Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About richnavis
richnavis
Contributor
Member since:
08-16-2017
06-17-2021
Community Statistics
| Posts | 113 |
| Solutions | 5 |
| Karma Given | 1 |
| Karma Received | 44 |
| Member Since | 08-16-2017 |
Activity Feed
- Posted Find count of repeat phone calls on Splunk Search. 06-16-2021 11:38 AM
- Karma Re: Line Breaker help for FrankVl. 06-05-2020 12:49 AM
- Got Karma for Extract fields using colon (:) except time field. 06-05-2020 12:49 AM
- Got Karma for Splunking custom windows performance counters. 06-05-2020 12:47 AM
- Got Karma for Splunking custom windows performance counters. 06-05-2020 12:47 AM
- Got Karma for Is there a way to monitor the number of files in the dispatch directory?. 06-05-2020 12:46 AM
- Got Karma for How is Max_size_kb determined. 06-05-2020 12:46 AM
- Got Karma for Using RDM vs VMFS for Virtual Machines. 06-05-2020 12:46 AM
- Got Karma for Using RDM vs VMFS for Virtual Machines. 06-05-2020 12:46 AM
- Got Karma for Scripted inputs fails on pooled search heads. 06-05-2020 12:46 AM
- Got Karma for Re: TZ offset in props.conf not working. 06-05-2020 12:46 AM
- Got Karma for Re: TZ offset in props.conf not working. 06-05-2020 12:46 AM
- Got Karma for Re: TZ offset in props.conf not working. 06-05-2020 12:46 AM
- Got Karma for Is there a Splunk OPSEC LEA for Check Point Technology Add-on that runs on Windows?. 06-05-2020 12:46 AM
- Got Karma for Is there a Splunk OPSEC LEA for Check Point Technology Add-on that runs on Windows?. 06-05-2020 12:46 AM
- Got Karma for Is there a Splunk OPSEC LEA for Check Point Technology Add-on that runs on Windows?. 06-05-2020 12:46 AM
- Got Karma for Is there a Splunk OPSEC LEA for Check Point Technology Add-on that runs on Windows?. 06-05-2020 12:46 AM
- Got Karma for Re: Is there a Splunk OPSEC LEA for Check Point Technology Add-on that runs on Windows?. 06-05-2020 12:46 AM
- Got Karma for Re: Is there a Splunk OPSEC LEA for Check Point Technology Add-on that runs on Windows?. 06-05-2020 12:46 AM
- Got Karma for Re: IMAP app : getting "endid" error : Rackspace mail server. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 |
05-09-2012
06:38 PM
More Info... I looked at a low indexing volume time (800MB/Indexer) and we still saw 28 indexqueue blocking event...
... View more
05-09-2012
06:25 PM
Aprox 30GBs/day... However, this even happens at substancially lower indexing volumes..
... View more
05-09-2012
06:16 PM
The interesting part is that if you look at disk queueing, disk response times and IOPs, there is not not much to indicate a disk bottleneck... Queueing is less than 1, RT is sub 20ms, and IOPS are less than 100... We tested the disks before installing splunk and we were able to reach upwards of 3000 IOPS... Of note.. these machines are virtualized, but are not sharing resources with other servers.. essentially dedicated from a Server AND SAN perspective...
... View more
05-09-2012
01:53 PM
Ok.. gonna answer some of this myself based on observation in my environment...
1. scheduler--this search has been invoked by the scheduler... duh!
2. rt--searches that are real time
3. remote-In a pooled search head environment, the search is dispatched for all pooled search heads, so, searches with the "Remote" prefix essentially indicates that the search is a spawned to a searchhead from the original search.
4. somenumber--haven't figured this one out yet.
5. Splunk01--this is a mistake.. there is no splunk prefix
6. username--this is a search spawned by a user
so.. just need to figure out what "somenumber" is.. then I'm good.. if anyone can help..that would be great.
... View more
05-09-2012
08:54 AM
Thanks.. This worked nicely for me... I wasn't aware that you could run any search by specifying /flashtimeline?q=search in the URL.. Nice.
... View more
05-09-2012
08:17 AM
From time to time, I would need to blast the folders in the dispatch folder. Can anyone shed some light on the naming convention? Here are the name prefixes I have found... Some are obvious, some... not so much...
scheduler rt remote "somenumber" splunk01 "username"
... View more
- Tags:
- dispatch
05-04-2012
08:20 AM
So.. Found out that this is NOT possible... However, one way to do this is to create a lookup list, and then group by the fields in the lookup list..
... View more
05-04-2012
08:12 AM
I would like a NavBar Menu item to link to a Macro that I have created... Is this possible? What about linking a NavBar Item to a NON Saved Search... In other words, hard code the search in the NavBar Item?
