Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About ben_leung
ben_leung
Builder
Member since:
05-13-2014
04-20-2021
Community Statistics
| Posts | 202 |
| Solutions | 11 |
| Karma Given | 44 |
| Karma Received | 88 |
| Member Since | 05-13-2014 |
Activity Feed
- Got Karma for Re: Waiting for web server at https:// (Web Services takes a long time to load). 01-16-2023 05:15 AM
- Got Karma for Re: Why is my search using "mcollect" command causing the following error: "Error in 'mcollect' command: Must specify a valid metric index"?. 12-15-2020 12:26 AM
- Karma Splunk App for Microsoft Exchange: Could not load lookup=LOOKUP-exc_host for jmillford. 06-05-2020 12:50 AM
- Karma Does a user always to have to authenticate every 30 days with a refresh token? for steve23063. 06-05-2020 12:50 AM
- Got Karma for Re: Question about "run as" (Owner or User ) for saved searches. Missing in version 7.. 06-05-2020 12:50 AM
- Karma Re: What are some solutions for high cardinality field reporting? for somesoni2. 06-05-2020 12:49 AM
- Karma REST API Modular Input: After creating a custom search command as a Python script, why am I getting the following "parse transport header" error message? for kiril123. 06-05-2020 12:49 AM
- Karma Sudden excessive WinEventLog:Security events involving splunkd.exe for nk-1. 06-05-2020 12:49 AM
- Karma Possible Bug in the Jenkins Apps for skycree_rh. 06-05-2020 12:49 AM
- Karma Re: How to search what values are missing in my lookup table? for niketn. 06-05-2020 12:49 AM
- Karma Re: Is it okay to run a universal forwarder without an inputs.conf? for ddrillic. 06-05-2020 12:49 AM
- Got Karma for Re: Why is my search using "mcollect" command causing the following error: "Error in 'mcollect' command: Must specify a valid metric index"?. 06-05-2020 12:49 AM
- Got Karma for Re: Why is my search using "mcollect" command causing the following error: "Error in 'mcollect' command: Must specify a valid metric index"?. 06-05-2020 12:49 AM
- Got Karma for Re: How can I direct a role to a specific dashboard at login?. 06-05-2020 12:49 AM
- Karma Re: How to get a single value display to show a value of zero instead of no results? for sundareshr. 06-05-2020 12:48 AM
- Karma Re: What are the minimum set of capabilities to log in to Splunk and search an index? for the_wolverine. 06-05-2020 12:48 AM
- Got Karma for Re: Can you regex or wildcard props Sourcetype stanzas?. 06-05-2020 12:48 AM
- Got Karma for Re: Can you regex or wildcard props Sourcetype stanzas?. 06-05-2020 12:48 AM
- Got Karma for How should I set the con_replication_max_pull_count value for search head cluster members to pull configuration changes from the captain?. 06-05-2020 12:48 AM
- Got Karma for Re: Can you regex or wildcard props Sourcetype stanzas?. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 |
07-13-2016
10:08 AM
I am not able to reproduce. Is there something out of the ordinary in the savedsearches.conf? Maybe this has been fixed. I'm using version 6.3.4
... View more
06-14-2016
05:31 PM
so if you manage the ta under your deployment server and upgrade the app to the latest version while your deployment server is also on the latest version of splunk, what will happen to the older instances of splunk that do not complain about url encoded stanzas? can someone confirm backwards compatibility?
... View more
06-13-2016
08:25 PM
Just checked the output of the xml, seems like I can grab the title tags easily. Thanks for the tip off that endpoint, I missed that one.
... View more
06-13-2016
02:52 PM
I was hoping /services/properties/serverclass would give me the app in a separate tag.
... View more
06-13-2016
02:39 PM
I was looking at the help pages under list [deploy-clients|forward-server|search-server]. Something like 'list deployment-apps' would be great to verify the apps that should be there for deployment.
... View more
06-13-2016
02:35 PM
I want to perform a check on the deployment server before reloading any apps:
integrate through all stanzas and identify if it contains app:
take the app name and then dedupe for any reoccurrence
cross reference the apps in deployment_apps directory
Is there a Splunk CLI command that would provide this check for me? As far as I know, btool only does syntax checking, not a logical verification.
... View more
06-10-2016
10:18 AM
I wonder if this is the same behavior for deployment server? Would you experience issues if you symlinked the deployment_apps?
... View more
06-06-2016
04:15 PM
Splunk Version 6.3.4
Search head cluster of 3 nodes
Indexer distributed search peers 4 nodes
I see the following error messages in _internal:
WARN DistBundleRestHandler - There was a problem renaming: /opt/splunk/var/run/searchpeers/F7521905-DA3E-4B9B-B2FE-08B911826B00-1465250902.b469fbba316fbf76.tmp -> /opt/splunkp/splunk/var/run/searchpeers/F7521905-DA3E-4B9B-B2FE-08B911826B00-1465250902: File exists
ERROR DistBundleRestHandler - Problem untarring file: /opt/splunk/var/run/searchpeers/F7521905-DA3E-4B9B-B2FE-08B911826B00-1465250902.bundle
WARN DistributedBundleReplicationManager - Asynchronous bundle replication to 4 peer(s) succeeded; however it took too long (longer than 10 seconds): elapsed_ms=48188, tar_elapsed_ms=10311, bundle_file_size=344190KB, replication_id=1465250902, replication_reason="async replication allowed"
... View more
06-01-2016
09:33 PM
2 Karma
You can actually embed the css within the view if you are using an html tag.
