About sushildabare

sushildabare · ‎12-20-2011

Hello, Did you find any solution for this problem. In my systems also splunk forwarder is conflicting with sitescope monitors. sitescope is not detecting any disks, CPU etc.. Please suggest if you have found any solution for this.

sushildabare · ‎12-14-2011

We are using seperate users for running splunk and sitescope and Permissions are correct. Also we have changed the forwarder management port to different port 8090 and rebooted the server. Still we are facing the issue, please advice what needs to be done.

sushildabare · ‎12-14-2011

We have installed splunk universal forwarder and its working fine. But its interfering with other monitoring tool(HP sitescope) which we are using to monitor the server diskspace, CPU, memory,ports etc. We did the following tests. 1 forwarder is installed and we tried to create disk space monitor in our HP sitescope, which is not possible. Its same even when we disabled the splunk service. 2. But we are able to create monitor in our sitescope when splunk was completely uninstalled. so we conclude that splunk is interfering with our HP sitescope monitoring tool. Can anyone please suggest what could be the reason for this and how to solve this issue.

sushildabare · ‎12-01-2011

Hi, Thanks for your answer. Before trying the fixed string, we did try "crcSalt = " which did not work as well. That time also it was showing only first few lines not the full file content. Moreover the file in question does not get updated very often(may be once/twice a year this file will be modified with few new lines), still splunk is not indexing it. Without using crcSalt also splunk was not indexing this file. Please suggest how to fix this. Thanks Rajashekhar

sushildabare · ‎11-30-2011

Can any one please provide your advice on this issue.

sushildabare · ‎11-29-2011

Please can any one help me on this issue.

sushildabare · ‎11-29-2011

We have used below monitor in inputs.conf [monitor:///usr/sap/IXP/SYS/profile/DEFAULT.PFL] disabled = false sourcetype = defprof index = erp crcSalt = defprof Few days back I could see the full content of this DEFAULT.PFL file in indexer search. Suddenly today when I searched the same its showing only first 4-5 lines of this file. I checked in somefile.out file, but no errors there. But when I changed the sourcetype and crcSalt string suddenly I could see the full file content in Indexer. Please let me know what could be the reason for this and why its working after changing the string. This is very strange, kindly help us to fix this issue. Thanks|Rajashekhar

sushildabare · ‎11-24-2011

Thanks a lot for your help..

sushildabare · ‎11-23-2011

[default] frozenTimePeriodInSecs = 7776000 [XYZ] frozenTimePeriodInSecs = 188697600 [erp] coldPath = $SPLUNK_DB\erp\colddb [erp_maxdb] coldPath = $SPLUNK_DB\erp_maxdb\colddb etc etc.... for remaining indexes. I have used 3 months in [default] stanza which will be global setting.Will this keep data of all indexes for 3 months and XYZ index data for 6 years? Please confirm.

sushildabare · ‎11-23-2011

We have decided to go for creating a seperate index(say XYZ) for these files. Now we have around 10 indexes for which we will modify the indexes.conf file in the path D:\Program Files\Splunk\etc\apps\search\local For 9 indexes we need to set frozenTimePeriod 3 months and only for this new index we want to keep it for 6 years so will the below indexes.conf file works fine ?

sushildabare · ‎11-23-2011

Hi Sean, Thanks again! To create summary index I need to follow the steps mentioned in http://docs.splunk.com/Documentation/Splunk/4.2.4/Knowledge/Usesummaryindexing section, "Setting up Summary index searches in splunk web" right ? Actually we need the entire file content not only changes.. I will send you data sample of one of the file tomorrow as I cannot access my server now. Thanks~

sushildabare · ‎11-23-2011

Hi, Can we move only selected file content from one index to another index. I want to move only selected source/content not the ful index data, is it possible? Thanks~

sushildabare · ‎11-23-2011

Hi Sean, Thank you for your detailed explaination. After 3 months, if the file in question has not yet changed then splunk will not reindex it automatically, I agree to this. Kindly clarify on below.. 1. After 3 months can we get search results for these files(purged data, which is not reindexed) as we used to get before 3 months? I think search will not give any results, But please confirm on this. 2. Suppose the file is changed after 6 months will splunk read it and reindex it automatically? Thanks~

sushildabare · ‎11-23-2011

Thanks Ayn and Sean for your inputs, I completely agree with Ayn, realtime searching events will be shown as they arrive in realtime.

sushildabare · ‎11-23-2011

We have a text file DEFAULT.PFL(which has just 3 lines of text) in all the below paths /usr/sap/IX4/SYS/profile /usr/sap/IXV/SYS/profile /usr/sap/IXD/SYS/profile /usr/sap/IXT/SYS/profile And I am using [monitor:///usr/sap/IX4/SYS/profile] disabled = false sourcetype = IX4webdisp_profile index = erp_webdisp crcSalt = IX4webdisp_profile Similarly I have created monitors for other file paths. Splunk is reading all other files except the DEFAULT.PFL in all the above file paths. I tried to create seperate monitor [monitor:///usr/sap/IX4/SYS/profile/DEFAULT.PFL] but still splunk does not read this file. All file permissions are same. Please let me know how to read this file..

sushildabare · ‎11-23-2011

When we perform All time search we get the results very quickly. But when we search by selecting Realtime(30seconds, 1 minutes, 60 minutes etc) search is very very slow, Is there any setting in splunk which we can set to improve this search response time for Real time searches? Thanks|

sushildabare · ‎11-23-2011

We have a file which will be updated very rarely(may be once a year or so that too may be a line will be added or deleted). We have used sourcetype = String crcSalt = String for this file in monitor input stanza. Without crcSalt Indexer is not reading this file. We have set retirement and archiving policy as 3 months for all splunk data. So after 3 months will splunk automatically read the above file with crcSalt? Can we modify the archiving period for only one source/file? say never archive, only for this one source. Thanks|

sushildabare · ‎11-15-2011

Thanks for answering! The requirement is when we extract few fields for example _ID,_TEXT from the above sample event, we want to display that in single line and other fields should not be shown at all. How can we achieve this.

