Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About koshyk
koshyk
Super Champion
Member since:
03-20-2013
06-17-2025
Community Statistics
| Posts | 1145 |
| Solutions | 115 |
| Karma Given | 283 |
| Karma Received | 361 |
| Member Since | 03-20-2013 |
Activity Feed
- Posted Re: How to Securely Deploy API Token in Passwords.conf for Scripted Inputs on HF Managed by Deployment Server on Splunk Enterprise. 06-17-2025 03:44 PM
- Karma Re: How to Securely Deploy API Token in Passwords.conf for Scripted Inputs on HF Managed by Deployment Server for isoutamo. 06-17-2025 03:38 PM
- Posted Re: How to Securely Deploy API Token in Passwords.conf for Scripted Inputs on HF Managed by Deployment Server on Splunk Enterprise. 06-15-2025 11:12 PM
- Karma Re: How to Securely Deploy API Token in Passwords.conf for Scripted Inputs on HF Managed by Deployment Server for cklunck. 06-15-2025 11:07 PM
- Posted Re: How to Securely Deploy API Token in Passwords.conf for Scripted Inputs on HF Managed by Deployment Server on Splunk Enterprise. 06-15-2025 03:46 PM
- Posted How to Securely Deploy API Token in Passwords.conf for Scripted Inputs on HF Managed by Deployment Server on Splunk Enterprise. 06-15-2025 05:20 AM
- Got Karma for Re: Where can I download Splunk .conf2017 session materials?. 06-01-2025 06:51 AM
- Posted Re: Splunk Enterprise security & ESCU: Customization of ESCU and upgrades on Splunk Enterprise Security. 05-13-2025 01:02 AM
- Karma Re: Splunk Enterprise security & ESCU: Customization of ESCU and upgrades for livehybrid. 05-13-2025 12:59 AM
- Posted Splunk Enterprise security & ESCU: Customization of ESCU and upgrades on Splunk Enterprise Security. 05-12-2025 02:37 AM
- Posted Re: How to insert ESCU detections via REST API into Splunk ESS? on Splunk Enterprise Security. 05-09-2025 03:06 PM
- Karma Re: How to insert ESCU detections via REST API into Splunk ESS? for livehybrid. 05-09-2025 02:59 PM
- Posted How to insert ESCU detections via REST API into Splunk ESS? on Splunk Enterprise Security. 05-08-2025 10:30 PM
- Karma call not properly authenticated for NatanS. 05-07-2025 11:40 PM
- Posted Re: call not properly authenticated on Getting Data In. 05-07-2025 11:38 PM
- Got Karma for Re: Explain Data Models (Like I'm Five). 04-04-2025 11:27 AM
- Posted Re: Presenting Splunk Large-Scale Design with Mermaid / Draw.io or similar products on Deployment Architecture. 03-20-2025 04:22 AM
- Karma Re: Presenting Splunk Large-Scale Design with Mermaid / Draw.io or similar products for livehybrid. 03-20-2025 04:22 AM
- Posted Re: Presenting Splunk Large-Scale Design with Mermaid / Draw.io or similar products on Deployment Architecture. 03-20-2025 04:21 AM
- Posted Presenting Splunk Large-Scale Design with Mermaid / Draw.io or similar products on Deployment Architecture. 03-19-2025 04:50 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-26-2016
03:39 AM
hi
We have a situation whereby we have to run an app (a script within an app) individually on each Servers of Search Head in a Search Head Cluster. This script mainly looks into various OS parameters and hence has to be individually run on each physical servers which has SH enabled
But AFAIK in a SHC, the script is run by Captain on one server at a time and is decided by captain and not on all servers.
Is there any option to override shcluster just for this app so that the script is run on all servers on a scheduled basis?
(In indexers it is ok, if we put directly into ./etc/apps)
Edit: Requirement is to run as scripted input
My question is similar to: https://answers.splunk.com/answers/294093/where-do-i-deploy-scripted-inputs-in-a-splunk-624.html , but wanted to collect data from Individual Search Heads
... View more
02-25-2016
05:41 AM
Please note, these values have changed now . Read the latest limits.conf
base_max_searches = <int>
* A constant to add to the maximum number of searches, computed as a multiplier
of the CPUs.
* Defaults to 6
max_searches_per_cpu = <int>
* The maximum number of concurrent historical searches per CPU. The system-wide
limit of historical searches is computed as:
max_hist_searches = max_searches_per_cpu x number_of_cpus + base_max_searches
* Note: the maximum number of real-time searches is computed as:
max_rt_searches = max_rt_search_multiplier x max_hist_searches
* Defaults to 1
... View more
02-11-2016
06:26 AM
We also having the same issue.(Though the default is 25MB files are more than 25MB) Were you able to find the root cause?
... View more
02-04-2016
01:35 AM
Thank you. So that means if we have accelerated data models(eg Splunk_TA_CIM), it is good enough to use "summariesonly=t"
... View more
02-02-2016
05:54 AM
hi,
I was looking into the out-of-box Splunk correlation searches in Splunk Enterprise Security (ES) and it contains allow_old_summaries=true and not summariesOnly=true . Both give me the same set of results.
Time required to run the original Splunk Searches takes me >220 seconds, but with summariesOnly=true , it gives me exactly same output in 8 seconds. So was thinking why Splunk didn't do it in first place? Will data be missed if I use summariesOnly=true ?
... View more
01-22-2016
03:44 AM
1 Karma
normalized_pct_cpu - Percentage of CPU usage across all cores. 100% is equivalent to all CPU resources on the machine.
