About verbal_666

verbal_666

Already installed. Just wanted to know if in official documentation, or other site, there is a full documented list. Thanks, anyway.

verbal_666

Hello. Is there a documentation to have a full visual list, how many and which icons, Splunk Enterprise includes in its default installation a user can use in his own Dashboard Panels inside a custom html code? Just to know if some icons are useful to make a Dashboard looks better without uploading new images/icons. Thanks.

verbal_666

Right, run away, newbie 👍

verbal_666

It's an old question, but i came though the same issue. You have to enable "dispatch_rest_to_indexers" for the Role to query also Indexers rest api (like Storage or any other api inside Indexers side).

verbal_666

Ok, try this, 1) you have 1000 Windows servers 2) any server is used/shared by a sub.Team of a Company (1 Applicative from UK, 1 Security from USA, 1 Sys.Admins from Canada) 3) so Company creates a 3 DS infrastructure which deploy each one its own addon for inputs/scripts 4) any Windows server needs 3 forwarder instances, anyone connected to its own DS (UK/USA/Canada) 5) try to install 3 forwarders, anynone in its own version (7.3 + 8.2 + 9.0) with .msi Ah... ps. 6) i install my own 3 forwarder intances with their own DS ponting in 5 minutes with my cooked zip... MY COOKED ZIP... since i can't download it from Splunk repo 😴

verbal_666

Ah, ps, just for your information: you can't install a multiple instance forwarder inside Windows using the .msi setup, since it update the previous or gets an error. Using zip you can install multiple instances (i have hosts with 2 instances by default for 2 both DS, and sometimes also more than 2 without a DS but only with manual deployed TA), as it does with *nix tgz.

verbal_666

So, why *nix distibutable repo has its own .deb .rpm AND .tgz ? And why Windows does not? Let's talk about people that actually still think Windows is only a GUI OS? If so, those guys are IT beginners. Windows can be managed by CLI as *nix, and so Splunk!!! I repeat, i deploy tens of forwarders without having to GUI login in any Windows host. And i cooked my zip by myself, the question is: WHY SPLUNK THINKS I HAVE TO COOK ZIP BY MYSELF? 😑 Said so, i close the question. So much splunk thinks like you 😟

verbal_666

Inside Windows you can manage forwarder as you manage in *nix. Installing the service is done by splunk binary, just with a "splunk enable boot-start" and the proper Splunk server name in splunk-launch.conf . It's not such difficult 🙄 I have batch scripts that deploy zip files on any machine in network, configure and start it, as i have in *nix env. So, zip files for Windows are not so unuseful!!! 😒

verbal_666

2023, still no zip/7z Forwarder download for Windows Env? I have a batch script to deploy forwarders on many hosts, and i need to "cook" my forwarder zip file from an installed msi, and it works fine. Still no download for users with all older versions? 😒

verbal_666 · ‎02-15-2023

Solved with a SH Cluster members full restart... gosh!!! Strage to me... ... ... 🤔 Maybe Cluster was not correcly in sync... 🙄

verbal_666 · ‎02-15-2023

It's making me crazy!!! 😡😡😡😡😡 Splunk Enterprise 8.2.6, Cluster SH with 3 members. [role_test] cumulativeRTSrchJobsQuota = 0 cumulativeSrchJobsQuota = 0 grantableRoles = test importRoles = user srchIndexesAllowed = *;_* srchMaxTime = 8640000 A "test" new Role. Import capabilities from "user" Role. A new user is assigner to the "test" Role. No way to query _internal indexes!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 😤😤😤 Any suggestion??? 🤔 Thanks.

verbal_666 · ‎02-08-2023

No, sorry, i did not mention that INDEXERS manage queues OK, they do not get over 10/20% in a full day, by media is 1/5% per INDEXER. HF was the issue. Leaving queues by default it can't manage the flows, raising to 2GB it does. My question is: with 16GB server, is there any risk raising to 2GB per queue, or, maybe, also more over? Best Practices what suggest about it? For now, with 2GB/queue i got no issues in data flow (and there is much much data!!!). The only little issue i encountered is that, sometimes, during the day, maybe for some networking problems, i found HF to do much os swap, and, in some cases, kernel killed the splunkd process for full swap usage.

verbal_666 · ‎02-07-2023

Hallo 😊 About this post, https://community.splunk.com/t5/Building-for-the-Splunk-Platform/Impact-of-increasing-the-queue-size/m-p/630016#M10927 What's the Best Practices about managing queues size? Let's talk about servers running only Splunkd (Indexers and HFs) and 16GB of total physical memory. Thanks.

verbal_666 · ‎02-07-2023

I have an HeavyForwarder in the middle of a Splunk flow infrastructure. I needed to edit the conf for queues, since the HF can't manage all the data UFs send. So, take a look here, https://docs.splunk.com/Documentation/Splunk/9.0.3/Admin/Serverconf#Queue_settings I need to raise all the major queues buffer, to 2GB (2000MB), in other ways HF was always blocked, and, moreover, did not send back to UFs the needed ACK, blocking all the streams many times a day. The config can be edited in server.conf in [queue] stanza. [queue] maxSize = [<integer>|<integer>[KB|MB|GB]] [queue=<queueName>] ( * you can look at metrics.log for the names) maxSize = [<integer>|<integer>[KB|MB|GB]] ... * Get all the queues names with index=_internal source=*metrics.log host=YOUR_INDEXER(S) group=queue | dedup name | table host name max_size_kb i did so for the HF (2000MB) and my Indexers (1000MB for major queues).

