Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About Jason
Jason
Motivator
Member since:
05-13-2010
08-07-2024
Community Statistics
| Posts | 477 |
| Solutions | 60 |
| Karma Given | 93 |
| Karma Received | 586 |
| Member Since | 05-13-2010 |
Activity Feed
- Got Karma for Re: Deleting an Index from the fish bucket. 10-01-2024 12:52 PM
- Got Karma for Re: Comparing Multivalue Fields. 09-16-2024 12:34 PM
- Got Karma for Re: How do I create a field whose name is the value of another field? Like backticks or eval() in other languages.. 01-23-2024 10:11 PM
- Got Karma for Re: How do you chart a cumulative sum?. 01-20-2023 12:03 PM
- Got Karma for Re: How do I create a field whose name is the value of another field? Like backticks or eval() in other languages.. 09-14-2022 07:30 AM
- Posted Re: How do I remove all special characters from all field names? on Splunk Search. 07-28-2022 02:22 AM
- Posted How do I remove all special characters from all field names? on Splunk Search. 07-28-2022 02:13 AM
- Posted Re: Comparing Multivalue Fields on Splunk Search. 05-31-2022 08:59 AM
- Got Karma for Re: How to determine daily license usage in GB?. 03-04-2022 12:47 PM
- Got Karma for Re: How do I remove \x00 characters from my log message?. 01-23-2022 07:09 PM
- Got Karma for Re: How do I create a field whose name is the value of another field? Like backticks or eval() in other languages.. 11-30-2021 02:56 PM
- Got Karma for Add a comment to a search?. 11-29-2021 02:21 PM
- Got Karma for Re: How do I find the name of a scheduled search just from the RMD5?. 03-16-2021 11:40 PM
- Got Karma for Re: How do I create a field whose name is the value of another field? Like backticks or eval() in other languages.. 01-26-2021 02:13 PM
- Got Karma for Re: How do I create a field whose name is the value of another field? Like backticks or eval() in other languages.. 12-23-2020 04:23 AM
- Got Karma for Re: drilldown from a hidden column. 09-16-2020 11:07 AM
- Got Karma for Re: How do I create a field whose name is the value of another field? Like backticks or eval() in other languages.. 09-08-2020 08:47 AM
- Karma Re: Why does Splunk_TA_nix rlog.sh cause huge amount of duplicate audit events on Ubuntu? for dshakespeare_sp. 06-05-2020 12:47 AM
- Karma Re: When archiving to Hadoop using Hunk from an indexer cluster, is only the primary copy of a bucket archived, or are all copies archived? for hsesterhenn_spl. 06-05-2020 12:47 AM
- Karma Re: How to restart a SHC (search head cluster) at the server level? for mahamed_splunk. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 2 | |||
| 1 | |||
| 0 |
09-16-2010
02:41 AM
2 Karma
So, I was running ... | sistats count by host, source, sourcetype, field1, field2 and saving it to a summary index.
Then, I wanted to use the summary data to give me lists of hosts, sourcetypes, and sources. No problem, I looked at the summary data and found they were all stored in orig_ variables. (This rewrite only happens with host, source, and sourcetype.)
The problem came when I wanted to create a sum of all "count"s done by the original sistats. It was in a field called psrsvd_gc , but I couldn't use it. It wouldn't play nice and kept saying it was an internal field, or field was not available.
How do I get the sum from summary index data?
... View more
09-15-2010
10:11 PM
4 Karma
By default, Splunk will expand store=bar into (bar AND store=bar) . If bar doesn't exist in your event, the event will not be returned.
If this is because store is an extracted field or lookup-based field, tell Splunk to not search for the text in the event by editing fields.conf:
[store]
INDEXED_VALUE = false
... View more
09-15-2010
06:26 PM
6 Karma
Transforms.conf, underneath the stanza defining your lookup, case_sensitive_match = false
... View more
09-13-2010
08:11 PM
3 Karma
Hint: to get at Splunk's version of python, run the following:
$SPLUNK_HOME/bin/splunk cmd python
So, to test a script in it,
$SPLUNK_HOME/bin/splunk cmd python yourscript.py
... View more
I have a handful of scheduled searches that a client would like emailed. They want to see the results in the email and not have to log into Splunk. However, when I go in Email Alert Settings in the WebUI set Splunk to Include Results Inline = yes, no matter what Email Format I choose they still receive no results in their email, only a link.
The search is returning results, and is emailing because it is set to email when number of events > 0.
