Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About Jason
Jason
Motivator
Member since:
05-13-2010
08-07-2024
Community Statistics
| Posts | 477 |
| Solutions | 60 |
| Karma Given | 93 |
| Karma Received | 586 |
| Member Since | 05-13-2010 |
Activity Feed
- Got Karma for Re: Deleting an Index from the fish bucket. 10-01-2024 12:52 PM
- Got Karma for Re: Comparing Multivalue Fields. 09-16-2024 12:34 PM
- Got Karma for Re: How do I create a field whose name is the value of another field? Like backticks or eval() in other languages.. 01-23-2024 10:11 PM
- Got Karma for Re: How do you chart a cumulative sum?. 01-20-2023 12:03 PM
- Got Karma for Re: How do I create a field whose name is the value of another field? Like backticks or eval() in other languages.. 09-14-2022 07:30 AM
- Posted Re: How do I remove all special characters from all field names? on Splunk Search. 07-28-2022 02:22 AM
- Posted How do I remove all special characters from all field names? on Splunk Search. 07-28-2022 02:13 AM
- Posted Re: Comparing Multivalue Fields on Splunk Search. 05-31-2022 08:59 AM
- Got Karma for Re: How to determine daily license usage in GB?. 03-04-2022 12:47 PM
- Got Karma for Re: How do I remove \x00 characters from my log message?. 01-23-2022 07:09 PM
- Got Karma for Re: How do I create a field whose name is the value of another field? Like backticks or eval() in other languages.. 11-30-2021 02:56 PM
- Got Karma for Add a comment to a search?. 11-29-2021 02:21 PM
- Got Karma for Re: How do I find the name of a scheduled search just from the RMD5?. 03-16-2021 11:40 PM
- Got Karma for Re: How do I create a field whose name is the value of another field? Like backticks or eval() in other languages.. 01-26-2021 02:13 PM
- Got Karma for Re: How do I create a field whose name is the value of another field? Like backticks or eval() in other languages.. 12-23-2020 04:23 AM
- Got Karma for Re: drilldown from a hidden column. 09-16-2020 11:07 AM
- Got Karma for Re: How do I create a field whose name is the value of another field? Like backticks or eval() in other languages.. 09-08-2020 08:47 AM
- Karma Re: Why does Splunk_TA_nix rlog.sh cause huge amount of duplicate audit events on Ubuntu? for dshakespeare_sp. 06-05-2020 12:47 AM
- Karma Re: When archiving to Hadoop using Hunk from an indexer cluster, is only the primary copy of a bucket archived, or are all copies archived? for hsesterhenn_spl. 06-05-2020 12:47 AM
- Karma Re: How to restart a SHC (search head cluster) at the server level? for mahamed_splunk. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 2 | |||
| 1 | |||
| 0 |
03-17-2011
08:30 PM
You could hack up deployment server to deploy to etc, but it only deploys "apps" and you probably wouldn't be able to deploy the exact file etc/log.cfg. Perhaps etc/something/local/log.cfg, but then Splunk wouldn't pick it up.
You could try symlinking etc/log.cfg to somewhere inside an app in etc/apps, then deploy that with DS, making sure to restart Splunk upon app install. That might work, but you would have to manage the symlink somehow.
... View more
03-17-2011
04:13 PM
I am experiencing an unresponsive splunkd with an indexer instance and a deployment server instance on the same box. It was working well at 700-800 forwarders, but when we went to about 1000 it stopped working. All forwarders are connecting to both the DS instance and the indexer to send data over SSL.
By unresponsive, I mean splunkd will respond to requests (from clients, from ./splunk list deploy clients, from ./splunk login) for a few seconds every couple of minutes.
Hardware is 16x2.4Ghz cores, 48GB memory, running Suse Linux 11.0.
... View more
03-16-2011
09:58 PM
2 Karma
So our Deployment Server was down for some time, beyond that of the clients' checkin interval, and now that it is back up it is being overwhelmed by hundreds of clients checking in within a few thousanths of a second of each other.
Can anyone think of a way to stop this, without using another tool to sequentially restart splunk on every forwarder?
This is going in as a bug, there's no reason Splunk shouldn't continue to use the checkin interval if unable to connect, or at least backoff and not try every 10-15 seconds.
... View more
03-16-2011
09:14 PM
I have a forwarder that appears to be a LWF (SplunkLightForwarder app is enabled) however I am seeing messages about unable to send to output queue parsingQueue. I thought the LWFs didn't do parsing.
How do I tell from Splunk's logs (splunkd.log, others?) that this is definitely a light forwarder and not attempting to parse events, perhaps through an errant setting somewhere?
