Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About xuanyun
xuanyun
Path Finder
Member since:
06-05-2013
06-05-2020
Community Statistics
| Posts | 25 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 4 |
| Member Since | 06-05-2013 |
Activity Feed
- Got Karma for Re: How to edit my search for an alert to be triggered if a host's CPU load percentage exceeds 60%?. 06-05-2020 12:47 AM
- Got Karma for Re: How to edit my search for an alert to be triggered if a host's CPU load percentage exceeds 60%?. 06-05-2020 12:47 AM
- Karma SourceType using Props.conf and Transforms.conf for rmcdougal. 06-05-2020 12:46 AM
- Got Karma for Re: # The lookup table 'oracle_actions' does not exist. It is referenced by configuration 'oracle_syslog'. 06-05-2020 12:46 AM
- Got Karma for Re: # The lookup table 'oracle_actions' does not exist. It is referenced by configuration 'oracle_syslog'. 06-05-2020 12:46 AM
- Posted Re: How to edit my search for an alert to be triggered if a host's CPU load percentage exceeds 60%? on Alerting. 11-26-2014 04:21 AM
- Posted How to edit my search for an alert to be triggered if a host's CPU load percentage exceeds 60%? on Alerting. 11-25-2014 06:26 AM
- Tagged How to edit my search for an alert to be triggered if a host's CPU load percentage exceeds 60%? on Alerting. 11-25-2014 06:26 AM
- Tagged How to edit my search for an alert to be triggered if a host's CPU load percentage exceeds 60%? on Alerting. 11-25-2014 06:26 AM
- Tagged How to edit my search for an alert to be triggered if a host's CPU load percentage exceeds 60%? on Alerting. 11-25-2014 06:26 AM
- Tagged How to edit my search for an alert to be triggered if a host's CPU load percentage exceeds 60%? on Alerting. 11-25-2014 06:26 AM
- Posted Re: vmware app 2.0 error on splunk 6 on All Apps and Add-ons. 03-25-2014 04:33 AM
- Posted vmware app 2.0 error on splunk 6 on All Apps and Add-ons. 03-25-2014 12:04 AM
- Tagged vmware app 2.0 error on splunk 6 on All Apps and Add-ons. 03-25-2014 12:04 AM
- Posted Re: FAVM problem: error when running "enginebuilder.py" on All Apps and Add-ons. 03-19-2014 11:46 PM
- Posted Re: Can't monitor linux cpu on splunk6 via Splunk_TA_nix-5.0.1-185737 on All Apps and Add-ons. 03-19-2014 08:54 PM
- Posted Can't monitor linux cpu on splunk6 via Splunk_TA_nix-5.0.1-185737 on All Apps and Add-ons. 03-19-2014 08:31 PM
- Tagged Can't monitor linux cpu on splunk6 via Splunk_TA_nix-5.0.1-185737 on All Apps and Add-ons. 03-19-2014 08:31 PM
- Tagged Can't monitor linux cpu on splunk6 via Splunk_TA_nix-5.0.1-185737 on All Apps and Add-ons. 03-19-2014 08:31 PM
- Posted Re: Forward installtion issus on AIX 5.3 5700 but /bin/uname is needed on Getting Data In. 12-26-2013 08:38 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
Thank you very much!
That's very kind of you!
... View more
11-25-2014
06:26 AM
We use the following search to obtain information on Percent_CPU_Load.
index=os sourcetype=cpu | multikv fields pctIdle | eval Percent_CPU_Load = 100 - pctIdle | timechart avg(Percent_CPU_Load) by host
The search results show the Percent_CPU_Load of all the hosts.
I want an alert to be triggered when Percent_CPU_Load if any one of the hosts exceeds 60%.
How do I set the alert to meet the conditions above?
... View more
03-25-2014
04:33 AM
Thank you very much for your help.
How can I download vmware app 3.0.1?
It can't be downloaded for a long time.
... View more
03-25-2014
12:04 AM
Dear all:
When I used vmware app 2.0 on splunk 5, the app can run correct.
But unfortunately, the same app is error on splunk 6.0
I can't describe it so print screen as the URL http://postimg.org/image/ymkqq5rtr/
How can I solve it ?
Is it means vmware app 3.0.2 is needed on splunk 6.0?
... View more
03-19-2014
11:46 PM
Hi!
How do you solve this issus?
