Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About vishaltaneja070
vishaltaneja070
Motivator
Member since:
03-09-2020
01-20-2022
Community Statistics
| Posts | 352 |
| Solutions | 30 |
| Karma Given | 0 |
| Karma Received | 69 |
| Member Since | 03-09-2020 |
Activity Feed
- Got Karma for Re: Renewing server.pem certificate. 06-12-2025 09:02 AM
- Got Karma for Re: Renewing server.pem certificate. 11-20-2024 07:52 AM
- Got Karma for Re: How do I retrieve the first and last date from each month?. 05-22-2024 06:59 AM
- Got Karma for Re: How to restart Universal Forwarder via the deployment server?. 01-23-2024 05:36 AM
- Got Karma for Re: How do I renew a Splunk forwarder's default certificate?. 09-19-2023 01:14 AM
- Got Karma for Re: Renewing server.pem certificate. 07-19-2023 08:57 AM
- Got Karma for Re: Can you help me with the following mongod kvstore error?. 04-05-2023 02:07 PM
- Got Karma for Re: What is the purpose of the sourcetype "stash_new"?. 12-02-2022 02:59 AM
- Got Karma for Re: Renewing server.pem certificate. 11-01-2022 11:11 AM
- Got Karma for Re: Renewing server.pem certificate. 09-29-2022 02:08 AM
- Got Karma for Re: Search factor vs Replication factor. 08-03-2022 06:58 AM
- Got Karma for Re: Renewing server.pem certificate. 07-12-2022 06:40 AM
- Got Karma for Re: How do I renew a Splunk forwarder's default certificate?. 03-10-2022 09:20 AM
- Got Karma for Re: Renewing server.pem certificate. 03-02-2022 07:20 AM
- Got Karma for Re: Renewing server.pem certificate. 03-02-2022 06:06 AM
- Got Karma for Re: Renewing server.pem certificate. 02-10-2022 03:39 AM
- Got Karma for Re: Splunk eval if with wildcard. 01-24-2022 06:19 AM
- Posted Re: Splunk DB connect connection to AWS Athena on Splunk Enterprise. 01-20-2022 01:39 AM
- Posted Splunk DB connect connection to AWS Athena on Splunk Enterprise. 01-19-2022 08:04 AM
- Got Karma for Re: Renewing server.pem certificate. 01-08-2022 08:36 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-03-2019
10:37 PM
Hello @orvarehn
Version details please?
... View more
02-03-2019
10:28 PM
@yutaka1005
Correct same rules as of stand-alone environment.
Thanks 🙂
... View more
02-01-2019
06:12 AM
@robertlynch2020
yes if the summarisation defined in your search range then it might take a little time to get data summarised. After that you can run search with summariesonly=true
... View more
02-01-2019
05:36 AM
@sboogaar
Don't get confused with the words, max runtime and max search result limit has been applied on subsearch so that, subsearch should not take a lot of time to run and block the main search to run.
... View more
02-01-2019
05:07 AM
yes it will count as 6 searches but not concurrent as it will run one by one not at a single which can cause a block. Thats why there is a max runtime and max search result limit on subsearch.
... View more
02-01-2019
05:06 AM
1 Karma
Hello @mindterrian,
For Linux server, this is recommended hardware requirement i.e. 12 Core CPU, 12Gb RAM. So it is better to go with this. You can use it for other apps as well like DB connect etc.
There is no need of any license if you already have enterprise license with you. Just add HF on the same pool of license it will work.
it is better to have HF in place for apps like OPSEC as you have better control and also you can do parsing on that server. I will recommand to a HF in place.
... View more
02-01-2019
04:58 AM
No, subsearch will run first and then the base search. But there is a catch: By default, subsearches return a maximum of 10,000 results and have a maximum runtime of 60 seconds. In large production environments, it is possible that the subsearch will timeout before it completes. The best option is to rewrite the query to limit the number of events that the subsearch must process.
... View more
02-01-2019
04:54 AM
@tcmarquesi
Welcome 🙂
... View more
02-01-2019
04:52 AM
Hello @sboogar
A historical search is a search that has a distinct time range, such as the past hour, the previous day, or "between 2 and 4 last Tuesday". Historical searches usually review data in the past, but you can set up these searches to review events with future-dated timestamps, if your index contains them.
In Limits.conf there are different parameter which can help you out. This is the formula which is used for this:
max_searches_per_cpu x number_of_cpus + base_max_searches = max_hist_searches
The default settings are base_max_searches = 6, max_searches_per_cpu = 1, max_searches_per = 50, and max_rt_search_multiplier = These settings can be changes using limits.conf but you need to be careful as it all depends on your hardware capability.
... View more
02-01-2019
03:14 AM
You can either run this search on License master or on SH if you have forwarded the _internal logs to Indexer layer.
As you need details with sourcetype, so metrices.log will also not help you.
... View more
02-01-2019
02:59 AM
@damucka,
Check if any issue with splunkd service at that time. Check for internal logs at that time.
... View more
02-01-2019
02:56 AM
@rakesh44
No i think that is event size on disk no the licensed size.
What is the error you are getting while running this command?
... View more
02-01-2019
02:52 AM
@vikas_baranwal
There is No logic behind it. As chart command need three axis for data showing. It will convert the command in different logic , so that the data can be visible better in any visualisation.