... View more
03-15-2011
09:35 PM
Can you please post the settings (in Oracle) that you use to spit out this level of information? I have a client who really needs all this data but their level of auditing isn't outputting the correct fields yet.
... View more
03-10-2011
09:30 PM
This one includes the proper license, if you don't want to download and untar an entire package: http://answers.splunk.com/questions/12167
... View more
03-10-2011
09:22 PM
But for other non-indexing uses, such as on a search head, it is of vital importance.
... View more
03-09-2011
05:15 PM
It does not have anything to do with AD authentication, as boxes I'm working with use Splunk standard auth.
... View more
03-09-2011
05:14 PM
This bug evidently can also manifest itself as a crash on restart, so you may not notice it at first, but crash logs will accumulate in $SPLUNK_HOME/var/log/splunk/
... View more
03-08-2011
04:45 PM
As far as I know, once it is indexed, it is immutable. You can restrict access to the data via a role's search strings, and you can use | rex mode=sed ... to hide data at search time. Perhaps combine both to enforce a sed for a particular role?
... View more
03-02-2011
03:58 PM
Thanks - This link actually has a copy of the correct license for folks out there. Good to know it's a known bug.
... View more
03-01-2011
03:16 PM
The expiring license file starts with forwarder@splunk.com and the encrypted text began with RV7 . When the license was changed to splunk-forwarder.license from the 4.1.6 64-bit linux tgz package, the date went back to 2020-06-08 as expected (that file starts with forwarder@splunk.com and the encrypted text starts with JbX ).
... View more
03-01-2011
02:46 PM
2 Karma
At a few customers now I have seen a 1MB (forwarder) license with an expiration of early March. I'm not sure where this came from - was this a bug?
user@host $ bin/splunk show license
Current Daily Usage Amount: 0
Expiration date: 2011-03-08T01:07:37-0500
Expiration State: 7
License level: 1 MB
Product: Enterprise
License violations:
Max Violations:
Peak usage: 0 MB
Days remaining: 6 day(s)
Violation Period:
... View more
02-22-2011
07:50 PM
And also check the spec for the ability to set priority to override things as need be.
... View more
02-22-2011
06:58 PM
According to props.conf.spec, it seems that the literal will override the pattern/wildcard by default:
If not specified, the default value for the priority field for:
- pattern matching stanzas is 0
- literal matching stanzas is 100
... View more
02-22-2011
06:47 PM
1 Karma
I'm setting the timezone for hundreds of forwarders at once by using props.conf wildcards on host:
[host::DN*]
# Denver Hosts
TZ = America/Denver
However, there are a few hosts that have timezones mis-set. Will setting the following explicit entry in the same file (in etc/apps/theapp/local) override the above wildcard?
[host::DNSERVER9]
# Misconfigured to Central time
TZ = America/Chicago
If not, can I override by putting the setting in a different app, (earlier lexographically), such as etc/apps/appname/local?
... View more
- Tags:
- wildcards
02-17-2011
06:59 PM
2 Karma
It seems that MetaData:Host is only available at index time, for index-time transforms.
Use SOURCE_KEY = host when using the transform at search time.
... View more
02-17-2011
06:57 PM
I am trying to extract data from the Host field at search time, using a REPORT- in props.conf.
The extraction works when I use SOURCE_KEY = ComputerName , a field in the data that contains the host. But, this is only available in WinEventLog data, and I want it to apply to all hosts regardless of type of data.
I have tried SOURCE_KEY = MetaData:Host , but it does not work. What gives?
... View more
02-17-2011
06:31 PM
A transform to pull information from a hostname and add fields accordingly (where the entire company conforms to a naming convention) would be useful for this as well, so it applies to all data.
... View more
02-15-2011
03:54 PM
I just set one up for earliest -2d latest now time bounds and 0 1 * * * cron schedule.
... View more
02-15-2011
03:53 PM
1 Karma
Note: this search needs to be run over a two day period, to compare yesterday's results to today's.
... View more
02-02-2011
08:20 PM
I'm about to help a client get some data split into different sourcetypes from syslog, based on a facility code set by the device.
Assuming I turn on no_priority_stripping in the udp input, is there a more elegant solution than just regexing off of _raw to split this out? Or are facility/priority codes not pulled out at index time?
... View more
- Tags:
- sourcetype
- syslog
02-01-2011
03:25 PM
I have not been able to test this, but am going to mark this as accepted. If anyone is able to test this, please comment!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-07-2024
07:26 AM
|
Karma given to
| User | Karma Count |
|---|---|
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 3 |
