Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About sbattista09
sbattista09
Contributor
Member since:
07-22-2014
06-05-2020
Community Statistics
| Posts | 156 |
| Solutions | 8 |
| Karma Given | 59 |
| Karma Received | 27 |
| Member Since | 07-22-2014 |
Activity Feed
- Got Karma for How to search how much bandwidth a forwarder is using?. 05-04-2022 08:46 AM
- Got Karma for Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?. 10-20-2021 06:23 AM
- Got Karma for Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?. 07-19-2021 09:48 AM
- Got Karma for Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?. 04-07-2021 08:45 AM
- Got Karma for How to take the perc of each action and display it in a single value panel on a dashboard?. 10-15-2020 08:18 PM
- Karma Re: standard deviation to alert us when we see source types and/or indexes grow more then expected for _gkollias. 06-05-2020 12:50 AM
- Karma Re: standard deviation to alert us when we see source types and/or indexes grow more then expected for jacobpevans. 06-05-2020 12:50 AM
- Karma Re: standard deviation to alert us when we see source types and/or indexes grow more then expected for jacobpevans. 06-05-2020 12:50 AM
- Karma Re: still not sending email for alerts for darshini2790. 06-05-2020 12:50 AM
- Karma Re: still not sending email for alerts for kamlesh_vaghela. 06-05-2020 12:50 AM
- Got Karma for Any good examples of run books for upgrading splunk 7.x to 8.x using Ansible?. 06-05-2020 12:50 AM
- Got Karma for Re: standard deviation to alert us when we see source types and/or indexes grow more then expected. 06-05-2020 12:50 AM
- Got Karma for standard deviation to alert us when we see source types and/or indexes grow more then expected. 06-05-2020 12:50 AM
- Got Karma for Re: How does Splunk connect to the Universal forwarders — using IP or HostNames?. 06-05-2020 12:50 AM
- Karma Re: Top 20 Memory-Consuming Searches for rphillips_splk. 06-05-2020 12:49 AM
- Karma Monitor Role Changes in _Audit Trail for lathwal. 06-05-2020 12:49 AM
- Karma Re: Is there documentation on how to migrate a search head deployer and a cluster master to new servers? for sloshburch. 06-05-2020 12:49 AM
- Karma Re: Search syntax for comparing events over 30-day timespan for elliotproebstel. 06-05-2020 12:49 AM
- Got Karma for What would be the best way to ensure redundancy in opsec lea add-on when the heavy weight forwarder running the app fails?. 06-05-2020 12:49 AM
- Karma How to configure DMC for heavy forwarder monitoring? for koshyk. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-29-2016
10:07 AM
1 Karma
Exactly +2.
... View more
02-25-2016
08:04 AM
what is the root cause of this issues?
I can go from the default of 5000 "5gb" to 10000 (10gb) sure that's fine however, whats to stop this error from happening again?
[diskUsage]
minFreeSpace = 10000
... View more
hmmm, fschange is deprecated since Splunk 5.x and therefore could possibly disappear some when in the future. Also, from my point of view, the idea to have something watching itself is a bit - sorry - strange. If I want something to watch/monitor something, I would use a different software that uses external checks.
cheers, MuS
... View more
02-02-2016
10:48 AM
Take a look at the Resource Usage: Machine view.
... View more
01-28-2016
12:06 PM
1 Karma
You should read this first : http://docs.splunk.com/Documentation/Splunk/6.3.2/Installation/ChoosetheuserSplunkshouldrunas
That outlines the different permissions that are required.
Reading files on disk, permissions are based upon standard RWXD permissions on ntfs etc.
For Database Connections, it will depend on which DB you connect to. MS supports AD credentials, where as mysql / oracle etc require ldap or local DB auth.
... View more
01-28-2016
01:39 PM
Check if this is been set on HF
Set up receiving with the configuration file
You can enable receiving on your Splunk Enterprise instance by configuring inputs.conf in $SPLUNK_HOME/etc/system/local. To configure a universal forwarder as an intermediate forwarder (a forwarder that functions also as a receiver), use this method.
To enable receiving, add a [splunktcp] stanza that specifies the receiving port. In this example, the receiving port is 9997:
[splunktcp://9997]
disabled = 0
... View more
01-28-2016
07:22 AM
2 Karma
Take a look at this:
Source: https://answers.splunk.com/answers/118859/diagram-of-splunk-common-network-ports.html
... View more
06-22-2018
03:25 AM
I found that this gives me the text output without a password after following the directions in this URL.
http://docs.splunk.com/Documentation/Splunk/7.1.1/Security/Getthird-partycertificatesforSplunkWeb
LD_LIBRARY_PATH=/opt/splunk/lib/ /opt/splunk/bin/openssl rsa -in /opt/splunk/etc/auth/mycerts/myprivate.key -text
... View more
05-19-2020
06:24 PM
index=_internal source=metrics.log group=udpin_connections |timechart avg(udp_kbps) max(udp_kbps) span=5m
UDP is similar. But UDP has _udp_bps=25434.085277542734, _udp_kbps=24.837973903850326, _udp_avg_thruput=15.692977114824794; so we might not need to do calculation.
