Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About las
las
Contributor
Member since:
12-05-2011
4 weeks ago
Community Statistics
| Posts | 141 |
| Solutions | 13 |
| Karma Given | 48 |
| Karma Received | 26 |
| Member Since | 05-12-2011 |
Activity Feed
- Posted Re: Configure Splunk Infrastructure Monitoring Add-on to give users access to sim command on Splunk Search. 4 weeks ago
- Got Karma for Re: Unable to create incident from Splunk in Service-Now using the add-on. 10-29-2024 03:34 AM
- Posted Configure Splunk Infrastructure Monitoring Add-on to give users access to sim command on Splunk Search. 10-18-2024 02:02 AM
- Tagged Configure Splunk Infrastructure Monitoring Add-on to give users access to sim command on Splunk Search. 10-18-2024 02:02 AM
- Posted Re: Configure Splunk Add-On for OpenTelemetry Collector to use HTTP_PROXY, without affecting other traffick on Splunk Observability Cloud. 10-14-2024 12:45 AM
- Karma Re: Configure Splunk Add-On for OpenTelemetry Collector to use HTTP_PROXY, without affecting other traffick for bishida. 10-14-2024 12:30 AM
- Posted Re: Configure Splunk Add-On for OpenTelemetry Collector to use HTTP_PROXY, without affecting other traffick on Splunk Observability Cloud. 10-09-2024 05:01 AM
- Posted Configure Splunk Add-On for OpenTelemetry Collector to use HTTP_PROXY, without affecting other traffick on Splunk Observability Cloud. 10-04-2024 12:05 AM
- Got Karma for Re: Event: Show source loading ..... 06-03-2024 04:52 PM
- Posted Re: Why doesn't a maintenance window in ITSI put the service in maintenance on Other Usage. 03-13-2024 06:49 AM
- Posted Why doesn't a maintenance window in ITSI put the service in maintenance on Other Usage. 03-13-2024 06:14 AM
- Karma Re: Why the ErrorCode 5 when trying to forward Sysmon logs (unable to subscribe)? for mawni. 03-07-2024 01:17 AM
- Posted Re: Splunk Secure Gateway Connect to SAML IdP on All Apps and Add-ons. 11-15-2023 06:38 AM
- Posted Re: Anybody knows about {@fieldname} in a join on Splunk Search. 10-17-2023 11:37 PM
- Karma Re: Anybody knows about {@fieldname} in a join for gcusello. 10-17-2023 11:37 PM
- Posted Anybody knows about {@fieldname} in a join on Splunk Search. 10-17-2023 11:11 PM
- Tagged Anybody knows about {@fieldname} in a join on Splunk Search. 10-17-2023 11:11 PM
- Posted Splunk Secure Gateway Connect to SAML IdP on All Apps and Add-ons. 07-25-2023 05:04 AM
- Tagged Splunk Secure Gateway Connect to SAML IdP on All Apps and Add-ons. 07-25-2023 05:04 AM
- Posted How to maintain ITSI Entity information field using the rest API from python? on Splunk ITSI. 02-24-2023 06:31 AM
09-27-2016
07:06 AM
I was notified that Splunk 6.5.0 was released, and decided to upgrade my sandbox.
I have Splunk App for Windows Infrastructure 1.3.0 installed, and after the Splunk upgrade it doesn't load table views in the app.
Have anybody else tried this yet, and if you have, did you have to tweak the installation?
Kind regards
las
... View more
08-09-2016
11:19 PM
Thanks, that was my guess too, but it is good to have it confirmed.
... View more
08-09-2016
06:36 AM
Hi.
I guess I might allready know the answer, but just to be sure.
Is it possible to deploy Splunk_TA_Stream on an Universal Forwarder running on a 32 bit windows 7 machine and get some data?
Kind regards
las
... View more
05-18-2016
03:12 AM
1 Karma
I have a log with statistics from mq containing some key values (time, MQmanager, Queuename) and some variables (number of messages added, number of messages removed and largest queue size).
If I do a search over time
sourcetype=MQResetStat (mqmanager=MQP) queue=* | dedup _raw | timechart sum(deqcount)
I see a line where over time, more and more messages are pushed thru the system.
How do I create a search that tells me which queues are responsible for the increased number of messages?
I could of course just add by queue to the above search, but either the rise is hidden in "other" or there are to many queues to make the graf readable.
Ideally I would want just the 10 queues with the largest difference between the start and end period of the search, but still graphed over time with the sum of deqcount as the variable.
I could also do a subsearch, where I find the 10 queues, and then do the original search on top of that, but that might not be feasable due to time limit on subsearches.
I have tried looking for something similar, but apparently is not able to frame my search, so anything useable surfaces.
