Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About teunlaan
teunlaan
Contributor
Member since:
07-03-2012
02-10-2026
Community Statistics
| Posts | 111 |
| Solutions | 11 |
| Karma Given | 3 |
| Karma Received | 49 |
| Member Since | 07-03-2012 |
Activity Feed
- Got Karma for Re: Spike in 503 errors in the Splunk WebUI after upgrading to 10.0.3 (also affects 9.4.8/10.2.0). 02-25-2026 09:18 AM
- Got Karma for Re: Spike in 503 errors in the Splunk WebUI after upgrading to 10.0.3 (also affects 9.4.8/10.2.0). 02-11-2026 03:10 PM
- Posted Re: Spike in 503 errors in the Splunk WebUI after upgrading to 10.0.3 (also affects 9.4.8/10.2.0) on Splunk Enterprise. 02-10-2026 04:56 AM
- Posted How to force delete savedsearch results after x time , disable " AutomIatic lifetime extensions"? on Splunk Search. 02-09-2023 08:41 AM
- Got Karma for Re: Can you update the Splunk manifest so that it will not throw warnings about it being modified?. 11-10-2022 07:31 AM
- Posted Re: How do I find the time events have been sent in for the last 3 days. I want to see the time 53 different events came on Splunk Search. 04-08-2022 01:08 AM
- Got Karma for Re: Why are realtime searches disliked in the Splunk world?. 01-25-2022 10:47 AM
- Posted Re: Universal Forwarder to remove files on Installation. 01-11-2022 04:56 AM
- Posted Re: UF's are disappearing from ForwarderManagement on Deployment Architecture. 01-11-2022 04:30 AM
- Got Karma for Re: UF's are disappearing from ForwarderManagement. 01-11-2022 03:38 AM
- Posted Re: UF's are disappearing from ForwarderManagement on Deployment Architecture. 12-31-2021 03:15 AM
- Got Karma for Re: How do I change the order of apps in the dropdown menubar?. 08-26-2021 09:11 AM
- Posted Re: Adaptive Response Action Send email not sending results on Splunk Enterprise Security. 08-01-2021 08:57 PM
- Got Karma for Re: Adaptive Response Action Send email not sending results. 07-29-2021 05:50 PM
- Posted Re: Adaptive Response Action Send email not sending results on Splunk Enterprise Security. 07-14-2021 02:43 AM
- Got Karma for Re: How do I get large LDAP/AD Groups (>1500 members) to work in Splunk?. 03-02-2021 07:42 AM
- Posted Re: CMMaster - Unable to send scheduled jobs on Splunk Enterprise. 11-30-2020 11:44 PM
- Got Karma for Re: Alert scheduling - cron expression not working as expected. 11-20-2020 05:26 AM
- Posted Re: The TCP output processor has paused the data flow on Getting Data In. 11-20-2020 12:39 AM
- Posted Re: Alert scheduling - cron expression not working as expected on Alerting. 11-20-2020 12:22 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
05-01-2017
05:58 AM
frozenTimePeriodInSecs = 1800
What is the Timestamp of the logs?
If they are older than 1800 seconds, (if they alre the only event in the bucket)
... View more
02-06-2017
11:39 PM
Have the same problem (6.5.1 and 6.5.2)
I noticed it only happens when we are running Real-time searches
... View more
08-04-2016
01:29 AM
Think your missing the format command.
http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Format
... View more
07-28-2016
05:51 AM
Think he is using UDP 514, than rsyslog is a very good Idea.
Otherwise you loose data everytime splunk is restarting
... View more
07-28-2016
04:58 AM
Are you sure it is "missing"?
We had a multiple problems with time extracion.
- another timstamp in the message, that was pickup as time
- an ID was picked-up as Epoch time
- wrong cut-off for timestamp. (timestamp without year followed by IP address. first 2 digits of the IP where used as YEAR
To see if the timestamp is wrong, start a real-time search. Just watch the timeline for events popping up in the past.
If they pop up in the past, you have to alter the props.conf for time extraction
... View more
07-22-2016
01:49 AM
think you have to set maxTotalDataSizeMB = xxxxxxxxx
Youre setting are still the default.
As far as I understand it will start dropping data on whatever limit is fit first.
... View more
07-20-2016
05:51 AM
2 Karma
We noticed when there is an new app with tour (ITSI), it wil allways pop-up the tour as long there is nothing configured in the new app.
So are the users "working" with app or just open it?
The is also a global setting to Ignore the tours.
