Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About twinspop
twinspop
Influencer
Member since:
06-09-2010
04-07-2021
Community Statistics
| Posts | 609 |
| Solutions | 72 |
| Karma Given | 384 |
| Karma Received | 232 |
| Member Since | 06-09-2010 |
Activity Feed
- Got Karma for Re: Why aren't defined field transformations showing in the GUI?. 09-09-2025 04:40 AM
- Got Karma for Re: Why is my log file sometimes ignored?. 05-19-2025 02:49 PM
- Got Karma for Re: How can I show the time of the last event in a stats by count table?. 12-11-2024 08:35 PM
- Got Karma for Re: Search to Identify when a host stops sending logs to Splunk. 10-09-2024 12:04 AM
- Got Karma for Re: Logging multiple sources from Docker with HEC: Are multiple sourcetypes possible?. 04-09-2024 06:41 AM
- Got Karma for Logging multiple sources from Docker with HEC: Are multiple sourcetypes possible?. 04-09-2024 06:41 AM
- Got Karma for Re: Logging multiple sources from Docker with HEC: Are multiple sourcetypes possible?. 04-09-2024 06:41 AM
- Got Karma for Re: How do I remove a dash (-) from the Account_Name field?. 02-22-2024 08:53 AM
- Got Karma for Re: How to configure props.conf for a Unix timestamp in a JSON log file?. 01-20-2024 09:06 AM
- Got Karma for Re: Why is my search head cluster captain logging KV Store replication errors?. 06-08-2023 12:21 PM
- Got Karma for Is there a way to convert a scheduled report to an alert? (6.6.3). 05-04-2023 03:51 PM
- Got Karma for Re: WinEventLog inputs: Why does current_only=1 skip server reboot events?. 03-15-2023 12:41 PM
- Got Karma for Re: How to change '_time'? _time is by default picking first alphabetical date column (Assigned) and doing +05:30. 09-30-2022 04:56 AM
- Posted Kafka add-on: Unable to initialize modular input on All Apps and Add-ons. 04-07-2021 07:52 AM
- Got Karma for Re: Is there any way to monitor CPU on Mac OS?. 03-20-2021 07:11 AM
- Got Karma for Re: With 8.1.2 or later should we still use an HEC tier on HWFs?. 03-08-2021 07:40 AM
- Posted Re: With 8.1.2 or later should we still use an HEC tier on HWFs? on Getting Data In. 03-05-2021 05:20 PM
- Posted With 8.1.2 or later should we still use an HEC tier on HWFs? on Getting Data In. 03-05-2021 05:19 PM
- Got Karma for Is there a way to convert a scheduled report to an alert? (6.6.3). 02-16-2021 11:23 PM
- Karma Re: Can you create/modify a lookup file via REST API? for 4n0m4l1. 12-15-2020 07:26 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-22-2016
06:31 AM
There was a scheduled search that had repeated fields in it. It was in splunkd.log. After fixing the search, searches immediately began firing again.
... View more
12-21-2016
05:32 PM
For this project we plan to be RF3/SF2.
... View more
12-21-2016
05:17 PM
We are clustered. Currently 5 (in 2 different clusters). Soon to be 12 each. Thanks for your input!
... View more
12-21-2016
12:39 PM
Actually, throwing this on the command line works really well. I can feed it into a for loop. The end result being a batch ownership change script.
... View more
12-21-2016
11:21 AM
Yeah, that would work. Was hoping for a single script solution, but I can copy-pasta.
... View more
12-21-2016
10:00 AM
These will be running SUSE 12. Each SSD will be 1.6TB. The systems have hardware RAID cards, but I'm tempted to go with JBOD, and use Linux tools or even ZFS to manage the volumes.
RAID50? eg, RAID5 with 5 members, 4 groups, striped
RAID60?
Multiple RAIDZ1 or -2 with ZFS?
Our storage group recommended one giant RAID5 volume, which worries me. Rebuild on a volume that size seems to be a problem, and losing a second drive during rebuild would be a real possibility. Not to mention having 1 drive failure protection in a 20 drive array seems like a bad idea.
EDIT - I'm trying to avoid RAID10, losing 50% of the raw storage.
