Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About twinspop
twinspop
Influencer
Member since:
06-09-2010
04-07-2021
Community Statistics
| Posts | 609 |
| Solutions | 72 |
| Karma Given | 384 |
| Karma Received | 232 |
| Member Since | 06-09-2010 |
Activity Feed
- Got Karma for Re: Why aren't defined field transformations showing in the GUI?. 09-09-2025 04:40 AM
- Got Karma for Re: Why is my log file sometimes ignored?. 05-19-2025 02:49 PM
- Got Karma for Re: How can I show the time of the last event in a stats by count table?. 12-11-2024 08:35 PM
- Got Karma for Re: Search to Identify when a host stops sending logs to Splunk. 10-09-2024 12:04 AM
- Got Karma for Re: Logging multiple sources from Docker with HEC: Are multiple sourcetypes possible?. 04-09-2024 06:41 AM
- Got Karma for Logging multiple sources from Docker with HEC: Are multiple sourcetypes possible?. 04-09-2024 06:41 AM
- Got Karma for Re: Logging multiple sources from Docker with HEC: Are multiple sourcetypes possible?. 04-09-2024 06:41 AM
- Got Karma for Re: How do I remove a dash (-) from the Account_Name field?. 02-22-2024 08:53 AM
- Got Karma for Re: How to configure props.conf for a Unix timestamp in a JSON log file?. 01-20-2024 09:06 AM
- Got Karma for Re: Why is my search head cluster captain logging KV Store replication errors?. 06-08-2023 12:21 PM
- Got Karma for Is there a way to convert a scheduled report to an alert? (6.6.3). 05-04-2023 03:51 PM
- Got Karma for Re: WinEventLog inputs: Why does current_only=1 skip server reboot events?. 03-15-2023 12:41 PM
- Got Karma for Re: How to change '_time'? _time is by default picking first alphabetical date column (Assigned) and doing +05:30. 09-30-2022 04:56 AM
- Posted Kafka add-on: Unable to initialize modular input on All Apps and Add-ons. 04-07-2021 07:52 AM
- Got Karma for Re: Is there any way to monitor CPU on Mac OS?. 03-20-2021 07:11 AM
- Got Karma for Re: With 8.1.2 or later should we still use an HEC tier on HWFs?. 03-08-2021 07:40 AM
- Posted Re: With 8.1.2 or later should we still use an HEC tier on HWFs? on Getting Data In. 03-05-2021 05:20 PM
- Posted With 8.1.2 or later should we still use an HEC tier on HWFs? on Getting Data In. 03-05-2021 05:19 PM
- Got Karma for Is there a way to convert a scheduled report to an alert? (6.6.3). 02-16-2021 11:23 PM
- Karma Re: Can you create/modify a lookup file via REST API? for 4n0m4l1. 12-15-2020 07:26 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-28-2019
08:00 PM
1 Karma
First you need to have your pattern wrapped in quotes.
Two, you need to use match() properly.
Then you need to fix your regex.
You probably want something like case(match(host,”az.*”),”Tuscon”,match(host,”bos.*”),”Boston”) for a shortened example
... View more
07-22-2019
02:30 PM
We're testing it, but not ready to roll into production. Yet. 🙂 Very promising!
... View more
07-22-2019
02:08 PM
Well shoot. If the sending application sets source, that overrides the default above, which means the transform doesn't fire. So still back to the old problem: How to guarantee a transform gets applied to every single event that came through a particular token's input def?
... View more
07-22-2019
02:04 PM
Perfect! I had no idea that was a thing. I feel like I gained a new superpower.
... View more
07-22-2019
01:23 PM
Yeah, a transform is where i was headed, but I don't see any foolproof way to identify only those those logs, and ALL those logs, that originate on 1 particular token. The token value and the input name are not things I can key off of in props as far as i know.
... View more
07-22-2019
12:53 PM
I have about 50 different tokens. I want data from one particular token to get some metadata added to it. Unfortunately, it doesn't appear that the _meta directive works for http in inputs.conf. Is it possible to replicate this functionality some how?
... View more
07-17-2019
06:47 AM
Adding to what Woodcock said above, I've found transaction can be replaced by stats in most situations with a little extra effort. Obviously it depends on what you're trying to report on, but something like this:
index=linux sourcetype=syslog
| stats last(somefield) as last_something first(somefield) as first_something range(_time) as span by queue_id
... View more
07-09-2019
06:45 PM
The bottom of this page has an example of how to do it using selective indexing.
https://docs.splunk.com/Documentation/Splunk/7.3.0/Admin/Outputsconf
... View more
07-09-2019
05:48 PM
That didn't work. I added this stanza (alone) to the CM and applied. No other changes. I had assumed that default would remain undefined and therefore it would index locally.
[tcpout:dc1_indexers]
server = dc1_indexers:9997
autoLBFrequency = 20
autoLBVolume = 10000
compressed = true
useACK = false
All locally indexed data disappeared, and tons of logs regarding TcpOutputProc connections to the indexers in the dc1_indexers cluster above.