verbal_666 · ‎01-09-2023

Hi guys. I was asking why my reports, using license_usage.log from LicenseMaster, for "LicenseUsage" sometimes do not log the "h" or "s" field (alias from host or from source). Doing so, i can have a full report for Indexers or Sourcetypes usage, but not for Host or Sources. INFO LicenseUsage - type=Usage s="" st="MY_ST" h="" o="" idx="MY_IDX" i="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" pool="auto_generated_pool_enterprise" b=51331 poolsz=214748364800 May it be the origin forwarder version? I have forwarders from 6.x.x to 8.x.x version running. Any clue? Thanks.

verbal_666 · ‎11-21-2022

Hi. I'm trying to apply a rule for dropping and, meanwhile, get only some events in Indexers. Here we are, props.conf [mysourcetype] TRANSFORMS-filter = drop transforms.conf [drop] REGEX = drop_event1|drop_event2|drop_eventX DEST_KEY = queue FORMAT = nullQueue This is the standard way for dropping. And it works! But, at the same time, i can't get a way to make both work with drop and get transformation, props.conf [mysourcetype] TRANSFORMS-filter = drop,filter transforms.conf [drop] REGEX = drop_event1|drop_event2|drop_eventX DEST_KEY = queue FORMAT = nullQueue [filter] REGEX = get_event1|get_event2|get_eventX DEST_KEY = queue FORMAT = indexQueue I would like to explain Splunk 8, FIRST: drop all events containing pattern regex "drop_event1|drop_event2|drop_eventX" SECOND: get only events containing pattern regex "get_event1|get_event2|get_eventX" It does not work! Splunk, after correctly dropping, gets all (".*"), except as said "drop_event1|drop_event2|drop_eventX" 😪 Any suggestion?

verbal_666 · ‎11-21-2022

I resolved this issue with 2 (or more) transformations, dropping all unuseful events... props.conf [mysourcetype] TRANSFORMS-filter = drop transforms.conf [drop] REGEX = drop_event1|drop_event2|drop_eventX DEST_KEY = queue FORMAT = nullQueue I think it's the best way. Maybe the only one 🤔 But, at the same time, there's is no way to make both work with drop and get transformation, props.conf [mysourcetype] TRANSFORMS-filter = drop,filter transforms.conf [drop] REGEX = drop_event1|drop_event2|drop_eventX DEST_KEY = queue FORMAT = nullQueue [filter] REGEX = get_event1|get_event2|get_eventX DEST_KEY = queue FORMAT = indexQueue I would like to explain Splunk 8, FIRST: drop all events containing pattern regex "drop_event1|drop_event2|drop_eventX" SECOND: get only events containing pattern regex "get_event1|get_event2|get_eventX" Splunk, after dropping, get all (".*") except "drop_event1|drop_event2|drop_eventX" 😪 Any suggestion?

verbal_666 · ‎11-20-2022

I got this same bahaviour on my updated Splunk 8.2.6. I encountered the problem was an inputs.conf with a stanza with [monitor://$SPLUNK_HOME/var/run] I really do not remember why i had this inputs, maybe in older 7.x.x i usedit for some "special" ingestion. Removing the inputs in 8.2.6, removed the error in ui and tracker.log was regular in splunkd.log by default. 👨‍🔧

verbal_666 · ‎11-18-2022

Did you find a way to remove the banners?

verbal_666 · ‎11-17-2022

Hi. This is a simple "positive/included" regex. OK! Is there a way, in reverse, to do a "negative/exclude" way to filter data? As an example, as for the log of the user, I DO NOT WANT "notice" PATTERN to be indexed, but all the rest, something like REGEX != notice Is there a simple way inside props/transforms?

Posts	114
Solutions	5
Karma Given	17
Karma Received	7
Member Since	‎03-15-2017

Online Status	Offline
Date Last Visited	a week ago

Is there documentation for an Icons list we can in...

Why can't I get a role to query _internal?

What are the Best Practices regarding managing que...

Why License Usage has empty fields?

DROP and GET events by pattern filters?

Is there a way to remove WARNING Banner?

Is it unsafe to upgrade from 7.0.x to 8.2.x?

Does Splunk "Clean All" make itself a backup of au...

NMON ADDON: permissions

BEST PRACTICE: maxKBps

Re: Icons list we can include in a Dashboard Panel

Is there documentation for an Icons list we can in...

Re: Splunk Windows universal forwarder zip file

Re: What capabilities does a REST API only user ne...

Re: Splunk Windows universal forwarder zip file

Re: Splunk Windows universal forwarder zip file

Re: Splunk Windows universal forwarder zip file

Re: Splunk Windows universal forwarder zip file

Re: Splunk Windows universal forwarder zip file

Re: Can't get a Role to query _internal

Why can't I get a role to query _internal?

Re: QUEUES: Best Practices

What are the Best Practices regarding managing que...

Re: Impact of increasing the queue size?

Why License Usage has empty fields?

DROP and GET events by pattern filters?

Re: Blacklist using props.conf and transforms.conf

Re: Why are we receiving this ingestion latency er...

Re: Remove "Latest Resources" from Dashboards page

Re: Blacklist using props.conf and transforms.conf