About MuS

MuS · ‎08-26-2014

feel free to up-vote and or accept any answers to show your support - and you will get karma too 😉

MuS · ‎08-26-2014

Hi wiredmonkey, check the updated version http://apps.splunk.com/app/1249/ I added your MAC format to the regex. cheers, MuS

MuS · ‎08-26-2014

The old host will found by searches as long as it is available in your data and/or metadata. Maybe you should look at the delete command which will hide events from showing up in searches http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Delete

MuS · ‎08-26-2014

Hi wiredmonkey, I wrote this App. Your MAC is not matching the regex used in the App. The regex uses : or - but your format is not matched. Give me some time and I'll update it 😉 Cheers, MuS

MuS · ‎08-26-2014

Hi dominiquevocat, I will soon upload a working LDAP App that will handle that .... Cheers, MuS

MuS · ‎08-26-2014

Hi a212830, take a look at this wiki page http://wiki.splunk.com/Community:TroubleshootingBlockedQueues hope this helps ... cheers, MuS

MuS · ‎08-26-2014

try something like this: index=xxx Code=101 OR Code=201 | streamstats current=f last(Code) AS last_code | where last_code=201 AND Code=101 | stats values(Last_code) values("Event Code") values("Computer Name") values("Account Domain") values("Client Address") by "Account Name" based on that you should be able to work your way to the target 😉

MuS · ‎08-26-2014

not that I'm aware off...I did it in the local.meta file

MuS · ‎08-26-2014

Hi HeinzWaescher, I had the same problem lately and was able to 'fix' that by changing the owner of the csv file to 'nobody'. After that the csv was editable with the lookup editor. hope this helps ... cheers, MuS

MuS · ‎08-26-2014

Hi philip.wong, yes there is one, try this: | rest /services/configs/conf-server in there look for a [pooling] stanza with state = enable this means search head pooling is enabled. hope this helps ... cheers, MuS

MuS · ‎08-26-2014

Hi AngelOps, you cannot limit a host license usage directly, you need to create a license pool and add the host to this pool - see docs about create license pool. Also check what kind of data/events this host is sending the most and if you need them at all, if not you could either exclude the data source on the host or nullQueue the data on the indexer - see the docs about Discard specific events and keep the rest. hope this helps ... cheers, MuS

MuS · ‎08-25-2014

Hi splunker12er, it all depends on your raw data, but basically you can say compression between 30-50% are normal, you can check this with this search: | dbinspect index=YOURINDEX | fields state,id,rawSize,sizeOnDiskMB | stats sum(rawSize) AS rawTotal, sum(sizeOnDiskMB) AS diskTotalinMB | eval rawTotalinMB=(rawTotal / 1024 / 1024) | fields - rawTotal | eval compression=tostring(round(diskTotalinMB / rawTotalinMB * 100, 2)) + "%" | table rawTotalinMB, diskTotalinMB, compression cheers, MuS

MuS · ‎08-25-2014

Hi dfigurello, Did you check splunkd.log for any SSL related errors? Did you do some SSL troubleshooting, if you need a hint on that follow this nice answer http://answers.splunk.com/answers/134053/ciphersuite-in-various-conf-files. Regarding the not matching search: is it the correct index? the correct time range? Do you get anything back by using | tstats count where host=x or | metadata type=hosts ? Hope this helps ... cheers, MuS

MuS · ‎08-25-2014

Hi jamesvz84, Take a look at this wiki entry http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings and you will see that parsing will never happens on an UF. Hope this helps ... Cheers, MuS

MuS · ‎08-25-2014

more like this index=_internal | chart values(kb) over _time by series ?

