Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About ansif
ansif
Motivator
Member since:
10-07-2017
11-28-2022
Community Statistics
| Posts | 323 |
| Solutions | 17 |
| Karma Given | 32 |
| Karma Received | 29 |
| Member Since | 10-07-2017 |
Activity Feed
- Posted Re: Is there a way for Lookup file to return field names? on Splunk Search. 11-23-2022 07:33 PM
- Posted Re: Is there a way for Lookup file to return field names? on Splunk Search. 11-23-2022 07:19 PM
- Posted Is there a way for Lookup file to return field names? on Splunk Search. 11-23-2022 12:40 PM
- Got Karma for Re: SH clustering and monitoring console. 04-18-2022 12:20 PM
- Got Karma for Re: License pools for Indexes rather than Indexers. 07-27-2021 02:40 AM
- Posted Re: How to resolve splunkd error when sending Meraki Alerts to Splunk HTTP Event Collector Endpoint? on Alerting. 04-22-2021 04:00 AM
- Posted Re: Is there a base_config available for SHC? on Deployment Architecture. 12-09-2020 07:59 PM
- Posted Re: License usage over 7days on Monitoring Splunk. 07-20-2020 11:15 AM
- Posted curl command not working may be a format issue - webtools addon on All Apps and Add-ons. 06-11-2020 12:09 AM
- Karma Re: windows 2003 servers monitor using Splunk 8.0 for Richfez. 06-05-2020 12:51 AM
- Got Karma for Is there a base_config available for SHC?. 06-05-2020 12:51 AM
- Karma Re: Universal Forwarder to report 2 Indexer for gcusello. 06-05-2020 12:50 AM
- Karma Re: SolarWinds Add-on for Splunk in Splunk 7 Version for vishaltaneja070. 06-05-2020 12:50 AM
- Karma Verifying Secure Communication between forwarders and indexers for anoopdi. 06-05-2020 12:50 AM
- Karma Re: SAP Solman Technology Addon License for Esky73. 06-05-2020 12:50 AM
- Karma Re: Query about Architect Exam (recertification) for koshyk. 06-05-2020 12:50 AM
- Got Karma for Exported addon from Splunk addon builder but unable to see inputs or configuration form. 06-05-2020 12:50 AM
- Got Karma for How to enable basic authentication in Splunk addon builder rest api input?. 06-05-2020 12:50 AM
- Got Karma for Re: Splunk Integration with HPE Systems Insight Manager. 06-05-2020 12:50 AM
- Karma Re: Load Balancer between Heavy Forwarder and Indexers for harsmarvania57. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-11-2018
08:47 PM
Hi @pauloyelakin :The internal logs from Splunk software are useful for troubleshooting or metric analysis.
http://docs.splunk.com/Documentation/Splunk/7.0.2/Troubleshooting/WhatSplunklogsaboutitself
May I know where the indexes.conf file is placed (Server and the dir)? If it is not placed in indexer then all parameters get dropped at indexer.
Regarding risen300 check if deployment server -> setting -> Forwarder Management has this server and Splunk service is running on this host. And check if the your single host (risenlab1) has only one dns name.
... View more
02-10-2018
11:50 AM
Which login user you are?If not admin , check with admin user login.
... View more
02-09-2018
06:14 AM
Additional detail:
Health score is calculated as weighted sum of all KPI status * importance 🙂
Upvote and Accept answer if it works.
... View more
02-09-2018
06:00 AM
Thanks for the response - I think I follow (I've only had limited exposure to SPLUNK so far). So, you are saying that the overall Service Health score in my example will only take into account the GREEN "Normal" statuses of the 3 services beneath it, which is why it displays a score of 100, even though one of the others is less that 100 (but is still NORMAL)..?
yes
The service health score is not calculating as (1+2+.....+n)/n.
ITSI calculates Service health score in different way and it take "status" in account.
If you still need to get ~97.91,you need to adjust the weightage on KPI level and on Parent service Health score level also.
... View more
02-09-2018
05:30 AM
For your first question related to equal distribution,you will need to configure load balancer with autolbvolume to equally distribute data. Fortunately Splunk has its own loadbalancer.
https://docs.splunk.com/Documentation/Forwarder/7.0.2/Forwarder/Configureloadbalancing
Second,
It is best practice to send search head data to indexer (as it maintains all instance data in Indexer) It is upto you whether data needs to forward to Indexer or not from Search Head.Since one of your search head is sending data why cant you configure SH2 also to send data to Indexer.
https://docs.splunk.com/Documentation/Splunk/7.0.2/DistSearch/Forwardsearchheaddata
NB:- You can use Splunk LB from SH to IDX also.
... View more
02-09-2018
05:23 AM
Let me understand the question correctly,why cant you schedule interval in inputs.conf?
