Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sushildabare
sushildabare
Path Finder
Member since:
06-08-2011
06-05-2020
Community Statistics
| Posts | 27 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 5 |
| Member Since | 06-08-2011 |
Activity Feed
- Got Karma for How to use Splunk for root cause analysis for SAP application?. 01-29-2021 02:23 PM
- Got Karma for move some content/source from one index to another index. 06-05-2020 12:46 AM
- Got Karma for move some content/source from one index to another index. 06-05-2020 12:46 AM
- Got Karma for move some content/source from one index to another index. 06-05-2020 12:46 AM
- Got Karma for crcSalt issue. 06-05-2020 12:46 AM
- Posted Re: Splunk removing perflib.dll? on Getting Data In. 12-20-2011 01:43 AM
- Posted Re: Splunk forwarder is interfering with other monitoring tool on Monitoring Splunk. 12-14-2011 09:16 PM
- Posted Splunk forwarder is interfering with other monitoring tool on Monitoring Splunk. 12-14-2011 03:01 AM
- Tagged Splunk forwarder is interfering with other monitoring tool on Monitoring Splunk. 12-14-2011 03:01 AM
- Tagged Splunk forwarder is interfering with other monitoring tool on Monitoring Splunk. 12-14-2011 03:01 AM
- Posted Re: crcSalt issue on Getting Data In. 12-01-2011 01:29 AM
- Posted Re: crcSalt issue on Getting Data In. 11-30-2011 08:36 PM
- Posted Re: crcSalt issue on Getting Data In. 11-29-2011 10:13 PM
- Posted crcSalt issue on Getting Data In. 11-29-2011 02:43 AM
- Tagged crcSalt issue on Getting Data In. 11-29-2011 02:43 AM
- Tagged crcSalt issue on Getting Data In. 11-29-2011 02:43 AM
- Posted Re: Retirement and archiving period for one file on Splunk Search. 11-24-2011 06:34 AM
- Posted Re: Retirement and archiving period for one file on Splunk Search. 11-23-2011 09:58 PM
- Posted Re: Retirement and archiving period for one file on Splunk Search. 11-23-2011 09:57 PM
- Posted Re: Retirement and archiving period for one file on Splunk Search. 11-23-2011 09:23 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 3 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
12-20-2011
01:43 AM
Hello,
Did you find any solution for this problem. In my systems also splunk forwarder is conflicting with sitescope monitors. sitescope is not detecting any disks, CPU etc..
Please suggest if you have found any solution for this.
... View more
12-14-2011
09:16 PM
We are using seperate users for running splunk and sitescope and Permissions are correct.
Also we have changed the forwarder management port to different port 8090 and rebooted the server. Still we are facing the issue, please advice what needs to be done.
... View more
12-14-2011
03:01 AM
We have installed splunk universal forwarder and its working fine.
But its interfering with other monitoring tool(HP sitescope) which we are using to monitor the server
diskspace, CPU, memory,ports etc.
We did the following tests.
1 forwarder is installed and we tried to create disk space monitor in our HP sitescope, which is not possible. Its same even when we disabled the splunk service.
2. But we are able to create monitor in our sitescope when splunk was completely uninstalled.
so we conclude that splunk is interfering with our HP sitescope monitoring tool.
Can anyone please suggest what could be the reason for this and how to solve this issue.
... View more
- Tags:
- interfering
- splunk
12-01-2011
01:29 AM
Hi,
Thanks for your answer.
Before trying the fixed string, we did try "crcSalt = " which did not work as well.
That time also it was showing only first few lines not the full file content.
Moreover the file in question does not get updated very often(may be once/twice a year this file will be modified with few new lines), still splunk is not indexing it.
Without using crcSalt also splunk was not indexing this file.
Please suggest how to fix this.
Thanks
Rajashekhar
... View more
11-29-2011
02:43 AM
1 Karma
We have used below monitor in inputs.conf
[monitor:///usr/sap/IXP/SYS/profile/DEFAULT.PFL]
disabled = false
sourcetype = defprof
index = erp
crcSalt = defprof
Few days back I could see the full content of this DEFAULT.PFL file in indexer search.
Suddenly today when I searched the same its showing only first 4-5 lines of this file.
I checked in somefile.out file, but no errors there.
But when I changed the sourcetype and crcSalt string suddenly I could see the full file content in Indexer.
Please let me know what could be the reason for this and why its working after changing the string. This is very strange, kindly help us to fix this issue.
Thanks|Rajashekhar
... View more
11-24-2011
06:34 AM
Thanks a lot for your help..
... View more
11-23-2011
09:58 PM
[default]
frozenTimePeriodInSecs = 7776000
[XYZ]
frozenTimePeriodInSecs = 188697600
[erp]
coldPath = $SPLUNK_DB\erp\colddb
[erp_maxdb]
coldPath = $SPLUNK_DB\erp_maxdb\colddb
etc etc.... for remaining indexes.
I have used 3 months in [default] stanza which will be global setting.Will this keep data of all indexes for 3 months and XYZ index data for 6 years? Please confirm.
... View more
11-23-2011
09:57 PM
We have decided to go for creating a seperate index(say XYZ) for these files. Now we have around 10 indexes for which we will modify the indexes.conf file in the path D:\Program Files\Splunk\etc\apps\search\local
For 9 indexes we need to set frozenTimePeriod 3 months and only for this new index we want to keep it for 6 years so will the below indexes.conf file works fine ?
... View more
11-23-2011
09:23 AM
Hi Sean,
Thanks again! To create summary index I need to follow the steps mentioned in http://docs.splunk.com/Documentation/Splunk/4.2.4/Knowledge/Usesummaryindexing
section, "Setting up Summary index searches in splunk web" right ?
Actually we need the entire file content not only changes..
I will send you data sample of one of the file tomorrow as I cannot access my server now.
Thanks~
... View more
11-23-2011
09:01 AM
3 Karma
Hi,
Can we move only selected file content from one index to another index.
I want to move only selected source/content not the ful index data, is it possible?
Thanks~
... View more
11-23-2011
08:34 AM
Hi Sean,
Thank you for your detailed explaination.
After 3 months, if the file in question has not yet changed then splunk will not reindex it automatically, I agree to this. Kindly clarify on below..
1. After 3 months can we get search results for these files(purged data, which is not reindexed) as we used to get before 3 months? I think search will not give any results, But please confirm on this.
2. Suppose the file is changed after 6 months will splunk read it and reindex it automatically?
Thanks~
... View more
11-23-2011
07:39 AM
Thanks Ayn and Sean for your inputs, I completely agree with Ayn, realtime searching events will be shown as they arrive in realtime.
... View more
11-23-2011
01:42 AM
We have a text file DEFAULT.PFL(which has just 3 lines of text) in all the below paths
/usr/sap/IX4/SYS/profile
/usr/sap/IXV/SYS/profile
/usr/sap/IXD/SYS/profile
/usr/sap/IXT/SYS/profile
And I am using
[monitor:///usr/sap/IX4/SYS/profile]
disabled = false
sourcetype = IX4webdisp_profile
index = erp_webdisp
crcSalt = IX4webdisp_profile
Similarly I have created monitors for other file paths.
Splunk is reading all other files except the DEFAULT.PFL in all the above file paths.
I tried to create seperate monitor [monitor:///usr/sap/IX4/SYS/profile/DEFAULT.PFL]
but still splunk does not read this file. All file permissions are same.
Please let me know how to read this file..
... View more
- Tags:
- file-monitoring
- monio
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma from