sushildabare · ‎10-11-2011

Yes, we have used SOURCE in capital letters, below is the complete stanza [monitor:///usr/sap/IXV/SYS/profile] disabled = false crcSalt = index = erp And in Search field we are giving: host= "spwdfvml0247" source= "/usr/sap/IXV/SYS/profile" and searching over all time but still no events found. Thanks Raj.

sushildabare · ‎10-11-2011

We have 2 issues now. 1. We have added crcSalt = parameter in monitor stanza, but after that its consuming files and showing the files in input activity but problem is when we do the search with this source it does not retrieve any events. Please tell us how to overcome this issue. Also after adding crcSalt its comsuming all files(in input activity as said above in point 1) except one file DEFAULT.PFL and in somefile.out it shows same error for this file. ignored file (crc conflict, needs crcSalt)/s:key /s:dict /s:key etc etc What needs to be done to solve these problems?

sushildabare · ‎10-11-2011

Hello, We tried adding crcSalt = parameter in monitor stanza, but after that also its not working. Can you tell is this something related to CRC? as it shows in the error directory/s:key /s:dict /s:key /usr/sap/IX4/SYS/profile/s:key ignored file (crc conflict, needs crcSalt)/s:key /s:dict /s:key What needs to be done to solve this problem?

sushildabare · ‎10-09-2011

Hello, I get below error while using the command provided by you. directory/s:key /s:dict /s:key /usr/sap/IX4/SYS/profile/s:key ignored file (crc conflict, needs crcSalt)/s:key /s:dict /s:key what does this mean and what needs to be done to rectify the problem?

sushildabare · ‎10-05-2011

Hello, Yes, user is having full permission to access profile directory. Best regards, Kratika

sushildabare · ‎10-02-2011

Universal forwarder is installed in linux server spwdfvml0247. In this we have below folders exe,gen,global,profile,profile_back,src under the path spwdfvml0247:/usr/sap/IX4/SYS. Index server is installed on windows server spwdfvm1490. All data under the path /usr/sap/IX4/SYS is being passed/indexed to the indexer except 'profile' folder. Even if we monitor specific file in 'profile' folder its not getting passed/indexed in the index server. In input activity also this is not showing. Below is the monitor we are using in inputs.conf from forwarder spwdfvml0247:/opt/splunkforwarder/etc/apps/search/local # cat inputs.conf [monitor:///usr/sap/IXV/SYS/profile] disabled = false index = erp Please help and let me know why this monitor is not working and not getting indexed. Thanks Rajshekhar

sushildabare · ‎09-30-2011

Universal forwarder is installed in linux server spwdfvml0247. spwdfvml0247:/usr/sap/IX4/SYS # ll [we have below files under this path] [drwxr-xr-x 3 ix4adm sapsys 4096 Jul 14 2010 exe] [drwxr-xr-x 3 ix4adm sapsys 4096 Jul 8 2010 gen] [lrwxrwxrwx 1 ix4adm sapsys 18 Jul 8 2010 global -> /sapmnt/IX4/global] [lrwxrwxrwx 1 ix4adm sapsys 19 Jul 8 2010 profile -> /sapmnt/IX4/profile] [drwxr-xr-x 2 root root 4096 Sep 28 15:41 profile_backup] [drwxr-xr-x 2 ix4adm sapsys 4096 Jul 8 2010 src] Index server is installed on windows server spwdfvm1490. All data under the path /usr/sap/IX4/SYS is being passed/indexed to the indexer except 'profile' folder. Even if we monitor specific file in 'profile' folder its not getting passed/indexed in the index server. In input activity also this is not showing. Below is the monitor we are using in inputs.conf from forwarder spwdfvml0247:/opt/splunkforwarder/etc/apps/search/local # cat inputs.conf [monitor:///usr/sap/IXV/SYS/profile] disabled = false index = erp Please help and let me know why this monitor is not working and not getting indexed. Thanks Rajshekhar

Posts	27
Solutions	0
Karma Given	0
Karma Received	5
Member Since	‎06-08-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Splunk forwarder is interfering with other monitor...

crcSalt issue

move some content/source from one index to another...

Not monitoring DEFAULT.PFL

Realtime search is very slow

Retirement and archiving period for one file

universal forwarder monitor not working

Universal forwarder monitor not working

custom Blacklist not working correctly

How to use Splunk for root cause analysis for SAP ...

Re: Splunk removing perflib.dll?

Re: Splunk forwarder is interfering with other mon...

Splunk forwarder is interfering with other monitor...

Re: crcSalt issue

Re: crcSalt issue

Re: crcSalt issue

crcSalt issue

Re: Retirement and archiving period for one file

Re: Retirement and archiving period for one file

Re: Retirement and archiving period for one file

Re: Retirement and archiving period for one file

move some content/source from one index to another...

Re: Retirement and archiving period for one file

Re: Realtime search is very slow

Not monitoring DEFAULT.PFL

Realtime search is very slow

Retirement and archiving period for one file

Re: convert pseudo XML file content to readable fo...

Re: universal forwarder monitor not working

Re: universal forwarder monitor not working

Re: Universal forwarder monitor not working

Re: universal forwarder monitor not working

Re: universal forwarder monitor not working

universal forwarder monitor not working

Universal forwarder monitor not working