Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About Hemnaath
Hemnaath
Motivator
Member since:
03-15-2015
11-20-2025
Community Statistics
| Posts | 903 |
| Solutions | 12 |
| Karma Given | 1 |
| Karma Received | 55 |
| Member Since | 03-15-2015 |
Activity Feed
- Posted Re: How to create heatmap visualization in dashboard studio? on Dashboards & Visualizations. 11-20-2025 09:06 PM
- Posted How to create heatmap visualization in dashboard studio? on Dashboards & Visualizations. 11-20-2025 03:56 AM
- Got Karma for How to troubleshoot and fix the website input 504 Gateway Timeout Error while configuring an input ?. 01-12-2024 02:44 PM
- Posted Re: Where I can get the Splunk Add-on for AWS 6.0.0 version documentation details on All Apps and Add-ons. 08-29-2023 03:34 AM
- Posted Where I can get the Splunk Add-on for AWS 6.0.0 version documentation details on All Apps and Add-ons. 08-28-2023 04:58 AM
- Tagged Where I can get the Splunk Add-on for AWS 6.0.0 version documentation details on All Apps and Add-ons. 08-28-2023 04:58 AM
- Got Karma for Re: Splunk has found 1 orphaned searches owned by 1 unique disabled users.Click to view the orphaned scheduled searches. Reassign them to a valid user to re-enable or alternatively disable the searches.. 06-13-2023 04:41 AM
- Posted What splunk precedence rules should be followed to upgrade splunk clustered environment ? on Splunk Enterprise. 01-26-2023 01:29 AM
- Got Karma for Unable to break the multi-line events into single event from kinesis log?. 11-07-2022 02:14 AM
- Posted Re: How to write a Splunk query to find the Splunk UF version for specific set of hosts in Splunk Enterprise on Splunk Enterprise. 10-31-2022 11:13 PM
- Posted How to write a Splunk query to find the Splunk UF version for specific set of hosts in Splunk Enterprise on Splunk Enterprise. 10-31-2022 06:44 AM
- Got Karma for Re: ERROR: kvstore port [8191] - port is already bound. Splunk needs to use this port.. 10-13-2022 02:16 PM
- Posted Where can I get the release notes for Splunk enterprise v8.2.6.1 release notes ? on Splunk Enterprise. 07-26-2022 11:17 PM
- Posted How to fix this error: could not use the strptime to parse timestamp from “2022-26-05T11:29:57”? on Getting Data In. 05-26-2022 09:01 AM
- Posted Re: How to write a monitoring stanza to monitor the windows Event Viewer logs on Getting Data In. 05-12-2022 08:59 AM
- Posted Re: How to write a monitoring stanza to monitor the windows Event Viewer logs on Getting Data In. 05-12-2022 06:14 AM
- Posted How to write a monitoring stanza to monitor the windows Event Viewer logs? on Getting Data In. 04-29-2022 03:13 AM
- Posted Re: How to write time format for 2022-04-07 20:40:03.360 -06:00 [XXX] XXXXX? on Splunk Enterprise. 04-16-2022 07:18 PM
- Posted How to write time format for 2022-04-07 20:40:03.360 -06:00 [XXX] XXXXX? on Splunk Enterprise. 04-14-2022 09:17 AM
- Posted Why is Splunk ingesting additional information from the source, when there is no actual data present in the source ? on Splunk Enterprise. 04-13-2022 05:11 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-06-2017
03:43 AM
Hi Harsmarvania57, thanks for your effort on this, I had placed the Splunk Add-on for F5 BIG-IP in the Heavy forwarder instances to parse the data before indexing the data. After placing the add-on in the HF instance now we could see the F5 data are being parsed.
... View more
12-05-2017
07:09 AM
Hi jkat54, thanks for supporting me again, I will be updating the below stanza in the HF instance and restart the splunk services.
