Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About lmyrefelt
lmyrefelt
Builder
Member since:
09-06-2011
06-05-2020
Community Statistics
| Posts | 191 |
| Solutions | 13 |
| Karma Given | 41 |
| Karma Received | 55 |
| Member Since | 09-06-2011 |
Activity Feed
- Got Karma for Re: How to disable scheduled searches via command line interface?. 06-13-2025 08:00 PM
- Got Karma for Re: Adding a navigation menu. 12-13-2021 09:53 AM
- Karma How is the removal of IT data block signing, Audit signing, and Event hashing features in Splunk 6.2 going to affect the Splunk for PCI Compliance App? for gfuente. 06-05-2020 12:47 AM
- Karma Error in 'databasePartitionPolicy': Max Raw Size Limit Exceeded for jjozwik702. 06-05-2020 12:47 AM
- Karma TransformsExtractionHandler - Unable to find stanza. Getting thousands of warnings in _internal splunkd for joshuamcqueen. 06-05-2020 12:47 AM
- Karma Re: How do I disable Transparent Huge Pages (THP) and confirm that it is disabled? for jwelch_splunk. 06-05-2020 12:47 AM
- Karma Are Key/Value Store data counted as Splunk license? for sunrise. 06-05-2020 12:47 AM
- Karma Re: Are Key/Value Store data counted as Splunk license ? for mgroves_splunk. 06-05-2020 12:47 AM
- Karma Re: Universal Forwarder not able to read all logs for frmaasdam. 06-05-2020 12:47 AM
- Karma Re: Is it possible to control where to write replicated data (hot/warm/cold) in cluster (single/multi) for Splunk 6.x? for luhadia_aditya. 06-05-2020 12:47 AM
- Karma Re: Has anybody been successful with configuring the Splunk Support for Active Directory app on Splunk 6.1.1? for m4him7. 06-05-2020 12:47 AM
- Karma Re: Hiding navigation bar - invisible in dashboards, briefly visible while switching between them for arkadyz1. 06-05-2020 12:47 AM
- Karma Re: Restricting index access from apps for kml_uvce. 06-05-2020 12:47 AM
- Got Karma for Re: How to apply a custom TIME_FORMAT specific to source with a wildcard in Props.conf?. 06-05-2020 12:47 AM
- Got Karma for Re: How to find when splunk is not indexing?. 06-05-2020 12:47 AM
- Got Karma for Re: How to stop the eventgen and how to get the number of events generated by eventgen?. 06-05-2020 12:47 AM
- Got Karma for Re: Why did we get TMG Firewall logs for 2 days, but suddenly stopped with my current inputs.conf configuration?. 06-05-2020 12:47 AM
- Got Karma for Re: Why did we get TMG Firewall logs for 2 days, but suddenly stopped with my current inputs.conf configuration?. 06-05-2020 12:47 AM
- Got Karma for Re: Why did we get TMG Firewall logs for 2 days, but suddenly stopped with my current inputs.conf configuration?. 06-05-2020 12:47 AM
- Got Karma for Re: Monitoring Indexers from Search head. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 |
11-21-2014
04:49 AM
I guess the rest of the traffic depends on the searches, its results , number of users and number of searches ...
reduce users and reduces searches and you reduces the network traffik between the nodes ...
There might be some setting around using / not using ssl / maybe some compression to set in server.conf or web.conf to controll the transport (protokol/mechanism) between sh and indexer
... View more
11-21-2014
04:46 AM
2 Karma
You can play around with settings inside of distsearch.conf
like ...
[replicationSettings]
replicationThreads
maxMemoryBundleSize
sanitizeMetaFiles
allowDeltaUpload
allowStreamUpload
But more intressting could be
[replicationBlacklist]
And
[replicationWhitelist]
I also belive there is a time-setting you can configure for how often it will try to poll/push /check for changes to the "bundle" .. can remember were...
Hope this helps!
... View more
11-20-2014
01:10 AM
which btw is not the same as that it would not work .. just not supported
... View more
11-20-2014
01:09 AM
In my opion the easist way is to use the built in function to loadbalance.
However .. in your case it seems that if you have an working load-balanced syslog solution using HaProxy and syslog-ng / what-ever ... that this might be a good solution and the only thing you need to do is install the splunk forwarder on your cluster nodes (aktive-active or passive-active?) and have them ingest the data/log-files create from syslog.
You then use the built in function in splunk forwarder to load-balance the data into your splunk indexer(-cluster)
The documentation clearly states "dont use 3dje party / hardware loadbalancer" between.
