About daniel333

daniel333 · ‎02-10-2016

Wow! I have 0 idea what is going on in that search. But I'll give it a shot tonight. Thanks for getting back to me.

daniel333 · ‎02-09-2016

Should be easy enough, but not working for me. I am trying to pull a hostname of a log. I am terrible at regex and trying to get better. ^ = starts with .* = any number of characters _ = space? transforms.conf DEST_KEY = MetaData:Host REGEX = ^(.*)_ FORMAT = host::$1 Here is format of the log: localhost nmap 25 tcp allowed smtp For some reason it's not extracting this hostname.

daniel333 · ‎02-09-2016

So I was up last night making an NMAP app for my company. Took it into work and a worker pointed out there was an NMAP app packaged with Splunk Enterprise Security and Splunk App for PCI Compliance. So my question is, why isn't it on Splunkbase? Am I not allowed to use it without an ES license? (which I have, just curious). Any more input on these packaged apps? I was unaware of them until today.

daniel333 · ‎02-09-2016

All, LOVE the patterns tab. Is there a way for me to get that as an emailed scheduled search for my users?

daniel333 · ‎02-09-2016

All, New to macros, hoping someone can hammer something out for me or at least point me in the right direction. I am not 100% sure Macros are what I need. Problem: I want to put expiration dates on a certain set of saved searches. That is, I want this alert after 6/15/2016 to no longer run. The job should run and just log out the alert as expired or something. Also helpful would be a line of code to warns the job is going to expire in 1 month giving the consumer of the job 30 days notice. Thinking: What I think I need to do is create a macros on my job that takes a parameter of the date I want it expire on. In the Macro I should set with an eval alertlifetime="good"|"expiringsoon"|"expiring" and include alertlifetime in the alert subject line as a token. But I am not sold on this solution. If there is something better I am open to it. Example: tag=java tag=problem expiremacro("6/6/16") | stats count by host, alertlifetime

daniel333 · ‎02-06-2016

All, I am reading other posts about this error, but what is not clear to me, is my customer still gets 100% of the requested logs. Just slowly? [Server] Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk. See search.log for more information.

daniel333 · ‎02-06-2016

All, Is there an existing data model or CIM standard for $$ related items? In an existing app or what not? Would rather take someone else's work here than have to reinvent the wheel. thanks -Daniel

daniel333 · ‎02-06-2016

It's pretty standard. I've been temped to just SEDCMD away the opening tag with a key=" instead then completely remove the closing tag to just a closing ". But this seems like a lot of manual work. Would be nice is there was a "mixed type" auto extraction option? But if not, maybe the SED option?

daniel333 · ‎02-03-2016

All, I have a log file which is largely key value, with some random human readable language tossed in. Recent upgrades have resulted in XML getting mixed into the party. Does Splunk have a mode to which might be able to address the mixture of data types in the same logs? %time% app=SOMETHING something=value message="Some human readable thing" <value> 12 </value> <nameofprod>Name </nameofprod> dump is status="complete"

daniel333 · ‎02-02-2016

So I am looking at about 20 million events an hour with this _. I am thoerizing that it will save some time on field extraction by using a props.conf SEDCMD on our heavy forwarders.

daniel333 · ‎02-02-2016

So based on what I think you're saying here. Is that there might be value in saving some field extraction at search time if I can correct this at ingestion time?

daniel333 · ‎01-28-2016

All, Can you explain how the underscore is treated by Splunk? I see they are dropped at search times. I am seeing a log that has: _message="some words" But it's extracted automatically as: message="" Would there be any value in me fixing _message to message at index-time?

daniel333 · ‎01-28-2016

Switched it to SEDCMD and it worked [log4j] SEDCMD-alter = s/elapsedTime/duration/g

daniel333 · ‎01-28-2016

Okay, tried to s//g version, and restarted the heavy forwarder. Unfortunately no luck. Still seeing elapsedTime coming in. Any idea where I might be going wrong?

daniel333 · ‎01-28-2016

All, My first time messing with data manipulation at the heavy forwarder tier. Specifically looking to CIM a field my developers can't fix at code. Essentially quick sub elapsedTime to duration. Version: Splunk 6.32/UF 6.24 Linux CentOS 6.x props.conf [log4j] SED-alter = y/elapsedTime/duration/

daniel333 · ‎01-28-2016

Thanks for replying. I really appreciate it. I have played with that setting in our dev environment and I am not seeing any real change. So I didn't see a reason to promote that config to prod. Perhaps I am misunderstanding benefit of that setting. But as I am reading it, this should allow the indexer to dump data back to the SH must faster. Which, is not really the bottle neck for us. So this specific index has nearly 400 unique key value pairs in it's logs. So the extraction times are really killing us.. i believe. So trying ot get more CPUs to help with that.

daniel333 · ‎01-27-2016

So looking at my search performance. In smart mode and verbose. I am overwhelmingly seeing that CPU "seems"to the bottle neck for me. If I run searches in fast mode for example they are 5x - 20x faster on specific index. right now, I am working ton reducing knowledge objects and playing with the Data Curator to improve things. But I really feel like there should be a way to fork a search to take full advantage of hardware not being utilized?