... View more
03-19-2014
08:54 PM
Thank you!
I miss check sysstat.
It's OK.
... View more
03-19-2014
08:31 PM
Hi expert:
Splunk 6.0 on Redhat5 x64
Forwarder 6.0 on SUSE Linux （Linux linux-jela 2.6.34-12-desktop #1 SMP PREEMPT 2010-06-29 02:39:08 +0200 x86_64 x86_64 x86_64 GNU/Linux）
unixTA Splunk_TA_nix-5.0.1-185737
I can't see the cpu value in Hosts tab. It show me 'CPU: unknown - is cpu.sh enabled?'
But the 'Ram' &'Disk' & 'Capacity' are correct.
I checked the inputs.conf in local file on the unixTA. The 'Shows stats per CPU (useful for SMP machines)' status is 'disabled = 0'.
When I run cpu.sh in /opt/splunkforwarder/etc/apps/Splunk_TA_nix/bin manually, but there is nothing result.
How can I solve the issus?
Thank you
... View more
12-26-2013
08:38 AM
splunkforwarder-6.0-AIX-powerpc.tgz
This is my installation file. I untar it get a file named "splunkforwarder" then I use 'smitty' to install it. But I saw the Error
... View more
12-23-2013
07:50 PM
Hi expert:
When I install the Forward on AIX system, there are some error.
Splunk forward version:6.0
AIX version: 5.3 5700
+-----------------------------------------------------------------------------+
RPM Error Summary:
+-----------------------------------------------------------------------------+
The following errors during installation occurred:
error: failed dependencies:
/bin/uname is needed by splunkforwarder-6.0-182037
/bin/mv is needed by splunkforwarder-6.0-182037
I have read the article from http://answers.splunk.com/answers/45469/forwarder-install-via-rpm-failed-dependencies.
But The Universal Forward is for AIX. The Article is based on Linux.
The Universal Forward installed via "smitty" on AIX.
Is there anything can be used to fix the problem?
Thank you!
... View more
12-02-2013
12:50 AM
How can I get Article for 'Architecting and Sizing Splunk'?
When I login my splunk, the web share me 'Architecting and Sizing Splunk' on slideshare.net.
Unfortunately the article disappear.
How can I get it? Thank you!
... View more
- Tags:
- architecture
- sizing
10-11-2013
11:05 PM
Dear expert:
There is an error on my index server when I installed ESS 2.0 on my Splunk 5. My environment is that only 1 splunk server, *nix apps has been installed on it. I can use splunk to monitor my linux and unix OS when the ESS did not install.
But , when ESS has been installed that I find a error in the dashboard of *nix. The dashboard tell me *unix-TA can not installed on index server, and I can not see anything.
How can I solve this problem ?
Thank you very much !
... View more
09-15-2013
11:01 PM
Dear expert:
When I installed ESS, I found a ERROR on the top of splunk's web.
Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'oracle' and lookup table 'oracle_action_lookup'.
I didn't do any change.
How can I solve it?
... View more
09-12-2013
12:18 AM
Hi expert:
I'm studying ESS.
There are 3 Add-ons in ESS, Domain Add-ons, Supporting Add-ons and Technology Add-ons.
I have been monitor my Redhat OS in splunk. Forward and TA for Unix have been installed on my host.
So, what is the different between ESS TA and TA for Unix? Should I install both of them on my Unix host?
... View more
08-15-2013
08:14 PM
1 Karma
Manager » Lookups » Lookup table files
Find out "Oracle Audit"
Set oracle_actions.csv "sharing=Global"
I will get it.
On Oracle 10G, you need active audit in DB by yourself.
On Oracle 11G, audit has been actived by default.
Good Luck!
... View more
08-06-2013
08:17 AM
1 Karma
I got it by myself.
Need change a little.
... View more
07-24-2013
09:35 PM
I found these errors in search.log at "Machines--%CPU load" with "No results found. Inspect ..."
07-25-2013 12:43:32.018 INFO LookupOperator - Disabling automatic lookup of table 'wls_messages' for conf 'wls_managedserver' because the output fields are not referenced.
07-25-2013 12:43:32.018 INFO LookupOperator - Disabling automatic lookup of table 'wls_messages' for conf 'wls_managedserver_out' because the output fields are not referenced.