Place ui-tour.conf in etc/system/local with
[default]
useTour = false
... View more
07-12-2016
01:58 AM
ehh. No the UF won't pickup de change the next phoneHomeInterval.
If you don't reload the deployment-sever, it doesn't "know" the app has changed. (it has to genarate a new hash)
... View more
07-07-2016
11:22 PM
It will only remove apps completely.
1) You could remove the complete app from de the deployer
2) push the budles (now the app should be gone on the SH's) .
3) restore the app on the deployer (without the bin directory
4) push bundles.
... View more
07-06-2016
04:31 AM
Your "show shcluster-status " looks ok, zo think its an issue in the DMC.
Are the SH's configured as "Search Peer" (settings > distribured search > search peers)? otherwise It can't make rest call's and the won't show up in the DMC
... View more
07-04-2016
02:28 AM
1 Karma
Did you remove de index from "indexes.conf" or deleted the directory on the server?
If you deleted it on the server, Your data is already gone
... View more
07-01-2016
05:00 AM
number of logins : index=_audit info=succeeded action="login attempt" | stats count by user
How many hours someone someone is accessing is very hard to get (in my opinion)
You could calculate the time between login and logout times. BUT most users don't press the logout button, so you don't have the data.
So you should track when users fires searches.
... View more
06-14-2016
04:02 AM
2 Karma
First Answer : http://docs.splunk.com/Documentation/Splunk/6.4.1/DistSearch/PropagateSHCconfigurationchanges#App_configurations
The Deployer merges Local > Default
Second Answer This is correct.
Keep in mind that again the local settings will be merged too default, but your "old locals" will stay on the SH's
... View more
04-28-2016
12:11 AM
Should not be a problem. The SH's won't notice its down.
Only if you restart your SH's, they may try to contact the deployer to check the bundles (depends on you SHcluster settings). But also should go fine.
... View more
03-29-2016
02:30 AM
although it is unsupported, it will work.
... View more
03-13-2016
11:00 PM
Why did you add a new License file? What error do you get?
If you maxed out your previous license, you'll need a reset license.
Just adding an extra license wont reset you limitations
... View more
11-20-2015
04:42 AM
What you can do, depends on the reason why there are not running immediately.
So before you try to fix anything find the error.
1) look at the duration of your searches. If you run the every 5 minutes, they should be finished within the 5 minutes.
2) If searches take a long time to finish, take a look at the search. Are the build in the right way (specify host, source type, ect.)
3) Are the searches “continued” because you don’t have any CPU-cores left on you searchheads OR on you indexers.
- Maybe more Indexers will help (single indexer has to search a smaller amount of data).
- Extra Searchhead is only usefull, if your Indexers can handle it
... View more
11-20-2015
04:23 AM
1 Karma
If you configured all the connections by hostname , there shouldn't be a problem.
Even your internals won't change, your machine name is set @ first-run of splunk.
... View more
11-18-2015
02:00 AM
1 Karma
Give user the can_delete permissions
Search for the old data (by source or somthing like that). If you found the data (and only the data you want to remove) do the same search, and place " | delete " after it.
Is will "hide" data and NOT remove it from disk
... View more
09-04-2015
12:42 AM
Keep in mind Splunk only displays groups when the are Users in that group.
... View more
08-10-2015
01:28 AM
So you have 3 files and only 2 are send all the time? How quick are thes files growing?
Default is in de outputs.conf
[tcpout]
maxConnectionsPerIndexer = 2
The forwarder will only send 2 files a the same time. As long the UF didn’t reach EOF of a file, it won’t switch to another file.
No EOF can be caused by several options
File is very big (GB's)
Network connection is slow/full, so can't get data out.
etc.
You could change the setting too:
[tcpout]
maxConnectionsPerIndexer = 4
See if this helps
... View more
03-25-2015
12:53 AM
Simple anwser: Yes you should remove them from the config before re-uploading.
It would be nice if there was a way to force a sync from a SHC member to the rest of the members. If you could, you could move your ./local to a SHC member and push it to the others.
If you put you local's now on the SHC, your SHC will work with them BUT they won't get synced unless you edit it
... View more
03-25-2015
12:31 AM
make sure there is no serverclass.conf with info in it on your heavy-forwarders. If your running 6.x the system Always creates an empty one in etc/system/local, but thats ok
... View more
03-25-2015
12:31 AM
make sure there is no serverclass.conf with info in it on your Indexers. If your running 6.x the system Always creates an empty one in etc/system/local, but thats ok
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-10-2026
04:55 AM
|
