About Kendo213

Kendo213 · ‎05-03-2018

I've tried restarting the service numerous times. That cron has 's around it because of the Splunk forum. It doesn't complain about an invalid cron in the internal logs.

Kendo213 · ‎05-02-2018

Here is my inputs.conf: [powershell://checkdnsext] script = . "$SplunkHome\etc\apps\test_infra_dnsext_inputs\bin\checkdnsext.ps1" schedule = `0 */5 * ? * *` sourcetype = test:powershell index = test Here is my Powershell located in /app/bin: $ErrorActionPreference="SilentlyContinue" $ipaddress = $(ipconfig | where {$_ -match 'IPv4.+\s(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})' } | out-null; $Matches[1]) $dnstest=Resolve-DnsName -Name google.com -server $ipaddress -QuickTimeout -Type A | select Name if ($dnstest -like '*google*') { $result="1" write-host ((get-date),"`nExternal DNS Status:","$result") } else{ $result="0" write-host ((get-date),"`nExternal DNS Status:","$result") } The script works. I don't see any errors in splunkd.log on the client, other than the fact that I don't see it scheduling the script to run. Any ideas?

Kendo213 · ‎04-30-2018

That's what I was thinking, however this is how Splunk PS configured it.

Kendo213 · ‎04-30-2018

I guess I would expect my forwarders to hit the cluster master, and be told that "these indexers are down" and start forwarding to the indexers that are up according to the cluster master. That doesn't seem to be happening

Kendo213 · ‎04-30-2018

We have a multi-site cluster of 6.6.4 (site1, site2) and when testing a downed state of site1, some of our forwarders were not failing to the site that was up. Or, we saw odd behavior like forwarders still attempting to hit site1 AND site2 (almost like a round robin) indexers despite the cluster master noting them as unknown/down. Here is what our outputs.conf looks like: [tcpout] defaultGroup = primary_indexers maxQueueSize = 7MB useACK = true forceTimebasedAutoLB = true forwardedindex.2.whitelist = (_audit|_introspection|_internal) [tcpout:primary_indexers] indexerDiscovery = clustered_indexers sslCertPath = $SPLUNK_HOME/etc/apps/forwarderoutputs/local/splunkforwarder.pem sslPassword = pass sslVerifyServerCert = true [indexer_discovery:clustered_indexers] pass4SymmKey = pass master_uri = https://clustermaster:8089 [tcpout-server://site01index01:9998] sslVerifyServerCert = true sslAltNameToCheck = site01index01, site01index01.domain.com [tcpout-server://site01index02:9998] sslVerifyServerCert = true sslAltNameToCheck = site01index02, site01index02.domain.com [tcpout-server://site2index01:9998] sslVerifyServerCert = true sslAltNameToCheck = site02index01, site02index01.domain.com [tcpout-server://site2index02:9998] sslVerifyServerCert = true sslAltNameToCheck = site02index02, site02index02.domain.com

Kendo213 · ‎04-06-2018

We have a virtualization index with no restrictions currently as far as hot/warm/cold. After about 4 months we're sitting at 16GB indexed per day (average) with 1.8 TB (compressed) on disk and searchable. I'm proposing that we set a hard cap on this, as I don't believe keeping all of the data around is useful. I'm looking to leverage summary indexes so that I can somehow summarize the data and then dump it. For example, grab the average CPU/memory usage and dump it to a summary index, but not to keep the source data around for long. I do see how I can create a saved search that outputs to a summary index in short timespans (i.e. last hour) however, how would I do this retroactively on 1.8 TB worth of data in chunks so that trends can be seen? If I need to clarify the question let me know. Thanks

Kendo213 · ‎03-28-2018

I could only get this working by putting the URL to the metric I'm wanting to track in the Endpoint URL field. If I put the base IP in the URL, and then added URL arguments, it wouldn't work. I'm not sure why this is the case 😕

Kendo213 · ‎03-28-2018

It works when I test it via a little Chrome extension. So I know the permissions are correct, and the URL parameters are correct. So, I'm assuming I'm just not putting it in correctly in the app 😕 However, there is no indication in splunkd.log of a mis-configuration, so I'm not sure. If I login to the EMC console in Chrome, and then bring up Restlet, and perform a GET against https://ip/api/types/metricValue/instances?filter=path eq "sp.*.cpu.summary.utilization" &per_page=1 I receive the json format return I'm expecting.

