Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About Brian_Osburn
Brian_Osburn
Builder
Member since:
04-27-2010
06-05-2020
Community Statistics
| Posts | 194 |
| Solutions | 29 |
| Karma Given | 197 |
| Karma Received | 300 |
| Member Since | 04-27-2010 |
Activity Feed
- Got Karma for Re: Splunk Free License and Free Forwarding. 03-22-2024 12:57 AM
- Got Karma for Re: Users who are logged in right now. 08-24-2023 09:57 AM
- Got Karma for Re: Users who are logged in right now. 01-04-2023 08:11 AM
- Karma Re: Failed to install app for sdwilkerson. 06-05-2020 12:46 AM
- Karma Re: very large lookup tables (exceeding 2gb bundle size) for hexx. 06-05-2020 12:46 AM
- Karma Re: Splunk on HP-UX, Too much CPU consumption for hexx. 06-05-2020 12:46 AM
- Karma Re: JMX App: How to remove "key = " from the value of JMX attributes? for Damien_Dallimor. 06-05-2020 12:46 AM
- Karma Re: Cannot eval a field obtained from rex for ziegfried. 06-05-2020 12:46 AM
- Karma Getting logs out of txt files converted from wireshark captures pcap file for misteryuku. 06-05-2020 12:46 AM
- Karma Re: Web intelligence download?? for Ayn. 06-05-2020 12:46 AM
- Karma Re: Who is BOSBURN? for dwaddle. 06-05-2020 12:46 AM
- Karma _time drilldown returning no events for Drainy. 06-05-2020 12:46 AM
- Karma Re: _time drilldown returning no events for Drainy. 06-05-2020 12:46 AM
- Karma Re: line breaking is not working for Drainy. 06-05-2020 12:46 AM
- Karma Re: Issue with á é í ó ú characters in Logs for dwaddle. 06-05-2020 12:46 AM
- Karma Re: HALP! Consulting the summary dashboard of the search app causes my system to run out of memory! for hexx. 06-05-2020 12:46 AM
- Karma Re: How to limit mgmt port access to localhost only on Universal Forwarder or Heavy Forwarder for mikelanghorst. 06-05-2020 12:46 AM
- Karma Re: Windows Installer error 1310 - Splunk 4.3 for piebob. 06-05-2020 12:46 AM
- Karma Re: PDF server: status page timed out for Lionel. 06-05-2020 12:46 AM
- Karma Splunkd crash after upgrade to 4.3 for crossroadsIT. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 3 | |||
| 2 | |||
| 2 | |||
| 0 | |||
| 4 | |||
| 0 | |||
| 3 | |||
| 10 | |||
| 6 | |||
| 2 |
04-25-2011
05:58 AM
1 Karma
Go into your local instance of Splunk.
Go to "Manager"
Click "Data Inputs"
Click "Files & Directories"
Click "New"
Select "Upload and Index a file"
Select browse and upload the file.
... View more
03-15-2011
03:02 PM
1 Karma
I think she's referring to these error messages during the upgrade:
Possible typo in stanza [class_id] in /opt/splunk/etc/apps/SplunkforBlueCoat/default/transforms.conf, line 30: SOURC_KEY = ClassID
I saw this in my dev environment (haven't done my production environment yet).
Brian
... View more
02-23-2011
06:16 PM
I don't have a way to test it right this second, but you should be able to set that up.
You will just need to make sure that the child modules are closed out correctly with the parent modules.
Brian
... View more
02-21-2011
08:10 PM
1 Karma
Can you provide a little more information about what you have done and haven't done?
Have you set up Splunk to consume your logs? If so, how did you do that?
Splunk is mostly independent on versions of software as long as the log files are still txt files which can be consumed by Splunk.
For example, if you install Splunk, and configure Splunk to point to your IIS logs, it should recognize them for what they are (unless you use custom logging format), and digest them.
Brian
... View more
02-21-2011
04:48 PM
3 Karma
You should have a field called "splunk_server", that's what indexer it came from.
You should be able to search / display based on that.
Brian
... View more
02-11-2011
06:41 PM
Ahhhh. Looks like i totally missed the point of the question. sorry about that
... View more
02-09-2011
08:38 PM
Can you provide the query you are running to generate the scheduled search?