[symantec:tap:incidents]
SHOULD_LINEMERGE = false
FIELDALIAS-event_host = tap_host as event_host
KV_MODE = json
TRUNCATE = 0
TIME_PREFIX=^time:\s
TIME_FORMAT=%FT%T.%3N
MAX_TIMESTAMP_LOOKAHEAD=32
TZ=EDT
... View more
12-05-2017
07:07 AM
Hi micahkemp, thanks for your effort on this, yes when we try to search with the above source type we are able to see the data in splunk console. But its not parsing the data as expected. I am came to know that we need to place the splunk Add-on for F5 BIG-IP in the Heavy forwarder instances to parse the data before indexing the data.
But I have question now, since i am using the sourcetype = f5:bigip:syslog do I need to place entire content of the splunk Add-on in the HF server or we can place only the props/transforms related to the sourcetype=f5:bigip:syslog is enough.
Kindly guide me on this please.
... View more
12-05-2017
03:54 AM
Hi Niketnilay, thanks for your effort on this, I will update the props.conf with the above mentioned stanza but I am not sure about how/ from where to calculate the value for MAX_TIMESTAMP_LOOKAHEAD=128 from the events. Kindly guide me on this.
[symantec:tap:incidents]
SHOULD_LINEMERGE = false
FIELDALIAS-event_host = tap_host as event_host
KV_MODE = json
TRUNCATE = 0
TIME_PREFIX=device_time:\s
TIME_FORMAT=%FT%T.%3N
MAX_TIMESTAMP_LOOKAHEAD=128
TZ=EDT
... View more
12-05-2017
03:44 AM
Hi Jkat54, after making the above changes we are still facing the same issue unable to fix the time stamp issue.
Problem: When we search with the below query, we could see that the splunk _time field is different from the event's "time" field.
Query details:
index=sem sourcetype="symantec:tap:incidents" time="2017-12-05T01:37:08.048Z"
Event details:
12/4/17
8:38:18.000 PM
{ [-]
tap_host: 10.X.X.X
tap_incident_id: 104651
deviceUid: [ [+]
]
device_time: 2017-12-05T01:37:08.048Z
domainId: [ [+]
]
event_count: 1
filehash: [ [+]
]
first_event_seen: 2017-12-05T01:31:24.000Z
last_event_seen: 2017-12-05T01:33:12.000Z
log_name: epmp_incident-2017-12-05/incident
priority_level: 2
recommended_action: Review the SEP settings, isolate the endpoint(s), remove the file(s), and/or clean the system(s).
state: 1
summary: Daily unresolved SEP detection(s)
time: 2017-12-05T01:37:08.048Z
updated: 2017-12-05T01:37:08.441Z
uuid: ce5c8d00-d95c-11e7-d251-00000000005c
}
Show as raw text
From the Event Action, I could see that in the event time field "2017-12-05T01:37:08.048Z" and in the _time field as "2017-12-04 20:38:18" for the same event, "_time" is not equal to "time".
_time is being calculated based on when it was indexed instead of when it was an event.
Props.conf details: We have placed this configuration in Heavy forwarder where the data first reaches the splunk then gets ingested into indexer.
[symantec:tap:incidents]
SHOULD_LINEMERGE = false
FIELDALIAS-event_host = tap_host as event_host
KV_MODE = json
TRUNCATE = 0
TIME_PREFIX=time:\s
TIME_FORMAT=%FT%T.%3N
MAX_TIMESTAMP_LOOKAHEAD=32
TZ=EDT
Question :
How to make the _time field be the same as the time field ?
Kindly guide me on this.
... View more
12-05-2017
12:51 AM
Hi somesoni2, thanks for your effort, but could you please guide me how much value should be set in-order to correlate the _time stamp with the event time field.
thanks in advance.
... View more
12-04-2017
11:29 AM
Hi All, Currently we are facing an problem in time stamp for a Symantec log data.
Problem: When we search with the below query, we could see that the splunk _time field is different from the event's "time" field.