... View more
12-21-2016
07:41 AM
Aha. The user had too many views to fit in the default count returned. Final product, including new '?count=0' specifier.
curl -sku admin:password 'https://127.0.0.1:8089/servicesNS/user/app/data/ui/views?count=0' | grep '<id>' | grep app/data/ui/views/ | sed -e 's^.*/views/^^' | sed -e 's^</id>^^'
EDIT: It's imperfect. I see views owned by "nobody" in the returned list. Still trying to find the magix to return just the views owned by user. -sigh-
... View more
12-21-2016
07:29 AM
I've tried the /servicesNS/userid/-/data/ui/views endpoint but maybe I'm not using it correctly. I have a known view owned by the user that does not show anywhere in the output from calling that endpoint.
curl -sku admin:password https://127.0.0.1:8089/servicesNS/userid/his_app/data/ui/views | grep known_view_name
The view I searched for is in the app, is shared at app level. If I run:
curl -sku admin:password https://127.0.0.1:8089/servicesNS/userid/his_app/data/ui/views/known_view_name
I get results. What am I missing?
I want a list of the view names (not the titles) for a particular user.
Thanks!
... View more
12-21-2016
06:58 AM
I don't think splunk can do this, but in Linux you can use iptables to redirect 1 port to another. I use this all the time because I run Splunk as non-root, but like to keep 80 working.
#!/bin/sh
# get the main interface
int=$(netstat -nr | egrep -i "^0.0.0.0|^default" | awk '{print $8}')
# run iptables rule for port 80 -> 8000 (WEB GUI)
iptables -A PREROUTING -t nat -i $int -p tcp --dport 80 -j REDIRECT --to-port 8000
# and for port 443 -> 8089 (API)
iptables -A PREROUTING -t nat -i $int -p tcp --dport 443 -j REDIRECT --to-port 8089
... View more
12-20-2016
01:43 PM
2 Karma
Splunk has confirmed this bug. Workaround they provided:
Save the search as a report, then
click Run (in the Searches, Reports
and Alerts page), finally use the
Share button. The under-privileged
user will now be able to see the
contents of the search.
... View more
12-20-2016
10:20 AM
I am an admin. People can share with me. But any time I share a search via the share widget on the search screen, they get "permission denied" when attempting to view it. This worked fine prior to 6.5.x.
Opening ticket. Just curious if others have seen it and found a workaround.
... View more
12-19-2016
04:01 PM
They would get re-indexed one more time since their hash would change when you stopped including source. But after that, they should stop. I'm not seeing any reason why they'd continue based on the configs provided. Sorry. ¯_(ツ)_/¯
... View more
12-19-2016
03:41 PM
Do NOT use crcSalt. That is the cause of your reindexing. Every time your log file rolls, it gets a new name. The crcSalt setting says to use the name of the file as part of the unique identifier. That's not what you want with rolling files.
crcSalt should be avoided in nearly every case I see people trying to use it in.
... View more
12-15-2016
11:51 AM
See the ldap answer above
... View more
12-14-2016
12:05 PM
3 Karma
you'll need to specify the full path to the splunk binary:
sudo /app/splunk/bin/splunk enable boot-start
For example. Replace with your path as required.
Also, do NOT forget to update the $SPLUNK_HOME/etc/splunk-launch.conf file with the appropriate username:
SPLUNK_OS_USER=splunkadmin
... View more
12-14-2016
07:14 AM
A few things: I don't understand what you're trying to do with the first 2 stats() commands. A count of properties_key? Maybe you want to use dc()? I'm leaving it as is, mostly. In any case, the first 2 search terms can definitely come together, and the table command doesn't do anything for you. When you have a sub search, you must explicitly declare the search command to use -- in this case, search. But I don't see that you're "join"ing any data. Probably appendcols is what you want?
index=rabbitmq properties_key="lsg*" | stats count by vhost, properties_key | stats count(vhost) as Total | appendcols [search index=rabbitmq earliest=-60 properties_key="lsg*" | stats count by vhost, properties_key | stats count(vhost) as Online] | eval difference=Total-Online
I hope this helps.
