Oh wow! Nice. The description in the documentation made it sound like you could enter them all in one go, separated by comma's. This makes sense. TY!! ... View more

Can anyone help with this? ... View more

Make the change or installation of the vmware app on one of the search heads. The configuration will then be passed on to the other search heads by the "captain" of the search head cluster. ... View more

What OS are you using? Is the hardware stable? How does it shut down? Just shuts off? or Hangs? ... View more

This worked perfect! Thank you!! ... View more

Are your servers using the f5 as their gateway back to the indexer? Yes Have you looked at the load, connection count, bandwidth and other stats on the F5 during peaks to see if there is some kind of plateau? Also have you checked the logs on the f5 for anything unusual? I do not have access to the F5, but I have looked over the shoulder of someone who does. He was saying that they are reaching the limit of threads to the server farms. How about other indexing functionality on the indexer during these times, are you indexing from any other machines and is this not impacted during the issue? (you could search the internal indexes for activity during these times if you have no other inputs) Yes. We are getting logs from everything except the servers behind the F5. I know. Pretty obvious. ... View more

Same. That's a couple days of my life i'm never getting back. /sigh ... View more

I'm trying to ingest a directory full of archived event logs. Our security team has zipped up a years worth of logs, and yes they are in EVTX files. I selected the formats to ingest when I installed the splunk agent. Are you saying that I can not splunk this data? ... View more

Help!! Anyone? ... View more

I tried adding that stanza and it still isn't working. Here is the results from the search. Splunk search criteria: source=udp:9514 host=broker-p* "Broker Registration Info" broker-p3.vsp.com app=BrokerApp [2014-11-25 13:58:38,636] INFO {abcdZw7rGW9P_gAWe8ONu} AppointmentCompleteAction.execute: Broker Registration Info: com.vsp.broker.model.AppointmentFormInfo@7ce1034f[licenses={0=com.vsp.broker.model.BrokerLicense@1e42d36e[state=MD,licenseNum=164213,effectiveDate=com.vsp.portal.util.Chrono@3546ea47[day=1,month=6,year=2014,value=,format=MMMM|dd#yyyy]], 1=com.vsp.broker.model.BrokerLicense@f75170b[state=PA,licenseNum=330247,effectiveDate=com.vsp.portal.util.Chrono@503bdb1a[day=3,month=3,year=2004,value=,format=MMMM|dd#yyyy]], 2=com.vsp.broker.model.BrokerLicense@abdcf8b[state=WV,licenseNum=6836793,effectiveDate=com.vsp.portal.util.Chrono@3384b42f[day=2,month=3,year=2002,value=,format=MMMM|dd#yyyy]], 3=com.vsp.broker.model.BrokerLicense@1aa29b40[state=,licenseNum=,effectiveDate=com.vsp.portal.util.Chrono@297e9469[day=,month=,year=,value=,format=MM...[Mag: Next line continuation is missing] ... View more

Nobody has any info on this on how to turn off logging here? ... View more

-sh-4.1$ sudo more props.conf [datapower] NO_BINARY_CHECK = 1 pulldown_type = 1 [PMIServlet] NO_BINARY_CHECK = 1 pulldown_type = 1 [host::SCHQVVCACDEM1*] TRANSFORMS-anonymizer = password-anonymizer [host::broker-*] TRANSFORMS-index = ClientRedirect TRUNCATE=0 [host::client-*] TRANSFORMS-index = ClientRedirect TRUNCATE=0 [host::pt*] TRANSFORMS-index = TrueFarmRedirect [host::st*] TRANSFORMS-index = TrueFarmRedirect [host::member-*] TRANSFORMS-index = MemberRedirect [host::doctor-*] TRANSFORMS-index = DoctorRedirect [host::www-*] TRANSFORMS-index = GlobalRedirect [host::sa-portals-*] TRANSFORMS-index = StrategicRedirect [source::udp:8514] TRANSFORMS-ClientHostOverride = ClientHostOverride SHOULD_LINEMERGE = true TRANSFORMS-ClientRawOverride = ClientRawOverride TRANSFORMS-ClientShRawOverride = ClientShRawOverride TRANSFORMS-ClientShortOverride = ClientShortOverride TRANSFORMS-ClientTempOverride = ClientTempOverride [source::udp:9514] SHOULD_LINEMERGE = false TRANSFORMS-BrokerHostOverride = BrokerHostOverride TRANSFORMS-BrokerRawOverride = BrokerRawOverride TRANSFORMS-BrokerShRawOverride = BrokerShRawOverride TRANSFORMS-BrokerShortOverride = BrokerShortOverride TRANSFORMS-BrokerTempOverride = BrokerTempOverride shandman gravatar image Answer by shandman 53 minutes ago ... View more