... View more
11-20-2014
01:03 AM
no, its not on github (at least not yet)
... View more
11-20-2014
01:02 AM
You can / could easily automate it, using scripts calling different cli-commands and or the rest-api to do the stuff.
I am using a script to add new indexes , roles, serverclass (standardized) for the forwarder configuration, deploying it the indexers ... creating the search-head app, linking / wrapping config / doku page from our wiki, from an template, deploying this together with roles and what not to my search head cluster.
I then use the api and or cli (also scriptet) to update / re-read the configs to activate the new app / data-input an make this available in no-time 🙂
Next thing to do is a self-service portal for creating the data-inputs (fwd configuration) for the system-owners/devs 😉
... View more
11-18-2014
07:51 AM
Well i would say it is easier to manage 400 indexes and the assosicated roles with them, then try to use 40 indexes and create 400 roles that are based on "search-terms" or whatever ...
Either you got access to the index and its application or you dont .. easy -peacy
I use the for "every" service / application (where it is suitable) on app with one role which gives access to 3 indexes, dev, stage, prod. Each index has with one role attached (corresponding group in ldap) . Users get access to indexes, and automatically the app at login.
In here i then have different views and search-views into the different indexes (without type index-name or search or whatever) so the users cant get lost. ie. they just need to choose if they want to work in dev, stage or prod .
But i am sure there is better ways of doing it
... View more
11-18-2014
07:39 AM
And you have configured everything accourding to the documentation;
http://docs.splunk.com/Documentation/MSApp/1.0.4/MSInfra/AbouttheSplunkAppforMSInfrastructure
and you have checked the following part of it:
http://docs.splunk.com/Documentation/MSApp/1.0.4/MSInfra/TroubleshoottheSplunkAppforWindowsInfrastructure
... View more
I would go for option 1
In most cases you dont have to think about the "nobody" user ...
... View more
11-18-2014
07:26 AM
2 Karma
You might want to filter on Logon_Type ... in addition ... different Logon_Types ... different meaning.
... View more
11-18-2014
07:24 AM
The following should work;
in props.conf
["your-sourcetype"]
DATETIME_CONFIG = ("path")/etc/apps/"app-name"/"path"/datetime.xml
inside datetime.xml, under lithmonth / _litmonth
dec|déc
... Well to be honest .. i have not tried using charachters like åæøø yet .. but ...
restart of course
here comes some additional good information;
http://blogs.splunk.com/2014/04/23/its-that-time-again/
http://blogs.splunk.com/2009/12/02/configure-splunk-to-pull-a-date-out-of-a-non-standard-filename/
... View more
11-18-2014
07:14 AM
2 Karma
You will find that it is well-documented here;
http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Setuploadbalancingd
Use the built in functions in the splunk forwarder to loadbalance your data or with dns .
... View more
11-03-2014
11:55 AM
hehe, don't forget to have patience 😉
If the other data / logs are coming, there is really no reason for the rest not to come?
... View more
11-03-2014
11:44 AM
And some data / host-names etc might come from within the logs themselves ... ie. using short name / fqdn name
... View more
11-03-2014
11:43 AM
You can / should check $SPLUNK_HOME/etc/system/local/server.conf, $SPLUNK_HOME/etc/system/local/inputs.conf, $SPLUNK_HOME/etc/system/local/deploymentclient.conf to see that they contain the "hostname" you like, either short or fqdn .
Sometimes when installing Splunkforwarder it does not set or change the $HOSTNAME-WHATEVEVER_STUFF_COMES-HERE$ in server.conf
... View more
11-03-2014
10:15 AM
aaaaah Sorry .. it seems you either need to set the "correct permission" on the log files and or change the user under which you are running Splunkforwarder.
You could for instance have two installed in some cases .. one for catching OS-logs and one for catching your App logs.
... View more
11-03-2014
10:12 AM
Well you also have except for the ulimit (OS-level) that you might want to increase but on high profil servers, hosting massive amounts of apps and or log files you might have to tweak limits.conf (on forwarder) for it to be able to coupe with the amount of data / number of files needed to monitor.
[inputproc]
max_fd =
* Maximum number of file descriptors that Splunk will keep open, to capture any trailing data from
files that are written to very slowly.
* Defaults to 100.
and (but not in your case .. you should see something regarding "block / blocked" in your log-files on the forwarder)
[thruput]
maxKBps =
* If specified and not zero, this limits the speed through the thruput processor to the specified
rate in kilobytes per second.
