Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About ansif
ansif
Motivator
Member since:
10-07-2017
11-28-2022
Community Statistics
| Posts | 323 |
| Solutions | 17 |
| Karma Given | 32 |
| Karma Received | 29 |
| Member Since | 10-07-2017 |
Activity Feed
- Posted Re: Is there a way for Lookup file to return field names? on Splunk Search. 11-23-2022 07:33 PM
- Posted Re: Is there a way for Lookup file to return field names? on Splunk Search. 11-23-2022 07:19 PM
- Posted Is there a way for Lookup file to return field names? on Splunk Search. 11-23-2022 12:40 PM
- Got Karma for Re: SH clustering and monitoring console. 04-18-2022 12:20 PM
- Got Karma for Re: License pools for Indexes rather than Indexers. 07-27-2021 02:40 AM
- Posted Re: How to resolve splunkd error when sending Meraki Alerts to Splunk HTTP Event Collector Endpoint? on Alerting. 04-22-2021 04:00 AM
- Posted Re: Is there a base_config available for SHC? on Deployment Architecture. 12-09-2020 07:59 PM
- Posted Re: License usage over 7days on Monitoring Splunk. 07-20-2020 11:15 AM
- Posted curl command not working may be a format issue - webtools addon on All Apps and Add-ons. 06-11-2020 12:09 AM
- Karma Re: windows 2003 servers monitor using Splunk 8.0 for Richfez. 06-05-2020 12:51 AM
- Got Karma for Is there a base_config available for SHC?. 06-05-2020 12:51 AM
- Karma Re: Universal Forwarder to report 2 Indexer for gcusello. 06-05-2020 12:50 AM
- Karma Re: SolarWinds Add-on for Splunk in Splunk 7 Version for vishaltaneja070. 06-05-2020 12:50 AM
- Karma Verifying Secure Communication between forwarders and indexers for anoopdi. 06-05-2020 12:50 AM
- Karma Re: SAP Solman Technology Addon License for Esky73. 06-05-2020 12:50 AM
- Karma Re: Query about Architect Exam (recertification) for koshyk. 06-05-2020 12:50 AM
- Got Karma for Exported addon from Splunk addon builder but unable to see inputs or configuration form. 06-05-2020 12:50 AM
- Got Karma for How to enable basic authentication in Splunk addon builder rest api input?. 06-05-2020 12:50 AM
- Got Karma for Re: Splunk Integration with HPE Systems Insight Manager. 06-05-2020 12:50 AM
- Karma Re: Load Balancer between Heavy Forwarder and Indexers for harsmarvania57. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-13-2018
12:37 AM
Good that it works.You can make your answer as "Accepted Answer".
... View more
06-13-2018
12:32 AM
make index=_internal then search for source splunkd.log
... View more
06-12-2018
05:53 AM
I tested, the second installation is not allowing us to select custom location for new path.So upgrade not working 😞
... View more
06-12-2018
04:15 AM
I will get a windows test machine, let me check and confirm.
... View more
06-12-2018
04:02 AM
Just try upgrading forwarder in one of the server and choose custom installation to include your new path.I haven't tried this but I hope this works for you. (sorry that I don't have win test server to perform this by myself)
Once installation done copy conf and app to new location.Please let me know if it is working.
NB:- There is always a small disruption in the data collection when you do this.
... View more
06-12-2018
03:19 AM
Try upgrading forwarders with custom location. But you should backup existing apps and configuration and then move to new location.
... View more
06-12-2018
03:14 AM
Your splunkd.log has phonehome connection logs but it is not visible in Search head?Ami I right?
If so may I know your search query?
... View more
06-12-2018
03:00 AM
Try this:
index=something "%ETHPORT-5-IF_*" OR "(Link failure)" OR "changed state to down"|where cidrmatch("10.29.57.128 /25",ipfieldname)
... View more
06-12-2018
01:07 AM
Yes,I want to check this whether he is using the correct port or not.The splunk service restart command gives us web url with port number.
... View more
06-12-2018
12:55 AM
I don't know the query. If you find any log files that logs boot start then you can use that log file to search.
Rather you can use scripts to determine if boot start enabled or NOT.
For Windows forwarders use Powershell script to get Splunk service startup status.
Linux machines use shell script to check if Sxxsplunk link file exist under /etc/rc.d/rc3.d (example S90splunk )
Both scripts use your servernames as input.
... View more
06-12-2018
12:43 AM
I am not clear that what you want to achieve. Can you try below query and let me know if this is what you expected:
index =a OR index=b OR index=c |dedup test|table test
... View more
06-12-2018
12:32 AM
Convert 2 fields to epoch time then do a comparison using where command to list only events which occurred first.
... View more
06-12-2018
12:23 AM
Please paste textual format.
... View more
06-12-2018
12:10 AM
Yes Dev/Test License will replace Enterprise License. You cant stack both in single instance.
I think the purpose is to keep Dev/Test License in one instance to have a single instance to dev/test activity, and not to disturb other environment.
... View more
06-11-2018
11:59 PM
Start with the basic troubleshooting:
telnet deployment server from Search head to the management port and vice versa(default 8089).
Check if services are running on both instance.Do a restart on both instance.
Check deploymentclients configuration file under Search Head.(paste it here)
Let me know if any progress.
... View more
06-11-2018
11:51 PM
Actual fields can be extracted easily with the above search. Moving to another attribute before extracting is an additional overhead. SPATH can easily extract fields from JSON.
... View more
06-11-2018
08:38 AM
Why you wanna move like this?May I know what you gonna achieve out of this movement?
... View more
06-11-2018
04:04 AM
Where you are running this script?
Paste the whole script .
... View more
06-11-2018
03:29 AM
Not with Splunk built-in export that I know.But you can achieve this by Microsoft Print to PDF.I hope you tried this already.
... View more
06-11-2018
02:17 AM
Can you check your pass4symmkey attribute value.Make sure you are not copied junk character from any text editor.
... View more
06-11-2018
02:14 AM
For large environment it is recommended to have separate instance.
We in our environment kept Deployer and Cluster Master in same instance without any problem.But in case if we required to restart anyone of the splunk role then eventually it affects other role.Hope this helps.
And the above answer is absolutely right in case of large environment and which is very sensitive.
... View more
