Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About the_wolverine
the_wolverine
Champion
Member since:
01-14-2010
11-24-2025
Community Statistics
| Posts | 994 |
| Solutions | 187 |
| Karma Given | 1004 |
| Karma Received | 956 |
| Member Since | 01-14-2010 |
Activity Feed
- Got Karma for Re: BUG: tstats not displaying latest time modifier correctly. 04-19-2025 10:52 AM
- Got Karma for Re: How do I reload authentication from CLI?. 01-17-2025 12:00 PM
- Got Karma for Re: Question about "run as" (Owner or User ) for saved searches. Missing in version 7.. 05-16-2024 05:58 AM
- Got Karma for Re: Someone else configured field extractions, but I would like to delete some of them. Where do I find them?. 01-18-2024 12:12 PM
- Got Karma for Re: What are the minimum capabilities needed to modify and push config change from Deployment Server?. 07-02-2023 01:36 AM
- Got Karma for Re: Is there a way to accurately measure data model acceleration disk usage via Splunk?. 03-07-2023 11:51 PM
- Got Karma for Re: Question about "run as" (Owner or User ) for saved searches. Missing in version 7.. 01-20-2023 07:43 AM
- Karma Re: Why would Splunk NOT obey "dispatch.ttl" and delete results/artifacts early? for matthewhasty. 12-20-2022 01:19 PM
- Got Karma for Re: Autostart Splunk on boot. 12-09-2022 05:46 AM
- Got Karma for Re: Perform two lookups with same table and two different lookup fields?. 11-21-2022 04:47 AM
- Got Karma for Re: How to determine daily license usage in GB?. 11-08-2022 02:37 PM
- Karma Re: Can i assign a color to a string in a field if it is present in the field ? for varun99. 11-03-2022 09:57 AM
- Got Karma for Re: Getting error "Streamed search execute failed because: JournalSliceDirectory: Cannot seek to 0" when running a search. 10-01-2022 04:25 AM
- Got Karma for Re: Multiple SEDCMDs. 06-29-2022 11:41 AM
- Got Karma for Re: How to efficiently calculate max events per second (eps) by hour over long timeranges, like 30 days?. 05-31-2022 02:54 PM
- Got Karma for Splunk alert reply-to field doesn't exist?. 04-28-2022 02:13 PM
- Got Karma for BEWARE: srchFilter usage may negate each other in certain situation.. 04-28-2022 02:11 PM
- Got Karma for What is the correct earliest_time format for searches when programmatically querying Splunk?. 04-28-2022 02:07 PM
- Got Karma for Re: What is the correct earliest_time format for searches when programmatically querying Splunk?. 04-28-2022 02:07 PM
- Got Karma for Re: Is there any way to get Splunk to replicate Search History in a Search Head Cluster?. 04-28-2022 02:06 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-30-2010
11:28 AM
Muebel, Thanks for catching that! I've corrected the doc so we don't have anymore confusion: http://www.splunk.com/base/Documentation/4.1.1/Admin/Whatsanapp#Bypass_the_Launcher_for_all_users
... View more
04-30-2010
11:00 AM
1 Karma
This error points to an issue with referrals in AD. Splunk currently does not support LDAP referrals and a workaround is documented. Refer to the top of the LDAP configuration section of our document for a pointer to the workaround.
The problem may be that your configuration is too broad and thus triggers AD referrals. Oftentimes, you can sidestep this specifying a more specific DN and using LDAP filters.
If that doesn't work you may need to resort to using the AD GC (Global Catalog) port (if implemented.)
... View more
04-30-2010
10:54 AM
In configuring Splunk to use LDAP, I'm seeing the following error in splunkd.log:
ERROR authenticationManagerLDAP - Text
'000004DC: LdapErr: DSID-0C0906DD,
comment: In order to perform this
operation a successful bind must be
completed on the connection., data 0,
v1771
I've provided a valid bindDN and password so what is the problem? I'm unable to see any users/groups in Splunk.
... View more
04-30-2010
09:28 AM
1 Karma
Jobs that are run as "splunk-system-user" are scheduled searches with no owner specified. If you need to specify an owner for these jobs, refer to the following answer.
... View more
04-29-2010
07:52 PM
SavedSplunker errors were converted to WARN in later versions of 4.0. You can re-enable logging at the INFO level by adding the following to your etc/log.cfg under [splunkd]:
[splunkd]
category.SavedSplunker=INFO
If you've got lots of scheduled searches this will result in a noisy splunkd.log.
In 4.1 we change the default logging to INFO and give it its own logfile: scheduler.log.
... View more
04-29-2010
07:46 PM
INFO SavedSplunker - Found 2 scheduled saved searches
INFO SavedSplunker - About to run saved search: 'admin;search;badger', next run: Thu Apr 29 12:43:00 2010, trigger_actions=1
INFO SavedSplunker - setting ttl=120 for savedsearch_ident="admin;search;badger"
INFO SavedSplunker - dispatched search for savedsearch_id="admin;search;badger"
INFO SavedSplunker - Saved search 'admin;search;badger' next run time set to: "Thu Apr 29 12:44:00 2010"
INFO SavedSplunker - changing ttl of sid=scheduler_admin_search_badger_at_1272570180_1230566965, new_ttl=86400
INFO SavedSplunker - AlertNotifier ran notifications=1, actions=1, managedSearchCount=0
It used to be that I could see my scheduled search runs in splunkd.log like above. This was very useful for debugging. What happened to them?
