Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About jodros
jodros
Builder
Member since:
01-18-2011
06-13-2024
Community Statistics
| Posts | 231 |
| Solutions | 23 |
| Karma Given | 26 |
| Karma Received | 48 |
| Member Since | 01-18-2011 |
Activity Feed
- Posted Re: Stream App + Netscaler AddOn: Why are Netflow elements not decoded? on All Apps and Add-ons. 02-16-2023 06:24 PM
- Posted Re: Search That Looks Back in Time and Checks Fields on Splunk Search. 08-11-2020 12:56 PM
- Posted Re: Search That Looks Back in Time and Checks Fields on Splunk Search. 08-11-2020 08:56 AM
- Posted Re: Search That Looks Back in Time and Checks Fields on Splunk Search. 08-10-2020 06:37 AM
- Posted Re: Search That Looks Back in Time and Checks Fields on Splunk Search. 08-10-2020 06:36 AM
- Posted Search That Looks Back in Time and Checks Fields on Splunk Search. 08-07-2020 02:33 PM
- Got Karma for Create alert when average events greater than 2 standard deviations from rolling average. 06-05-2020 12:49 AM
- Got Karma for Why am I getting "ERROR:root:code for hash md5 was not found." running a Python script on a search head?. 06-05-2020 12:48 AM
- Karma Re: How to find the average of daily indexed data by host for a given time range and show all hosts on a timechart, not just the top 10? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Is there a way i can schedule a saved search to run for every 2 weeks? for woodcock. 06-05-2020 12:47 AM
- Karma Re: How to get Windows logs into my Splunk instance on Ubuntu? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: How to assign syslog file to specific index based on file name in transforms.conf? for strive. 06-05-2020 12:47 AM
- Karma Re: What is the quickest way to see if a host was ever indexed in Splunk? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Google Maps not working after upgrade to 6.1.2 for southeringtonp. 06-05-2020 12:47 AM
- Karma Re: Does Splunk for Juniper SA SSL VPN support Syslog over TCP? for xinger. 06-05-2020 12:47 AM
- Karma Re: Where is the Splunk logrotate file located? for yannK. 06-05-2020 12:47 AM
- Karma Re: At what point do you need to consider scaling horizontally for Syslog collection and what would that architecture look like? for ltrand. 06-05-2020 12:47 AM
- Got Karma for Where is the Splunk logrotate file located?. 06-05-2020 12:47 AM
- Got Karma for Re: At what point do you need to consider scaling horizontally for Syslog collection and what would that architecture look like?. 06-05-2020 12:47 AM
- Got Karma for Google Maps not working after upgrade to 6.1.2. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 |
07-30-2014
02:56 PM
Splunk DB Connect can run on a searchhead pool and send data to indexer servers. We are doing this currently. Also, you do not need to actually index data from a database to create alerts. DB Connect can simply search against a database (as if the data were residing on indexers) and alert just the same.
... View more
07-30-2014
12:18 PM
Figured out the issue. There was an additional auditing setting that needed to be tweaked in the GPO before the CA events started showing up in the WinEventLog:Security. No need to try and figure out a way to monitor the edb files.
... View more
07-30-2014
12:17 PM
@southeringtonp Awesome. Yeah this app is all advanced XML. I would rather just get Google Maps working, even though I prefer the new native Splunk Maps. This is an older app that I built a while back. An app refresh is definitely needed, but it is very low priority right now.
I changed that line in the GoogleMaps.js, but it did not resolve the issue. Does it require a Splunk service restart?
... View more
07-30-2014
06:06 AM
I'll be converting this dashboard over to using Splunk maps.
... View more
07-30-2014
06:05 AM
early morning bump. No one is monitoring any Microsoft CA servers running on 2008 R2 with Splunk?
... View more
07-30-2014
06:03 AM
@yannK, I made a logrotate config file to be run against all of the .log files in /opt/splunk/var/log/splunk. Should roll when a file is over 24M and only rotate 1 and compress. Went from 1.2GB to about 120MB. Nice disk size savings. I chose 24M so that my logrotate job would run against logs before the Splunk log rotate job. Do you know how often and at what times Splunk runs it's logrotate job?
... View more
07-30-2014
05:33 AM
@linu1988 thanks for the reply. Will using SOURCE_KEY = MetaData:Host make the REGEX = test123 match on the host sending the log, or will it match on characters within the log itself. I should have clarified that I have used the DEST_KEY = queue and FORMAT = indexQueue successfully in the past.
Thanks
... View more
07-29-2014
01:31 PM
I do have another question pertaining to the transforms.conf file. Would the below config route all logs to the normal queue for host test123?
[keep_test123_data]
SOURCE_KEY = MetaData:Host
REGEX = test123
DEST_KEY = queue
FORMAT = indexQueue
... View more
07-29-2014
01:15 PM
1 Karma
I figured it out. There is a statement in the props.conf on the indexers that deletes wineventlog:application data that does not match some regex value. I will need to modify this statement.
