About alacercogitatus

alacercogitatus · ‎04-01-2013

You will need to check with your Network/Firewall guy to make sure ACLs, ports, etc are all open on 9589 and 9997 between client and server. Once you get the telnet command to work, deployment server should work as well.

alacercogitatus · ‎04-01-2013

Is your deployment client a universal forwarder? If it is, it won't Index and Forward. You need heavy forwarder for that. Additionally, can you confirm you can connect from client to server? Try: telnet 2xx.4xx.1xx.2x1 9589 from the client and make sure it connects successfully.

alacercogitatus · ‎03-28-2013

any kind of session_id or transaction_id that would be used to correlate the events?

alacercogitatus · ‎03-28-2013

You may want to consult this doc: http://docs.splunk.com/Documentation/Splunk/5.0.2/Indexer/Clustersinscaledoutdeployments#Cluster_peer_management_compared_to_deployment_server To Install SoS in a cluster, install the app on the search head, and the TA-sos on the indexers. Or use deploy-server to send the TA to the indexers.

alacercogitatus · ‎03-27-2013

If you want to manually install it to /opt/splunkforwarder, you can just do this (don't start splunk until after mv): tar xvzf splunk_package_name.tgz -C /opt mv /opt/splunk /opt/splunkforwarder

alacercogitatus · ‎03-25-2013

I found that with IIS, I had to place the stanza in etc/system/local/props.conf on each indexer, not just in an app on the indexer. Can you verify that the time in the raw text is the correct offset from the time in the UI?

alacercogitatus · ‎03-25-2013

I do believe that the $ is special within macros. I'd wager that is correct.

alacercogitatus · ‎03-25-2013

I think I spotted the issue. In your macro, you are returning "$earliest". Try returning "earliest".

alacercogitatus · ‎03-25-2013

Can you provide the macro definition with stanza?

alacercogitatus · ‎03-15-2013

Glad it worked for you, please accept the answer if it worked for you.

alacercogitatus · ‎03-15-2013

Looks like this is a windows log file. Try this: host=Computername EventCode=1309 | rex field=_raw "Exception message:(?<exception_message>[^\r\n]*)"| dedup Application_Path| table Application_Path exception_message

alacercogitatus · ‎03-15-2013

My initial answer had an append=t because I normally append lookups to search results. Try this: |inputlookup c2_zeus.csv | inputlookup DNS_DOMAINS_malware.csv append=t

alacercogitatus · ‎03-15-2013

You have them backwards. Swap the two. For each inputlookup after the first, you need "append=t"

alacercogitatus · ‎03-15-2013

can you post your search that is failing?

alacercogitatus · ‎03-15-2013

make sure you have a | at the front of your search, and that it is the first command in the search.

alacercogitatus · ‎03-15-2013

A better solution would be: |inputlookup file1.csv | inputlookup file2.csv append=t|...

alacercogitatus · ‎03-15-2013

It can. One way is to install one forwarder with a package based manager, and the use the tarballs and just unzip and go. cp splunkforwarder.tgz /tmp && cd /tmp tar xvfz splunkforwarder.tgz mv splunkforwarder/ /opt/splunkforwarder_second_instance /opt/splunkforwarder_second_instance/bin/splunk start

alacercogitatus · ‎03-14-2013

Are the ** on the ApdexScore part of the field value?

alacercogitatus · ‎03-14-2013

So I reran with phoneHomeInterval = 120. After 2 minutes, the deployment server stopped reporting the client, and within 30 seconds of the drop, it came back after the client phoned home. So I'm thinking 2 minutes is about the timeout.

alacercogitatus · ‎03-14-2013

Yes there is and can be done in two ways. use data preview (under New Data Input) to generate the sourcetype and event breaking for this file "matrix" for example. use props.conf to configure event breaking (see sections on BREAK_ONLY_BEFORE...) http://docs.splunk.com/Documentation/Splunk/latest/admin/propsconf

alacercogitatus · ‎03-13-2013

Actually, unless you specify a script to freeze it, the data gets deleted. So that should automatically delete the data for you. From the doc: * If you do not specify a coldToFrozenScript, data is deleted when rolled to frozen. http://docs.splunk.com/Documentation/Splunk/5.0.2/Admin/Indexesconf

alacercogitatus · ‎03-13-2013

Actually, in testing, I found that around 2 minutes is the time range. The results of my command watch -n 15 'date >> /opt/deploy.log && splunk list deploy-clients |grep "IPADDRESS" >> /opt/deploy.log' are found in pastebin below. I stopped the forwarder between the 11:52:55 and 11:53:10 times. I then started the forwarder after the 11:55:57 time. Also, default for phoneHomeIntervalInSecs is 60. http://pastebin.com/rP2By1FC UPDATE NOTE: The timeout may be dependent on your system and what configuration options you have set.

alacercogitatus · ‎03-13-2013

Yeah, those are the metadata for the system folder. Don't mess with the default one, but check the local one for your stanzas.

alacercogitatus · ‎03-13-2013

Make sure that $APP_HOME/metadata has two files: default.meta and local.meta. $APP_HOME is whatever app you were in at the time the error occurred. You should also check those files for anything relating to "iis-xpox" or "xpox-devicelog" to make sure you have permissions to those files. Also, might be a bug (what version Splunk do you have?)

alacercogitatus · ‎03-13-2013

What version of Splunk?

Posts	1174
Solutions	262
Karma Given	465
Karma Received	1318
Member Since	‎04-19-2011

Online Status	Offline
Date Last Visited	a week ago

SplunkJS/HTML Dashboards + map command + $foo$ sub...

Transpose Multi Value Fields

Web Framework Require Local File

Search Returns Exit Code -2

Splunk Daemon Not Responding

Splunk-system-user Report Acceleration Search Stuc...

Modular Input Scripts Don't Die during Splunk rest...

Beta Testers Wanted - Google Apps Modular Input

AutoRun form from populated dropdown when only one...

Linebreaking Failure - BREAK_ONLY_BEFORE_DATE

Re: Need Help With Deployment-Server and Deploymen...

Re: Need Help With Deployment-Server and Deploymen...

Re: find event that happens before another event o...

Re: What are the best practices for installing SoS...

Re: /opt/splunkforwarder Default?

Re: GMT IIS logs won't display real-time

Re: Debugging a search ran from python script

Re: Debugging a search ran from python script

Re: Debugging a search ran from python script

Re: I can't capture an unrecognized field with a s...

Re: I can't capture an unrecognized field with a s...

Re: inputlookup

Re: inputlookup

Re: inputlookup

Re: inputlookup

Re: inputlookup

Re: multiple forwarder instances on same server

Re: Timechart - _time subsearch issue

Re: What timerange does ./splunk list deploy-clien...

Re: XML Log File Question

Re: How do I permanently delete logs from an index

Re: What timerange does ./splunk list deploy-clien...

Re: Props and field extraction not working

Re: Props and field extraction not working

Re: Props and field extraction not working

Join the Conversation