Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About twinspop
twinspop
Influencer
Member since:
06-09-2010
04-07-2021
Community Statistics
| Posts | 609 |
| Solutions | 72 |
| Karma Given | 384 |
| Karma Received | 232 |
| Member Since | 06-09-2010 |
Activity Feed
- Got Karma for Re: Why aren't defined field transformations showing in the GUI?. 09-09-2025 04:40 AM
- Got Karma for Re: Why is my log file sometimes ignored?. 05-19-2025 02:49 PM
- Got Karma for Re: How can I show the time of the last event in a stats by count table?. 12-11-2024 08:35 PM
- Got Karma for Re: Search to Identify when a host stops sending logs to Splunk. 10-09-2024 12:04 AM
- Got Karma for Re: Logging multiple sources from Docker with HEC: Are multiple sourcetypes possible?. 04-09-2024 06:41 AM
- Got Karma for Logging multiple sources from Docker with HEC: Are multiple sourcetypes possible?. 04-09-2024 06:41 AM
- Got Karma for Re: Logging multiple sources from Docker with HEC: Are multiple sourcetypes possible?. 04-09-2024 06:41 AM
- Got Karma for Re: How do I remove a dash (-) from the Account_Name field?. 02-22-2024 08:53 AM
- Got Karma for Re: How to configure props.conf for a Unix timestamp in a JSON log file?. 01-20-2024 09:06 AM
- Got Karma for Re: Why is my search head cluster captain logging KV Store replication errors?. 06-08-2023 12:21 PM
- Got Karma for Is there a way to convert a scheduled report to an alert? (6.6.3). 05-04-2023 03:51 PM
- Got Karma for Re: WinEventLog inputs: Why does current_only=1 skip server reboot events?. 03-15-2023 12:41 PM
- Got Karma for Re: How to change '_time'? _time is by default picking first alphabetical date column (Assigned) and doing +05:30. 09-30-2022 04:56 AM
- Posted Kafka add-on: Unable to initialize modular input on All Apps and Add-ons. 04-07-2021 07:52 AM
- Got Karma for Re: Is there any way to monitor CPU on Mac OS?. 03-20-2021 07:11 AM
- Got Karma for Re: With 8.1.2 or later should we still use an HEC tier on HWFs?. 03-08-2021 07:40 AM
- Posted Re: With 8.1.2 or later should we still use an HEC tier on HWFs? on Getting Data In. 03-05-2021 05:20 PM
- Posted With 8.1.2 or later should we still use an HEC tier on HWFs? on Getting Data In. 03-05-2021 05:19 PM
- Got Karma for Is there a way to convert a scheduled report to an alert? (6.6.3). 02-16-2021 11:23 PM
- Karma Re: Can you create/modify a lookup file via REST API? for 4n0m4l1. 12-15-2020 07:26 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-10-2012
06:52 AM
1 Karma
Based on retention needs, daily volume and available disk I've broken my group's index into 5 main indexes plus 2 summary indexes. We share the 2 server index cluster with other groups, and if they use the same methodology, we could be looking at 30 or more indexes. Is this a problem? Is there some tuning I should be doing to make it perform better?
The indexers are 32-core, 64 GB beasties with SAN disk.
... View more
02-10-2012
06:42 AM
Can't upvote this enough
... View more
02-07-2012
07:39 AM
The license screen on the slaves also shows good contact to the LM.
... View more
02-07-2012
07:33 AM
2 Karma
Since upgrading to 4.3, all of the license slaves I have show login screens with the "Upgrade to Splunk Enterprise to add alerting, single sign-on blah blah..."
Previously they acknowledged their licensing as dictated by the master. The LM server shows them as slaves and properly licensed.
Today, they all suspended searching for license violations but volume is well below our licensed level. These 2 seem related.
... View more
02-01-2012
01:44 PM
When trying to contact the search head: "The splunkd daemon cannot be reached by splunkweb. Check that there are no blocked network ports or that splunkd is still running." And when I issue a restart: "splunkd somepid was not running." Thanks for heads-up tho. I had noticed that other problem as well!
... View more
02-01-2012
01:21 PM
Anyone else getting dead splunkds? Unfortunately, the splunkd log isn't giving any useful info. Tips on where else to look? I've got 2 totally separate SHs that are doing this. Both do forwarding duties as well as SH duties. Prior to 4.3 I don't recall ever seeing them crash.
Linux x64
... View more
01-25-2012
10:44 AM
I'm very curious to hear how other admins are handling summary indexing with multiple indexers and search heads.
Schedule them on 1 Search Head?
Schedule on multiple SHs with Pooling enabled?
Schedule them on each Indexer?
Schedule them on 1 Indexer with distributed search to the others?
Have a dedicated "Collection" Search Head?
Send the results to the Indexers?
Set up local Summary Indexes on the SH(s)?
Dedicated Summary Indexers?
It seems like every option above is imperfect, making for many compromises. Please share your SI architecture and why you chose it.
Thanks,
jon
EDIT - I found this previous answer. It still leaves some questions though. If I want to search from the SH and collect into an index on the indexer, do I need to create a "dummy" index on the search head? Without the custom index on the SH, it won't let me schedule it. Seems a little hacky.
... View more
01-12-2012
08:49 AM
Multiple failures here. I didn't even realize I had a 4.2.3 indexer still. And then failed to read the error message correctly. Doh! Thanks.
