re: Is there a list of what each privilege/capability permits?. 06-05-2020 12:50 AM
- Got Karma for Re: Is there a list of what each privilege/capability permits?. 06-05-2020 12:50 AM
- Got Karma for Re: Is there a list of what each privilege/capability permits?. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 1 | |||
| 1 |
04-21-2017
08:45 AM
we did define specific index name in f5_index macro, still we see different hosts in non-responding hosts...did you get this resolved...??
... View more
04-19-2017
01:31 PM
In my case, the scheduler is running on Search Head.....
1.when i read the docs, i don't find any configs related to hostvmperf_interval and hostvmperf_expiration in \etc\apps\Splunk_TA_vmware\local., but i'm thinking to put down all the 4 changes(hostvmperf_interval,hostvmperf_expiration,hostinv_interval,hostinv_expiration) in \etc\apps\Splunk_TA_vmware\local adding a [default stanza]
2.did you also change the vCenter timeout value....??
Increase the timeout period in the vpxd file on your vCenter.
Open the vpxd.cfg file, located in C:\Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\vpxd.cfg file (C:\ProgramData\VMware\VMware VirtualCenter\vpxd.cfg on Windows 2008) using a text editor.
... View more
04-19-2017
12:51 PM
sure...i appreciate it if you can forward me the details. Thanks..!!
... View more
04-18-2017
01:24 PM
I did check on the roles, it looks good....seems the error is related to this known issue
VMW-4466 Frequent job expiration leads to not all data being collected, task=hostvmperf has expired and will not be running.
https://docs.splunk.com/Documentation/AddOns/released/VMW/Releasenotes#Known_Issues
... View more
04-18-2017
10:33 AM
We have upgraded Splunk app for VMware v3.3.2, when we launch the app, it says no data for perf, i did see the data when i search it by sourcetype=vmware:perf*
We have 4DCns pointing to a single vCenter.....i see this error log when i search for DCns internal logs...
2017-04-18 10:20:43,863 ERROR [ta_vmware_collection_worker://beta:8453] [getJob] job=job_ed017b23245a11e78ba3ecf4bbd1db64 of task=hostvmperf has expired and will not be run
I have also attached the screen shot of the issue...any help would be appreciated. Thanks..!!
... View more
04-18-2017
10:24 AM
Did you get any resolution of this issues...we are seeing the same error as you mentioned above....??
we're with splunk app for vmware v3.3.2 with 5DCns pointing to the vCenter...i can see the data in search sourcetype=vmware:perf*, but the dashboard in the home page says No data.
... View more
03-06-2017
08:31 AM
2 Karma
I have a user who scheduled a dashboard delivery at a specific time in a day, meanwhile he cloned the same dashboard with a clone at the end.
He eventually deleted the cloned dashboard, but we're still getting the dashboard generation ERROR to look at python.log. We haven't found any valuable information in python.log.
*An error occurred while generating the PDF. Please see python.log for
details.*
index=_internal sourcetype="pdfgen*"
2017-02-23 06:00:02,667 -0600 ERROR pdfgen_utils:485 - Bailing out of Integrated PDF Generation. Exception raised while preparing to render "Untitled" to PDF. [HTTP 404] https://127.0.0.1:8089/servicesNS/robert/apm_network_app/data/ui/views/perf_daily_checks_clone; [{'type': 'ERROR', 'text': 'Could not find object id=perf_daily_checks_clone', 'code': None}]
How do i get rid of this schedule error??
... View more
10-18-2016
08:15 AM
somehow it's not working well for this kind of data
GET /ajax/real/setsample.asp - 443 - 192.168.21.0 Mozilla/5.0+(Windows+NT+5.1;+WOW64;+rv:35.0)+Gecko/20980000+Firefox/45.0 200 0 0 31 950 #softwate#apache 560 731
UserAgent=Mozilla/5.0+(Windows+NT+5.1;+WOW64;+rv:35.0)+Gecko/20980000+Firefox/45.0 200 0 0 31 950 #softwate#apache 560
expected(UserAgent=Mozilla/5.0+(Windows+NT+5.1;+WOW64;+rv:35.0)+Gecko/20980000+Firefox/45.0)
status=731
(expected status=200)
GET / - 443 - 192.168.67.1 - 200 0 0 202
UserAgent= -200
(expected UserAgent = -)
status=202
(expected status=200)
... View more
10-18-2016
07:18 AM
I'm trying to extract the following from this regex...somehow i am not able to get the browser agent and status...
