Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About Branden
Branden
Builder
Member since:
07-19-2010
02-23-2026
Community Statistics
| Posts | 258 |
| Solutions | 3 |
| Karma Given | 91 |
| Karma Received | 82 |
| Member Since | 07-19-2010 |
Activity Feed
- Got Karma for Re: log4j exploit - how do I remedy?. 02-23-2026 11:18 PM
- Karma CVE-2025-68161 - which version of Splunk Enterprise is this vulerability fixed in? for Dabbsy. 02-23-2026 11:18 AM
- Posted Re: log4j exploit - how do I remedy? on Splunk Enterprise. 02-23-2026 11:12 AM
- Karma Re: log4j exploit - how do I remedy? for richgalloway. 02-23-2026 11:12 AM
- Posted log4j exploit - how do I remedy? on Splunk Enterprise. 02-06-2026 11:47 AM
- Posted Splunk Connect for SNMP documentation help on All Apps and Add-ons. 01-27-2026 07:18 AM
- Posted Re: SAML Login problem: Saml response does not contain group information. on Splunk Enterprise. 12-13-2024 06:24 AM
- Posted SAML Login problem: Saml response does not contain group information. on Splunk Enterprise. 12-12-2024 12:37 PM
- Karma Re: How do I enforce disk usage on volumes by index? for PickleRick. 11-19-2024 09:02 AM
- Posted Exporting/Importing a CSV to new Splunk Enterprise instance on Other Usage. 11-19-2024 09:01 AM
- Posted Re: How do I enforce disk usage on volumes by index? on Deployment Architecture. 11-08-2024 11:03 AM
- Posted How do I enforce disk usage on volumes by index? on Deployment Architecture. 11-08-2024 09:57 AM
- Karma Re: Why did Universal forwarder 9.1.0 (linux) change owner? for auradk. 10-07-2024 07:26 AM
- Karma Why did Universal forwarder 9.1.0 (linux) change owner? for auradk. 10-07-2024 07:26 AM
- Karma Splunk Indexers — ext4 vs XFS filesystem performance for gjanders. 10-01-2024 10:57 AM
- Posted UF Upgrade to 9.0.1 - disable kvstore? on Installation. 10-28-2022 10:20 AM
- Posted Export unlimited results from CLI search - not working on Splunk Search. 01-26-2022 11:54 AM
- Tagged Export unlimited results from CLI search - not working on Splunk Search. 01-26-2022 11:54 AM
- Got Karma for Re: splunk thinks text file is binary. 06-30-2020 11:34 PM
- Karma Re: rsyslog server with UF not sending events to Splunk for solarboyz1. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-13-2010
12:37 PM
3 Karma
Hi. We have script that Splunk runs every 15 minutes. The script checks to see if a partition is using the primary or back-up ethernet adapter. If it is using the back-up adapter, it notifies us via e-mail.
This alert works great except for one thing: it will repeat the alert every time the script runs. That means we get alerted every 15 minutes, which creates a cluttered mailbox in the morning.
I realize that this may be expected behavior. I'm wondering if anyone has a procedure or trick to prevent a repeat alert from going out.
I'm running Splunk 4.1.5 on the indexer and 4.1.4 on the forwarders.
Thanks!
... View more
- Tags:
- alert-scripts
- alerts
09-12-2010
02:08 PM
I think you need to include the [get_project_num] stanza in your transforms.conf. Like this:
[get_project_num]
SOURCE_KEY = MetaData:Source
REGEX = C:\splunk-data\([0-9-])\([0-9-])
FORMAT = project_number::"$1"
WRITE_META = true
I think your regex may be off too. In your inputs.conf, you're monitoring "c:\splunk-data...*". But your transforms.conf regex includes a slash after c:\splunk-data. That may be correct, but it looks inconsistent with what you typed as your inputs.conf example.
Anyways, I hope this helped. 🙂
... View more
09-08-2010
06:31 PM
I read a similar post about this here but I'm not sure I completely understand.
My tomcat log name looks like this:
tomcat_access_log.2010-09-08.txt
I understand I can just monitor for /tomcat/logs/tomcat_access_log* (right?)
When it gets indexed, I don't want the source to be called "tomcat_access_log.2010-09-08.txt". I'll end up with hundreds more sources. I'd rather it simply be called "tomcat_access_log" or something like that.
So let me take a stab at this:
In inputs.conf:
[monitor:///tomcat/logs/tomcat_access_log*]
sourcetype = tomcat-access
In props.conf:
[tomcat-access]
TRANSFORMS-rename_source = drop_trailing_text
In transforms.conf:
[drop_trailing_text]
DEST_KEY = MetaData:Source
SOURCE_KEY = MetaData:Source
REGEX = source::(.*)\d\d\d\d-\d\d-\d\d.txt
FORMAT = source::$1
I guess it's the REGEX I'm uncertain about.
Am I on the right track?
Thanks!
... View more
- Tags:
- rotating-logs
- tomcat
09-08-2010
05:49 PM
In your savedsearches.conf, make sure the following is set for the search in question:
action.email.sendresults = 1
... View more
09-08-2010
03:52 PM
1 Karma
Thank you for the response. That procedure tells me how much as indexed in GB, but it doesn't give me much more granularity than that. I'll play with it though and see what I can come up with. Thanks!