MuS · ‎08-25-2014

Hi iamniks, Yes, you can do this - but you need to tweak some css and js files to achieve this. See this http://answers.splunk.com/answers/83206/color-in-a-table-based-on-values or this app http://apps.splunk.com/app/570/. hope this helps ... cheers, MuS

MuS · ‎08-25-2014

Hi las, take this run everywhere example: index=_internal | chart values(kb) over series by _time this will generate a bar graph like this: hope this helps ... cheers, MuS

MuS · ‎08-25-2014

so in this case there is no user authentication and that's the reason why you cannot login - please mark this as answered, thx 🙂

MuS · ‎08-25-2014

Hi TheBellonz, do you use the trial license or the free license? User authentication is disabled with the free license. If you can access the filesystem of your Splunk installation go to /opt/splunk/etc (assuming you're on Linux) and delete the passwd file and restart Splunk. It will re-create a new default passwd file with the username admin and changeme as password. hope this helps ... cheers, MuS

MuS · ‎08-25-2014

Hi tumdev, you could use syslog to forward the Ubuntu logs to the Splunk indexer or mount the Ubuntu's /var/log on the Splunk indexer and read the logs this way. To get the performance data, some script must be run on the Ubuntu server that writes those figures into either syslog or a log file in /var/log . hope this helps to get you started ... cheers, MuS

MuS · ‎08-25-2014

Hi, I'pretty sure this is not caused nor related to Splunk. perform basic troubleshooting where and why those messages occur and fix that problem.

MuS · ‎08-23-2014

Hi sadkha, try something like this: your base search to get all fields for 1st and 2nd scenario | transaction "Account Name" | ... or your base search to get all fields for 1st and 2nd scenario | stats values("Event Code") values("Computer Name") values("Account Domain") values("Client Address") by "Account Name" streamstats or eventstats can also be used for such searches. hope this helps ... cheers, MuS

MuS · ‎08-23-2014

Hi a212830, Yes, it can. BUT: Even the universal forwarder can send to any kind of 3rd party receiver, it is most likely that this receiver will only see data babble. The parsed and unparsed formats are both referred as cooked data, to distinguish them from raw data. By default, forwarders send cooked data — in the universal forwarder's case, unparsed data, and in the heavy forwarder's case, parsed data. Therefore follow the docs on Forward data to third-party systems cheers, MuS

MuS · ‎08-22-2014

Does your sourcetype match exactly?

MuS · ‎08-22-2014

agreed, that's why it is limited to exactly one app and certain key / value pairs in this local/foo.conf file ! Last to say, I used only Splunk features to create this editor.

Posts	4458
Solutions	814
Karma Given	2144
Karma Received	3944
Member Since	‎05-02-2011

Online Status	Offline
Date Last Visited	3 weeks ago

Report Capture app for Splunk: Exception capturing...

How to use eval if there is no result from the bas...

How to compare fields over multiple sourcetypes wi...

Splunkbase Apps update bug?

docs.splunk.com wrong link to answers

splunkbase feature request

splunkbase colored background

Captain Picard's Star fleet messages

the pony command

max throughputs of forwarders

Re: Syslog disk full Alert after changing hostname...

Re: How to use Add-on for MAC lookup to search and...

Re: Syslog disk full Alert after changing hostname...

Re: How to use Add-on for MAC lookup to search and...

Re: non ASCII characters in LDAP attributes

Re: How to troubleshoot busy queues reaching near ...

Re: Using transaction or stats to do event correla...

Re: Lookup File Editor - Can't view uploaded files

Re: Lookup File Editor - Can't view uploaded files

Re: Is there a REST API that can tell if a search ...

Re: Why host with NULL hostname consumes most of t...

Re: What will be the size of the indexed data if I...

Re: How to use default certificate ssl to encrypt ...

Re: If props.conf is used on a universal forwarder...

Re: How to make a barchart with start time, durati...

Re: colour format in chart based on the list

Re: How to make a barchart with start time, durati...

Re: I cannot log in

Re: I cannot log in

Re: How to get data into Splunk from Ubuntu Linux ...

Re: Syslog disk full Alert after changing hostname...

Re: Using transaction or stats to do event correla...

Re: Can a universal forwarder send cooked data to ...

Re: Why is nullQueue configuration not working?

Re: Lookup File Editor: Have there been any ideas ...

Join the Conversation