... View more
12-22-2015
12:39 AM
1 Karma
Our cluster master and deployment servers were sharing a VM with the following specs until very recently: 4 cores, 4 GB RAM, 50GB dedicated drive. We had 2000 UFs and 6 indexers.
The minimum spec I would go for nowadays is the following:
Intel 64-bit chip architecture, 2 cores, 2 GHz
2GB RAM
OS installation + 50GB free
Standard 1Gb Ethernet NIC, with optional second NIC for a management network
Linux 3.x 64-bit edition
If you can afford it get 4 cores and 4GB RAM.
Hope that helps.
Regards,
Javier
... View more
11-24-2015
01:32 PM
How robust are you individual systems? A replication factor of 4 is awfully high. That is 4 ENTIRE copies of the data spread across each node. I think you may have misinterpretation what replication factor means.
Are you expecting multiple entire individual systems to become unrecoverable? Each replication number means one entire copy of all indexers data spread across the entire platform. This also means that for each GB of original data indexed on a single peer atleast another 500MB will be written on EVERY other node in the system for the same data (assume 2:1 minimum compression). You can potentially run out of available IOPS (for both searching and indexing) depending on your normal ingestion rate.
Normally you have raid which protects individual file systems. But say the entire raid fails. Then you have replicated copies to fix this.
With a replication factor of 4 you are expecting that you will have 3 entire systems with unrecoverable data.
I don't know your situation so it seems unlikely that would be required. You may want to revisit that setting.
... View more
06-09-2016
10:01 AM
Create a custom timepicker.
... View more
02-07-2018
01:57 PM
deleting or renaming workflow_actions.conf worked for me.
It's also recommended you delete eventgen.conf before applying to indexer cluster.
http://docs.splunk.com/Documentation/AddOns/latest/Overview/Distributedinstall#collapseDesktop2
... View more
05-13-2015
02:03 AM
Hi,
For LTM traffics events (mainly http/https), the add-on leverages the iRules/HSL to send relative events to Splunk forwarders.
You need to configure HSL on F5 BIG-IP device side and attach a iRule to your VIPs for this purpose to send https(s) traffics events to Splunk.
Please refer to below guide for detail. Kindly let me know if it works.
http://docs.splunk.com/Documentation/AddOns/released/F5BIGIP/Setup
> Configure F5 for HSL
> Configure iRules for LTM
... View more
04-03-2015
01:05 PM
downgraded java from 8 to 7.
... View more
03-09-2015
01:29 PM
your the MAN! thanks!
... View more
03-09-2015
12:11 PM
this was a data export error. Splunk was not creating this issue.
... View more
03-09-2015
12:24 PM
it looks like it was because the file was renamed and added a few times throwing things off. I deleted the files i didn't need in Splunk and that seemed to have solved my problem.
The Directory had two files in it but, Splunk was seeing 4. Ill admit i don't fully understand why the time was getting messed up but everything seems back to normal.
thank you for your time and input rich.
... View more
03-02-2015
12:53 PM
sorry, you are correct.
thanks for the help!
... View more
03-02-2015
12:00 PM
1 Karma
That is somewhat of a given. Anything that is acquired as part of event parsing (timestamp recognition, host name, etc) must ALWAYS be done on the first parsing node to touch the data. Indexers are parsing nodes, as are heavy forwarders.
As a best practice, if you have something in your topology outside of indexers and universal forwarders, I would suggest making that information part of your question to begin with. Also, ESR's http://www.catb.org/esr/faqs/smart-questions.html is always a good read to help remind you how to focus technical questions in a way that helps make the community able to best assist.
... View more
02-02-2015
05:54 PM
still getting odd results-
|timechart count(eval RISK=4) as "High" count(eval RISK=5) as "Severe" by SUBCATEGORY useother=f usenull=f gave me a chart however it did not count anything, all the results were 0.
|eval RISK=case(RISK==4,"High",RISK==5,"Severe") |timechart count by RISK, SUBCATEGORY useother=f usenull=f gave me "Error in 'timechart' command: The argument 'SUBCATEGORY' is invalid."
Thanks for the help!
... View more
02-19-2015
12:38 PM
not sure if the will make sense but, i built it out a little differently and it works, i named the fileds in the CSV's the same that i need to compare counts-
[|inputlookup ipsav.csv] index=summaryindex host=host1 | timechart count | Rename count As "total count of host1" | appendcols[search [|inputlookup ipsav.csv] index=summaryindex host=host1 OR host=host2 |stats count by "FIELD NAMED THE SAME IN BOTH HOSTS"| Where count = 1 | stats count | Rename count as " show count if the count is only one"]
thanks for the help guys.
... View more
12-12-2014
01:33 PM
3 Karma
It works exactly like the search you already wrote, as long as the CSV file contains one single field that's called whatever field you want to filter by. So if for instance the field you want to filter by is cisco_dsthost, your CSV needs to look something like this:
cisco_dsthost
1.1.1.1
1.1.1.2
...
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma from
Karma given to
| User | Karma Count |
|---|---|
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