... View more
09-08-2010
03:51 PM
1 Karma
Thank you for the response. I was able to narrow down the host that it's coming from (wasn't the host I was expecting!) but I can't tell WHAT on the host is causing it. I am wondering if one of the log files has spun out of control or something. Is there a way to get that information?
Thanks!
... View more
09-08-2010
01:36 PM
Oooh. I'm not sure how to advise you in that case. I was going to suggest simply re-creating the User role via the manager. I believe there's a way to do it from the file system without logging in. Perhaps someone on here will know the answer to that.
... View more
09-08-2010
12:59 PM
1 Karma
Do you mean you can no longer log in to Splunk at all, even as the admin user?
If you can log in as admin, what happens when you try to re-create the User role?
... View more
09-08-2010
12:21 PM
3 Karma
The amount of data I index daily is pretty consistent for the most part. I suppose it's gradually increasing, but no big deal.
But once in a while there is a day where there is a 100% increase in the amount of data indexed.
I suspect it's one log/one forwarder that's doing it. And I have a hunch as to what log it is, but I can't demonstrate that in Splunk.
This is supposed to be easy with Splunk, but I can't figure this out. What is the best way to track which forwarder is the source of the spike? How can I narrow down the log that is causing this?
Thanks!
... View more
- Tags:
- indexing
09-08-2010
12:16 PM
I'm curious to see what kind of response you get to this question.
I run in an environment similar to yours- Indexer running on an LPAR running AIX 6.1 (Was on 5.3 just a few weeks ago tho), 1.5 POWER6 CPUs capped, 4 GB of RAM. We haven't experienced the performance problem that you're experiencing, but we're not indexing as much data as you.
(Calculating the same license usage for us takes only about 12 seconds, not the 2+ minutes you're experiencing.)
How long have you been running Splunk?
I do notice that Splunk becomes a CPU hog when it is first started, but it settles down after a little while. But it sounds like your problem goes far beyond that.
Out of curiosity, what kind of disk are you using?
... View more
09-07-2010
01:35 PM
1 Karma
I've found that the first time Splunk is installed on a system, it uses more resources than normal. It's probably because it has to index EVERYTHING the first time around. After I let it run for a [long] while, it catches up and settles down.
For whatever it's worth...
... View more
09-07-2010
01:32 PM
Interesting point. I mentioned that to the support engineer. I'll see what they come back with. Thank you again for all your help.
... View more
09-03-2010
09:44 PM
I sometimes have the same problem as you, and we're also running AIX. I'm curious to see what responses you get to this post.
I don't know if this is related or not (probably not), but I noticed the 5-10 minute stop times on Splunk didn't happen as often after we moved to AIX 6.1. That's probably a coincidence, but I thought I'd point it out.
... View more
09-03-2010
07:30 PM
Splunk support got back to me. My indexer is running 4.1.4, but my forwarders are running 4.0.9. 4.0.X and 3.X versions do not handle files/input over less than 256 bytes very well. Each errpt entry is 64 bytes. I will upgrade the forwarders next week and see what happens.
... View more
09-03-2010
02:54 PM
I think I'm going to open a case with Splunk tech support on this one. Two of the errpt entries just got indexed over 10,000 times. Oops!
... View more
09-03-2010
01:08 PM
Question edited with inputs.conf and props.conf errpt stanzas. Thanks!
... View more
09-02-2010
05:01 PM
Correct, it is not a file; it's capturing the output of the errpt command. It should only be giving back items from the past 60 seconds... even if there was a duplicate because of my logic, I could see it indexing twice, but not 3-5 times. I'm certain the script is only running in one place.
Actually, this all started after fixing the previous issue I wrote about with the errpt command (splitting it up into individual lines). I'm not sure if that's related or not...
... View more
09-01-2010
06:00 PM
They're one line long, just like above.
It's possible they could be multiple lines if there were multiple errors within that one minute.
... View more
09-01-2010
04:37 PM
1 Karma
I'm having what appears to be a logic problem, but it could be something else.
I have an app that displays the output of an error log. Output looks something like this (may be familiar to those who have been helping me with other issues):
AA8AB241 0901122910 T O OPERATOR OPERATOR NOTIFICATION
It parses the timestamp correctly. The error log script outputs any errors that have occurred in the past 60 seconds, and Splunk runs that every 60 seconds.
Unfortunately, it appears to be indexing it 3-5 times. In other words, for each one of those entries, I get 3-5 identical entries in the index.
I'm wondering if it has to do with my "every 60 seconds, produce results from the past 60 seconds" logic. Or could it be something else?
Any feedback is appreciated.
Thanks!
Edit:
Here is the inputs.conf file (note: this is on the forwarder):
[script://splunk/etc/apps/all/bin/errptsplunk.sh]
interval = 60 # Run every minute
sourcetype = errpt
source = script://./bin/errptsplunk.sh
And props.conf (on the indexer):
[errpt]
SHOULD_LINEMERGE = false
TIME_PREFIX = ^\S+\s+
TIME_FORMAT=%m%d%H%M%y
MAX_TIMESTAMP_LOOKAHEAD = 25
... View more
- Tags:
- indexing
09-01-2010
01:41 PM
2 Karma
The e-mail that an alert sends out isn't the prettiest e-mail in the world. It produces a pretty-wide HTML table with fields that we don't need.
Is there a way to customize the e-mail output? I think someone asked a similar question on here a while ago, and the answer involved modifying a python script. I'd prefer not to go that route...
Thanks!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-23-2026
11:51 AM
|