Query details:
index=sem sourcetype="symantec:tap:incidents" time="2017-12-04T17:19:06.606Z"
Event detail:
12/4/17
12:26:52.000 PM
{ [-]
tap_host: 10.140.37.7
tap_incident_id: 104649
deviceUid: [ [+]
]
device_time: 2017-12-04T17:19:06.606Z
domainId: [ [+]
]
event_count: 6
filehash: [ [+]
]
first_event_seen: 2017-12-04T16:30:08.000Z
last_event_seen: 2017-12-04T17:10:37.000Z
log_name: epmp_incident-2017-12-04/incident
priority_level: 1
recommended_action: If this site is not business critical, consider adding it to the Blacklist. Otherwise, consider creating a sinkhole server in your DNS to block the site.
state: 1
summary: Multiple malicious behaviors have been detected from xxxx.sharepoint.com.
time: 2017-12-04T17:19:06.606Z
updated: 2017-12-04T17:19:07.193Z
uuid: 3ba258e0-d917-11e7-e89d-00000000005a
}
Show as raw text
eventtype = nix_errors error host = splunk01.xxxx.com source = symantec_tap sourcetype = symantec:tap:incidents
From the Event Action, I could see that in the event time field "2017-12-04T17:19:06.606Z" and in the _time field as "2017-12-04 12:26:52" for the same event, "_time" is not equal to "time".
_time is being calculated based on when it was indexed instead of when it was an event.
Props.conf details: We have placed this configuration in Heavy forwarder where the data first reaches the splunk then gets ingested into indexer.
[symantec:tap:incidents]
TRUNCATE = 0
TIME_PREFIX=time:\s
TIME_FORMAT=%FT%T.%3N
MAX_TIMESTAMP_LOOKAHEAD=32
TZ=EDT
Question :
How to make the _time field be the same as the time field ?
Kindly guide me on this.
... View more
11-28-2017
04:53 AM
hey issue got fixed after rebooting the servers, the server was in hung status so requested server team to reboot the server and it got fixed. But could you please suggest me some troubleshooting steps for resolving this type of Error message if it occurs in future.
thanks in advance.
... View more
11-27-2017
10:13 AM
hi mdsnmss, hey thanks for responding on this issue, let me check the same and get back to you.
... View more
11-27-2017
08:32 AM
Hi All, Currently we have been informed that two of the Windows domain server is not reporting as expected, so when checked the issue by executing the simple query in splunk we could see that the below error message.
index="_internal" source="C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log" log_level=ERROR host="test01"
11/27/17
10:54:31.463 AM
11-27-2017 10:54:31.463 -0500 ERROR TcpOutputFd - Connection to host=10.x.x.x:9997 failed
eventtype = err0r error eventtype = nix-all-logs eventtype = nix_errors error eventtype = splunkd-log host = test01 source = C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log sourcetype = splunkd
connection to host=10.x.x.x is the HF instance
Kindly let me know how to fix this issue.
... View more
11-26-2017
08:35 AM
Hi All, Currently facing an issue in parsing the data and also the data is not conformed with CIM model.
Environment details :
F5 LTM data are being ingested into splunk Environment from syslogs servers. We have 5 Heavy forwarder instances configured to fetch the syslogs data's and forward it to the 5 individual indexer instances. Splunk F5 Add-on is uploaded in search head cluster master with the below configuration details as per the splunk documentation.
appserver
bin
default
metadata
static
ReadME
We have customize app Test-IA-f5 with the inputs.conf configured to fetch the data from the syslog server and this app is placed in all the Heavy forwarder instances.
Test-IA-f5:
F5 LTM
[monitor:///opt/syslogs/web_access/.../*.log]
index = web_app
sourcetype = f5:bigip:syslog
host_segment = 4
We could see the data in splunk console but data is not parsing properly and also its conformed with the CIM model.
Kindly guide me how to fix this issue.
thanks in advance.