daniel333 · ‎01-14-2016

All, Trying to bring in a NFS share of JSON files, but they are coming up as individual line items when I search with no extractions. Did I miss something? TA-company-akamai-networklists - inputs.conf [monitor:///NFS/utl/akamai/networklists/*] index=main sourcetype=akamai:networklists SA-COMPANY-akamai-props.conf - props.conf [akamai:networklists] DATETIME_CONFIG = CURRENT KV_MODE = json NO_BINARY_CHECK = 1 TRUNCATE = 0 SHOULD_LINEMERGE = true MAX_EVENTS = 20000

daniel333 · ‎01-14-2016

All, Is it possble to display a list of fields for an index? Something like this? index=java | dedup fields | table fields thanks, -Daniel

daniel333 · ‎01-14-2016

All, When I "inspect" a job, I see that "command.search.kv" is my longest part. Please correct me if I am wrong about this, but that is the search head itself running various key value pair extractions against the data it received from the indexers? e.g. that is a CPU bottle neck on the search head. Under that assumption I am watching top. I see on my 8 CPU search head, CPU 4 jumps to about 50% usage at most. The rest hover below 1%. It seems to me that the search head is for some reason not taking full advantage of the CPUs I have allocated. Is there a way to tweak this? A setting I am missing? Or are my assumptions off?

daniel333 · ‎12-29-2015

Hey yes, the manual key exchange is what I am trying to avoid. Assuming there is a script or something that we should be using? Distribute the key files If you add search peers via Splunk Web or the CLI, Splunk Enterprise automatically configures authentication. However, if you add peers by editing distsearch.conf, you must distribute the key files manually. After adding the search peers and restarting the search head, as described above: Copy the file $SPLUNK_HOME/etc/auth/distServerKeys/trusted.pem from the search head to $SPLUNK_HOME/etc/auth/distServerKeys//trusted.pem on each search peer. The is the search head's serverName, specified in server.conf. Restart each search peer.

daniel333 · ‎12-28-2015

Is there a trick to adding search peers with a search head cluster? I have to add 20 new indexers very soon and I don't want to have to goto each SH GUI over and over. Assuming there is a script somewhere I should be running?

daniel333 · ‎12-03-2015

Hello, I have an issue where a small percentage of my logs are coming in dated 2011. I tracked it down to a field called usernum=* where some subset of the users account numbers match Epoch time format. So Splunk uses that time as the time. The correct field it should use it start. I assume there is someway to set in the props.conf on the indexers to say [mysourcetype] Time_Use_Field=start But for the life of me the time documentation is going over my head.

daniel333 · ‎11-30-2015

I happen to have some control over our java logs. Rather than use transforms.conf/props.conf to create various sourcetypes based on the app that is running. Could I simply log out sourcetype in my logs? I believe Splunk will respect it as a KVP. But I don't know if it will really treat it like a sourcetype? thanks,

daniel333 · ‎11-17-2015

hello! I have a set of universal forwarders that keep shutting down on their own. We have a case open with support but this bring up and important question. How do I monitor the health and availability of my forwarders?

Posts	483
Solutions	8
Karma Given	5
Karma Received	57
Member Since	‎09-08-2011

Online Status	Offline
Date Last Visited	‎04-01-2025 07:08 PM

Alert Manager Enterprise - Malware Detection vsw.e...

Missing Data in Office 365 App Input

How do I map my group/roles with human readable cl...

Splunk needs a shell?

Troubleshooting Stanza entry not found for data-t...

Splunk_TA_Windows - script:installedapps timestamp...

Conditional Input.conf setting?

Any experience/practices with old buckets getting ...

Estimating Cost By Sourcetype

How can I send the same data to multiple indexers?

Re: How to put an expiration date on a set of save...

Field Extraction of a hostname

Why is the NMAP app that is packaged with Splunk E...

How to get the Patterns Tab as an emailed schedule...

How to put an expiration date on a set of saved se...

Why am I getting error "Events may not be returned...

Standard CIM/Data Model for money?

Re: Is there a way to configure Splunk to parse a ...

Is there a way to configure Splunk to parse a sour...

Re: How are underscores in logs treated by Splunk?

Re: How are underscores in logs treated by Splunk?

How are underscores in logs treated by Splunk?

Re: How configure SED props.conf on a Heavy Forwar...

Re: How configure SED props.conf on a Heavy Forwar...

How configure SED props.conf on a Heavy Forwarder ...

Re: Why are only 4 CPUs being used on my 8 CPU sea...

Re: Why are only 4 CPUs being used on my 8 CPU sea...

Trying to bring in an NFS share of JSON files, why...

How to display a list of fields for an index?

Why are only 4 CPUs being used on my 8 CPU search ...

Re: How to add search peers in a search head clust...

How to add search peers in a search head cluster?

How do I configure props.conf to recognize the pro...

Can I define the sourcetype in the log itself?

How do I monitor the health and state of universal...

Join the Conversation