About Simeon

Simeon · ‎10-20-2010

The violaions are on a rolling period. So if you have just recently violated the maximum number of times, you will have to wait until one of those violations roll out of the window. Otherwise, you will need to contact your sales representative or account manager to get this addressed.

Simeon · ‎10-20-2010

I believe these are built into the TitleBar and Appbar module. I am unsure how much you can edit, but you can rewrite some of these items by editing the Navigation stuff. In your app directory, you should have some default navigation files that dictate the labeling of these items. So if you were editing the search app, you would edit this: $SPLUNK_HOME/etc/apps/search/default/data/ui/nav/default.xml You could also edit this in the UI, under manager in the navigation section.

Simeon · ‎10-20-2010

I do not believe you can configure the port setting for the port range that a forwarder uses as it's source. If I recall correctly, this is randomly determined by the OS.

Simeon · ‎10-20-2010

I don't believe Splunk can read .evt files because they are in a non-textual format. Splunk will not perform any processing of binary type files. So in your case, I suspect we will not index that data as expected.

Simeon · ‎10-19-2010

Saved searches will be persisted until your quota settings rotate out the old searches based on the period settings. This is probably the most consistent way to have a search persisted and be able to load it at a future point in time. To load it in the future, you can view it through the jobs viewer in the gui or via the loadjob search command. Note - simple dashboards that leverage scheduled saved searches will utilize the last run search. I believe the setting is called "useHistory". This may be a bit easier to use from an interface standpoint, as a user can just load that dashboard at any point in time to see the last stored result set for a given set of search results.

Simeon · ‎10-19-2010

It looks like you would want to run the command in this way from within the Google Maps app: sourcetype=access_combined | lookup geoip clientip | geonormalize So for your situation: sourcetype="iis_w3c_default" | lookup geoip c_ip | geonormalize

Simeon · ‎10-19-2010

Splunk will delete based upon the latest event contained in a bucket. For this reason, you may not see exact timing for deletion of data if there is a large overlap in timing. To inspect the span of a db/bucket, you can use the dbinspect command to see the time range of each bucket. It's possible that you have data in a bucket that is before and later than the deletion time. Since we delete based on the latest (most recent) event in a bucket, you may still see older events in an index.

Simeon · ‎10-18-2010

You should synchronize the whole auth directory for consistency. Those files are their for the ssl communication and password configuration. As the other Splunk Answers question and answer states, you should also sync the etc/system/local/server.conf and the etc/passwd file.

Simeon · ‎10-18-2010

If you have enabled the forwarder app, that could turn off local indexing. You can check which apps are enabled by running the following command: /opt/splunk/bin/splunk display app

Simeon · ‎10-15-2010

The dedup command will return the first key value found for that particular field. This means the most recent in time, as splunk searches from latest to earliest. For example, in the search that dedups the ip_address value for your firewall log, you will see the most recent ip_address that has been logged to that source. For more detail: http://www.splunk.com/base/Documentation/latest/SearchReference/Dedup

Simeon · ‎10-15-2010

I am running the dedup command for my ip_address field and I want to know the value returned by the command. Is it the last value seen, first value seen, something random? My search looks like this; sourcetype=firewall_log | dedup ip_address

Simeon · ‎10-14-2010

The autoCancelInterval is supposed to spawn a window to "auto cancel" a search that is run from the UI that might be over too long of a period.

Simeon · ‎10-11-2010

Splunk has internal tracking of files so that it does not reindex files. You can force Splunk to reindex data by using CRC Salt. If you add the following setting to your stanza, the file will be reindexed: crcSalt = <SOURCE> Here is an excerpt from the documentation regarding this setting: crcSalt = <string> If set, this string is added to the CRC. Use this setting to force Splunk to consume files that have matching CRCs. If set to crcSalt = <SOURCE> (note: This setting is case sensitive), then the full source path is added to the CRC. We typically do NOT recommend adding this as you will confuse Splunk regarding what files need to be indexed in addition to how much of that file has been indexed.

