Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About nawazns5038
nawazns5038
Builder
Member since:
11-25-2016
09-20-2021
Community Statistics
| Posts | 225 |
| Solutions | 6 |
| Karma Given | 17 |
| Karma Received | 20 |
| Member Since | 11-25-2016 |
Activity Feed
- Got Karma for Re: new indexer not showing in Monitoring console. 10-02-2023 08:12 PM
- Got Karma for Changing the Ulimits for openfiles. 12-13-2022 06:45 AM
- Got Karma for Why is Distributed Management Console (DMC) not displaying accurate DISK usage values?. 01-05-2022 12:42 AM
- Got Karma for Re: Knowledge Objects with "No owner" ownership.. 12-27-2021 07:55 AM
- Got Karma for Knowledge Objects with "No owner" ownership.. 12-27-2021 07:55 AM
- Posted Re: Automatic client deletion in deployment server (similar to manual "delete record" option). on Deployment Architecture. 09-20-2021 04:17 PM
- Posted Re: Splunk rest curl query fails to execute on the successive attempts with the session key authorization on Splunk Search. 07-29-2021 05:08 PM
- Karma Splunk rest curl query fails to execute on the successive attempts with the session key authorization for sathishraja92. 07-29-2021 05:08 PM
- Got Karma for Double field extraction for the JSON data. 04-02-2021 06:48 AM
- Posted Re: Splunk Cloud Gateway setup on All Apps and Add-ons. 10-06-2020 11:27 AM
- Posted Re: Splunk Cloud Gateway setup on All Apps and Add-ons. 10-06-2020 11:07 AM
- Posted Re: Problem with upgrade on Splunk Cloud Gateway to version 1.12.4 - drone_mode_subscription_modular_input on All Apps and Add-ons. 10-04-2020 04:23 PM
- Posted Re: Splunk Cloud Gateway setup on All Apps and Add-ons. 10-04-2020 04:23 PM
- Posted Re: .csv file input indexed and available in splunk but the data is invisible on Getting Data In. 09-16-2020 05:02 PM
- Posted Re: Data PArsing json on Getting Data In. 08-27-2020 03:48 PM
- Karma Re: Data PArsing json for to4kawa. 08-27-2020 12:34 PM
- Posted Re: Data PArsing json on Getting Data In. 08-27-2020 12:32 PM
- Posted Re: Data PArsing json on Getting Data In. 08-26-2020 10:11 AM
- Posted Data PArsing json on Getting Data In. 08-25-2020 04:29 PM
- Posted field extractions transforms on Getting Data In. 07-16-2020 11:32 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
02-26-2018
05:41 PM
how to exclude the searches obtained from a dashboard ?
... View more
02-19-2018
12:13 PM
Should we check it on the search head or the peer ?
... View more
02-05-2018
02:34 PM
Hi @garethatiag ,
You mean to say bring a peer offline and make changes and reboot the instance ? and bring back online.
Won' t that effect the cluster or is it a safe way to reboot the cluster
... View more
02-02-2018
05:36 PM
I have tried the rolling restart of the cluster peers and it doesn't solve the problem I'm facing and the manual restart of one of the cluster peers gave the expected result.
Can we restart a single search peer by keeping the cluster in maintenance mode ?
Can we restart a single search peer by keeping the cluster in maintenance mode and keeping that particular peer offline ?
Problem I'm facing :
change of ulimits .... ulimit -n 65536, I have used this command and the change isn't happening unless Splunk is restarted. If the cluster is restarted by rolling restart I cannot see the change in the ulimtis
Please help !!
Thanks
... View more
01-26-2018
05:39 PM
1 Karma
Yes I could see the link,
Could you please paste some example scripts that are in use or that can be used.
... View more
01-25-2018
05:24 PM
Can we use python scripts other than shell scripts for alert actions ?
... View more
01-25-2018
04:38 PM
Hi,
Can I please get an example of a script to make use of the alerts results.
I have read the documentation that the "$SPLUNK_ARG_8" has the location that holds the results in a zip file .
I want to know how can I access the zip file or open it and use the results by a python or a shell script.
... View more
01-24-2018
04:46 PM
@nickhillscpl , how can we restart the OS without effecting Splunk service.
Maintenance mode only restarts the Splunk service.