You may be able to to send everything to:
| table field1,field2,description
... View more
02-07-2011
03:46 PM
15 Karma
I use this:
index=_audit NOT user="n/a" NOT user="splunk-system-user" NOT "scheduler__nobody__search" | stats max(timestamp) by user
It may not be the best, but it gives me an idea who's in the system and the last action they took. Useful when you need to do stealth restarts in production 🙂
Brian
... View more
01-13-2011
07:07 PM
In order to get data from the linux machine to the windows indexer, you have a couple of options.
The first is to install Splunk as a lightweight forwarder on the Linux machine and have it send the logs over to the windows machine.
The second and probably more overly complicated option is to transfer the files to the windows box using either ftp or sftp.
Brian
... View more
01-11-2011
07:38 PM
Did you set it up to send it to the splunk machine itself or just a flat file?
I found it easier to set up Splunk to listen on a port (I used 42096) and configure Symantec to talk to the server (in my case, plsplunk01:42096).
Brian
... View more
12-16-2010
01:30 PM
I was able to install it on Solaris 10, but didn't use the pkg file..just unzip and stick the directory where you want it.
Brian
... View more
11-18-2010
08:39 PM
Is it possible to do something like this?
I have a table that's being generated (see below). Is it possible to do the following:
If the user clicks on the first
column, open up a redirect to
another view that has a value or two
passed in it (for example, a view
that provided more detail about that
file)
If the user clicks on the rest
column, open up a new window to the
url that's generated?
The other columns should have nothing happen.
Thanks in advance.
... View more
- Tags:
- drilldown
11-17-2010
07:37 PM
1 Karma
I actually have a script that uses a post-commit hook to write to a log.
I'm working on incorporating that as an app itself, where you can do reports and statistics on users and files and such.
... View more
11-04-2010
09:48 PM
1 Karma
Clark -
I don't think the F5 Application supports the LTM line yet. I would set up an iRule to determine what you want to log.
This is one thing I'm going to work on when I'm done my current project.
Brian
... View more
11-02-2010
07:40 PM
10 Karma
Hi Matt -
Having gone through this before, I can say that anything forwarded from the Search head to the indexers is NOT counted toward your license cost. You can even set up the Search head to use the forwarder license included with the app.
With regards to setting up the Search head as a forwarder, it's the same process as you would use for any other forwarder. You can find the details here: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Setupforwardingandreceiving#Set_up_forwarding_and_receiving:_heavy_or_light_forwarders.
Now, there's one caveat. If you use custom named summary indexes, you'll have to make sure they're created in the indexes.conf on the Indexers as well.
Hope this helps!
Brian
... View more
10-29-2010
06:25 PM
Splunk handles .gz just fine - it'll unzip it and index it.
... View more
10-11-2010
04:02 PM
1 Karma
I'd recommend just installing it on the Search head. Set up the search head as a forwarder so that the summary indexes are populated on the indexers (for redundancy and licensing measures).
I don't use the application myself, but those would be my suggestions off the top of my head.
... View more
10-11-2010
04:00 PM
Can you give an example of the search you are using?
... View more
10-11-2010
03:57 PM
3 Karma
What type of information are you looking for? What does your data look like?
Searches are pretty basic - figure out what you want to look for, save it and set up an alert.
Taking a look at http://www.splunk.com/base/Documentation/latest/User/AboutSearch and http://www.splunk.com/base/Documentation/latest/User/MonitoringRecurringSituations for some more information..
... View more
10-03-2010
06:45 PM
I've opened one previously for this.
... View more
10-03-2010
02:01 PM
Judging from http://www.splunk.com/base/Documentation/4.1.5/Admin/Configureusertimeouts,
In addition to setting the splunkweb/splunkd session value, you can also specify the timeout for the user browser session by editing the ui_inactivity_timeout value in web.conf. The Splunk browser session will time out once this value is reached. The default is 60 minutes. If ui_inactivity_timeout is set to less than 1, there's no timeout -- the session will stay alive while the browser is open.
But I'm not sure that can be applied to specific users or not..
... View more
10-03-2010
01:53 PM
1 Karma
Take a look at this http://answers.splunk.com/questions/6147/how-to-generate-a-report-on-multiple-indexes.
It's basically a perl script that I wrote that parses the indexes.conf and uses the dbinspect command functionality to get the information you're looking for.
Unfortunately, the dbinspect command doesn't allow wildcards, hence the parsing of the indexes.conf file.
Brian
... View more