... View more
01-12-2012
07:54 AM
This search works without issue in 4.2.4:
sourcetype="teledebug" | transaction keeporphans=1 host source startswith=ANI endswith=onhook
In 4.3 it appears to work, but it returns an error in red atop the results:
[splunk1] Streamed search execute failed because: Error in 'transam' command: Invalid argument: 'keeporphans=1'
Anyone else? Known bug?
EDIT: the error is coming from one of my 4.2.3 indexers. Weird. Any ideas? I'll upgrade asap and report back if it fixes the problem.
... View more
- Tags:
- transactions
11-15-2011
12:55 PM
Move the EXTRACT line up to the source stanza.
Also, verify the source stanza is doing what you think it's doing. Search for sourcetype=oracle_aud_logs to make sure that stanza is working.
... View more
10-04-2011
06:33 AM
I opened a support case for this issue last week, but have yet to hear anything. 😞
... View more
09-20-2011
08:37 AM
I think this is getting me down the correct path, but as posted above it does not work. The prev_* values are identical to those in the current record. Setting current=f seems to be the fix. Now to omit the rolled over counters and other cruft.
... View more
09-19-2011
09:32 AM
1 Karma
I've got the Universal Forwarder installed on all our web servers. Every 5 minutes they are posting "Total Bytes Sent" from the "Web Service" object. These are simple counters, so in order to get bandwidth information, I need to use the delta command. That complicates things very quickly tho.
We have 96 web servers broken into 24 farms of 4 each. I'd want to report on bandwidth stats per farm. I'm at a loss for how to mix and match delta , stats , timechart , bucket and friends into aggregating the deltas while separating them into the appropriate farms.
Is it possible, or should I simply be running 24 different searches feeding into a summary index?
... View more
08-05-2011
07:15 AM
Same problem on 32bit Windows SUF 4.2.2. I put in _Total, but it runs as if I put in *.
... View more
08-03-2011
09:58 AM
Overlapping events aren't the problem. My mistake. Got other problems with SEDCMD and event breaking, but I'll dig further before asking again. 😕
... View more
08-03-2011
09:25 AM
Using splunktcp to receive. All SUFs are using tcpout stanzas in outputs.conf to send. All SUFs are default installs with regard to host definitions: $SPLUNKHOME/etc/system/local/inputs.conf has the unique hostname for each SUF install in a default stanza. The host attribute does not get set anywhere else.
... View more
08-03-2011
08:27 AM
It seems like LINE_BREAKER might be some help. Testing it now, but it doesn't seem like I should need to delineate events from different hosts.
... View more
08-03-2011
08:09 AM
IGNORE this question/problem. Bad search skills led to bad conslusion.
About 30 Splunk Universal Forwarders sending to one indexer on a common port. The source of the data is a curl data pull from localhost. The HTML does not end in a line feed. (This seems to be an important point.)
Everything worked fine when one was running. However, when I fully deployed it, all hell broke loose. After much tweaking and investigation I see that Splunk is treating events that come in at roughly the same time from different hosts as the same event. This is no bueno.
Is this expected behavior? Any ideas on how to fix aside from assigning every forwarder to their own port? (Or fighting the long battle with development to add a line feed at the end of their HTML.)
... View more
07-25-2011
02:26 PM
| stats count by userID | sort - count
... View more
06-27-2011
02:35 PM
2 Karma
I created a new app, and executed a search. Under Actions, I clicked Add to Dashboard. The save search dialog came up, followed by the Add to Dashboard dialog where I created a new Dashboard. I finished out the dialog box, and executed a new search that I also wanted to add to the Dashboard. Saved the search, went to add it to the newly created Dashboard... but it was not listed as a potential target. I canceled out of the dialog and checked under Views. There's my Dashboard. Why is it a View instead of a Dashboard? What's the difference?
... View more
06-24-2011
01:13 PM
I think the field name _time tells Splunk to make it human readable, so renaming it removes that built-in functionality. This might work for you:
sourcetype="solaris3-web-access" /uhpo/ status="200" |
convert timeformat="%H:%M:%S" ctime(_time) as timestr|
timechart first(timestr) as hours,count as Logins
Jon
... View more
06-20-2011
08:30 AM
2 Karma
I've seen it before and my theory is: Your fist search looks for "row" first, then matches it to a field with "row" as a value. Since "row" doesn't match a whole term in _raw, you get nothing. In the second, field extraction has already happened -- you're dealing with the results. In this case, it will match. Make sense?
... View more
06-10-2011
09:26 AM
2 Karma
Minimally, in /opt/splunkforwarder/etc/system/local
outputs.conf:
[tcpout:somelabel]
server=192.168.0.1:9997
inputs.conf:
[monitor:///path/yo/your/access_log]
sourcetype = access_log
On the receiving end, you'll need to activate a corresponding receiving port under Management -> Forwrding/Receiving. (In this case, and by default, 9997.)
... View more
06-10-2011
06:26 AM
Yes, I was aware of that. I was really looking for the CLI equivalent of the enable/disable switch available in the GUI. I guess the more brutish add/delete would work. I'll need to research the add command more to see if all the input settings I use are available vi CLI. Thanks.
... View more
06-10-2011
06:23 AM
Doesn't work with Splunk 4.2.1
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-07-2021
02:44 PM
|