... View more
07-24-2013
02:52 AM
I solved it.It missed a code in "wlsCollectJmxDataMinute.py" which is "logFile.close()" at the end of this ".py".
There is a new error.
At chapter "Troubleshooting the Technology Add-on" in the "WLS_App_TA_install_instructions.pdf"documentation, it told me " Verify the forwarders output configuration."
But I can not find "outputs.conf". When I create "outputs.conf", I don't known what to write format.
Where I can find the example of "outputs.conf"?
Thank you!
... View more
07-22-2013
02:44 AM
Sorry
It may a error of Oracle Audit Trail not Splunk for Orcle Weblogic Server.
... View more
07-22-2013
02:41 AM
It looks like "serverDataStr" can be generated, but cannot be exported.
Could anyone help me to solve it?
... View more
07-22-2013
01:50 AM
I used Splunk for weblogic monitor.
When I test wlsCollectJmxDataMinute.py, I got some error.
1.env can not be found
Then I solve it.
Add --sys.registry.setProperty( "python.os", "nt" )-- in .py file
2.wlsCollectJmxDataMinute.py can not logging.
The .py script can be run to generate log files, but there is no content.
So I run .py in WLST manually.
There is no error and no content in log.
wls:/medrec/domainRuntime> if (len(servers) > 0):
... for server in servers:
... cd ('/ServerRuntimes/' + server.getName() )
... serverDataStr = "domain=%s|server=%s|server_state=%s|server_health=%s" % ( domainRuntime.getName(), server.getName(), str(cmo.getState()), str(cmo.getHealthState()) )
... writeServerData(serverDataStr)
...
wls:/medrec/domainRuntime/ServerRuntimes/MedRecServer>
I can print serverDataStr as blow:
wls:/medrec/domainRuntime> print serverDataStr
domain=medrec|server=MedRecServer|server_state=RUNNING|server_health=Component:ServerRuntime,State:HEALTH_OK,MBean:MedRecServer,ReasonCode:[]
The log Security Permissions, I give it "Everyone" with "All control".
How can I do for the log error?
My env.:
weblogic:10.3.0.0
os:windows server 2008 x64
jdk:sun jdk 1.6 x64
... View more
07-12-2013
12:57 AM
Thank you anshu! I wait you for a long time. It is that I see a reb row message display "The lookup table 'oracle_actions' does not exist. It is referenced by configuration 'oracle_syslog'." on top when I installed Weblogic apps. How can I do for the red message?
... View more
07-06-2013
12:21 AM
Oracle Audit Trail installed.
I keep getting below error in my searches
The oracle_actions.cvs can be foud as blow:
[root@CACTI lookups]# ll
total 8
-rw------- 1 root root 4499 Jul 9 11:14 oracle_actions.csv
[root@CACTI lookups]# pwd
/splunk/etc/apps/oracleaudit/lookups
props.conf
[root@CACTI default]# cat props.conf
[syslog]
TRANSFORMS-sourcetype = sourcetype_to_oracle_syslog
[oracle_syslog]
EXTRACT-oracle_key_value_pair = (?i)(?<_KEY_1>\S+):[\d+]\s+"(?<_VAL_1>[^"]+)"
LOOKUP-action = oracle_actions ACTION OUTPUT oracle_actionname, oracle_eventtype, oracle_eventclass
[oracle_key_value-pair]
transforms.conf
[root@CACTI default]# cat transforms.conf
[sourcetype_to_oracle_syslog]
SOURCE_KEY = _raw
DEST_KEY = MetaData:Sourcetype
REGEX = Audit[\d+]: LENGTH\s+:\s+\'\d+\'\s+ACTION\s+:[\d+]\s+
FORMAT = sourcetype::oracle_syslog
[oracle_actions]
filename = oracle_actions.csv
max_matches = 1
min_matches = 1
I read link but it is not for me
How can I solve this issus?
... View more
06-14-2013
02:52 AM
http://docs.splunk.com/Documentation/Splunk/latest/Data/Unixlogslocal
I can't understand that.
How to Splunk monitor log from remote linux log?
Universal Forwarder have been installed in the remote linux.
What I should do then?
... View more
06-12-2013
06:58 PM
Hi expert:
Universal forwarder on windows can collect data from windows Server. Technology Add-on for Windows run on universal forwarder. They can collect data from system both. What is the different between universal forwarder on windows and Technology Add-on for Windows.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