... View more
11-22-2017
10:00 AM
Hi All, We have an issue in fetching the data from the qualys app, We have installed the latest TA-QualysCloudPlatform version 1.2.3 in one of our Heavy forwarder instances, it was working fine till last week and suddenly we could see that app is not fetching the data. Splunk version 6.6.1
index = vulnerability source = qualys sourcetype = qualys:hostDetection
No Result found
when checked the TA-QualysCloudPlatform.log we could see the below error message
TA-QualysCloudPlatform: 2017-11-19T20:55:48Z PID=7327 [MainThread] ERROR: TA-QualysCloudPlatform [host_detection] - could not load API response
Kindly guide me how to fix this issue.
thanks in advance.
... View more
11-22-2017
08:12 AM
2 Karma
Yes I had checked it by executing the ps -aux | grep 8191 and I could see the mongod is using the process id but parent process id is used by splunk. When checked the other splunk instances, I could see the same result.
ps -ef | grep -i splunk
splunk 51435 51412 0 10:08 ? 00:00:10 mongod --dbpath=/opt/splunk/var/lib/splunk/kvstore/mongo --port=8191 --timeStampFormat=iso8601-utc --smallfiles --oplogSize=200 --keyFile=/opt/splunk/var/lib/splunk/kvstore/mongo/splunk.key --setParameter=enableLocalhostAuthBypass=0 --replSet=EA0E64F9-39BF-4B45-9876-C14157BD1429 --sslMode=requireSSL --sslAllowInvalidHostnames --sslPEMKeyFile=/opt/splunk/etc/auth/server.pem --sslPEMKeyPassword=xxxxxxxx --sslCipherConfig=TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH --nounixsocket --noscripting
ps -aux | grep 51412
splunk 51412 0.0 0.0 71068 8468 ? Ss 10:08 0:00 [splunkd pid=51407] splunkd -p 8089 restart [process-runner]
I hope you are asking to this only.
thanks
... View more
11-22-2017
07:25 AM
4 Karma
Hi Niketnilay, hey thanks for your effort on this, now splunk service is up and running fine in HF instance. I had followed the below steps to restart the splunk service.
steps:
1) First need to check wether the port is used be some other application by executing the ps -aux | grep
ps -aux | grep 8191
[splunk@splunk01 bin]$ ps -aux | grep 8191
splunk 24597 0.4 0.5 1366300 95464 ? Ssl Nov10 71:26 mongod --dbpath=/opt/splunk/var/lib/splunk/kvstore/mongo --port=8191 --timeStampFormat=iso8601-utc --smallfiles --oplogSize=200 --keyFile=/opt/splunk/var/lib/splunk/kvstore/mongo/splunk.key --setParameter=enableLocalhostAuthBypass=0 --replSet=EA0E64F9-39BF-4B45-9876-C14227BD1429 --sslMode=requireSSL --sslAllowInvalidHostnames --sslPEMKeyFile=/opt/splunk/etc/auth/server.pem --sslPEMKeyPassword=xxxxxxxx --sslCipherConfig=TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH --nounixsocket --noscripting
splunk 47877 0.0 0.0 112648 964 pts/0 S+ 09:09 0:00 grep --color=auto 8191
2) Before going for the kill, I had made sure that the splunkd services are not running at the back ground by executing the below command.
cd /opt/splunk/bin
./splunk status
splunkd is not running.
ps -ef | grep -i splunkd
splunk 48308 48267 0 09:42 pts/0 00:00:00 grep --color=auto -i splunkd
3) After executing the above steps, then we have executed Kill 24597 (mongod process id) and before restarting the splunk services by executing the below command. I had made sure that mongod process is properly killed.
ps -ef | grep -i mongod
splunk 48328 48267 0 09:45 pts/0 00:00:00 grep --color=auto -i mongod
4) Started the splunk service using the splunk user id.
cd /opt/splunk/bin
./splunk start
5) Validated the splunk service are up and running or not.
cd /opt/splunk/bin
./splunk status
splunkd is running (PID: 48375).
splunk helpers are running (PIDs: 48381 48407 48527 48547 48569).
... View more
11-22-2017
06:25 AM
Hi All, I am getting this below Error, when i am trying to restart the splunk services on one of the Heavy forwarder instances , I am getting the below error message.
