About echalex

echalex · ‎04-12-2013

Hi, I need to reference a file distributed by an input app from within the app itself (outputs.conf). I need to configure a specific receiver with a specific certificate with this app. I've tried specified a relative path, but it doesn't seem to work: # first try: sslRootCAPath = specific-cert.pem # second try: sslRootCAPath = ./specific-cert.pem # third try (copied it first to another dir called certs) sslRootCAPath = ./certs/specific-cert.pem # fourth and only successful try: $SPLUNK_HOME/etc/apps/the_specific_app_directory/certs/specific-cert.pem However, I'm not happy with this, since the name of the directory may change and I may copy this configuration to other apps as well. So, is there a generic way of referencing the app's directory? Based on the scripted inputs in the Splunk_TA_nix configuration, I thought a dot might work, but it does not seem to work.

echalex · ‎04-03-2013

Maybe I should've searched better, but hopefully the link to the doc is useful to you. 🙂

echalex · ‎04-03-2013

Answering my own question, this situation has been documented. (5.0.2, 4.3.5)

echalex · ‎04-03-2013

Hi, I'm wondering how Splunk (4.3.x) deals with new roles created through the GUI. Since they're located in etc/system, I suppose you have to distribute any changes by yourself, or is there a way to automate this?

echalex · ‎11-14-2012

Ok. Thanks for confirming.

echalex · ‎11-14-2012

Hi, Can I set the clientName in deploymentclient.conf through the CLI? I'm not willing to edit the file on all clients.

echalex · ‎10-31-2012

Hi slowry, Are you using wget from the command line in a terminal window? Wget does not have a graphical user interface. I think wget should be installed by default, but if it isn't, you can always do this: sudo apt-get install wget If you have the .deb or .tgz file downloaded locally, you don't have to go through an FTP server. Your Ubuntu server probably has sshd installed, so you can scp it from the command line: scp <splunkfile> <your_user_name>@<your_server>: If you do not have sshd insstalled, do this on your server: sudo apt-get install openssh-server

echalex · ‎10-30-2012

In what sense are the installation instructions out of date? The documentation for 5.0 seems to missing, but you can find the documentation for 4.3.4 right here. It's as simple as a sudo dpkg -i splunk-4.3.4-136012-linux-2.6-amd64.deb . Splunk will run quite nicely on Ubuntu Desktop, but it's neither harder nor easier to install.

echalex · ‎10-30-2012

To be clear, the props.conf of the TAs do include props.conf -files. These have settings for SHOULD_LINEMERGE and CHECK_FOR_HEADER . To my understtanding, these are index-time directives and since I'm using the universal forwarder, there is no parsing on the Exchange host itself. Does this matter?

echalex · ‎10-30-2012

Thank you very much for a clear and concise answer. 🙂 Here's the documentation I was reading. If your central Splunk instance is distributed (meaning that it contains indexer(s) and search head(s) on separate systems): - You must install all of the technology add-ons (TAs) onto every indexer in the instance.

echalex · ‎10-30-2012

Yes, it is indeed not a typo or trick. I was staring myself blind at the splunk-perfmon.exe in $SPLUNK_HOME/bin and did not see that the conf actually points to the subdirectory scripts , which includes the .path -scripts.

echalex · ‎10-29-2012

Hi, As I'm installing TA's on windows hosts, I see that the PerformanceMonitor source is specified as [script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path] The file itself is called splunk-perfmon.exe . Is this intentional - as in disabling accidental usage of the exe, a Splunk trick or a typo?

echalex · ‎10-29-2012

To elaborate a bit on that sample table: At time n, the avgWaitMillis of host001 equals max(avgWaitMillis) of all hosts (at that time). Likewise, at time l, the avgWaitMillis of host219 == max(avgWaitMillis) of all hosts at that time.

echalex · ‎10-29-2012

Thanks, but that is still not what I'm after. useother only affects the grouping of the hosts in the chart. timechart is really not the answer here, since I'm not concerned about the values themselves, but which hosts had the max value at a particular time. Since I'm primarily interested in the hostnames, a chart is probably not the best visualization, but rather a table, with values about like this: time , host_with_highest_latency time n, host001.domain.com time m, host321.domain.com time l, host219.domain.com

echalex · ‎10-29-2012

Hi, I'm about to deploy Splunk for Exchange. One thing I'm noticing is that the documentation says all TAs should be installed on the indexers. Howevers, the indexes.conf only exists in the main app itself (ie. "Splunk for Exchange"). I do need the indexes.conf, don't I? That's my first question. My second question is: should I then pull out that particular file and add it to a small app which I deploy to my indexers? Or, as I'm doing now with other indexes, adding those indexes to a generic Our_Indexes app, which defines all indexes and does nothing else?