Full API details: http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTintrospect
There might be multiple entries of same SearchId (sid). But if you carefully look into the _raw events, you could see the "process ID" (pid) and parentProcess ID would be different. (or the component might be different)
... View more
01-15-2016
01:26 PM
thanks for your input and links. voting up. (Will accept by end of this week, just wanted to see if any other opinion comes as well)
... View more
01-15-2016
06:49 AM
folks,
We have two sites and we host 8 Search Heads (4 per site) all clustered with 16 indexers. We need to have a non-clustered SearchHead(SH) for sandbox purposes connected to same indexers
My colleague is suggesting its better to have an odd + even setup in SH (ie. 3x + 4y + 1 standalone) as SH captain works on odd/even configuration better. But my view is to have (4x + 4y + 1 standalone) for consistency and maintainability purposes. (ps: company can sponsor 2 SH's extra, budget is not the real problem)
Any suggestions on above?
... View more
11-08-2015
11:12 AM
eStreamer has got lot of disadvantages (eg extra perl modules, pull technology etc..). So was planning to use "syslog" from Cisco Firesight/Defence Centre. Does anyone know if there are issues with Firesight syslog? Is any data missing if we use syslog?
I can see Splunk supported addon works with both estreamer output and syslog. So preferred way for us is to go with syslog.
Would be very helpful to know if any of you have implemented using Firesight syslog.
... View more
10-31-2015
03:31 PM
Hope Splunk enabled a similar option for "tokenisation" of certain fields at index time (eg credit card numbers for apple pay)
... View more
10-26-2015
04:23 AM
I can see you are adding css class (eg: range-severe) . Hope you have app.css in correct location?
... View more
08-24-2015
04:12 AM
bump.. (To see if any better ideas in 2015)
... View more
08-20-2015
07:46 AM
I think its extracting ok, but Splunk has already done the timestamp extraction automatically on top of what you specified, hence duplicating. Could you please try..
# props.conf
[sourcetype]
NO_BINARY_CHECK = 1
TIME_PREFIX = "timestamp"
pulldown_type = 1
KV_MODE = JSON
# Sometimes below is required.
# BREAK_ONLY_BEFORE = (^{)
... View more
08-14-2015
01:27 AM
5 Karma
for easier copy paste 🙂
rm $SPLUNK_HOME/var/run/splunk/splunkd.pid
$SPLUNK_HOME/bin/splunk status
$SPLUNK_HOME/bin/splunk start
... View more
08-04-2015
02:03 AM
that's bit of complex sample in that.
But found a simpler example at: splunk.blogs
https://github.com/splunk/splunk-sdk-python/tree/develop/examples/searchcommands_app
https://github.com/splunk/splunk-sdk-python/blob/develop/examples/searchcommands_app/bin/generatehello.py
which you can convert to java
... View more
08-04-2015
01:18 AM
don't think i quite understood. Is this what you are trying to do ?
- run search1 & get results of search1
- create search2 with results of search1
(you said, you got examples in python. if you put that, i might look to convert to java)
... View more
08-04-2015
01:05 AM
best is to package & deploy whole app.
... View more
08-04-2015
01:03 AM
1 Karma
You need to use Splunk Java SDK. Very good documentation at: Splunk Java SDK documentation
The core logic being..
// Create the job
JobArgs jobArgs = new JobArgs();
jobArgs.setEarliestTime("rt-1m");
String mySearch = "search index=_internal";
Job job = service.search(mySearch, jobArgs);
// View the results--a stream of previews--using standard Java classes
JobResultsPreviewArgs previewArgs = new JobResultsPreviewArgs();
InputStream stream = job.getResultsPreview(previewArgs);
BufferedReader reader = new BufferedReader(new InputStreamReader(stream, "UTF-8"));
while ((line = reader.readLine()) != null) {
System.out.println(line);
}
... View more
08-04-2015
12:56 AM
You could do convert it using online tools
http://meyerweb.com/eric/tools/dencoder/
... View more
07-28-2015
04:21 AM
just bumping to see if anyone have implemented TA for Cyberark? Would be very helpful to see how CIM is mapped
... View more
07-16-2015
01:33 AM
So essentially you are trying to remove "intersection" of two datasets.
Multiple ways to do it
- Option 1 (Using NOT) . Ensure your first Search contains "user_name" field , otherwise rename fields to match
index=* source="index_file.csv" NOT [|inputlookup lookup_file.csv | fields user_name| dedup user_name]
Option 2 (Using join)
index=* source="index_file.csv" | join type=left user_name [ | inputlookup lookup_file.csv | fields user_name | dedup user_name | eval DummyColumn="Table2"| fields user_name, DummyColumn] | search NOT DummyColumn=*
Option 3 (Using SET)
| set diff [index=* source="index_file.csv" | fields user_name| dedup user_name] [| inputlookup lookup_file.csv | fields user_name | dedup user_name]
More Details in this post
... View more
07-14-2015
08:08 AM
It is straightforward. You just need to provide your "Splunk forwarder" file:
${SPLUNK_FWD_HOME}/etc/apps/deployclient/local/deploymentclient.conf
with below entry
[deployment-client]
[target-broker:deploymentServer]
targetUri = <DEPLOY_SERVER>
I've automated installation of Splunk Forwarder in Windows/Linux. Code can be found here
... View more
07-14-2015
03:33 AM
do you need to view the output results in a single row or multiple rows?
... View more
07-07-2015
07:13 AM
Please find a similar issue .. ie Excluding the intersection
http://answers.splunk.com/answers/260368/how-to-ignore-ip-address-from-events-that-exist-in.html#answer-261438
... View more
07-07-2015
07:09 AM
i have noticed the same problem in Ubuntu 14.04. Up voting for asking it 🙂
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-17-2025
03:38 PM
|
