Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About sim_tcr
sim_tcr
Communicator
Member since:
08-08-2014
06-05-2020
Community Statistics
| Posts | 84 |
| Solutions | 3 |
| Karma Given | 5 |
| Karma Received | 12 |
| Member Since | 08-08-2014 |
Activity Feed
- Got Karma for Re: How to create a new index in index cluster (6.2.2). 01-12-2021 06:52 AM
- Karma Re: How to configure Splunk to use a field/column from a flat CSV file as the event timestamp? for woodcock. 06-05-2020 12:48 AM
- Got Karma for How to blacklist application event level "Information" on Windows 2012 servers?. 06-05-2020 12:48 AM
- Got Karma for Re: How to blacklist application event level "Information" on Windows 2012 servers?. 06-05-2020 12:48 AM
- Got Karma for Re: How to blacklist application event level "Information" on Windows 2012 servers?. 06-05-2020 12:48 AM
- Got Karma for Re: How to subtract one field value from another field value for each event?. 06-05-2020 12:48 AM
- Got Karma for Re: How to subtract one field value from another field value for each event?. 06-05-2020 12:48 AM
- Karma Re: After migrating from a single search head to search head clustering, why have some user saved items under search context and global gone missing? for harsmarvania57. 06-05-2020 12:47 AM
- Karma Re: Is there any documentation to get started and set up the SplunkIT app? for jlin. 06-05-2020 12:47 AM
- Got Karma for Re: After migrating from a single search head to search head clustering, why have some user saved items under search context and global gone missing?. 06-05-2020 12:47 AM
- Got Karma for How to create a new index in index cluster (6.2.2). 06-05-2020 12:47 AM
- Got Karma for 6.2.2 search head cluster: how to manage roles (authorize.conf), ldap groups (authentication.conf) using deployment server (deployer). 06-05-2020 12:47 AM
- Got Karma for 6.2.2 search head cluster: how to manage roles (authorize.conf), ldap groups (authentication.conf) using deployment server (deployer). 06-05-2020 12:47 AM
- Got Karma for 6.2.2 search head cluster: how to manage roles (authorize.conf), ldap groups (authentication.conf) using deployment server (deployer). 06-05-2020 12:47 AM
- Got Karma for Using Splunk DB Connect 2 in a search head cluster, should database inputs originally set on the deployer be set to disabled or enabled?. 06-05-2020 12:47 AM
- Karma Re: how to parse an xml file as 1 event for chris. 06-05-2020 12:46 AM
- Karma Re: Hadoop Connect job error for sunrise. 06-05-2020 12:46 AM
- Posted Re: splunk event time and timestamp on log file is not matching. on Splunk Search. 02-27-2020 02:35 AM
- Posted splunk event time and timestamp on log file is not matching. on Splunk Search. 02-27-2020 02:23 AM
- Posted Re: How to add additional SPLUNK_COLD_DB path? on Deployment Architecture. 02-21-2020 01:28 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-13-2016
03:32 AM
Hello,
In our log, every new event starts with below pattern,
Sunday 2016-10-09 12:02:46,047 [tomcat-http--9]
Currently line breaking is not happening correctlly.
the props.conf on the indexer look like below,
[ecapi_log4j_2]
TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N
MAX_TIMESTAMP_LOOKAHEAD = 26
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)(?:\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2},\d{3})
TRUNCATE = 100000
Can some one help to fix it please?
Thanks,
Simon Mandy
... View more
- Tags:
- splunk-enterprise
10-07-2016
04:43 AM
It did not work
inputs.conf
[monitor://L:\Logs\csv\*.csv]
sourcetype = uow_fitcap_csv
index = sandbox
disabled = false
crcSalt=<SOURCE>
outputs.conf
[ uow_fitcap_csv ]
CHARSET=AUTO
INDEXED_EXTRACTIONS=csv
KV_MODE=none
SHOULD_LINEMERGE=false
category=Structured
disabled=false
pulldown_type=true
HEADER_FIELD_LINE_NUMBER=1
FIELD_DELIMITER=,
... View more
10-07-2016
04:17 AM
Hello,
I have a csv file in below format,
date,time,rundate
02/09/2016,00:00.0,02/07/2016
02/09/2016,00:00.0,02/07/2016
02/09/2016,00:00.0,02/07/2016
02/09/2016,00:00.0,02/07/2016
What should be the props.conf on indexers look like, so that each item in first row (separated by ,) should come as fields and items under that get indexed under that fields name?