... View more
02-09-2018
04:41 AM
@svemuric : The issue has been fixed by creating KPI itself. Attaching KPI settings for others who requires:
Treat Gap in data as Normal.
... View more
02-09-2018
03:19 AM
How ITSI Score works?
@RussSmith : Please find the below details,
In the above example,taking Database:
%Memory Used : 87.6 Normal
%CPU Used : 9.168 Normal
%Free Space : 17.324 Normal
See the composite score is showing 100% since all KPI's are Normal.When you change the severity to simulate like if CPU Utilization went Medium your over score get change.
Now coming to your question,you wish to see the overall score as not 100%.In that case you need to define like below:
In the above screenshot you could see that if free space is medim then overall score is 80 and in Low Status (not Normal)
So it is required to define KPI in such a manner it should change the status of over all score.
Since the overall status changed now it will get reflect in Parent Service.
NB:- The overall score calculation is based on Status also.
... View more
02-09-2018
01:39 AM
Rolling to frozen bucket from cold we can configure to run a script.
You can achieve data upload to google cloud using the script.
... View more
02-09-2018
01:31 AM
1 Karma
On 1st instance make the Licence mode as slave:
http://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/Configurealicenseslave
... View more
02-07-2018
04:13 AM
@SeanPLittle : It is easy,you need to create an aggregation policy under configure->notable_event_aggregation_policies
There you can group events and in action you can send mail or tickets or run a script etc...
https://docs.splunk.com/Documentation/ITSI/3.0.1/User/CreateAggregationPolicies
... View more
02-07-2018
04:04 AM
Dont you see any clue from Indexer and UF _internal logs.Just search for this indexname as keyword.
... View more
02-06-2018
09:20 PM
You need to configure inputs.conf on syslog server with the Indexname
If you have not changed the default path of Splunk DB then the index will be available under $SPLUNK_HOME/var/lib/splunk dir
You can check if data get indexed using the search below:
index=indexname
... View more
02-06-2018
09:13 PM
It is admin/changeme
Check if capslock is on
Check the text by entering it in a text file and check if Keyboard input is correct.
... View more
02-06-2018
09:08 PM
We had same issue ,when data fetches from summary index it shows no data but when disabling Summary Index it works.
Our problem resolved by adding more roles to admin.Try to play around roles and check if the serach works with Summary.
try to add all app_admin and user.
... View more
02-06-2018
08:59 PM
For me a reboot helped.
You can also check the user permissions.
... View more
02-06-2018
08:54 PM
Whats the challenge on mimic their index name and define in your environment. Do you want to keep all security logs in same index?
... View more
02-06-2018
08:46 PM
1 Karma
You can use the polling interval to set the time interval to poll the data:
... View more
02-06-2018
08:37 PM
inputs.conf
[WMI:LocalMainMemory]
interval = <Interval_Time>
wql = select CommittedBytes, AvailableBytes, PercentCommittedBytesInUse, Caption from \
Win32_PerfFormattedData_PerfOS_Memory
disabled = 0
index = <IndexName>
[WMI:process]
index = <IndexName>
disabled = 0
interval = <Interval_Time>
wql = Select IDProcess,Name,PercentProcessorTime,TimeStamp_Sys100NS from Win32_PerfRawData_PerfProc_Process
Search Query:
index=<INdexName> sourcetype="WMI:process" Name!=_Total Name!=Idle
You can try this:
index=<INdexName> sourcetype="WMI:process" Name!=_Total Name!=Idle
| reverse | streamstats current=f last(PercentProcessorTime) as last_PercentProcessorTime last(Timestamp_Sys100NS) as last_Timestamp_Sys100NS by Name
| eval cputime = 100 * (PercentProcessorTime - last_PercentProcessorTime) / (Timestamp_Sys100NS - last_Timestamp_Sys100NS)
| search cputime > 0
| timechart limit=50 useother=f avg(cputime) by Name
... View more
02-06-2018
08:13 PM
ServiceNow has a copy of all AD username and password. Splunk login page should authenticate with Service Now .Let me know the possible solutions for this.
If scripted authentication help let me know how can I achieve.
NB:- ServiceNow can exposed to Splunk using REST API to check authentication.
... View more
02-06-2018
05:58 AM
If it solved then you can make it as Accepted Answer. Others get benefit over this.
... View more
02-06-2018
04:23 AM
Just to make understand,Do you want to stop getting data or stop viewing data in dashboard?
... View more
02-06-2018
04:18 AM
1 Karma
For HP uCMDB 11 version REST API is supported,you can use REST API to get all interested data from uCMDB.
... View more
02-06-2018
04:15 AM
Go through the documentation again. I came across this kind of issue and when I check the supported ad add on is missing,once I added everything was working.
In your case just go thru the documentation again.
... View more
