About jackiewkc

jackiewkc · ‎10-31-2017

Hi, I have an index called app1 with the following configuration. [app1] coldPath = $SPLUNK_DB/app1/colddb homePath = $SPLUNK_DB/app1/db thawedPath = $SPLUNK_DB/app1/thaweddb maxDataSize = auto_high_volume frozenTimePeriodInSecs = 31536000 maxTotalDataSizeMB = 5000000 repFactor = auto Under $SPLUNK_DB/app1/, here is the output of " du -sk * " 2016530744 colddb 0 datamodel_summary 2256897696 db 0 thaweddb My understanding is that data is indexed and stored for 365 days, and I would assume the indexed data is stored under $SPLUNK_DB/app1/db. The part I don't understand is how the data is rolled into colddb and where may that be configured. Any help will be greatly appreciated. Thanks.

jackiewkc · ‎10-26-2017

Ah ! That explains the difference in the numbers. I didn't change the license master setup so it should be the default 30 days. Thanks a lot !

jackiewkc · ‎10-26-2017

Hi, I have an index with the following configuration: [index1] coldPath = $SPLUNK_DB/index1/colddb homePath = $SPLUNK_DB/index1/db thawedPath = $SPLUNK_DB/index1/thaweddb maxDataSize = auto_high_volume frozenTimePeriodInSecs = 31536000 maxTotalDataSizeMB = 5000000 repFactor = auto In the license master, I can see that the cumulative raw data size for index1 is 619GB. However, on the indexers, the size of $SPLUNK_DB/index1/colddb and $SPLUNK_DB/index1/db are 1.8TB and 2.1TB respectively. Is this right? Is there any way i can reduce the disk usage with the data retention period unchanged? Thanks. Regards, Jackie

jackiewkc · ‎10-25-2017

Thanks a lot for the information.

jackiewkc · ‎10-25-2017

I would like to capture the same information, i.e. license usage beyond the past 30 days. Can you please advise what needs to be done to extend the retention period?

jackiewkc · ‎10-23-2017

Hi, splunk-launch.conf did the trick, thanks for your help.

jackiewkc · ‎10-23-2017

Hi, thanks for the information. I have updated all those files already. Under /apps/splunk-2/etc/system/local, I ran "grep -ir 8980 ." to confirm that there is no reference to the port used by splunk-1. Can you please advise how ./splunk start and ./splunk status work? i.e. where do they look for the related configs? /apps/splunk-2/bin/splunk status still references splunk-1 so it must look at somewhere to get the port, pid file, the name of the instance or something else to check the status, right? Regards, Jackie

jackiewkc · ‎10-23-2017

Hi, I am running a splunk instance on a server under /apps/splunk-1/ at port 8980. I would like to run another instance on the same server at a different port. So I ran "cp -R /app/splunk-1 /apps/splunk-2" to create a new instance. Then I removed the pid file under /apps/splunk-2/var/run, updated the related files so that it will use a different port (8950). However, when I ran "/apps/splunk-2/bin/splunk start", I got the following error: The splunk daemon (splunkd) is already running. [FAILED] If you get stuck, we're here to help. Look for answers here: http://docs.splunk.com The Splunk web interface is at http://server1:8980. When I executed /apps/splunk-2/bin/splunk status, I got this: splunkd is running (PID: 3898). splunk helpers are running (PIDs: 3903 4024 4060 4083). Can someone please advise why splunk-2 is still referencing splunk-1? What else do I need to update under splunk-2? Thanks. Regards, Jackie

jackiewkc · ‎05-31-2017

Ah, thanks !! I was in the "All unique tag objects" page which doesn't allow me to edit but I can do so in the "List by field value pair" page. This is probably not related to this topic but is it possible to change the default permission when a user creates a new tag? At the moment, it is set to Private, I would like to change it to App. Thanks again

jackiewkc · ‎05-31-2017

Hi, can you please advise how to "open the knowledge object for edit in the GUI and click save"? Thanks. J

jackiewkc · ‎08-25-2015

ok, thanks for getting back to me.

jackiewkc · ‎08-25-2015

Thanks for the reply, but the problem we have is that we use sourcetype for something else (linebreak). Therefore in our inputs.conf, there are multiple monitors with the same sourcetype which can't be changed. This means the only thing we can use to distinguish between different sources (i.e. monitors) is the source itself. Now I have updated props.conf with the settings in my reply above, and it works fine. There should not be another monitor with the exact same path but for a different index cos that would not be right, but I am just thinking out loud here whether it is possible to include the index in the configs above. Something like if the source is D:\def\reporting*.log and it is for the index "abc" then do the EVAL-log_type part. Thanks.

jackiewkc · ‎08-24-2015

Thanks a lot. I managed to do it based on your suggestion. In props.conf, I have this setting: [source::D:\abc\testing*.log] EVAL-log_type = "testing-logs" [source::D:\def\reporting*.log] EVAL-log_type = "reporting-logs" Now my question is that is it possible to specify the index in the above settings as well? It may happen that logs with the same paths coming from different servers for different indexes will match the paths above. I only want those that match the paths above and for a particular index to have log_type configured. Is this possible? Thanks.

jackiewkc · ‎08-24-2015

Thanks a lot. I managed to do it based on your suggestion. In props.conf, I have this setting: [source::D:\\abc\\testing*.log] EVAL-log_type = "testing-logs" [source::D:\\def\\reporting*.log] EVAL-log_type = "reporting-logs" Now my question is that is it possible to specify the index in the above settings as well? It may happen that logs with the same paths coming from different servers for different indexes will match the paths above. I only want those that match the paths above and for a particular index to have log_type configured. Is this possible? Thanks.

