About muebel

muebel · ‎06-28-2010

I would run | metadata index="foo" type=hosts | outputcsv foo_hosts for each index that could contain host indexed data.

muebel · ‎06-28-2010

I haven't been able to find this setting in SplunkWeb manager.

muebel · ‎06-28-2010

How could you find the time for the first event in an index? I.E. the oldest event? Is there a way beyond "index=foo *", searching over all time, and then waiting a good while?

muebel · ‎06-28-2010

Besides running "index=foo *" is there a way to quickly check the total number of events indexed in an index?

muebel · ‎06-28-2010

On every view in the webgui I have a blue stripe notifying me of an unconfigured or disabled index. This issue seems to be corrected as far as I can tell. My question is then - how do you clear these notifications?

muebel · ‎06-25-2010

You could also tag the domain: ### In tags.conf [domain="bad.domain.etc"] suspicious_domain = enabled Then run a scheduled search on tag=suspicious_domain which you could alert on for events found > 0

muebel · ‎06-25-2010

How could I the capture firmware version of a Dell chassis/blade etc. and index it into Splunk?

muebel · ‎06-24-2010

I am beginning to work with tags and am having partial success. I have a tags.conf file that I dropped into the local directory of a new app I created. I then restarted and started to try to search based on the tagging configuration. I could not find anything. After reading some documentation, I was led to believe that the tags.conf file should be in the system configuration, so I dropped it in the local directory there. Sure enough, I was able to search and find events based on the tags configured. However, when I load up a dashboard in the app I created, I am unable to find any events based on the tagging configuration. Why isn't the tags configuration extending to all apps? Is the only proper location for it $splunkhome/etc/system?

muebel · ‎06-24-2010

This link is a good place to start: http://www.splunk.com/search/docs?q=dashboard It is a search for dashboard entires in the documentation in the general sense. This link is to the specific doc entry on form creation: http://www.splunk.com/base/Documentation/latest/Developer/FormIntro Try to drop this code into your dashboard panel to give a general sense of how forms can work: <form> <label>My form search</label> <searchTemplate>$username$</searchTemplate> <fieldset> <input type="text" token="username" /> </fieldset> </form>

muebel · ‎06-23-2010

oop, thats an easy one heh. Went over the documentation but must have missed that bit. Thanks!

muebel · ‎06-22-2010

I have created a chart panel in a dashboard in Simple XML. Is there a way to set the height to a certain value beyond what comes by default as being part of a row?

muebel · ‎05-20-2010

I have blue bar notification in each view informing me that an event was received "for unconfigured/disabled index='sample'..." How would I be able to find when these events were received?

muebel · ‎05-03-2010

As far as I know, changing the license doesn't change the configuration. It just changes the permitted functionality. To provide my answer to the question, nothing changes in the configuration.

muebel · ‎04-29-2010

I am wrestling with similar issues. The best answer I can provide is that Splunk is indexing a particular event, that is Traceback (most recent call last):... or File "/opt/splunk/etc/system/bin/appsmanager.py" and it can't find a pattern that matches any known sort of timestamp. There is some configuration that likely needs set so that Splunk will know that you are sending it a multi-line event, and know where to find the timestamp (if there is one).

muebel · ‎04-28-2010

try setting a local.meta in the /app/splunk/etc/apps/search/metadata folder http://www.splunk.com/base/Documentation/4.1.1/Developer/Step5SetPermissions and http://www.splunk.com/base/Documentation/4.1.1/Admin/Defaultmetaconf will help. I suspect the configuration would look like: [<object_type>/<object_name>] access = read : [ <comma-separated list of roles>], write : [ comma-separated list of roles>] owner = <User_Name_in_Question> for instance: [savedsearches/Splunk%20errors%20last%2024%20hours] access = read : [ admin ], write : [ admin ] owner = jdoe

muebel · ‎04-27-2010

See my comment on wolverine's answer.

muebel · ‎04-27-2010

Wolverine has the key element here. The Splunk documentation says that you simply need to add "default_namespace = search" to the user-prefs.conf stanza, but this did not work for me. Once I included the above configuration as part of the [general_default] stanza, and then restarted splunk, I was able to see the Search app by default.