So how do you add an output destination that will not take over default when you want to maintain local indexing?
... View more
07-05-2019
08:37 AM
I have Http Event Collector inputs defined on an indexer cluster. I need to send one of the tokens' data to a different indexer. _TCP_ROUTING in inputs, plus an outputs.conf def?
If so, what magic in outputs.conf do I need to ensure most traffic ignores the special case and just indexes normally?
... View more
06-21-2019
09:49 AM
By default the management port uses self-signed certs, but it absolutely is SSL (TLS) enabled. If you'd like to secure it with properly signed, or locally signed by your company's CA, there are lots of docs out there. This was a great presentation by splunk legend Dwaddle a few years back.
https://conf.splunk.com/session/2015/conf2015_DWaddle_DefensePointSecurity_deploying_SplunkSSLBestPractices.pdf
... View more
06-21-2019
09:40 AM
[yoursourcetype]
SHOULD_LINEMERGE = 0
LINE_BREAKER = ([\r\n]+\s*)\[
TIME_PREFIX = \[
TIME_FORMAT = %m/%d/%y %T:%3N
EDIT: fixed year from 4 digit (%Y) to 2 digit (%y)
... View more
06-21-2019
09:37 AM
1 Karma
You'll also need to consider changing initCrcLength or crcSalt . The beginning of your file looks like it will be the same every time. Splunk tracks files based on the opening 256 bytes, so it will likely stop reading new files. "Hey, I've seen this file before. Ignore."
... View more
06-11-2019
01:28 PM
The entirety of cold storage has 0 files in it. Remains true after running historical searches that would surely end up with some cold data in play.
... View more
06-11-2019
01:09 PM
I can confirm that once migration takes place, buckets are no longer stored on cold.
EDIT: I tried to force the CM to populate the cache with "cold buckets" but have failed to replicate this behavior. (Ran a search over a small window from months ago on a known index that would have been cold at the time of migration. No colddb population.)
... View more
05-29-2019
12:53 PM
The list command is borked. It lists all searches baduser can see. Not what baduser owns. Bah!
... View more
05-29-2019
12:36 PM
Partial answer: If I use nobody in the username slot in the POST command, it works.
... View more
05-29-2019
12:25 PM
I'm attempting with 2 REST calls: 1 to get the list of searches, and 1 to POST is_scheduled = 0 .
The list curl command I'm using is:
curl -sku admin:pass https://localhost:8089/servicesNS/baduser/-/saved/searches?count=0
Then I'd like to step through each returned with this curl template:
curl -sku admin:pass https://localhost:8089/servicesNS/baduser/$APP/saved/searches/$SEARCHNAME -d is_scheduled=0
But Splunk is cloning the search, not disabling the schedule. I get the original, and a private copy with no schedule.
I'm missing something basic about the way the API works. Help?
... View more
04-23-2019
07:34 AM
Excellent, thx! 2 follow-ups: 1) Does S2 change this search at all? 2) Which of the numbers is applicable to the 5m bucket suggested limit?
... View more
04-13-2019
06:06 PM
I'm not sure I follow. You don't have a choice of WARM or COLD with S2. There is HOT; briefly there is WARM while waiting to upload to remote; and finally there is remote with cached local copies. Th entire bucket lifecycle changes.
At least this is my understanding.
... View more
04-08-2019
04:58 PM
This is a really good rundown for anyone planning to use S2. Thanks for the summary @davidpaper!
... View more
03-09-2019
05:49 AM
Good idea! BUT, we have a load balancer in front of HEC. All the IPs are the same.
... View more
03-08-2019
01:22 PM
One of my defined HEC tokens is receiving a lot more traffic than it's writing to indexes. I'm comparing the indexes it has access to and the introspection stats for the event collector. The EC stats are showing upwards of 3 MB/s. The indexes have no where near that volume. I suspect someone is sending using that token and a bad index. Indeed, I have these logs showing up at nearly 1 per/second:
03-08-2019 16:08:59.964 -0500 ERROR HttpInputDataHandler - Parsing error : Incorrect index
But that log is worthless. Index? Host or IP? Source? Sourcetype? Anything?! I also tried enabling debug for HttpInputDataHandler but it didn't advance my quest any.
How to track this down aside from tcpdump and hours of hunting through packet captures?
... View more
02-27-2019
06:46 AM
1 Karma
We had an issue with parsing queue filling recently. Our oversized event profile is to blame. To address, I increased our queue size across the board to 100 MB from 50 MB. Is there any reason not to go higher? 1 GB? Given an indexer with unlimited RAM, is there a point of diminishing returns when it comes to queue sizing? Do the different queues have different PoDRs?
... View more
02-18-2019
12:29 PM
See other comments in here re: polkit, which will solve the problem of requiring root auth level.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-07-2021
02:44 PM
|