<html>
<head>
<style type="text/css">
.my-list ul {
list-style-position: inside;
}
</style>
</head>
</html>
... View more
06-01-2016
09:28 PM
1 Karma
Version 6.3+
I would like to use style sheets with Simple XML view instead of having to add the files in the file system.
... View more
05-10-2016
03:49 PM
This is a reoccurring issue. Are there any known issues with objects not having the Move/Delete action?
Is it some kind of permissions with the objects? For my scenario, the lookup tables have missing actions. What I did was set the [lookups] 's export value to system on all the apps to allow global access. Still facing the issue.
Version 6.3.3
... View more
04-29-2016
01:53 PM
* matches non-directory separators
Try adding the star after the trailing 3 periods.
... View more
04-29-2016
01:45 PM
No problem. Source is the way to go since those stanzas will overwrite clashes between sourcetype/host configurations.
Potential enhancement request to the product to allow wildcards on source types? I do not feel the need for this if source accepts wildcards.
... View more
04-29-2016
01:00 PM
5 Karma
Here is a test performed by Splunk support Case: 219804, Props stanza not honoring a wildcard source:
Where...
Splunk Version is 6.0.5
source=/User/TEST/LOG/SMP1234.log
sourcetype=test1
#[(?:::){0}SMP.+] # does not work
#[source::/Users/TEST/LOGS/SMP...] # works
#[::SMP*] # does not work
#[source::.../SMP*] # works
#[source::.../SMP...*] # works
#[::.../SMP*] # does not work
#[*::.../SMP*] # does not work
#[...::.../SMP*] # does not work
#[(?:::){0}SMP.*] # does not work
#[source::\/Users\/TEST\/LOGS\/SMP...] # works
#[source::\/Users\/TEST\/LOGS\/SMP...*] # works
#[source::/Users/TEST/LOGS/SMP1234.log] # works
#[test1] # works
#[test1*] # does not work
#[sourcetype::test1] # does not work
... View more
04-18-2016
03:36 PM
I would suggest looking at your conf.log for "data.worklog{}.status”=STOP_ON_MISSING_LOCAL_BASELINE
This would tell you if there are potential out of sync nodes from the clusters' captain. I see that these messages automatically disappear. Would that mean the node has dropped its captaincy and after re-synced to the new captains bundle?
... View more
04-12-2016
05:51 PM
plus 1; where is the SPL code to follow up on?
... View more
04-12-2016
04:39 PM
4 Karma
The endpoint for a destructive resync should be /services/replication/configuration/commits
If you notice the baseline is out of sync in the splunkd.logs, or if you find yourself seeing the banner message to run a destructive resync, run the following command (should work):
curl -k -u admin:splunker https://127.0.0.1:8089/services/replication/configuration/commits
Basically is the equivalent of :
./splunk resync shcluster-replicated-config
Based off of $SPLUNK_HOME/etc/system/static/splunkrc_cmds.xml
1801 <item obj="shcluster-replicated-config">
1802 <cmd name="resync">
1803 <uri><![CDATA[/replication/configuration/commits]]></uri>
1804 <default>
1805 <arg name="resync_destructive" value="1" />
1806 </default>
1807 <help>
1808 <title><![CDATA[Destructively resyncs this node to the latest replicated config on the captain.]]></title>
1809 <examples>
1810 <ex><![CDATA['./splunk resync shcluster-replicated-config]]></ex>
1811 </examples>
1812 </help>
1813 <type>edit</type>
1814 </cmd>
1815 </item>
... View more
03-14-2016
12:58 PM
Example, if I do index=main | stats count by sourcetype | outputlookup ben_test.csv , the file should not be overwritten if another user runs ... |outputlookup ben_test.csv
... View more
03-14-2016
12:49 PM
Background on this setup:
I have 2 search head nodes in a cluster. The captain is static.
... View more
03-14-2016
12:48 PM
I am getting an incorrect value for the mgmt_uri value when accessing the rest endpoint /services/shcluster/status
This is on a search head node on a search head cluster on version 6.3.3
My server.conf shows the following:
[shclustering]
disabled = 0
pass4SymmKey = $1$asdfasdfasdf
shcluster_label = PROD_SHC
id = 26FBD1A2-8388-43A2-A1FC-C2EA9C9021D6
mgmt_uri = https://myhost@domain.com:8089
conf_deploy_fetch_url = https://mydeployer@domain.com:18089
scheduling_heuristic = round_robin
replication_factor = 1
election = false
mode = captain
captain_uri = https://myhost@domain.com:8089
captain_is_adhoc_searchhead = false
... View more
- Tags:
- splunk-enterprise
03-11-2016
04:31 PM
This is still the case in version 6.3.3. Does this mean that this behavior is expected from Splunk and that it will not change? Do other customers face this challenge of overwriting existing lookups? Or do they want to overwrite the lookup files purposely?
... View more
03-04-2016
05:01 PM
Is the argument not applicable when modifying a system configuration?
... View more
02-26-2016
10:51 AM
replication_factor = 1
but that is only for replication of search artifacts
The WARN message is referring to configuration changes, like knowledge objects changing by users via the UI.
... View more
02-25-2016
02:51 PM
1 Karma
WARN ConfMetrics - single_action=PULL_FROM took wallclock_ms=4610! Consider a lower value of conf_replication_max_pull_count in server.conf on all members
What should I base the value on for conf_replication_max_pull_count? The warning is telling me that the cluster nodes are taking too long to pull configuration changes from the captain. Is my understanding correct?
conf_replication_max_pull_count = <int>
* Controls the maximum number of configuration changes a member will
replicate from the captain at one time.
* A value of 0 disables any size limits.
* Defaults to 1000.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-20-2021
01:05 PM
|
Karma given to
