About crazyeva

crazyeva · ‎07-16-2015

The search is easy: index=_internal|fields|stats count|rangemap field=count low=0-50000 elevated=50001-100000 default=severe visualization single value stops growing before the search finishes! I uploaded the results: http://ntu.so/di/SR69M/bug.gif In a dashboard rangemap field=count severe=0-50000 elevated=50001-100000 default=low works fine rangemap field=count low=0-50000 elevated=50001-100000 default=severe stays green? I am really confused by this command splunk version 6.0

crazyeva · ‎10-29-2014

thank you very much that is my fault: firewall ! RHEL 7, "iptables off" is not effictive... "systemctl disable firewalld" to shutdown firewall By the way, splunk 6.2 does not support IE 11 !

crazyeva · ‎10-29-2014

thank you i cant telnet in either port, i changed web port and splunkd port to 80 89, still get this: Checking prerequisites... Checking http port [80]: open Checking mgmt port [89]: open Checking appserver port [127.0.0.1:8065]: open Checking kvstore port [8191]: open Checking configuration... Done. Checking critical directories... Done Checking indexes... Validated: _audit _blocksignature _internal _introspection _thefishbucket history main summary Done Checking filesystem compatibility... Done Checking conf files for problems... Done All preliminary checks passed. Starting splunk server daemon (splunkd)... Done [ OK ] Waiting for web server at http://127.0.0.1:80 to be available... Done ........telnet ip-addr:22 successful

crazyeva · ‎10-29-2014

thank you for helping Splunk does start with the ip SPLUNK_BINDIP specified, but i still cant not access to splunk web through ip-addr:8000 after started, ip-addr:8089 ip-addr:8000 are listening, but can not telnet in from outside.

crazyeva · ‎10-28-2014

I have a problem Splunk always start at http://127.0.0.1:8000 and ignor the interface IP address it is newly installed in a virtual machine, RHEL 7, IP is set as 192.168.100.1 i access the machine with SSH, i mean the interface is alive, can be access to remotely but it seems SPLUNK can not recognise it

crazyeva · ‎07-07-2014

thank you, now at last i understand what ' ' means! i am so stupid

crazyeva · ‎07-07-2014

I installed a windows universal forwarder, to send some txt files to indexer. those txt files are named with timestamp, say 20140707120100_xx.txt. i'd like splunk to eat every newly generated txt file, nomatter if in 'default crclength' is the same content. because a new file maybe just exactly the same with the last one, except a last line... i found 'crcSalt = *.txt' does not work, and 'initCrcLength' will be too large a number to make effect. What should i do to force splunk eat files with same and very very long head?

crazyeva · ‎07-07-2014

i am test '_tcp_routing' in my virtual machines, before doing that on online system. simply i add: [monitor://afile] _tcp_routing = forward-group ... to inputs.conf and [tcpout:forward-group] server = anothersplunkinstance:9997 to outputs.conf i did these configuration before first-time-run-splunk after i started splunk --accept-license i found nothing in splunk, idx main is clean(supposed to receive some other data), even _internal, _*** were all empty. did 'tcp_routing' forward all my data to anothersplunkinstance:9997,which i set up as an Universal Forwarder?

crazyeva · ‎05-15-2014

OK thank you

crazyeva · ‎05-13-2014

Thank you, in my scene splunk forwarder is not allowed on the log generating instance I have to copy every new edition of the log file periodically According to your suggestion, i do "cat message.log_new|tail -n (compared_lines) >> message.log" Is there any better idea?

crazyeva · ‎05-12-2014

I mean e.g. if i manually copy and overwrite a "message.log" to splunk monitoring path, the new one contains some growth at end than the old one. How could i make sure splunk ignore the already indexed data, and just eat the increased part?

crazyeva · ‎04-24-2014

thank you! CHARSET -> UF's props.conf SEDCMD,TRANSFORM -> INDEXER's props.conf a same sourcetype stanza solved

crazyeva · ‎04-24-2014

Let indexer monitor a local file, CHARSET in props.conf works But if the same file was delivered by an universalforwarder, indexer will eat it as UTF-8, nomatter what was set in indexer's props.conf!

crazyeva · ‎01-22-2014

'TIME_FORMAT=%d-%m-%y %I.%M.%S.%9N %p' is correct when i manully modified source data with AM/PM and 'SEDCMD' part is also effective of replacing XXYY with AM/PM But they do not work together.