Kendo213 · ‎03-28-2018

That's the app I'm using, and that is returning the data I provided in the original post. I'm using the GUI to input the parameters for the REST API of the EMC Unity array.

Kendo213 · ‎03-28-2018

I'm attempting to get some data out of an EMC Unity Array. Using the Restlet Chrome Extension, I can get valid data back with this URL: https://IP/api/types/metricValue/instances?filter=path eq "sp.*.cpu.summary.utilization" &per_page=1 When I configure the REST Modular Input the same way, I get no data basically. Here is what I receive: <!DOCTYPE html><html><head><meta http-equiv="Cache-Control" content="no-store"; charset=UTF-8 > <script type="text/javascript">function getUrlVars(location) { var vars = [], hash; var hashes = location.href.slice(location.href.indexOf('?') + 1).split('&'); for(var i = 0; i < hashes.length; i++){ hash = hashes[i].split('='); vars[hash[0]] = hash[1]; } return vars;}var winlocation = window.location;var hrefSplit = winlocation.href.split('#'); var destloc = '/misc/index.jsp' + '?' + 'url=' + encodeURIComponent(hrefSplit[0])+'&'+'hash='+encodeURIComponent(hrefSplit[1]);var casHomeValue=getUrlVars(winlocation)['casHome'];if (casHomeValue) { destloc += '&' +'casHome'+'='+encodeURIComponent(casHomeValue);}window.location=destloc;</script></head></html> The documentation is pretty slim, so I'm assuming I'm doing it wrong. Any ideas?

Kendo213 · ‎03-23-2018

timechart last(PercentUsed) doesn't seem to show a value, although chart last(PercentUsed) does. If I do that, and set the threshold field as last(PercentUsed) I'm still not populating any data. Am I doing what you were recommending, just to clarify?

Kendo213 · ‎03-22-2018

Is this possible? I have some searches I use for dashboards where I'm doing various evals. For example, I'm evaluating the storage free percent field, and then attempting to use that as the threshold field in ITSI. It doesn't seem to see the data, can't do a back fill, it's listed as N/A, etc.

Kendo213 · ‎03-15-2018

Is there a way to pull a list of running processes and the CPU % usage per process via Splunk natively? Using Powershell isn't proving to be that useful. For example, get-process | select name,CPU will give you the CPU time, but not the CPU percentage. Various scripts I've tried aren't successful at converting to a percentage.

Kendo213 · ‎03-14-2018

This seems to cut off about 30 seconds on average. index=systems sourcetype=WindowsUpdateLog "Installation started" | search [inputlookup serverlist.csv | rename cn as host] | stats count by host I'm not sure from a Splunk perspective why that is, but it seems to work and run quickly (last run was 2 seconds vs 39)

Kendo213 · ‎03-14-2018

I do see that, however it's only returning the first host in the results. Is that expected?

Kendo213 · ‎03-14-2018

This does return much faster. Could you explain from a technical perspective why that is? Thanks

Kendo213 · ‎03-14-2018

I have this, however it's really slow...Is there a faster way to get this to run? Basically we're wanting to narrow down Windows Install events to servers, and not desktops. index=systems sourcetype=WindowsUpdateLog eventtype=Update_Successful [inputlookup serverlist.csv | table cn | rename cn as host] | stats count by host Would it be faster to have an inputlookup with workstation names and just a where clause host != workstationname?

Kendo213 · ‎03-14-2018

I have a CSV that I've created via ldapsearch, that contains a single column with 'cn' and then a list of servers. I want to search a sourcetype on each of these servers for a keyword. I'm having difficulty figuring this out. Any ideas?