Please let me know what settings I should check, I think this is a stock 4.1.4 install.
... View more
09-08-2010
05:25 PM
As of 4.1.4, you can edit the subject line via the Web Manager interface at <splunk web address>/en-US/manager/search/configs/conf-alert_actions/email?action=edit
... View more
09-08-2010
05:20 PM
Blacklist should probably be blacklist = .inprogress$ to ensure it ignores files ending in dot inprogress. I don't think the .* or parentheses (capturing group) are necessary either.
... View more
09-07-2010
06:29 PM
There was a problem with auditd and setroubleshootd. I don't know what happened exactly, but I traced it to a misconfiguration with those spitting out 20MB+ logs every couple of seconds, and Splunk was trying to eat it. One of the system admins managed to fix it and unfortunately I don't know how.
I did up Splunk indexing performance by cleaning out tens of thousands of learned csv-nnnnn sourcetypes from the Learned app.
... View more
09-01-2010
09:17 PM
I doubt it, I know Splunk checks for SELINUX on startup and it hasn't complained.
... View more
09-01-2010
08:49 PM
Ouch, I guess I hadn't noticed HOW slow it was at batch input: it seems like it's doing ~5 files per minute...
... View more
09-01-2010
08:31 PM
I'm working on a box right now that seems to be unnecessarily slow at both searching as well as indexing from a batch folder (files have been in there for hours and haven't been deleted yet).
One odd thing I noticed is that auditd is taking 95-110% CPU, splunkd is taking 100-175% CPU, and there's another process, setroubleshootd around 90-95%.
This is an 8-3Ghz core box, so I'm not worried about the over 100% measurements from the top command, but with auditd taking so much CPU, is it perhaps conflicting with Splunk, similar to having an antivirus system on Windows monitoring Splunk's data directories?
... View more
- Tags:
- performance
09-01-2010
07:56 PM
If batch follows the same logic as monitor, if you put the same file into a batch input twice, will you have to change crcSalt to make Splunk eat the file again?
... View more
08-24-2010
05:35 PM
1 Karma
This has been complained about, tested, and found to not work by Splunk support. A bug (SPL-29475) has been filed. http://answers.splunk.com/questions/5311/multi-level-nav-menu-wont-open
Let's hope it gets fixed (or at least set so an error message shows) soon.
... View more
08-24-2010
05:32 PM
This is unfortunate, as it half-appears to work without giving an error. But thanks for testing it out for us!
... View more
08-24-2010
05:30 PM
As for testing, nope. The client wants it, but I don't know if we have access to any "typical" servers that are not production. I doubt my laptop would be a similar enough environment to their servers.
... View more
08-24-2010
05:29 PM
True, I assume they don't want to index the files, so let's go with that.
... View more
08-24-2010
05:08 PM
For reference, C:\windows just on my laptop is 5.2 GB, almost 25,000 files, and 2100+ folders. Who knows how often files in it are changed.
... View more
08-24-2010
05:06 PM
1 Karma
Has anyone put into production an input stanza that runs an fschange on all of C:\windows?
A) what is the performance impact, if any, that was noticed on the host running this fschange?
B) This will be run on a light forwarder. If anyone is doing C:\windows fschange on a light forwarder successfully (despite the SPL-25294 bug) please let me know!
... View more
08-24-2010
04:59 PM
It sounds as if there is a bug with light forwarder and fschange. From Known Issues at http://www.splunk.com/base/Documentation/latest/ReleaseNotes/Knownissues : When configuring file system change monitor (fschange) on a forwarder, if signedaudit = true and index=_audit are not explicitly set, fschange events do not get forwarded. (SPL-25294) Also in Answers http://answers.splunk.com/questions/2882/using-fschange-to-monitor-windows-filesystem
... View more
08-12-2010
07:21 PM
Is HP-UX 11i v1 supported by Splunk? The download page only lists v2 and v3.
... View more
- Tags:
- hp-ux
08-11-2010
10:08 PM
1 Karma
Sounds like a bug - file a ticket with splunk support?
... View more
08-10-2010
10:31 PM
1 Karma
According to gkanapathy, it is not possible. You need to use DNS round-robin or a load-balancer.
... View more
08-10-2010
10:26 PM
If regex in these whitelists are anything like the regexp in stanza names, there was a bug in the docs. . means dot, * means anything but slash (meaning filenames only) and ... (three dots) means anything, your usual regex .*
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-07-2024
07:26 AM
|
Karma given to
| User | Karma Count |
|---|---|
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 3 |