[splunk@splunk01 bin]$ ./splunk restart
splunkd is not running. [FAILED]
Splunk> All batbelt. No tights.
Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking appserver port [127.0.0.1:8065]: open
Checking kvstore port [8191]: not available
ERROR: kvstore port [8191] - port is already bound. Splunk needs to use this port.
Would you like to change ports? [y/n]:
When checked whether port is used by any other application by executing the ps -aux | grep 8191 and I found that mongod process taking up the port 8191. Need to know whether i can kill the below mongod process id and restart the splunk services.
[splunk@splunk01 bin]$ ps -aux | grep 8191
splunk 24597 0.4 0.5 1366300 95464 ? Ssl Nov10 71:26 mongod --dbpath=/opt/splunk/var/lib/splunk/kvstore/mongo --port=8191 --timeStampFormat=iso8601-utc --smallfiles --oplogSize=200 --keyFile=/opt/splunk/var/lib/splunk/kvstore/mongo/splunk.key --setParameter=enableLocalhostAuthBypass=0 --replSet=EA0E64F9-39BF-4B45-9876-C14227BD1429 --sslMode=requireSSL --sslAllowInvalidHostnames --sslPEMKeyFile=/opt/splunk/etc/auth/server.pem --sslPEMKeyPassword=xxxxxxxx --sslCipherConfig=TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH --nounixsocket --noscripting
splunk 47877 0.0 0.0 112648 964 pts/0 S+ 09:09 0:00 grep --color=auto 8191
kill -9 24597
Kindly guide me on this.
... View more
11-21-2017
09:35 AM
Hi Rich, Can you please guide me on the above questions.
thanks in advance.
... View more
11-21-2017
06:49 AM
thanks hettervi, I hope the below stanza will be fine to fetch and index the data related to SQL Error.log s.
Inputs.conf Details
ERROR Log for SQL Server 2014
[monitor:// C:\Program Files\Microsoft SQL Server\MSSQL12.MSSQLSERVER\MSSQL\Log\ERRORLOG*]
[monitor:// D:\Data\MSSQL12.MSSQLSERVER\MSSQL\Log\ERRORLOG*]
[monitor:// D:\Program Files\Microsoft SQL Server\MSSQL12.SCOM2012RS\MSSQL\Log\ERRORLOG*]
[monitor:// D:\Program Files\Microsoft SQL Server\MSSQL12.SQLEXPRESS\MSSQL\Log\ERRORLOG*]
[monitor:// D:\Program Files\Microsoft SQL Server\MSSQL12.SQL2014\MSSQL\Log\ERRORLOG*]
sourcetype = mssql:errorlog
index = windows
disabled = 1
... View more
11-21-2017
05:52 AM
Hi hettervi, thanks for your effort on this, hey I have planned to create six different App and each app will be containing respective SQL version config details Example : MS SQL 2014 Version
APP name : Test-IA-MS SQL2014
Inputs.conf Details
ERROR Log for SQL Server 2014
[monitor:// C:\Program Files\Microsoft SQL Server\MSSQL12.MSSQLSERVER\MSSQL\Log\ERRORLOG*]
[monitor:// D:\Data\MSSQL12.MSSQLSERVER\MSSQL\Log\ERRORLOG*]
[monitor:// D:\Program Files\Microsoft SQL Server\MSSQL12.SCOM2012RS\MSSQL\Log\ERRORLOG*]
[monitor:// D:\Program Files\Microsoft SQL Server\MSSQL12.SQLEXPRESS\MSSQL\Log\ERRORLOG*]
[monitor:// D:\Program Files\Microsoft SQL Server\MSSQL12.SQL2014\MSSQL\Log\ERRORLOG*]
sourcetype = mssql:errorlog
index = windows
disabled = 1
This app will be pushed / managed from deployment server to remote nodes.
I have following questions before proceeding for the Database configuration in splunk.
