Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About the_wolverine
the_wolverine
Champion
Member since:
01-14-2010
11-24-2025
Community Statistics
| Posts | 994 |
| Solutions | 187 |
| Karma Given | 1004 |
| Karma Received | 956 |
| Member Since | 01-14-2010 |
Activity Feed
- Got Karma for Re: BUG: tstats not displaying latest time modifier correctly. 04-19-2025 10:52 AM
- Got Karma for Re: How do I reload authentication from CLI?. 01-17-2025 12:00 PM
- Got Karma for Re: Question about "run as" (Owner or User ) for saved searches. Missing in version 7.. 05-16-2024 05:58 AM
- Got Karma for Re: Someone else configured field extractions, but I would like to delete some of them. Where do I find them?. 01-18-2024 12:12 PM
- Got Karma for Re: What are the minimum capabilities needed to modify and push config change from Deployment Server?. 07-02-2023 01:36 AM
- Got Karma for Re: Is there a way to accurately measure data model acceleration disk usage via Splunk?. 03-07-2023 11:51 PM
- Got Karma for Re: Question about "run as" (Owner or User ) for saved searches. Missing in version 7.. 01-20-2023 07:43 AM
- Karma Re: Why would Splunk NOT obey "dispatch.ttl" and delete results/artifacts early? for matthewhasty. 12-20-2022 01:19 PM
- Got Karma for Re: Autostart Splunk on boot. 12-09-2022 05:46 AM
- Got Karma for Re: Perform two lookups with same table and two different lookup fields?. 11-21-2022 04:47 AM
- Got Karma for Re: How to determine daily license usage in GB?. 11-08-2022 02:37 PM
- Karma Re: Can i assign a color to a string in a field if it is present in the field ? for varun99. 11-03-2022 09:57 AM
- Got Karma for Re: Getting error "Streamed search execute failed because: JournalSliceDirectory: Cannot seek to 0" when running a search. 10-01-2022 04:25 AM
- Got Karma for Re: Multiple SEDCMDs. 06-29-2022 11:41 AM
- Got Karma for Re: How to efficiently calculate max events per second (eps) by hour over long timeranges, like 30 days?. 05-31-2022 02:54 PM
- Got Karma for Splunk alert reply-to field doesn't exist?. 04-28-2022 02:13 PM
- Got Karma for BEWARE: srchFilter usage may negate each other in certain situation.. 04-28-2022 02:11 PM
- Got Karma for What is the correct earliest_time format for searches when programmatically querying Splunk?. 04-28-2022 02:07 PM
- Got Karma for Re: What is the correct earliest_time format for searches when programmatically querying Splunk?. 04-28-2022 02:07 PM
- Got Karma for Re: Is there any way to get Splunk to replicate Search History in a Search Head Cluster?. 04-28-2022 02:06 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-19-2010
10:17 PM
1 Karma
Splunk does not currently provide any support for LDAP failover.
We do have a site that has worked around this by creating a VIP on an F5 load balancer that front-ends several AD global catalog servers.
... View more
04-19-2010
07:28 PM
5 Karma
Size Limit Exceeded is an LDAP server error indicating that the search request was unable to return all entries due to a limit. The problem encountered is that the users or groups you are looking for may have been in the 1001+ entries and are not being returned.
In AD, the default size limit is typically 1000 entries. The LDAP server error is usually followed by an error indicating the number of entries returned which is a few entries less than the actual size limit. There is nothing you can do to change this limit unless you are the LDAP server administrator.
In Splunk, you can use filters to reduce the number of LDAP entries returned so that you do not hit this limit.
... View more
04-19-2010
07:23 PM
3 Karma
I'm trying to configure LDAP and am hitting the following error:
ERROR ScopedLDAPConnection - Search for DN 'CN=Users,DC=Domain,DC=Com' gave error: Size limit exceeded
What does this error mean?
... View more
Labels
- Labels:
-
LDAP
04-19-2010
11:45 AM
2 Karma
The behavior you're describing sounds like a bug. You've specified a whitelist by naming the log file in your monitor input. Please file a support ticket.
In the meantime, you should be able to use a single monitor input in conjunction with props.conf to get this to work:
inputs.conf:
[monitor:///app/ems-store-uat/uat/.../config]
_whitelist = (topics\.conf|queues\.conf)$
props.conf:
[source::.../topics.conf]
sourcetype=ems_topics
[source::.../queues.conf]
sourcetype=ems_queues
... View more
04-16-2010
10:43 PM
3 Karma
The Australian locale, en_AU, does not ship with Splunk but since its exactly the same as en_GB you can do the following:
- cd to $SPLUNK_HOME/lib/python2.6/site-packages/splunk/appserver/mrsparkle/locale/
- cp -R en_GB en_AU
- restart Splunk
Your users who have their browsers set to en_AU should now see the correct date format.
... View more
04-16-2010
10:40 PM
1 Karma
We need to get Splunk to display date formats using the Australian format of dd/mm/yyyy rather than the US format which will confuse users.
I have my browser set to en_AU as it's default language but Splunk doesn't seem to be picking it up. I can get it to use en_GB since Great Britain has the same date format but we can't have all users change their browser language to en_GB just for Splunk.
... View more
04-16-2010
09:19 PM
16 Karma
You can search for your unwanted events and then pipe them to delete. For example:
sourcetype=wantedsource | delete
It's a good idea to search for your events first and confirm that these events are the correct events.
Important notes:
The user running this command must have the delete capability or be assigned the can_delete role.