muebel · ‎04-27-2010

one way is to run the following search to give an idea of which hosts are fowarding how many events * | chart count(host) by host Run this over the last 15 minutes.

muebel · ‎04-27-2010

My indexer has a Intel Xeon X5570 which has four cores. http://ark.intel.com/Product.aspx?id=37111 How can I make sure that Splunk is using this multicore capability to its full advantage?

muebel · ‎04-23-2010

From "license comparison" in splunk.com search Splunk licenses Splunk offers two basic kinds of licenses: Free, and Enterprise. Splunk Free is a totally free (as in beer) version of Splunk. It allows you to index up to 500MB/day and will never expire. Splunk Free is designed for personal, ad-hoc search and visualization of IT data. It entitles you to 500MB/day of licensing volume. It does not support the features listed below for Splunk Enterprise. Splunk Enterprise supports multiple user accounts and role-based access controls, distributed search, forwarding in TCP/HTTP formats (you can forward data to other Splunk instances, but not to non-Splunk instances), deployment management, scheduled saved searches (including summary indexing) and alerting/monitoring. About Splunk licenses - from Documentation More about Splunk Free - from Documentation How Splunk licensing works More About Splunk Free

muebel · ‎04-22-2010

You might find help here http://answers.splunk.com/questions/1542/issues-with-pci-app-after-4-1-upgrade/1623#1623 I think the problem is that of the new lookup scoping mechanisms added in 4.1. Adding [lookups] export=system to the $splunk_home/etc/system/metadata/local.meta config file should save your day.

muebel · ‎04-22-2010

I have no idea why this was considered the best answer hah

muebel · ‎04-22-2010

If you are responsible for maintaining your Splunk implementation's config, you can simply remove the saved searches in question. Navigate to http://localhost:8000/en-US/manager/search/saved/searches and click "Scheduled Time" to find which saved searches have a scheduled time. You can then find these searches in the various savedsearch.conf files, or perhaps disable them. This should stop this warning from showing (I would suppose)

muebel · ‎04-22-2010

In addition to gkanapathy's answer, additional indexes seems to be part and parcel of how summary indexing works. http://www.splunk.com/base/Documentation/4.1.1/Knowledge/Usesummaryindexing

muebel · ‎04-21-2010

I have been having repeated warnings that the system is unable to read metadata.csv, which looks like it should be located in the above mentioned directory, replacing "..." with what looks to be a datastamp. However, it is absent. What is metadata.csv's purpose? And, by extension, how worried should I be that it is not actually in the intended directory?

Posts	517
Solutions	80
Karma Given	220
Karma Received	351
Member Since	‎04-14-2010

Online Status	Offline
Date Last Visited	a month ago

What governs the limits around the Splunk Web expo...

What kind of things do you view as "bad config"?

Is there any script to lint and validate splunk co...

How do you maintain your splunk config?

Splunk Community Office Hours - March 4th 2022 11:...

What type of restart happens during a normal index...

Swap field and values

How does a Search Head Cluster determine if a rest...

Audit Default Admin Creds?

What is the difference between the metasearch and ...

Re: I'm being audited. Can i give my auditor a li...

Re: How do you acknowledge or otherwise clear blue...

How to return time of first event in an index?

How to quickly count total events in an index?

How do you acknowledge or otherwise clear blue bar...

Re: How can I set up a watchlist?

How to index current firmware version of Dell hard...

Where should the tags.conf file be located?

Re: help with dashboard search?

Re: Set Height of Panels in Simple XML?

Set Height of Panels in Simple XML?

Received event for unconfigured/disabled index... ...

Re: License Question : Enterprise Demo -> Free Li...

Re: What are these WARN DateParserVerbose messages...

Re: How to specify an owner for pre-canned saved ...

Re: How do i set the default App in splunk?

Re: How do i set the default App in splunk?

Re: Who is forwarding data

How to take advantage of a multi-core indexer?

Re: What does an Enterprise license get me?

Re: Error in 'lookup' command: The lookup table 't...

Re: Why does Splunk have multiple indexes?

Re: how do i remove the saved search warning when ...

Re: Why does Splunk have multiple indexes?

What is the purpose of var/run/splunk/dispatch/......