Questions:
1) Should I need to copy/push entire content of "Splunk_TA_microsoft-sqlserver" to the remote nodes or we can just keep the inputs.conf, props.conf, default.meta.conf , since we are going to use this app "Test-IA-MS SQL2014" only to fetch the Error log details from the SQL server machine.
2) Should I need to create an identity with user name and password for each database, then we have almost 100 + nodes with different SQL version, what should be done. Or We can create a common identity with user name and password, that has complete access to the data that splunk will fetch from that database.
3) How to configure the Database inputs in DB connect, We have DB connect version 3.0.3 but when I checked the splunk Add-on for Microsoft SQL server documentation, we can choose DB Connect v3.1 inputs for the Splunk Add-on for Microsoft SQL Server or DB Connect v2 inputs for the Splunk Add-on for Microsoft SQL Server. So in this case which type of configuration inputs should be used.
4) I am planning to use the default template provide in the Splunk SQL server add on for configuring the database input. so in this how to configure it via DB connect.
5) While configuring the Database input via DB connect GUI, --> Datalab-->new inputs--> Name-->Description --> App name --> In this case which app should I need to select to store the inputs, do i need to choose DB connect app or Splunk Add-on for MS SQL, as i need to monitor the MS SQL database instances.
Kindly guide me on the above questions.
thanks in advance.
... View more
11-21-2017
04:03 AM
Hi Rich, thanks for your support on this, hey I have planned to create six different App and each app will be containing respective SQL version config details Example : MS SQL 2014 Version
APP name : Test-IA-MS SQL2014
Inputs.conf Details
ERROR Log for SQL Server 2014
[monitor:// C:\Program Files\Microsoft SQL Server\MSSQL12.MSSQLSERVER\MSSQL\Log\ERRORLOG*]
[monitor:// D:\Data\MSSQL12.MSSQLSERVER\MSSQL\Log\ERRORLOG*]
[monitor:// D:\Program Files\Microsoft SQL Server\MSSQL12.SCOM2012RS\MSSQL\Log\ERRORLOG*]
[monitor:// D:\Program Files\Microsoft SQL Server\MSSQL12.SQLEXPRESS\MSSQL\Log\ERRORLOG*]
[monitor:// D:\Program Files\Microsoft SQL Server\MSSQL12.SQL2014\MSSQL\Log\ERRORLOG*]
sourcetype = mssql:errorlog
index = windows
disabled = 1
This app will be pushed / managed from deployment server to remote nodes.
Questions:
1) Should I need to copy/push entire content of "Splunk_TA_microsoft-sqlserver" to the remote nodes or we can just keep the inputs.conf, props.conf, default.meta.conf , since we are going to use this app "Test-IA-MS SQL2014" only to fetch the Error log details from the SQL server machine.
2) Should I need to create an identity with user name and password for each database then we have almost 100 + nodes with different SQL version, what should be done. Or We can create a common identity with user name and password, that has complete access to the data that splunk will fetch from that database.
3) How to configure the Database inputs in DB connect, We have DB connect version 3.0.3 but when I checked the splunk Add-on for Microsoft SQL server documentation, we can choose DB Connect v3.1 inputs for the Splunk Add-on for Microsoft SQL Server or DB Connect v2 inputs for the Splunk Add-on for Microsoft SQL Server. So in this case which type of configuration inputs should be used.
4) I am planning to use the default template provide in the Splunk SQL server add on for configuring the database input. so in this how to configure it via DB connect.
5) While configuring the Database input via DB connect GUI, --> Datalab-->new inputs--> Name-->Description --> App name --> In this case which app should I need to select to store the inputs, do i need to choose DB connect app or Splunk Add-on for MS SQL, as i need to monitor the MS SQL database instances.
Kindly guide me on this.
thanks in advance.
... View more
11-21-2017
02:40 AM
Hi All, Can anyone guide me on how to setup an inputs.conf to monitor Error.log file placed under different paths on multiple remote nodes.
thanks in advance.