This command does not reclaim disk space. It merely masks the deleted events so that they are not returned as part of search results. To reclaim disk space, you need to clean the index -- if all of your unwanted data is in one index then you can simply clean that index. Or, set an automatic archival policy to, eventually, expire your data automatically but then you'll have wait for the trigger (size or age.)
... View more
04-16-2010
09:13 PM
10 Karma
I have some data in my index that I don't want. How can I get rid of them?
... View more
04-16-2010
05:31 AM
You can contact [email protected] for any docs issues.
... View more
04-15-2010
05:30 PM
4 Karma
When a user creates and schedules a saved search, that search gets created in some app context and ownership of this search is specified in the user's Splunk directory ($SPLUNK/etc/users///local/savedsearches.conf).
In the case stated here, you want to package a saved search with your app that already has an owner specified. If you just create a saved search and schedule it in the app, it'll run without an owner. Without an owner, the scheduled search is run via the splunk-system-user account which has its own quota limits.
In order to specify an owner, do the following:
Create the saved search in someapp/default/savedsearches.conf:
[Errors in the last 24 hours]
search = error OR failed OR severe "more search terms"
dispatch.earliest_time = -1d
...
etc.
Then you'll specify the owner per saved search in the someapp/metadata/default.meta file:
### SAVED SEARCHES
[savedsearches/Errors%20in%20the%20last%2024%20hours]
access = read : [ * ], write : [ admin ]
owner = admin
... View more
04-15-2010
05:08 PM
2 Karma
In version 4.0, the general consensus is DO NOT USE usePersistentQueue. Further, Splunk has documented that the feature is deprecated. The default behavior (in 4.0) is that, when a forwarder loses its connection to the indexer for whatever reason, it will block continuously instead of writing to disk. For UDP/syslog inputs, this means any events forwarded during the time that queues are blocked will be dropped.
If the concern is prevention of data loss, you should consider going to TCP input and using flat files (e.g. syslog-ng).
Be forewarned that a usePersistentQueue-enabled configuration will require very careful planning as it is heavily dependent on hardware resources. You will be responsible for fully testing this configuration before Production implementation. If you still choose to go this route, be aware of the scenario where, if queues are blocked and the Splunk forwarder is writing to disk, you cannot restart the forwarder until the "issue" is resolved or events will be lost.
... View more
04-15-2010
04:22 PM
3 Karma
I've written a bunch of scheduled searches for a Splunk app. The searches appear as having no owner. How can I specify an owner for these scheduled searches?
In order to be able to control the quota for these searches, I need to assign an owner. Otherwise, the quota is that assigned to splunk-system-user.
I need to package the app so the configuration must exist within the app context.
... View more
04-15-2010
03:58 PM
2 Karma
What are the gotchas to configuring this other than what is documented in this Splunk Wiki article which states that this should NOT be configured in version 4.0 and later except for very specific use cases (contact Support)?
... View more
04-14-2010
11:08 PM
No, a search peer does not have to be configured to use distributed search. It must, however, be distributed search-enabled so that other peers can add it.
... View more
04-14-2010
04:18 AM
This sounds the same as THIS answers issue.
... View more
04-14-2010
04:10 AM
1 Karma
And I talk to myself.
... View more
04-14-2010
03:44 AM
2 Karma
My understanding is that this is now done via a splunk config file. How?
... View more
04-13-2010
05:39 PM
You should use the host_segment setting in your inputs.conf. It looks like this might be the same issue addressed in the following answers post.
... View more
04-13-2010
01:25 PM
4 Karma
RTSearch, real-time search, is in 4.1 and replaces its predecessor, LiveTail.
... View more
04-13-2010
01:22 PM
2 Karma
Livetail was around in version 3.x and went away in 4.0. When is it coming back?
... View more
04-13-2010
12:02 PM
1 Karma
Hi Dragan,
If you configure for this input, set host = segment in path, it should automatically figure out your syslog hosts. Since the input has already been created you won't be able to edit it from the UI. However, you can modify the monitor input directly in $SPLUNK_HOME/etc/.../local/inputs.conf:
[monitor:///var/log/HOSTS]
host_segment = 5
sourcetype = syslog
... View more
04-13-2010
11:48 AM
7 Karma
Note that when scheduled search does not have an owner, it is run by splunk-system-user.
The splunk-system-user seems to have a hardcoded quota.
Therefore, you'll need to assign an owner/user to the scheduled search and specify a role for the user. This is because there isn't a way to set a per-user disk quota so you'll have to edit the role to increase this limit. Here are the defaults from $SPLUNK_HOME/etc/system/default/authorize.conf:
[role_admin]
srchDiskQuota = 10000
[role_power]
srchDiskQuota = 500
[role_user]
srchDiskQuota = 100
(System-wide default is 100 MB which will be applied to all roles where a srchDiskQuota is not specified)
Best way is probably to create a custom role and assign it to this user rather than edit the defaults for the canned roles. Create your custom role in $SPLUNK_HOME/etc/system/local/authorize.conf:
[role_quota]
srchDiskQuota = 5000
... View more
04-13-2010
11:29 AM
3 Karma
I'm running summary searches and the splunk-system-user keeps hitting a quota limit.
04-12-2010 16:50:28.436 ERROR SavedSplunker -
Maximum disk usage=10422MB quota=10000MB, reached. Search not executed.
SearchId=scheduler_nobody_myapp_custom_summary_searchname
I'm only running summary searches on this host so I want to give the splunk-system-user free reign. How can I increase the quota for just the splunk-system-user?
... View more
- Tags:
- quota
04-12-2010
08:13 PM
2 Karma
Another great (freeware) LDAP browser is Apache Directory Studio. You can download builds for OSX, Linux and Windows.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-24-2025
08:16 AM
|
Karma given to