echalex · ‎10-25-2012

Thanks. This is probably the best information available. It's just that I would like to restart the indexers one-by-one (preferrably not at all). Of course, I can have one server class per indexer as well.

echalex · ‎10-23-2012

Thank you for your effort to help, never the less!

echalex · ‎10-23-2012

I'm afraid this doesn't do what I want at all. That will just show the max values of avgWaitMillis, without even mentioning the host. I want to know which host had the highest latency, not what the highest latency was. Doing the same by host doesn't help me either, for out of the hundred or so hosts, the majority will be lumped into OTHER . So knowing that one host of 90 in OTHER had the highest latency at 21:15 and 23:30 reveals nothing.

echalex · ‎10-23-2012

Hi, We're debugging an issue where disk latency shoots up at a specific time. I would like to create a search which shows the host with the highest latency at any specific minute. So the base search is: index=os sourcetype=iostat | multikv fields avgWaitMillis ...but then I'm not sure how to continue... I would like to find every host where avgWaitMillis is the highest for every minute.

echalex · ‎10-22-2012

Thank you for the answer, gekoner. I hade the same kind of problem under Windows 7. Any splunk command, such as splunk status would only quickly flicker another terminal window. Opening cmd with "run as administrator" solved this issue.

echalex · ‎10-19-2012

Hi, I'm using the deployment server to deploy, among other things, props.conf files to indexers. I'm a bit concerned about the impact of indexing, so that's why I'm asking if I'm required to restart splunkd on the indexers for props.conf to be effective, especially if I have both indexers in one class.

echalex · ‎10-19-2012

Thanks, yannK. That is what I suspected. Even the reverse dns lookup script will use the default configuration. Of course, I can do my own reverse lookup script in eg. perl.

echalex · ‎10-18-2012

Hi, We are having some DNS issues in our infrastructure. Apparently the name servers our splunk hosts are using are not able to resolve some PTR queries, because of our network topology. Unfortunately, simply editing /etc/resolv.conf would also break stuff. So I need to use a different name server than the system is using by default. Is this possible?

echalex · ‎10-11-2012

Aha, so I misinterpreted your needs, apparently? You want the full day from last week, but you don't want the zeros for today to show up, because they look bad to management and management doesn't always understand that you can't see tickets from the future?

echalex · ‎10-11-2012

Hi, I have a search running once an hour, which is configured to raise an alert and email me if events>0. Alert expiration is set to 24 hours. I get the emails, but the alerts do not show up in the "Alerts" link. Also, under "Manager > Searches & reports", the number of alerts stays at 0. Why is that?

Posts	238
Solutions	23
Karma Given	445
Karma Received	104
Member Since	‎12-14-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Performance of combined Cluster Master, License Ma...

Transform to replace index does not work for two h...

Is it possible to set the TZ in props.conf on a Un...

Timechart with latest() doesn't display results wh...

How to configure inputs.conf on a Splunk forwarder...

To change the date format for events, do we modify...

HTTP Event Collector: Why am I getting "Null" for ...

How to configure a universal forwarder to clone da...

Pivot: distinct values as mvcombine

Detect events with sequential values

Variables available in input app

Re: Search head pooling and authorize.conf

Re: Search head pooling and authorize.conf

Search head pooling and authorize.conf

Re: Set deployment client name in CLI

Set deployment client name in CLI

Re: Splunk on Ubuntu

Re: Splunk on Ubuntu

Re: Splunk for Exchange for indexers

Re: Splunk for Exchange for indexers

Re: splunk-perfmon.path (sic?)

splunk-perfmon.path (sic?)

Re: List hosts with highest value

Re: List hosts with highest value

Splunk for Exchange for indexers

Re: Is restartSplunkd required for changes to take...

Re: List hosts with highest value

Re: List hosts with highest value

List hosts with highest value

Re: CLI: Linux vs. Windows

Is restartSplunkd required for changes to take eff...

Re: Can I specify a name server for DNS

Can I specify a name server for DNS

Re: How can I remove the 0 values for time > now i...

Alerts not showing up

Join the Conversation