... View more
11-19-2017
10:10 PM
Hi Nagadeepthi, hey we have a requirement to monitor SQL error log and data base monitoring using the splunk. I had downloaded the MS-SQL Add-on 1.3 and DB-Connect 3.1. We have 5 indexer instance, 5 Heavy Forwarder instances, three cluster search heads, deployment instances and Deployer instances all are running with Splunk 6.6.1 version.
We have downloaded the SQL Add-on app from splunk base to monitor the Error log file.
Default monitoring stanza provide in MS SQL Add-on
Inputs.conf
ERROR Log for SQL Server 2014
[monitor://C:\Program Files\Microsoft SQL Server\MSSQL11\MSSQL\Log\ERRORLOG*]
sourcetype = mssql:errorlog
disabled = 1
My Question : How to configure inputs.conf to monitor the Error Log file placed under different paths on the remote node.
Example : Test01 Test02 Test03
Node=test01
SQL Version: Microsoft SQL Server 2014 - 12.0.2000.8 (X64)
File Monitoring:D:\Data\MSSQL12.MSSQLSERVER\MSSQL\Log\ERRORLOG
Node=test02
SQL Version: Microsoft SQL Server 2014 - 12.0.4100.1 (X64)
File Monitoring:C:\Program Files\Microsoft SQL Server\MSSQL12.MSSQLSERVER\MSSQL\Log\ERRORLOG
Node=test03
SQL Version: Microsoft SQL Server 2014 - 12.0.2000.8 (X64)
File Monitoring: 😧 \Program Files\Microsoft SQLServer\MSSQL12.SCOM2012RS\MSSQL\Log\ERRORLOG
Kindly guide me on how to setup an inputs.conf to monitor Error.log file placed under different paths on different nodes from remote nodes.
thanks in advance.
... View more
11-19-2017
10:10 PM
Hi Phuonguit, hey we have a requirement to monitor SQL error log and data base monitoring using the splunk. I had downloaded the MS-SQL Add-on 1.3 and DB-Connect 3.1. We have 5 indexer instance, 5 Heavy Forwarder instances, three cluster search heads, deployment instances and Deployer instances all are running with Splunk 6.6.1 version.
We have downloaded the SQL Add-on app from splunk base to monitor the Error log file.
Default monitoring stanza provide in MS SQL Add-on
Inputs.conf
ERROR Log for SQL Server 2014
[monitor://C:\Program Files\Microsoft SQL Server\MSSQL11\MSSQL\Log\ERRORLOG*]
sourcetype = mssql:errorlog
disabled = 1
My Question : How to configure inputs.conf to monitor the Error Log file placed under different paths on the remote node.
Example : Test01 Test02 Test03
Node=test01
SQL Version: Microsoft SQL Server 2014 - 12.0.2000.8 (X64)
File Monitoring:D:\Data\MSSQL12.MSSQLSERVER\MSSQL\Log\ERRORLOG
Node=test02
SQL Version: Microsoft SQL Server 2014 - 12.0.4100.1 (X64)
File Monitoring:C:\Program Files\Microsoft SQL Server\MSSQL12.MSSQLSERVER\MSSQL\Log\ERRORLOG
Node=test03
SQL Version: Microsoft SQL Server 2014 - 12.0.2000.8 (X64)
File Monitoring: 😧 \Program Files\Microsoft SQLServer\MSSQL12.SCOM2012RS\MSSQL\Log\ERRORLOG
Kindly guide me on how to setup an inputs.conf to monitor Error.log file placed under different paths on different nodes from remote nodes.
thanks in advance.
... View more
11-19-2017
09:41 PM
Hi All, We have more than 100 + servers that needs to be monitored via splunk to capture SQL Error logs from these servers. We have deployment server to manage the app configuration centrally and We have UF agent running in all these nodes.
W have downloaded the SQL Add-on app from splunk base to monitor the file.
Default monitoring stanza provide in MS SQL Add-on
Inputs.conf
ERROR Log for SQL Server 2014
[monitor://C:\Program Files\Microsoft SQL Server\MSSQL11\MSSQL\Log\ERRORLOG*]
sourcetype = mssql:errorlog
disabled = 1
My Question : How to configure inputs.conf to monitor the Error Log file placed under different paths on the remote node.