Simeon · ‎10-07-2010

Please supply your exact search query in addition to any details about how the source data is classified or input to Splunk

Simeon · ‎10-06-2010

Splunk is packaged to run on the solaris specific hardware, so you would minimally need to confirm that compatibility (Sparc Vs. x86). Next, you should verify that the underlying Solaris architecture is one that Splunk has been tested on. I believe the latest versions of Splunk (4.1.x) only support Solaris 9 or later. With that in mind, any competent Trusted Solaris admin should be able to get Splunk working. It should behave similar to any other web service/application. I would recommend following the instructions we have for running as non-root user.

Simeon · ‎10-06-2010

Do you have version info for the Trusted Solaris system?

Simeon · ‎10-06-2010

If you can confirm the appropriate metrics on the indexing side, then the data is likely in the index. However, you need to run a search that will find out where Splunk stored it. Typically, you can run a search over all-time just for that specific source or sourcetype and that will show you where the data has been stored. Most likely, the event data is getting incorrectly time stamped or bunched into a large multi line event.

Simeon · ‎10-05-2010

Splunk will track the top 10 inputs based on source and host. To retrieve that information, you could run the following search: index=_internal source=*metrics.log* per_host_thruput | timechart sum(kb) by series To increase the number of tracked inputs, you can set that in your limits.conf file for metrics tracking.

Simeon · ‎10-05-2010

Your question is not very clear without any information about the data source (input).

Simeon · ‎10-05-2010

Please send a diag

Simeon · ‎10-04-2010

http://answers.splunk.com/questions/4897/how-to-determine-daily-license-usage

Simeon · ‎10-04-2010

You should be able to use a transaction command that starts and stops with each event. From there, we automatically create a "duration" field that logs the amount of time between them. Alternatively, you could evaluate the difference in the _time field.

Simeon · ‎10-04-2010

The event itself is probably using the IP address for the Host value. It might be helpful to see what Splunk has indexed for the host value of that event, as well as what is the extracted field value. To compare, run a search similar to the following: | metadata type=hosts | search host=<your_ip_address> | metadata type=hosts | search host=<your_fqdn> index=your_index source=udp:514 | fields host The value from the metadata searches are what is stored in the index, and the values from the search with | fields is likely the extracted value.

Simeon · ‎10-04-2010

Without seeing the output of each event in the search window, this will be hard to answer. I strongly suspect your field for TX_Thruput is not extracted by default. Typically, Splunk finds the fields you want to use automatically, but there are some cases where you must configure Splunk to properly extract fields. You will need to create a field extraction for the TX_Thruput field. You can do this via the interactive field extraction tool or via a rex command.

Simeon · ‎10-04-2010

As confirmed by the gkanapathy, you cannot run dbinspect on other machines from the UI. However, you can use the -uri option via command line. ./splunk dispatch "| dbinspect index=myindex" -uri https://<server>:8089

Posts	366
Solutions	72
Karma Given	69
Karma Received	470
Member Since	‎11-08-2009

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

What is the difference between passing Appinspect ...

How to find common packages installed on many host...

how do I find the different packages installed on ...

Can I index WMI from a Splunk instance running on ...

Does multikv work with lookup tables?

Does a scripted authentication user take priority ...

How can I run searches against the Splunk API?

Why do I get different results when I search my ex...

How do I extract Key Value pairs from Ruby on Rail...

What do I need to do to run Anti Virus software wi...

Re: Your Splunk license expired or you have exceed...

Re: Remove menu entries from application

Re: What ports does a forwarder bind to for sendin...

Re: batching .EVT Files

Re: Cached search results

Re: Google Maps App Not Showing Results

Re: Indexed data not erased

Re: Puppetizing Splunk for SSL-enabled Light Forwa...

Re: Search head not writing to internal or summary...

Re: Which value does the dedup command keep?

Which value does the dedup command keep?

Re: What is the function of the "autoCancelInterva...

Re: Index monitored file initially

Re: Log data source received but only some of it s...

Re: Are there any implications/caveats for running...

Re: Are there any implications/caveats for running...

Re: Log data source received but only some of it s...

Re: examples of searches to capture network thrupu...

Re: examples of searches to capture network thrupu...

Re: How do I increase the number of series display...

Re: Where can I find information on how to track m...

Re: How do I get the amount of time between event ...

Re: UDP Syslog Host Showing up as IP

Re: Network throughput monitor

Re: Command or search to list index statistics?

Join the Conversation