Kendo213 · ‎10-23-2017

I'm looking to graph out the average of "Processor Queue Length" perfmon per day over the last couple of months. I can get the average for that 2-month period, but I want to graph to show the increase in queue over the course of the last couple of months. Essentially my search to see the average of this event looks like this so far (just a simple search): index=perfmon sourcetype="Perfmon:System" counter="Processor Queue Length" | stats avg(Value) as avgnum How can I go about doing this?

Kendo213 · ‎08-18-2017

I have the Splunk Addon for SQL Server installed on some SQL servers and search heads. We have active SQL servers sending in data, however none of it is being tagged as database by Splunk ITSI / the TA. Because of this, none of the default built-in KPIs for database are working in ITSI (tag=database returns nothing). Any ideas?

Kendo213 · ‎08-14-2017

We have a table within an MSSQL database that contains application logs. The issue is that each time dbconnect queries that table, it (obviously) pulls all of the data in that specific table. How can I get around this? How can I ensure I'm only pulling in NEW rows since the last time dbconnect was ran? We don't want duplicate data to be indexed obviously as it will be confusing and searches will return incorrect results.

Kendo213 · ‎03-20-2017

I've sent a copy to that e-mail. Thanks!

Kendo213 · ‎03-20-2017

Michael, Thanks for the quick response. I e-mailed you at that e-mail address with more details. Thanks! Jerad

Kendo213 · ‎03-20-2017

Michael, Thanks for the response. I have added the additional SID in the data input, however it states that no arrays are found, and also that performance statistics need to be registered for the remote array according to the log files. The array has been registered for performance, as it works if I use the Unipshere IP for that array. I misunderstood your response. It looks like I need to deploy another search head / heavy forwarder. Thanks! Jerad

Kendo213 · ‎03-16-2017

In this case I'm using the Dell EMC VMAX Add-on for Splunk (TA_Dell_VMAX) to monitor an array. It only allows for one IP to be specified, and we have an additional VMAX array that needs to be monitored. How can I go about duplicating this add-on on my search head so I can monitor both arrays? Is this even possible?

Posts	105
Solutions	2
Karma Given	1
Karma Received	5
Member Since	‎04-23-2013

Online Status	Offline
Date Last Visited	‎02-23-2021 04:23 PM

Threshold Fill Settings

TA-WebTools

Base Searches

Stored Procedures

Splunk Stream - Distributed Forwarder Management

Splunk Stream

Search Question

Dashboard Comments Field

CSS / JS Not Loading on Dashboard

Javascript Not Loading

Re: Why is the Powershell Modular Input not schedu...

Why is the Powershell Modular Input not scheduling...

Re: Splunk Index Clustering

Re: Splunk Index Clustering

Splunk Index Clustering

How to leverage summary indexes so that it can sum...

Re: How to configure the Splunk Rest Modular Input...

Re: How to configure the Splunk Rest Modular Input...

Re: How to configure the Splunk Rest Modular Input...

How to configure the Splunk Rest Modular Input to ...

Re: How to use evaluated fields as threshold field...

How to use evaluated fields as threshold field in ...

CPU Usage by Process

Re: How to search Events on Hosts in Inputlookup F...

Re: How to search Events on Hosts in Inputlookup F...

Re: How to search Events on Hosts in Inputlookup F...

Re: How to search Events on Hosts in Inputlookup F...

How to search Events on Hosts in Inputlookup File?

Average per day line chart dashboard

Why does the database tag return nothing with Splu...

How can I prevent Splunk DB Connect from pulling i...

Re: Dell EMC VMAX Add-on for Splunk: How to duplic...

Re: Dell EMC VMAX Add-on for Splunk: How to duplic...

Re: Dell EMC VMAX Add-on for Splunk: How to duplic...

Dell EMC VMAX Add-on for Splunk: How to duplicate ...

Join the Conversation