some of the data doesn't have a user agent..any help to get IP, UserAgent(optional), status
(?P<method>\w+)\s(?P<URL>.*)?\s\-\s(?P<port>\d+)\s\-\s(?P<IP>\d+\.\d+\.\d+\.\d+)\s?\-?\s(?P<UserAgent>.*\))?\s?(?P<status>\d+)
GET /user/stell_static/legacy/css/share.css - 443 - 192.188.2.0 - 404
GET / - 443 - 192.168.28.0 - 200 0 0 0
GET /public/about.html - 443 - 192.168.26.7 - 403
POST /data/willer/testsample.php - 443 - 192.168.20.1 Mozilla/4.0+(Windows;+U;+Windows+NT+5.1;+en-US;+rv:1.8.1.14) 404 0 2 0
GET /ajax/real/setsample.asp - 443 - 192.168.21.0 Mozilla/5.0+(Windows+NT+5.1;+WOW64;+rv:35.0)+Gecko/20980000+Firefox/45.0 200 0 0 31 #apache webserver services #version5.5
... View more
10-13-2016
12:25 PM
you might have to try any one of these use cases below...
https://answers.splunk.com/answers/53161/alert-when-a-host-exceeds-a-certain-number-of-messages-per-minute.html
https://answers.splunk.com/answers/141161/how-to-trigger-alert-if-exceeds-more-than-100-times-of-403-status-code-in-a-second.html
... View more
10-13-2016
11:56 AM
you can use this on your search bar for the versions....
| rest /services/server/info | table splunk_server version
... View more
10-13-2016
11:52 AM
Here's the sample....
./splunk cmd btool transforms list
https://docs.splunk.com/Documentation/Splunk/6.5.0/Troubleshooting/Usebtooltotroubleshootconfigurations
... View more
08-10-2016
12:35 PM
1 Karma
What is the best approach to drop some of the data to nullQueue in Splunk Enterprise..?
... View more
- Tags:
- splunk-enterprise
08-09-2016
08:13 AM
1 Karma
Looking for a regex in 612,200(threadDuration) and 3(no.of.Threads) for the log message below...
WSVR0605W: Thread “WebContainer : 1” has been active for 612,000 milliseconds and may be hung. There are 3 threads in total in the server that may be hung.
... View more
06-22-2016
12:42 PM
Thanks it worked...just for my understanding..why do we use $1 and $3 in there..?
... View more
06-22-2016
11:47 AM
How do I replace/mask the pattern below in props.conf..?
pattern
\"password\":\"passtest@123\"
expecting
\"password\":\"masked\"
... View more
06-21-2016
10:41 AM
some how it's giving me the date when i do | rex field=_raw (?"[^\s]+\s+[^\s?]+)(?<=\/) | table myCapture, _raw
... View more
06-21-2016
09:08 AM
Need help with regex...should start with " end with space or ?
Need entire string in a field starting with " and end until j.prod or c.cat etc...
"GET /brit-pocket09fress/cprod121000019___/j.prod HTTP/1.1"
"GET /nprod789jkj908989heys__/j.prod?icid=&searchType=
"GET /Zin-carsposn-vwlvet-09878__/c.cat HTTP/1.1"
... View more
06-15-2016
08:19 AM
got it, Thank you..!!
... View more
06-14-2016
11:53 AM
So, it's good to go with maxTotalDataSizeMB instead going with forzenTimePeriodInSecs..?
... View more
06-14-2016
11:50 AM
Thank you make sense..
... View more
06-14-2016
11:49 AM
Thanks ddrillic..:)
... View more
06-14-2016
08:09 AM
Thanks,...what's the advantage of defining these kind of attribute-values in indexes.conf...?
maxMemMB = 20
maxConcurrentOptimizes = 6
maxHotIdleSecs = 86400
maxHotBuckets = 10
... View more
06-14-2016
07:19 AM
1 Karma
I am bit confused on setting up a retention period for an Index in splunk....If i need a retention period of 60 days setting a frozenTimePeriodInSecs = 5184000 will work, if i go with the settings below, How does the rolling happen from hot to warm, warm to cold and thawed...? Does this setting says the data is searchable for 30day period before it's deleted...? What' the typical way to setting this with other options...?
[jra_server]
homePath = <path>
coldPath = <path>
thawedPath = <path>
frozenTimePeriodInSecs = 5184000
... View more
Labels
- Labels:
-
indexer
06-07-2016
09:08 AM
You can find the config details in this docs...
http://docs.splunk.com/Documentation/Splunk/6.4.1/DistSearch/SHCandindexercluster
... View more