Thanks
... View more
07-29-2014
12:40 PM
inputs.conf:
[WinEventLog:Application]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index = techsvcs
As far as I can tell, this is the same wineventlog configuration that I have working on other versions of UF.
There is also an outputs app that is working for 40+ other servers that is applied to this server to indicate how to send data to the indexers.
... View more
07-29-2014
12:02 PM
I recently installed the newest UF on a server to test before rolling out to the rest of the environment. I am able to monitor log files on the filesystem, but not wineventlogs. I verified the configuration is correct. Is there a bug with this UF?
Any assistance would be appreciated.
... View more
07-29-2014
08:39 AM
Has anyone been successful in monitoring Microsoft CA logs on Server 2008 R2? It looks as if they are being written to C:\Windows\System32\CertLog in EDB log format, which is not human readable. I want to say the EDB log format might also be used by Microsoft Exchange, so I don't know if any TA or SA for exchange could be leveraged.
Any assistance with this issue would be appreciated.
Thanks
... View more
07-28-2014
07:57 AM
So what you are saying is that I need to create my own logrotate config and drop it in the logrotate.d directory. I don't want anymore than 1 log file rolled. 5 is way too many and diskspace is an issue. I would rather indexed data fill that space instead of logs. Doesn't the SOS app pull in and index those logs anyway?
... View more
07-25-2014
08:57 AM
@yannK a few followup questions:
is there a way to push this out with the deployment-server?
will an update of splunk erase changes made to this file?
is there a way to set a global setting for any log file and not have to update settings on each log file?
Thanks
... View more
07-22-2014
07:44 AM
Yep. I cleaned up a bunch of logs in $SPLUNK_HOME/var/log/splunk. I just needed to know where the log rotate config was that Splunk used to clean up the logs. Thanks!
... View more
07-22-2014
07:42 AM
1 Karma
Yeah, I read the notes about the Google Maps app. I actually prefer the Splunk native mapping module more. This is a custom app I built a while back and it was the first one I used the Google Maps module. I was checking to see if there was an easy fix, or if I would have to recode everything for Splunk native maps.
... View more
07-21-2014
07:10 AM
I updated the title to reflect the new issue. I was able to reclaim a good amount of drive space by removing many of the redundant log files that have been rolled. I tried to look for a Splunk logrotate config file in /etc/logrotate.d/ but there is not one.
Does anyone know where the Splunk logrotate config file is located? I would like to update it to only roll a log file one, and not five times.
Thanks
... View more
07-21-2014
07:06 AM
1 Karma
Google maps app worked fine on 6.0. After upgrade to 6.1.2 it now says "loading google API" and the module never fully loads. This is running on a searchhead pool server. Is there an app that needs to be moved to the network storage location? Is there something else that needs to happen to get the Google Maps module working again?
Any assistance would be appreciated.
Thanks
... View more
07-18-2014
06:37 AM
Bump. This issue is still happening. I would really appreciate any thoughts.
Thanks
... View more
07-17-2014
01:58 PM
Thanks Dave. I believe the 5 GB limit has been a requirement for a few major releases now.
Regardless, I need to find what files/directories are growing and are not being cleaned up.
Thanks
... View more
07-17-2014
01:27 PM
1 Karma
Our shop has four indexers with limited storage. This is due to the fact that we wanted fast disk for quicker searching of the most recent data. All servers are RHEL 5.10 x64 running Splunk 6.0. I am planning on upgrading to 6.1.2 soon. Recently I noticed that we are getting the alert stating that there is only 5 GB of disk space left and indexing has been paused. This is happening on all four indexers from time to time. I have a volume configured on the indexers that when it reaches a max size to roll the warm buckets to cold (network storage). This has worked well for about 2 1/2 years until recently. I am guessing that there are other files that are outside of this volume cap that are not getting cleaned up.
I did a search for large files/directories and found the /searchpeers directory with bundles from all of the searchheads. Some of them seem somewhat old.
So enough of the back story. Here are my questions:
Do knowledge bundles get cleaned up by some process?
If not can I delete them without any issues?
I noticed that all of the log files rotate 5 copies. Would there be an issue to modify the logrotate job to only keep one copy?
Are there any other files that others have seen that drive disk utilization up?
Any assistance with this issue would be greatly appreciated.
Thanks
... View more
05-21-2014
08:49 AM
Did the 6.1 searchhead display any sort of notifications about incompatibility with 6.0 indexers?
... View more
05-21-2014
08:49 AM
Thank you for your response. I saw this, but was looking for more actual experience in running an environment in this hybrid 6.x way.
Thanks
... View more
05-21-2014
07:19 AM
1 Karma
Aside from the new internal index, are there any issues running a 6.1.1 searchhead with 6.0 indexers? I am trying to test functionality on our searchhead before rolling 6.1.1 to the entire environment.
Thanks
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-13-2024
05:04 PM
|
Karma from
Karma given to