broker-p3.vsp.com app=BrokerApp [2014-10-20 13:38:14,149] INFO {abcpnhFLDq4THhWxDqVKu} AppointmentCompleteAction.execute: Broker Registration Info: LOG STARTINGcom.vsp.broker.model.AppointmentFormInfo@61bf56bd[licenses={0=com.vsp.broker.model.BrokerLicense@439a95a[state=MS,licenseNum=10265706,effectiveDate=com.vsp.portal.util.Chrono@659d55e0[day=1,month=10,year=2012,value=,format=MMMM|dd#yyyy]], 1=com.vsp.broker.model.BrokerLicense@384bc948[state=,licenseNum=,effectiveDate=com.vsp.portal.util.Chrono@778bb2d7[day=,month=,year=,value=,format=MMMM|dd#yyyy]], 2=com.vsp.broker.model.BrokerLicense@824cf37[state=,licenseNum=,effectiveDate=com.vsp.portal.util.Chrono@28a0280e[day=,month=,year=,value=,format=MMMM|dd#yyyy]], 3=com.vsp.broker.model.BrokerLicense@3caf42c7[state=,licenseNum=,effectiveDate=com.vsp.portal.util.Chrono@164935f1[day=,month=,year=,value=,fo... LINE ENDING and NEXT LINE TRUNCATED I don't want this truncated. I want a continuation of this event. Does that make sense? ... View more

broker-p3.vsp.com app=BrokerApp [2014-10-20 13:38:14,143] INFO {abcpnhFLDq4THhWxDqVKu} LogInterceptor.before: Invoking appointment-complete broker-p3.vsp.com app=BrokerApp [2014-10-20 13:38:14,149] INFO {abcpnhFLDq4THhWxDqVKu}AppointmentCompleteAction.execute: Broker Registration Info:com.vsp.broker.model.AppointmentFormInfo@61bf56bd[licenses={0=com.vsp.broker.model.BrokerLicense@439a95a[state=MS,licenseNum=10265706,effectiveDate=com.vsp.portal.util.Chrono@659d55e0[day=1,month=10,year=2012,value=,format=MMMM|dd#yyyy]],1=com.vsp.broker.model.BrokerLicense@384bc948[state=,licenseNum=,effectiveDate=com.vsp.portal.util.Chrono@778bb2d7[day=,month=,year=,value=,format=MMMM|dd#yyyy]],2=com.vsp.broker.model.BrokerLicense@824cf37[state=,licenseNum=,effectiveDate=com.vsp.portal.util.Chrono@28a0280e[day=,month=,year=,value=,format=MMMM|dd#yyyy]],3=com.vsp.broker.model.BrokerLicense@3caf42c7[state=,licenseNum=,effectiveDate=com.vsp.portal.util.Chrono@164935f1[day=,month=,year=,value=,fo... broker-p3.vsp.com app=BrokerApp [2014-10-20 13:38:14,317] INFO {abcpnhFLDq4THhWxDqVKu} MailBlock.doAfterBody: Sending 'VSP Resource Center Registration' to jennleebush@aol.com that's the sample of data. ... View more

I've been trying for about a month now to get this working. Extremely frustrating. When you say 8686 is not the only port in a remote JMX handshake, how do we find out what the "secret" ports are? ... View more

i tried replacing all mbean domain="java.lang" with mbean domain="*" didn't work ... View more

Thank you so much! Here is a snapshot from my config.xml . are you saying i need to configure the config_notifications.xml ? in my config, do I need to adjust all the mbean settings? ... View more

no? the example files all had this format. I did not see mbeans there? ... View more