Already tried,
[sourcetype-name]
INDEXED_EXTRACTIONS = csv
HEADER_FIELD_LINE_NUMBER = 1
HEADER_FIELD_DELIMITER = ,
Thanks,
Simon Mandy
... View more
- Tags:
- splunk-enterprise
07-14-2016
05:55 AM
How do i confirm that my forwarder not connecting to indexers using encrypted?
07-14-2016 08:53:08.462 -0400 INFO TcpOutputProc - Connected to idx=xx.xx.xxx.xx:9997 using ACK.
Thats the logs shows
... View more
07-13-2016
12:02 AM
2 Karma
I figured out myself.
| eval difference = elapsedMs - backendServiceMillis | table elapsedMs backendServiceMillis difference
... View more
07-12-2016
11:18 PM
Hello,
We have two fields: elapsedMs and backendServiceMillis. Both have only numeric values.
How can we display a new field which has the result of elapsedMs - backendServiceMillis?
Thanks,
Simon Mandy
... View more
07-12-2016
08:44 PM
I waited for 24 hours and there was no progress shown in master dashboard. So restarted master and within 5 minutes, all 3 turned green.
All Data is Searchable - Green
Search Factor - Green
Replication Factor - Green
But old server was still showing as "Decommissioning", So i went to old server and checked "splunk status" it showed it as running. Hence i issued "splunk stop"
waited for a while to turn master to show green on all. This time master dashboard showed old server status as "GracefulShutDown"
And then i ran "splunk remove cluster-peers -peers " from master.
All set now
... View more
07-12-2016
05:33 AM
All Data is Searchable - Green
Search Factor - Red
Replication Factor - Red
... View more
07-12-2016
05:24 AM
I am assuming you are asking for Search Factor and Replication Factor number from Bucket Status->Fixup Task Pending view.
Search Factor = 39
Replication Factor =39
... View more
07-12-2016
05:21 AM
I am waiting for old server to show as "GracefulShutDown" in master dashboard before i can run $SPLUNL_HOME/bin/splunk remove cluster-peers -peers from master to remove it from master's list
... View more
07-12-2016
05:09 AM
I initiated $SPLUNK_HOME/bin/splunk offline --enforce-counts on old indexer.
Our master dashboard shows "Decommissioning" against the old server. Its been 8 hours now.
Bucket status->Fixup Task Pending shows the count as 78. Its not reducing. status shows "Cannot fix search count as the bucket hasn't rolled yet."
Any thoughts?
... View more
07-11-2016
04:53 AM
So I need to,
run $SPLUNL_HOME/bin/splunk offline --enforce-counts from my old indexer.
run *$SPLUNL_HOME/bin/splunk remove cluster-peers -peers * from master to remove it from master's list as per http://docs.splunk.com/Documentation/Splunk/6.3.3/Indexer/Removepeerfrommasterlist
Is that correct?
... View more
07-11-2016
04:32 AM
The old indexer is still online and part of the cluster.
My thought was, being it part of cluster, the data on it can be still read by and eventually data get aged out and at that point remove it from cluster and offline it.
... View more
07-10-2016
11:40 PM
Hello,
We are on index clustering with version 6.3.3.
We have 6 indexers.
We manage the outputs.conf on our forwarders through an app called all_forwarder_outputs from deployment server . The app has the outputs.conf defined as below,
[tcpout:group1]
server=server1:9997, server2:9997, server3:9997, server4:9997, server5:9997, server6:9997
autoLB = true
useACK = true
We have replaced server1 indexer with server7. So i updated all_forwarder_outputs/local/outputs.conf by replacing server1 with server7 and pushed to all forwarders.
1) Even though we have restartSplunkd = true is defined on the serverclass all_deployment_clients, the forwarders did not get recycled. I had to restart them manually on all. (all forwarders received the updated outputs.conf) our serverclass is defined as below
[serverClass:all_deployment_clients:app:all_forwarder_outputs]
restartSplunkWeb = false
restartSplunkd = true
stateOnClient = enabled
[serverClass:all_deployment_clients]
whitelist.0 = *
2) Some of the forwarders are still sending data to old indexer server1. I have verified that those servers received new outputs.conf and no other copies of outputs.conf exist. I have recycled these forwarders several times. Verified that splunkd.log on the forwarder does not have Connected to idx=server1 ip message but has Connected to idx=server7 ip
Can some one help me on this please?