... View more
02-01-2019
02:27 AM
Hello @rakesh44
try this:
index=_internal source=*license_usage.log* type=Usage pool=* | eval GB=b/1024/1024/1024 | stats sum(GB) by st
... View more
02-01-2019
12:35 AM
Hello @vikas_baranwal
The difference start comes in pictures when you mention two or more fields in by clause in Splunk.
When you use stats count by a,b , it will created status based on the a & b which is visible easily in your search results.
But when it comes to chart command it doesn't follow the same process. Because you need to create a graph. the command will be identical to chart over a by b
in your case: | chart min(update) as qaStatusDateMin over key by Status
... View more
01-31-2019
11:47 PM
Hello @att35,
I dont think there is any issue with Splunk Version because i am using the same with no issues.
Please try the below steps:
1. First try to run the query directly, which i think you have already tried.
2. Then after that select checkpoint field and enter the value of checkpoint.
3. Then update the query to have checkpoint information: i.e. SELECT * FROM VIEW_NAME WHERE CHECKPOINT_VALUE > ? ORDER BY CHECKPOINT_VALUE
4. I think this will solve your issue.
... View more
01-31-2019
11:10 PM
Try this:
| makeresults | eval source="E:\\Apache\\apisit\\*" | eval site = if (source like "E:\A%",1,0) | eval api = if(source like "E:\Apache\a%",1,0)
... View more
01-31-2019
10:58 PM
Hello @danfinan
I think you can join command which can help you here: I am assuming, there is keyword field is common in index=web_filtering and high_risk_keywords lookup:
index="web_filtering" | join type=left keyword [ | inputlookup high_risk_keywords.csv | eval url="*".HighRiskWords."*" | fields url format keyword] | stats count by user url
if you want multiple matches then use max=0 as well with join.
... View more
01-31-2019
10:48 PM
@mandarpim: Are you looking something like this:
| makeresults | eval msd="12"
| append [| makeresults | eval msd="13"]
| append [| makeresults | eval msd="14"]
| append [| makeresults | eval msd="12"]
| fields - _time
|join max=0 msd [ | makeresults | eval msd="10"
| append [| makeresults | eval msd="14"]
| append [| makeresults | eval msd="14"]
| append [| makeresults | eval msd="14"]]
... View more
01-31-2019
10:36 PM
Hello @w199284
I think the issue here is Splunk try to achieve 90% rebalancing not fully 100%. If you want 100% rebalancing on both the sides, then you can achieve that as well using the below command:
splunk edit cluster-config -mode master -rebalance_threshold 1 -auth admin:your_password
The below link can help you better:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Indexer/Rebalancethecluster
... View more
01-31-2019
10:31 PM
Try this:
| makeresults | eval bigfix=1 | eval norton=1 | eval mcafee=0
| eval newbigfix=if(bigfix = 1,1,0)
| eval newnorton=if(norton = 1,3,0)
| eval newmcafee=if(mcafee = 1,6,0)
| eval search_score = newbigfix + newnorton + newmcafee
| eval search1 = if (search_score == 4, "index=bigfix IPAddress =198.168.1.25 | table IPAddress CompName MAC OS Manufacturer Model","")
... View more
01-31-2019
10:15 PM
Hello @yutaka1005,
The below formula works for all:
max_searches_per_cpu x number_of_cpus + base_max_searches = max_hist_searches
(max_searches_perc / 100) x max_hist_searches = max_hist_scheduled_searches
max_rt_search_multiplier x max_hist_searches = max_realtime_searches
The default settings are base_max_searches = 6, max_searches_per_cpu = 1, max_searches_per = 50, and max_rt_search_multiplier = 1 . These settings can be changes using limits.conf but you need to be careful as it all depends on your hardware capability:
((1 * 8) +6) = 14 = max_hist_searches per SH
3 * 14 = 42 = max search head cluster concurrency
((50 /100) * 14 ) = 7 = max_historical_scheduled_searches per SH
3 * 7 = 21 max search head cluster scheduled search concurrency
1 * 14 = 14 = max_realtime_searches per SH
3 * 14 = 42= max rt search head cluster concurrency
This Link can provide you better understanding:
https://docs.splunk.com/Documentation/Splunk/7.2.3/DistSearch/SHCarchitecture
Also, if captain feels the SHC is not able to handle that much jobs, it will start delaying or cancel the jobs automatically.
... View more
01-31-2019
10:05 PM
Hello @danieljackson
For High availability, you should have Search Head and Indexer Cluster in place. So that in case of any failure on Indexer side or search head side it can easily achievable through additional SH and Indexer.
Now lets discuss about your first concern: The best approach is to have a VIP enabled which can load balanced the load in case of any failure on indexer side. And in case of any issue with universal forwarder as the logs are getting stored in a file, so no need to worry once you fix the issue with universal forwarder, the logs will start moving from the same point itself so no duplication.
second concern: Mostly everyone has a single master server. And you are correct here, the logs will still be indexed without any concerns, just replication of buckets will be a issue for some time.
... View more
01-31-2019
06:50 AM
if you are using it with Db connect, then splunk direct database driver is available which can help you out better.
Try this:
https://jdbc.postgresql.org/
I have already tried this and working great with Splunk.
... View more
01-31-2019
05:51 AM
If it is really required, then you can do it with the help of configuration file as well. Which i think will be easy for you.
create new connection using db_connections.conf and identities.conf.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-20-2022
01:06 PM
|