* To control the CPU load while indexing, use this to throttle the number of events this indexer
processes to the rate (in KBps) you specify.
... View more
10-30-2014
01:08 PM
1 Karma
And do Splunk do any recommendations on how to / what to "substitute" it with while "waiting" for your solution ?
... View more
10-29-2014
05:49 AM
Environment: 4x indexers 3 search-heads 1 job-server, red hat linux, splunk 5.0.3 / 5.0.7 .
Trying to get Shuttl running in our environment using local storage ...
We have configured shuttl to be "running" on our jobserver, that is storage mounted on job-server, shuttl configuration pointing to jobb-server etc etc as described at github.
However we are getting the following error from the indexers when trying to role data from cold to frozen.
10-29-2014 13:27:28.118 +0100 INFO BucketMover - will attempt to freeze: candidate='/opt/cold02/db_splunk/testindex/colddb/db_1336690292_970437600_2' because frozenTimePeriodInSecs=120 exceeds difference between now=1414585648 and latest=1336690292
10-29-2014 13:28:14.305 +0100 ERROR BucketMover - coldToFrozenScript Exception in thread "main" com.splunk.shuttl.archiver.copy.IndexScanner$UnknownIndexPathException: Unknown index with bucket path: /opt/cold02/db_splunk/testindex/colddb/db_1414489876_1336745601_0
10-29-2014 13:28:14.305 +0100 ERROR BucketMover - coldToFrozenScript at com.splunk.shuttl.archiver.copy.IndexScanner.getIndex(IndexScanner.java:41)
10-29-2014 13:28:14.305 +0100 ERROR BucketMover - coldToFrozenScript at com.splunk.shuttl.archiver.copy.IndexScanner.getIndexNameByBucketPath(IndexScanner.java:46)
10-29-2014 13:28:14.305 +0100 ERROR BucketMover - coldToFrozenScript at com.splunk.shuttl.archiver.copy.EntryPointUtil.getIndexNameForBucketDir(EntryPointUtil.java:35)
10-29-2014 13:28:14.305 +0100 ERROR BucketMover - coldToFrozenScript at com.splunk.shuttl.archiver.archive.BucketFreezer.runMainWithDependencies(BucketFreezer.java:118)
10-29-2014 13:28:14.305 +0100 ERROR BucketMover - coldToFrozenScript at com.splunk.shuttl.archiver.archive.BucketFreezer.main(BucketFreezer.java:106)
10-29-2014 13:28:14.319 +0100 ERROR BucketMover - coldToFrozenScript cmd='/opt/hot02/splunk/etc/apps/shuttl/bin/coldToFrozenScript.sh /opt/cold02/db_splunk/testindex/colddb/db_1414489876_1336745601_0' exited with non-zero status='exited with code 1'*
IF i am trying to use the testArchivingBucket.sh script i am getting the following error;
If you're having trouble, you can customize the shuttl vars with usage:
/opt/hot02/splunk/etc/apps/shuttl/bin/testArchivingBucket.sh [shuttl_port] [shuttl_host]
Shuttling bucket with:
index=TestIndexForTryingOutShuttlArchiving
shuttl_host=svvploggjs01
shuttl_port=9090
HTTP ERROR 500
Problem accessing /shuttl/rest/archiver/bucket/archive. Reason:
java.io.FileNotFoundException: Could not find directory: /tmp/db_1336330530_1336330530_0.6Ia4Rn Caused by: java.lang.RuntimeException: java.io.FileNotFoundException: Could not find directory: /tmp/db_1336330530_1336330530_0.6Ia4Rn
at com.splunk.shuttl.server.mbeans.rest.ArchiveBucketEndpoint.archiveBucket(ArchiveBucketEndpoint.java:73)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at com.sun.jersey.spi.container.JavaMethodInvokerFactory$1.invoke(JavaMethodInvokerFactory.java:60)
at com.sun.jersey.server.impl.model.method.dispatch.AbstractResourceMethodDispatchProvider$VoidOutInvoker._dispatch(AbstractResourceMethodDispatchProvider.java:167)
at com.sun.jersey.server.impl.model.method.dispatch.ResourceJavaMethodDispatcher.dispatch(ResourceJavaMethodDispatcher.java:75)
at com.sun.jersey.server.impl.uri.rules.HttpMethodRule.accept(HttpMethodRule.java:288)
at com.sun.jersey.server.impl.uri.rules.ResourceClassRule.accept(ResourceClassRule.java:108)
at com.sun.jersey.server.impl.uri.rules.RightHandPathRule.accept(RightHandPathRule.java:147)
at com.sun.jersey.server.impl.uri.rules.RootResourceClassesRule.accept(RootResourceClassesRule.java:84)
at com.sun.jersey.server.impl.application.WebApplicationImpl._handleRequest(WebApplicationImpl.java:1469)
at com.sun.jersey.server.impl.application.WebApplicationImpl._handleRequest(WebApplicationImpl.java:1400)
at com.sun.jersey.server.impl.application.WebApplicationImpl.handleRequest(WebApplicationImpl.java:1349)
at com.sun.jersey.server.impl.application.WebApplicationImpl.handleRequest(WebApplicationImpl.java:1339)