Any help is much appreciated.
kind regards
... View more
04-20-2016
03:35 AM
2 Karma
As dmr195 I upgraded to Splunk 6.4.0, and regenerated the server certificate, and that solved tho problem for me.
... View more
04-07-2016
01:13 AM
Hi.
After having enabled introspection_generator_addon on a Universal Forwarder on AIX, I get data for partion and FishBucket, but not on Perprocess, Hostwide, or Dispatch. My Universal Forwarder is version 6.3.3, and the app has been enabled using CLI on the AIX host. After enabling, the UF has been restarted.
Are there any other out there having the same problem, and have found a work around?
I do not have access to the AIX machine, and have almost no knowledge about AIX.
Kind Regards
Lars
... View more
10-29-2015
12:24 AM
1 Karma
Would it be possible for you, to share your app?
That way others might benefit, and won't have to start from scratch.
kind regards
... View more
10-19-2015
05:45 AM
I don't really want to disable SSL for Splunk, and I don't think that is the issue.
If I stop Splunkd, and delete the kvstore folder, I don't get the SSL errors, but mongod is stil unable to start. The only difference is, that it doesn't start with anything in mongod.log - absolutely no entries in that log.
... View more
10-07-2015
12:30 PM
You might want to look at _indextime for the events contained in those buckets too, that is a very good way to discover out-of-sequence data, though it is rather time consuming.
... View more
10-07-2015
11:50 AM
I think this might be a wrong tree to look at.
I tried running the same two commands on a working installation, on windows 2008 r8, with Splunk 6.3.0, where KVstore is working:
D:\Splunk\bin>splunk validate files
Validating installed files against hashes from 'D:\Splunk\splunk-6.3.0-aa7d4b1ccb80-windows-64-manifest'
Could not open 'D:/Splunk/bin/mongod_legacy.exe': The system cannot find the file specified.
File 'etc/splunk-launch.conf.default' changed or missing.
D:\Splunk\bin>splunk cmd mongod --version
db version v3.0.3-splunk
git version: f0547c3bbc1fc8eb4325ce6c158edfe4ef45733f
OpenSSL version: OpenSSL 1.0.2d-fips 9 Jul 2015
why etc/splunk-launch.conf.default has changed, I have no idea, but it is an exact match to etc/splunk-launch.conf, and the change from "default" is a relocation of SPLUNK_DB.
I am not really comfortable wit reinstalling Splunk, as far as I remember, it involves uninstalling, and then installing Splunk again - and then make sure all configurations are back in order - yes, I can just make a backup of etc, but still... After all this is a production installation.
... View more
10-06-2015
11:27 PM
Of course.
D:\Splunk\bin>splunk cmd mongod --version
db version v3.0.3-splunk
git version: f0547c3bbc1fc8eb4325ce6c158edfe4ef45733f
OpenSSL version: OpenSSL 1.0.2d-fips 9 Jul 2015
D:\Splunk\bin>splunk validate files
Validating installed files against hashes from 'D:\Splunk\splunk-6.3.0-a
a7d4b1ccb80-windows-64-manifest'
Could not open 'D:/Splunk/bin/mongod_legacy.exe': The system cannot find the fil
e specified.
File 'etc/splunk-launch.conf.default' changed or missing.
D:\Splunk\bin>
... View more
10-06-2015
07:15 AM
Sorry, I should have mentioned, it is on Windows 2008 R2 64 bit.
So I just ran the MSI file to upgrade.
As I mentioned, there were problems due to a diskexpansion, where the procedure was to make a copy of the folder containing the live indexes, in the service window, Splunk was stopped, and a last copy was made, the live disk was then renamed, and the new disk renamed to the old disks name.
That gives me a copy off the folder kvstore\mongod on the old live disk.
As there were problems with the copy being a copy, not a mirror (duplicate buckets), I had a cleaning job to do, and since Mongod did not start, I assumed it had similar problems.
We do not really use KVstore at the moment, so I deleted the folder, and let Splunk recreate it.
Now there are no entried in mongod.log, but it still fails to start.
So I tried to copy the "backup" back to the live folder, and I get the SSL errors, and it still wont start.
... View more
10-05-2015
11:47 PM
That is part of the problem, There are no entries in mongod.log.
If I copy the original kvstore into the current repository, I get some expired certificate errors:
2015-10-04T01:20:44.330Z W CONTROL No SSL certificate validation can be performed since no CA file has been provided; please specify an sslCAFile parameter
2015-10-04T01:20:44.330Z I CONTROL Hotfix KB2731284 or later update is not installed, will zero-out data files
2015-10-04T01:20:44.673Z I CONTROL dbexit: The provided SSL certificate is expired or not yet valid. rc: 2
But if I clear the kvstore, I get no entries what so ever.