Thanks,
Simon Mandy
... View more
- Tags:
- splunk-enterprise
07-08-2016
06:32 AM
Hello,
Our indexer is getting full because of lot of old colddb data. I am checking the option of coldToFrozenDir and then delete the contents inside coldToFrozenDir. Right now I don't see any folder called frozendb in my indexer.
Should I also define coldToFrozenDir = $SPLUNK_COLD_DB/fens/frozendb to get older data moved there?
Below is sample from our indexes.conf
[fens]
repFactor=auto
homePath = $SPLUNK_DB/fens/db
coldPath = $SPLUNK_COLD_DB/fens/colddb
thawedPath = $SPLUNK_DB/fens/thaweddb
maxWarmDBCount = 10
frozenTimePeriodInSecs = 2592000
maxDataSize = auto_high_volume
# this index will exceed the default of .5TB requiring a change to maxTotalDataSizeMB
maxTotalDataSizeMB = 1100000
... View more
06-23-2016
12:38 AM
I ran the command only few got moved. Getting below error on some
Could not move /apps/splunk/var/run/splunk/dispatch/_splunktemps to /apps/old-splunk_dispatch/_splunktemps. Directory not empty
total: 2014, moved: 0, failed: 1, remaining: 2014 job directories from /apps/splunk/var/run/splunk/dispatch to /apps/old-splunk_dispatch
... View more
06-22-2016
02:42 AM
We are on search head clustering with 4 search heads and version 6.3.3.
Recently started seeing WARNING:
Too many search jobs found in the dispatch directory (found=3186, warning level=2000). This could negatively impact Splunk's performance, consider removing some of the old search jobs.
Can we run below command on all our search heads to clean it?
splunk cmd splunkd clean-dispatch /apps/old-splunk_dispatch -1d
Will this only clean 1 day old jobs, or can we safely run it with -7d?
... View more
06-07-2016
02:02 AM
Hello,
My source filed has value such as,
*/icsws/log/INSTANCE1/was/base/icsws_ca_server/SystemOut.log*
/icsws*/log/INSTANCE1/ihs/access_log
/wcics/log/INSTANCE1/ihs/access_log
...
...*
I would like to extract the first folder names (icsws*, wcics) from above to field named VAH.
can someone help me complete *| rex field=source ".."**
Thanks,
Simon Mandy
... View more
- Tags:
- rex
- splunk-enterprise
06-01-2016
12:31 AM
2 Karma
[WinEventLog://Application]
blacklist = Type="(Information)"
sourcetype = applicationerrors
disabled = 0
index = osgpp
disabled = false
crcSalt=<SOURCE>
Above fixed my issue
... View more
05-20-2016
01:27 AM
Tried below and made sure that forwarder was restarted after both changes. Still not working. Still getting Information events.
our server are windows 2012
[WinEventLog://Application]
blacklist = Type=0
sourcetype = applicationerrors
disabled = 0
index = osgpp
disabled = false
crcSalt=<SOURCE>
and
[WinEventLog://Application]
blacklist = Type=Information
sourcetype = applicationerrors
disabled = 0
index = osgpp
disabled = false
crcSalt=<SOURCE>
... View more
05-18-2016
12:43 AM
Tried below and made sure that forwarder was restarted after both changes. Still not working. Still getting Information events.
[WinEventLog://Application]
blacklist = EventType=0
sourcetype = applicationerrors
disabled = 0
index = osgpp
disabled = false
crcSalt=<SOURCE>
and
[WinEventLog://Application]
blacklist = EventType=Information
sourcetype = applicationerrors
disabled = 0
index = osgpp
disabled = false
crcSalt=<SOURCE>
... View more
05-12-2016
08:03 AM
But which one of them is correct?
I tried both.
Forwarders must have restarted whenever i deployed these. I pushed these through deployment server.
... View more
05-11-2016
05:35 AM
1 Karma
Hello,
How to blacklist application event Level "Information" on Windows 2012 servers.
Already tried:
[WinEventLog:Application]
blacklist = EventType=Information
sourcetype = applicationerrors
disabled = 0
index = osgpp
disabled = false
crcSalt=
[WinEventLog:Application]
blacklist = EventType=0
sourcetype = applicationerrors
disabled = 0
index = osgpp
disabled = false
crcSalt=
... View more
05-05-2016
06:19 AM
Hello,
I have a field where the user names are recorded. I want to display a timechart with total number of users for a day.
user
------
user1
user2
user5
user6
...
...
Please help me construct the search
index="_internal" sourcetype=splunk_web_access source="/apps/splunk/var/log/splunk/web_access.log"
Thanks,
Simon Mandy
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma from