Example : Test01 Test02 Test03
Node=test01
SQL Version: Microsoft SQL Server 2014 - 12.0.2000.8 (X64)
File Monitoring:D:\Data\MSSQL12.MSSQLSERVER\MSSQL\Log\ERRORLOG
Node=test02
SQL Version: Microsoft SQL Server 2014 - 12.0.4100.1 (X64)
File Monitoring:C:\Program Files\Microsoft SQL Server\MSSQL12.MSSQLSERVER\MSSQL\Log\ERRORLOG
Node=test03
SQL Version: Microsoft SQL Server 2014 - 12.0.2000.8 (X64)
File Monitoring: 😧 \Program Files\Microsoft SQLServer\MSSQL12.SCOM2012RS\MSSQL\Log\ERRORLOG
Kindly guide me on how to setup an inputs.conf to monitor Error.log file placed under different paths on different nodes from remote nodes.
thanks in advance.
... View more
11-17-2017
07:51 AM
Hi Hiroshisatoh, I could not understand the above comment. Anyway I had requested the application owner to change the log generation method in such a way to include the time stamp in the actual logs.
thanks for your effort.
... View more
11-17-2017
07:47 AM
Hi All, I have a requirement from data base team to monitor bunch of Microsoft SQL server in our organization. I had gone through the document provided in the splunk base for splunk Add-on and as per we can do File monitoring, windows performance monitoring and Database monitoring. In our case we are going to do the file monitoring and Database monitoring, as windows performance monitoring is already done by a customized app.
We have Deployment server which manages the overall apps centrally, so any changes to any app will be done via Deployment server under /etc/deployement-apps/our apps and it will be reloaded to the remote machines.
Requirement: Initially we are planning to set a file monitoring for all the servers which are having the SQL servers running in them.
Challenge 1: We want to manage / push this Splunk_TA_microsoft-sqlserver via deployment server. But we have different SQL versions running in different windows OS with different path locations to capture the Error.log.
Got an idea to configure/manage centrally but not sure whether this is the right approach.
1) Create a splunk add-on app for each version separately and likewise create a server class for each Splunk Add-on and add the respective hosts based on the SQL version.
Example: For Microsoft SQL Server 2016
a) Rename the Splunk_TA_microsoft-sqlserver_2016 and create a separate server class SC-microsoft-sqlserver-2016
b) Rename the Splunk_TA_microsoft-sqlserver_2014 and create a separate server class SC-microsoft-sqlserver-2014
Challenge2: How to configure the inputs.conf stanza provided in the Add-on, as we have different path/different host for the same SQL version? Based on the below data as example.
Node=test01
SQL Version: Microsoft SQL Server 2014 - 12.0.2000.8 (X64)
File Monitoring:D:\Data\MSSQL12.MSSQLSERVER\MSSQL\Log\ERRORLOG
Node=test02
SQL Version: Microsoft SQL Server 2014 - 12.0.4100.1 (X64)
File Monitoring:C:\Program Files\Microsoft SQL Server\MSSQL12.MSSQLSERVER\MSSQL\Log\ERRORLOG
Node=test03
SQL Version: Microsoft SQL Server 2014 - 12.0.2000.8 (X64)
File Monitoring: 😧 \Program Files\Microsoft SQLServer\MSSQL12.SCOM2012RS\MSSQL\Log\ERRORLOG
Likewise we have more than 100 + systems which needs to be configured for file monitoring.
Challenge3: We have SQL Version: Microsoft SQL Server 2016 (SP1-CU3), Microsoft SQL Server 2008 (SP3) & Microsoft SQL Server 2005. But not sure whether it supported by the Splunk Add-on are supported by the splunk add-on.
Kindly guide me how to setup inputs.conf configuration to monitor the Error.log.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-20-2025
08:58 PM
|