... View more
12-13-2016
01:00 PM
1) In the 7 MB/s range. Unchanged from before. If it was load related, when the 2 dropped, I would expect the surfing members to be overwhelmed. They are not. They handle the additional load fine, up to 15 MB/s sometimes.
2) BucketMover activity is no more or less than the other indexers. (When they're active. When they block for long periods of time, BucketMover activity disappears, as it should.)
3) No. That would be nice! At least I'd have somewhere to start.
2 pieces of curious info: The 2 usually block together. Rarely does one start blocking without the other. And when they are blocked they take an abnormally long time to restart. While waiting for the restart to happen, with the "..." crawling across the screen, server load drops to 0. Vs while running but blocked, load is at ~ 1. And while running normally, load is ~ 10.
... View more
12-13-2016
08:30 AM
_time is not human readable, it's just that Splunk will make it so when you use it in a table. What you want is the _time field in epoch. ... | eval _time=request_time/1000 | timechart ...
... View more
12-13-2016
08:24 AM
1 Karma
* | rex "Timestamp:\s(?<request_time>\d+)\s(?<response_time>\d+)" | eval stripped_time=strftime(request_time/1000,"%Y-%m-%d %T %z")
EDIT: Based on other comments:
* | rex "Timestamp:\s(?<request_time>\d+)\s(?<response_time>\d+)" | eval _time=request_time/1000 | timechart ...
... View more
12-13-2016
08:19 AM
This will first get the earliest time a particular sessionNum was seen. Then it will chart the count of sessionNums over time by source.
... | stats min(_time) as _time by sessionNum, source | timechart count by source
EDIT: Based on comment below:
... | timechart sum(sessionNum) by source
... View more
12-13-2016
07:33 AM
index=_internal component=metrics processor=nullqueue group=pipeline sourcetype=splunkd
... View more
12-13-2016
07:25 AM
1 Karma
Appendcols is what you want. You don't need the bucket and stats commands, just timechart:
index=web_summary report="volumebyminuteweb" earliest=-30m@m latest=@m |timechart span=5m count as Today |
appendcols [
search index=web_summary report="volumebyminuteweb" earliest=-30m@m-1w latest=@m-1w |timechart span=5m count as "1 week ago" ] |
appendcols [
search index=web_summary report="volumebyminuteweb" earliest=-30m@m-2w latest=@m-2w |timechart span=5m count as "2 weeks ago" ] |
appendcols [
search index=web_summary report="volumebyminuteweb" earliest=-30m@m-3w latest=@m-3w |timechart span=5m count as "3 weeks ago" ]
... View more
12-12-2016
05:16 PM
1 Karma
Answer for problem 1: The error in the _internal index, vector::_M_range_check , led us to this more detailed error:
12-08-2016 20:12:33.160 -0500 ERROR StatsProcessor - Error in 'stats' command: 3 duplicate rename field(s). Original renames: [c ftime ltime I_EMAIL I_CELL I_DIALCODE I_UID VIEW_ID ERROR_ID DELIVERY_METHOD CALLER OUTPUT_TYPE VIEW_ID ERROR_ID URI ORGID AOID ORG_NAME UID VALIDATED_CHANNEL_COUNT UID_RETRIEVED FN_NOT_MATCH R_FN DELIVERY_METHOD]. Duplicate renames: [DELIVERY_METHOD ERROR_ID VIEW_ID].
There was an accelerated saved search that had multiple duplicated fields. As soon as I edited the search to remove the dupes, everything cleared up. 6.4.4 did not trip up on this, but 6.5.1 did. Big thanks to Terrance Lam @ Splunk Support for finding this.
Still dealing with problem 2. No closer to resolution there.
EDIT - Answer for problem 2: The 2 indexers that were periodically blocking all indexing could not see our AD server for LDAP auth. The connection was timing out. This was always happening, but 6.5.1 appears to handle it badly. The entire splunkd process blocks for long periods of time occasionally. I entered the hostname in my /etc/hosts file pointing to localhost as a quick work around. The connection is immediately refused and Splunk handles that better.
... View more
12-12-2016
05:03 PM
Not related. Same error, but different cause.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-07-2021
02:44 PM
|