at com.sun.jersey.spi.container.servlet.WebComponent.service(WebComponent.java:416)
at com.sun.jersey.spi.container.servlet.ServletContainer.service(ServletContainer.java:537)
at com.sun.jersey.spi.container.servlet.ServletContainer.service(ServletContainer.java:708)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:802)
at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:594)
at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:485)
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:119)
at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:521)
at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:233)
at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1065)
at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:412)
at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:192)
at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:999)
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:117)
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:111)
at org.eclipse.jetty.server.Server.handle(Server.java:351)
at org.eclipse.jetty.server.AbstractHttpConnection.handleRequest(AbstractHttpConnection.java:451)
at org.eclipse.jetty.server.AbstractHttpConnection$RequestHandler.content(AbstractHttpConnection.java:931)
at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:857)
at org.eclipse.jetty.http.HttpParser.parseAvailable(HttpParser.java:235)
at org.eclipse.jetty.server.AsyncHttpConnection.handle(AsyncHttpConnection.java:76)
at org.eclipse.jetty.io.nio.SelectChannelEndPoint.handle(SelectChannelEndPoint.java:609)
at org.eclipse.jetty.io.nio.SelectChannelEndPoint$1.run(SelectChannelEndPoint.java:45)
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:599)
at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:534)
at java.lang.Thread.run(Unknown Source)
Caused by: java.io.FileNotFoundException: Could not find directory: /tmp/db_1336330530_1336330530_0.6Ia4Rn
at com.splunk.shuttl.archiver.model.LocalBucket.verifyDirectory(LocalBucket.java:57)
at com.splunk.shuttl.archiver.model.LocalBucket.<init>(LocalBucket.java:45)
at com.splunk.shuttl.archiver.model.LocalBucket.<init>(LocalBucket.java:34)
at com.splunk.shuttl.server.mbeans.rest.ArchiveBucketEndpoint.isPathReplicatedBucketWithRawdataOnly(ArchiveBucketEndpoint.java:79)
at com.splunk.shuttl.server.mbeans.rest.ArchiveBucketEndpoint.archiveBucket(ArchiveBucketEndpoint.java:57)
... 41 more
We are setting $SPLUNK_HOME as well as a few other variables for use with database / volum definisions inside indexes.conf .
And we are deploying are index ( indexes.conf etc etc ) using a centraly management deployment server.
Both the buckets inside the testindex are existent and valid, and using the testArchiveScript the "tmp" buckets gets created at the "client" side. (not in archive @ jobserver)
Any advice / experiences to share?
... View more
You can also disabled "scheduling capability" in $SPLUNK_HOME/etc/system/{local,default}/default-mode.conf
No scheduled searches willl run ... "ever" on this server.
[pipeline:scheduler]
disabled = true
... View more
09-17-2014
07:18 AM
"It will work" since you reference your sourcetype OR source in props.conf for whatever data you want to do something with.
... View more
09-17-2014
07:12 AM
You could index the csv file into an index, that i am sure will speed up your search.
If you have a distributed environment and your lookup file is BIG , you also add local=t .
Like;
[|inputlookup local=t blacklist.csv
That helps to speed it up sometimes .
... View more
09-17-2014
07:05 AM
8 Karma
I belive the best tool for the job is ;
regex101.com .
Simply superb!!
... View more
09-17-2014
07:04 AM
And dubbelcheck any configurations that might interfere with each other.
... View more
09-17-2014
07:02 AM
Not that it shouldnt be in the way of having it working, but you dont need to specify booth a tcp-group and a tcpout-server in your outputs.conf .
One or the other should be OK.
Have you tried to re-install the agent ?
I have seen this message on a forwarder just the other day .. however in my case it was enough to just restart the agent (if i am not remembering wrong .. since i did not get ony more troubles with the forwarder after that i did not take any ation on the message) .
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma given to