... View more
01-23-2018
03:22 PM
Ya breaking is proper and props has been tested with the sample data as well. It is only one Json block.
Data is pulled from S3 buckets and it is not AWS default data . and it is pulling lots of .gz files which has json files in it
Is it a problem related to the Addon ?
... View more
01-23-2018
12:36 PM
@p_gaurav
There is only time field and all the events are of the same format...Some are taking the correct value and some are not even in the range or just picking up some random timestamp which is not even present in the event
The data is being sent from S3 input from AWS addon
... View more
01-23-2018
12:21 PM
It's really strange ... "time":"2018-01-21 05:42:34.0"
There is only time field and all the events are of the same format...Some are taking the correct value and some are not even in the range or just picking up some random timestamp which is not even present in the event
The data is being sent from S3 input from AWS addon
... View more
01-22-2018
02:23 PM
Hi,
the log has timestamp like this "time":"2018-01-22 13:43:40.0"
props.conf :
TIME_FORMAT = %F %T.%3N
TIME_PREFIX = "time":\"
MAX_TIMESTAMP_LOOKAHEAD = 25
that was the props conf used. The setting worked fine while testing. After indexing the data the timestamp shown in Splunk or _time has come upto "11/28/17 4:06:53.568 PM" . which is even no where present in the event.
How can this be resolved. Please help.
... View more
01-22-2018
01:28 PM
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Forwarding/Routeandfilterdatad#Index_one_input_locally_and_then_forward_all_inputs
Did the trick
... View more
01-22-2018
12:04 PM
I want only the internal data to be indexed locally. I want all other data that we are collecting using the heavy forwarder to be forwarded to indexers
... View more
01-22-2018
11:47 AM
I am forwarding the logs from the heavy forwarder using the outputs.conf and as a result all the internal logs have been forwarded as well.
Is there a way to search the _internal logs internally in that instance itself. There is a dashboard provided for an Addon for that heavy forwarder .. it cannot run as there are the internal logs cannot be searched .
... View more
01-22-2018
11:36 AM
how can reboot all the servers of a cluster safely ?
Rebooting is fine if its a single instance
... View more
01-18-2018
05:17 PM
Yes.. It worked .. Thanks !!!
... View more
01-18-2018
03:12 PM
4 Karma
Go to Settings and then General Setup in monitoring Console and click on Apply Changes
It will change the state of the indexer from "new" to "configured"
... View more
01-18-2018
02:30 PM
I just added a new indexer to the indexer cluster and the cluster master shows the updated list but not the monitoring console. It shows that the state of the new indexer as new . As a result does not have the updated list on the number of instances.
How do I change it to configured ?
... View more
01-18-2018
01:42 PM
Yes I see the new indexer added to the instances list ..But it says the state is new
All others as configured
How can I change the settings so that It appears as configured just like others.
... View more
01-18-2018
11:30 AM
Yes, It is set and the cluster was attached before and all the indexers could be seen, a new indexer was added to the cluster yesterday and unable to find only that one server in DMC ,
... View more
01-17-2018
06:06 PM
Any standard procedure for changing the ulimits of the servers ?
I tried "ulimit -n 65536" command on all the indexers and did a rolling restart on the servers. Still there is no change in the ulimits. and edited the /etc/init.d/splunk script as mentioned.
Is it the right process to be followed ?
... View more
01-17-2018
06:06 PM
Any standard procedure for changing the ulimits of the servers ?
I tried "ulimit -n 65536" command on all the indexers and did a rolling restart on the servers. Still there is no change in the ulimits. and edited the /etc/init.d/splunk script as mentioned.
Is it the right process to be followed ?
... View more
01-17-2018
06:06 PM
Any standard procedure for changing the ulimits of the servers ?
I tried "ulimit -n 65536" command on all the indexers and did a rolling restart on the servers. Still there is no change in the ulimits. and edited the /etc/init.d/splunk script as mentioned.
Is it the right process to be followed ?
... View more
01-17-2018
04:31 PM
I have added a new indexer to the indexer cluster and I can see it in the Indexer clustering dashboard but I can't see in the monitoring console overview page.
Should anything be done in order to make the new indexer appear in the monitoring console.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-20-2021
07:37 PM
|
Karma given to
| User | Karma Count |
|---|---|
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