... View more
10-04-2015
11:50 PM
3 Karma
I had to make a non clean upgrade to 6.3.0.
The disk Splunk has its indexes on had to be expanded, and the way it happened was, that a new disk was allocated, the indexes copied to the new disk over a period of time, and then in the service window, a final copy, and then rename the disks. The only problem was, it was a copy, not a mirror, so Splunk was unable to start due to duplicate buckets (hot buckets moved to warm - but not removed in the copy)
After the upgrade I have troubles with Mongod.
In the Splunkd.log I get the following:
10-04-2015 03:20:44.705 +0200 ERROR MongodRunner - mongod exited abnormally (exit code 2, status: exited with code 2) - look at mongod.log to investigate.
10-04-2015 03:20:55.328 +0200 ERROR KVStoreConfigurationProvider - Could not get pint from mongod.
10-04-2015 03:20:55.328 +0200 ERROR KVStoreConfigurationProvider - Could not start mongo instance. Initialization failed.
In Mongod.log I get nothing.
Anybody having any experiences with this?
kind regards
... View more
03-13-2015
12:17 PM
I agree with your notion, that it doesn't work, personally I considered using an eventstats, and still join the three types together.
What is more important is, that the query I pasted in the original question is used in the html, that is shipped with the app, so hopefully the guys working on Splunk app for windows infrastructure will see the post, so it might be corrected in the future, and until then its a head up, that Host Information might be incorrect in some cases.
... View more
03-13-2015
02:57 AM
Hi.
On windows machines with 2 or more cpu slots, the hostmon will return an event pr. slot. as seen by the following screenshot:
The problem is the way the search handles this, as it just makes a dedup by host:
{% searchmanager
id="computer-and-processor"
search='eventtype=hostmon_windows Type=OperatingSystem host="$Host$" | dedup host | eval OSArchitecture=Architecture | join host [search eventtype=hostmon_windows Type=Computer host="$Host$" | dedup host | eval ComputerManufacturer=Manufacturer] | join host [search eventtype=hostmon_windows Type=Processor host="$Host$" | dedup host]'|token_safe
autostart=False
%}
This will result in a grand total of 8 cores, not the 32, that actually is on the host.
kind regards
las
... View more
11-03-2014
11:58 PM
Thanks, that corresponds with my own findings.
... View more
11-03-2014
07:32 AM
1 Karma
@martin_mueller: Could you elaborate a little over the root cause.
I seem to get something about a trust relationship being broken between the primary domain and the trust domain. My translation might not be right, as this log is written in danish.
... View more
09-17-2014
03:13 AM
That is a workaround, yes - but it is not practical in our situation, where there is a lot of saved reports, with a timepicker, or dashboards with a timepicker. I'm not saying it is not possible to use the workaround, but it's not usable.
... View more
09-15-2014
07:09 AM
This looks like the same problem as this one
http://answers.splunk.com/answers/154984/why-time-range-picker-on-default-splunk-6-1-x-ui-shows-earliest-time-cannot-be-greater-than-latest-time-errors.html
Hopefully this will get fixed soon.
... View more
09-11-2014
01:53 AM
I agree with you on the flakiness, I am able to overtype the date, and pick it from the calender pop up, but when I press Apply, it reverses to 2001 again. Hopefully it will be resolved soon.
... View more
09-10-2014
06:41 AM
The problem, or a similar is also present, with the timepicker in the Search app.
If you choose "Date & Time Range", Splunk seems to do something strange with the values you picked, and in my case select a date in 2001, at a different time than I choose.
... View more
09-09-2014
02:01 PM
1 Karma
I didn't get the trick with adding a max to work alone, but when I added "| eval _txn_orphan=NULL" just before my second transaction it works like a charm.
I haven't tried without the max's.
... View more
09-04-2014
04:30 AM
The search is as follows:
eventtype=TWS_logs eventtype=TWS_job_events NOT (userID = "TWSD01" OR userID = "TWSP01") submitName=* NOT submitName=TWSON* (eventText="TWS_Job_Abend" OR eventText="TWS_Job_Failed" OR eventText="TWS_Job_Launched" OR eventText="TWS_Job_Done") | dedup _raw | eval label=submitName."-".jobNumber | timechart limit=0 first(jobNumber) by label
And what I end up with, is a result set like this:
Where the four arrows indicate the unique number, and a name wich is concatenated as a label
The end result is as follows:
The graph is rather large, so I have just taken a small portion.
... View more
09-04-2014
01:52 AM
The search button workd, when the criteria is changed, if it is just a refresh, there is a special refresh button, somewhere on the form.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
4 weeks ago
|