crazyeva · ‎01-22-2014

thank you! do you have any idea to solve my problem: timestamp form '22-1-14 09.30.00.000000000 \A\C' in which '\A\C' means PM

crazyeva · ‎01-22-2014

timeformat is not desired, I tried SEDCMD to correct it(12-hour format with 'am','pm') props.conf of INDEXER: SEDCMD-timechar=s/XXXXX/AM/g s/YYYYY/PM/g TIME_FORMAT=%d-%m-%y %I.%M.%S.%9N %p but '%p' is not recognized, as SEDCMD has not been effective in the same props.conf. I wonder if i can put SEDCMD to UNIVERSALFORWARDER, and TIME_FORMART remain on INDEXER?

crazyeva · ‎01-22-2014

when can be SPL-67688 released? and before that, may i use 'SEDCMD' to transform it to lartin charactor?

crazyeva · ‎01-22-2014

hello i asked the same question after yours and my name is jicheng nice too meet you!

crazyeva · ‎01-22-2014

http://answers.splunk.com/answers/86896/how-to-recognize-timestamp-with-chinese-character

crazyeva · ‎12-25-2013

You are quite right! maxKBps was set to 256! Its the first time I use universalforwarder. Thank you very much!

crazyeva · ‎12-24-2013

i let universalforwarder distribute raw data, when doing unzip work; indexer doing sedcmd-filter, transfrom-filter work But indexing process very slow 500events/persecond cpu, diskio, network all at low utility i dont know what is wrong Can i just: # cp /opt/splunkforwarder /opt/splunkforwarder01 # /opt/splunkforwarder01/bin/./splunk start # # cp /opt/splunkforwarder /opt/splunkforwarder02 # /opt/splunkforwarder02/bin/./splunk start ..... ?

crazyeva · ‎12-08-2013

Thank you i have to let Splunk do some “route and filter” work, It seems universalforwarder is not able to do that. i have to let indexer to do it？

crazyeva · ‎12-06-2013

4 high performance PC server, I want them all to be INDEXERs Logs are uploaded to one of them, not by any FORWARDER I want set 1 server as forwarder, to distribute Logs to the other 3, 1/4 of the logs each. meanwhile let itself keep 1/4 to eat. What should do with those .confs? and I want to backup splunk-eaten-data, maybe 'splunk/var', through scripts, daily. what targets should I choose to backup? Since I will not assign dedicated MASTER-PEER to a 64GB memory instance. thanks!

crazyeva · ‎12-03-2013

how to judge if a file was eaten by splunk, and then i can delete or move it immediately?

crazyeva · ‎11-04-2013

Thank you, that's sweet!

Posts	109
Solutions	2
Karma Given	14
Karma Received	18
Member Since	‎06-05-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

how to tell splunk automatically extract fields wi...

Someone else configured field extractions, but I w...

After upgrading from Splunk 6.0 to 6.3.2, why does...

Is it possible to stop splunkweb without restartin...

another problem to display $tokens$ with a default...

How to transpose a table to make the values in Col...

how to set token from a table

How to use rangemap in a "layout overlay" panel?

Can mobile access app access to none-https searchh...

How to search a count of events by index-name ever...

Why is the rangemap command in my search not produ...

Re: splunk always starts at 127.0.0.1:8000

Re: splunk always starts at 127.0.0.1:8000

Re: splunk always starts at 127.0.0.1:8000

splunk always starts at 127.0.0.1:8000

Re: windows UF issues

windows UF issues

tcp_routing route every thing?

Re: How does splunk eat newly copied edition of a ...

Re: How does splunk eat newly copied edition of a ...

How does splunk eat newly copied edition of a file

Re: CHARSET does not effect when data is from a u...

CHARSET does not effect when data is from a unive...

Re: does universalforwarder support SEDCMD?

Re: does universalforwarder support SEDCMD?

does universalforwarder support SEDCMD?

Re: how to recognize timestamp with Chinese charac...

Re: how to recognize timestamp with Chinese charac...

Re: timestamp in chinese charactors

Re: forwarding too slow

forwarding too slow

Re: set instance as a forwarder meanwhile an inde...

set instance as a forwarder meanwhile an indexer

delete source file after indexing

Re: How to filter or extract fields before indexi...