jackiewkc · ‎08-21-2015

Hi, In my inputs.conf I have a number of monitors. I would like to create a custom field called logtypevalue with values based of the monitors. For example, if the monitor is: [monitor://D:\logs\logfiles\tomcat*.log] I want the value of logtypevalue set to abcde. If the monitor is: [monitor://D:\logs\logfiles\apache*.log] I want the value of logtypevalue set to testing. Basically the values of logtypevalue can't be extracted from the monitor so I am not sure how I can do this. Any help will be greatly appreciated. Thanks. Jackie

jackiewkc · ‎08-17-2015

What happens if there is one single search head cluster which contains search head from various regions? In this case, the user configuration will be from the same deployer which means we can't specify different time zone settings for the same user. And I think Splunk advise NOT to edit user setting on individual Splunk clustered search head server locally. Please advise. Thanks.

jackiewkc · ‎07-03-2015

Thanks for the reply. And yes, I was talking about the event tab. And the scenario is that when I do a simple search like "index=abc". you can see the events in the events tab with ... as part of the source when it is longer than 90 characters. I wanted to know if it is possible to configure Splunk to simply show the complete values of the soruce field in the normal search result without doing anything like table * to alter how the results are displayed. Based on your reply, I take it the answer is no. If this is not the case and in fact there is a way to do it, please do let me know. Thanks.

jackiewkc · ‎07-02-2015

The results of my queries in Splunk are truncated ie, it only shows: source =/data/logs/sdf/sdfdsfds/f/sdf/dsf/dsf/dsf/dsf/d/fsd/fd/sf/sdf/sd/fsd/f/sdf/sd/fs/dfggd/f… when I instead want to see the full log name source =/data/logs/sdf/sdfdsfds/f/sdf/dsf/dsf/dsf/dsf/d/fsd/fd/sf/sdf/sd/fsd/f/sdf/sd/fs/dfggd/fsd/fs/ftest.log Can it be configured in Splunk to expand the source field to show the full field value by default? FYI it seems like the source field has a max length of 90 characters including the 3 dots. Thanks in advance. Jackie

jackiewkc · ‎01-30-2015

Thanks Martin

jackiewkc · ‎01-28-2015

One quick question. The numbers returned from the query you suggested, are they in bit or byte or Mb? I want to have it set to GB, but when I changed sum(length) to sum(length/1024), it didn't work.

jackiewkc · ‎01-28-2015

Thanks a lot for the quick reply, I really appreciate it.

jackiewkc · ‎01-28-2015

Hi, Does anyone know how I can query the license usage of a particular index, breakdown by a field? Basically I have an index called testindex and there is a field in each event called log_type. I would like to know, on a given date, how much indexed data there is in this index, broken down by log_type. I would expect the output to be something like: log_type1 10G log_type2 1.5G log_type3 0.45G etc. Any help will be greatly appreciated. Thanks. Regards, Jackie

jackiewkc · ‎01-16-2015

Thanks a lot, that's exactly what I need.

jackiewkc · ‎01-15-2015

Does anyone know where I can get some explanation on all the Splunk capabilities such at list_inputs, get_metadata, rtsearch, etc? I don't seem to be able to find any on Splunk's website. Thanks. Regards, Jackie

jackiewkc · ‎12-18-2014

I have a search which does a basic query to a database using dbquery. I have a user which has a role assigned to it and this role has been given read/write permission to DB Connect and the database. The role also has the capabilites "dbx_capable" and "schedule_rtsearch". However, when running the search, I got the external command error as stated in the title of this question. The weird thing is that if I add the role "dbx_user" as an inherited role to the role assigned to this user, the search works. The dbx_user role has only the two capabilites "dbx_capable" and "schedule_rtsearch and read/write permission to DB Connect and the database. I don't understand why the role I created doesn't work since it has the same permissions as the dbx_user role. Can someone please advise? Thanks. Regards, Jackie

Posts	34
Solutions	0
Karma Given	0
Karma Received	5
Member Since	‎03-03-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How does Splunk rotate indexed data (colddb, etc)?

Difference in license usage and diskspace usage

Error message when creating new Splunk instance: T...

How to create a custom field with values based on ...

How to display the complete source without ...

How to get license usage data for a particular ind...

Documentation for Splunk capabilities

External search command 'dbquery' returned error c...

headers in csv do not appear as field names in sea...

The searchhead is unable to update the peer inform...

How does Splunk rotate indexed data (colddb, etc)?

Re: Difference in license usage and diskspace usag...

Difference in license usage and diskspace usage

Re: How to get the the Splunk License Usage dashbo...

Re: How to get the the Splunk License Usage dashbo...

Re: Error message when creating new Splunk instanc...

Re: Error message when creating new Splunk instanc...

Error message when creating new Splunk instance: T...

Re: How to resolve error "Replication-related issu...

Re: How to resolve error "Replication-related issu...

Re: How to create a custom field with values based...

Re: How to create a custom field with values based...

Re: How to create a custom field with values based...

Re: How to create a custom field with values based...

How to create a custom field with values based on ...

Re: When a scheduled search spans multiple indexer...

Re: How to display the complete source without ...

How to display the complete source without ...

Re: How to get license usage data for a particular...

Re: How to get license usage data for a particular...

Re: How to get license usage data for a particular...

How to get license usage data for a particular ind...

Re: Documentation for Splunk capabilities

Documentation for Splunk capabilities

External search command 'dbquery' returned error c...