... View more
04-27-2010
11:25 PM
2 Karma
This is well documented in the configuring custom segmentation portion of our doc.
... View more
04-27-2010
11:20 PM
I want to change the default UI segmentation behavior for a certain sourcetype. How can I do this?
... View more
- Tags:
- segmentation
- ui
04-26-2010
09:35 PM
You just lost reputation point for doing that.
... View more
04-26-2010
08:54 PM
1 Karma
There is an additional configuration required when you have an extraction configured to pull a value out of a subtoken. Its a simple edit to fields.conf:
[field_name]
INDEXED=False
INDEXED_VALUE=False
Note that this may impact search performance for this particular field.
... View more
04-26-2010
08:52 PM
3 Karma
I have a search-time field extraction that shows up in my pick fields list and everything. The fields list is showing an event count for values that occur for that field. However, when I click on the field value, it returns 0 events.
My search-time extraction REGEX pulls out a portion of the token to return as a value. So, in my raw event, I have a token like a12345b where the value is actually 12345.
What is the problem?
... View more
04-23-2010
03:57 PM
If this isn't working for you still, please feel free to file a support ticket. I'm sure its just some type of misconfiguration.
... View more
04-22-2010
09:19 PM
Ok, I didn't realize that there was a separte auto setting. The spec file indicates that "Specifying "auto" or "auto_high_volume" will cause Splunk to autotune this param based on your system (Recommended)"
A value of 100 (or 10GB) does not sound like there's any "auto" tuning going on here.
"
... View more
04-22-2010
06:30 PM
1 Karma
Actually, memPoolMB is not related to bucket size, but memory pool allocation.
maxDataSize determines the size of your buckets. On 64-bit architecture, a setting of auto_high_volume will give you a bucket size of 10GB. On 32-bit, this is 750MB.
... View more
04-22-2010
03:58 PM
10 Karma
By default, Splunk displays your search results from most recent to oldest. You can reverse the order by appending your search with '| reverse'. For example:
sourcetype=foo | reverse
... View more
04-22-2010
03:57 PM
3 Karma
Got this question today from someone who needs to reverse the order of the search results for their troubleshooting purposes.
... View more
- Tags:
- search-tip
04-21-2010
10:21 PM
1 Karma
If you contact your account rep you will be able to speed up your request. Support funnels requests for reset licenses back to the account rep before issuing the license (or not.)
Or, cc your account rep on the support request for a reset license.
... View more
04-21-2010
09:40 PM
13 Karma
The obvious reason for this error is that port 514 is already in use on the Splunk Host. Splunk is unable to listen on a port that is already in use by another application.
Disable whatever application is listening on port 514 (syslog?).
... View more
04-21-2010
09:38 PM
6 Karma
Got this question today that would be useful to answer here:
I'm trying to set up Splunk to accept syslog data from my Cisco routers. When I do so, by attempting to add a data input for UDP port 514, I receive the following error:
Encountered the following error while trying to save: In handler 'udp': UDP port 514 is not available.
... View more
04-21-2010
05:18 PM
1 Karma
You can change the format system-wide by editing the alert_actions.conf file. The out-of-box default in version 4.1 is html:
# Specify the format of the text in the email as either:
# html, raw, csv, plain. Remember that results are always attached in csv format
#
format = html
... View more
04-21-2010
04:55 PM
4 Karma
Once you've cleaned up the existing data, you can set up a transform to route all its events to nullQueue in the event it decides to send again.
props.conf:
[host::the_bad_host]
TRANSFORMS-nullhost = nullhost
transforms.conf:
[nullhost]
REGEX=.
DEST_KEY = queue
FORMAT = nullQueue
... View more
04-21-2010
04:33 AM
1 Karma
You mentioned syslog-ng. Assuming your host is the path for monitor input, you should be able to do this by setting the following on your LWF:
[monitor:///syslog-ng/path/.../logs]
host_segment = 3
So if you have a path like /var/log/192.168.9.1/ events will be set to host=192.168.9.1
Without this setting, you can't use your current props configuration.
This will set the host field for your syslog-ng events and allow the props/transforms on the indexer to do their job.
... View more
04-20-2010
02:24 AM
Yes - good point GK. I've updated my example now. Thanks.
... View more
04-19-2010
11:38 PM
1 Karma
In Splunk 4.1, LDAP/Scripted Auth is done side-by-side with SplunkAuth. Enable Radius authentication and you can still create Splunk users.
Enjoy!
... View more
04-19-2010
10:51 PM
1 Karma
I have a simple case where I want to see if the value of one field has shown up as the value of another field.
rec=dns a=3.4.2.3
rec=dns a=5.1.2.3
rec=tcpsession server=5.1.2.3
rec=tcpsession server=3.4.2.3
rec=tcpsession server=6.3.2.4
rec=tcpsession server=5.6.7.8
intended search: (show me rec=tcpsession events in which server=(some value that has shown up as the value of "a" in a "rec=dns" event)
intended results:
rec=tcpsession server=5.1.2.3
rec=tcpsession server=3.4.2.3
transaction seems to be one way, but i'm looking for a simpler search structure that doesn't require rex.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-24-2025
08:16 AM
|
Karma given to