... View more
05-02-2012
06:38 PM
Hi,
I think this must be easy.. but I can't wrap my head around how to get this done... I want to gather multiple stats for a single query. Essentially, I want to gather the count and avg thruput for webpages from my iis logs...Essentially, something like this..
Page1.html count=10, avgtime=20
Page2.html count=17, avgtime=30
Any suggestions?
... View more
04-23-2012
04:32 PM
I had the same problem.. was able to resolve it with this solution as well.
... View more
03-08-2012
12:41 PM
Sometimes we have 20+ users doing needle in haystack type searches. From a concurrent searches perspective, we make extensive use of Views and scheduled searches.. so sometimes close to 40/50 concurrent searches..
... View more
03-08-2012
12:39 PM
Thanks for the reply... Yes, I am aware of the HA considerations, and the complications of Search head pooling. In order to simplify the answer, I tried to have the focus be on "Performance based reasons" only..
... View more
02-28-2012
12:59 PM
Hello, I've already read the Splunk planning for a large scale deployment documents. However, I didn't get a sense about what would be better for scaling searchheads... adding more servers or adding processors to existing servers. We have a lot of utility hardware and are debating whether we'd get better performance by adding 4 searchheads with 2socket/4core procs, or adding adding 2 searchheads with 4 socket 4 procs, given equal memory/processor speed and ignoring the differences in OS and Hardware Management, does anyone see a PERFORMANCE BASED reason to choose one or the other?
... View more
02-15-2012
02:11 PM
Our Topology consists of pooled search heads all pointing to 3 search peers. How can I determine the concurrent search activity on each search peer? I know how to find out which search heads the searches are coming from, but how can I figure out which indexers are returning the results from these searches. I
... View more
- Tags:
- concurrency
02-15-2012
08:24 AM
2 Karma
Our shop virtualizes everything, including our splunk deployment. We are now looking at re-architecting our solution because of performance problems due to some design flaws we made the first time around. We will continue to virtualize, but are debating about whether to continue to use vmfs volumes, or switch to RDMs. I found a comments on the splunk site supporting the use of RDM, but VMWARE docs indicate that the performance of these two file systems are nearly equal. Does anyone know if the reccommendations for RDM is out of date? Has anyone recently tested the performance differences between these two?
... View more
02-13-2012
09:09 AM
I have the same problem for remote event logs. Disabled collection, but they continue to collect.
... View more
02-10-2012
05:32 AM
13 Karma
A feature should be added to disable that.. It generates unnecessary calls to the help desk
... View more
02-09-2012
02:44 PM
1 Karma
I am looking to troubleshoot performance problems (Indexing latency) on my splunk indexers. I noticed that there is a lot of blocking, apparently due to the max_size_kb being reached on the indexqueue. I am not seeing any disk latency, so not sure why this is happening..
Anyone know how the max_size_kb is determined, and if it is changeable?
... View more
01-31-2012
12:17 PM
I know that I can use tags to define a search, but can I also use them to group results? In my situation, I want to search my servers, and have them grouped by the type of servers I have. So...
I have created a tag called "Linux" and Another Tag called "Windows", then have created field value pairs to tag the servers. It it possible to then query them and get a count?
I've tried the following, but doesn't return any results.
Search tag=Linux or tag=Windows | stats count(host) by tag::host
I'm on 4.2.1
... View more
01-12-2012
11:49 AM
Also tried this, [(?:::){0}httperr-*] and it worked perfectly for my http error files which had 10 different source types
... View more
10-19-2011
06:31 PM
Although this doesn't return an error, it also doesn't return any results.
... View more
10-19-2011
10:15 AM
Thanks for the reply, but when I attempt this, I get Error in 'stats' command: The argument 'host::tag' is invalid. I wasn't sure if you meant this literally, or if tag should have been replaced by the name of the tag. I tried the tag name "Owner" it the same error occurred.. I'm running 4.2.1.. Perhaps this is no longer supported?
... View more
10-17-2011
05:41 PM
I'd have a number of servers that are tagged with a category of the system owner. Can I use these tags to group the reports?
Servers 1 to 10 have a tag named "systems"
Servers 11 to 20 have a tag named "database"
Servers 21 to 30 have a tag named "database"
Is it possible to write a search that groups results by tag?
For example, if I was searching for the number of errors on all these servers, it would return something like this..
Tag Count
systems 22
database 18
network 8
... View more
- Tags:
- tags
10-17-2011
02:59 PM
I tried this out and although I was able to create a menu two levels deep, none of my menu items were displayed...
eg:
LEVEL 1 Menu
LEVEL 2 Menu
Menu item (This item is not displayed)
... View more
- « Previous
- Next »
