Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About dan60201
dan60201
Explorer
Member since:
06-07-2013
06-05-2020
Community Statistics
| Posts | 11 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 06-07-2013 |
Activity Feed
- Got Karma for DB Connect TimeStamp Format. 06-05-2020 12:46 AM
- Posted Re: Enable performance metrics for Splunk TA for Windows on All Apps and Add-ons. 09-26-2013 10:59 AM
- Posted Enable performance metrics for Splunk TA for Windows on All Apps and Add-ons. 09-26-2013 08:54 AM
- Tagged Enable performance metrics for Splunk TA for Windows on All Apps and Add-ons. 09-26-2013 08:54 AM
- Posted Re: Can deployment server manage Dbx configuration? on Deployment Architecture. 09-06-2013 10:58 AM
- Posted Can deployment server manage Dbx configuration? on Deployment Architecture. 09-06-2013 06:51 AM
- Tagged Can deployment server manage Dbx configuration? on Deployment Architecture. 09-06-2013 06:51 AM
- Tagged Can deployment server manage Dbx configuration? on Deployment Architecture. 09-06-2013 06:51 AM
- Posted Re: Calculated field in DB Connect on Splunk Search. 07-25-2013 01:49 PM
- Posted Re: Calculated field in DB Connect on Splunk Search. 07-24-2013 03:18 PM
- Posted Re: Calculated field in DB Connect on Splunk Search. 07-24-2013 09:36 AM
- Posted Re: Calculated field in DB Connect on Splunk Search. 07-24-2013 09:34 AM
- Posted Re: Calculated field in DB Connect on Splunk Search. 07-24-2013 07:18 AM
- Posted Calculated field in DB Connect on Splunk Search. 07-23-2013 03:38 PM
- Tagged Calculated field in DB Connect on Splunk Search. 07-23-2013 03:38 PM
- Posted DB Connect TimeStamp Format on Splunk Search. 06-27-2013 10:01 AM
- Tagged DB Connect TimeStamp Format on Splunk Search. 06-27-2013 10:01 AM
- Tagged DB Connect TimeStamp Format on Splunk Search. 06-27-2013 10:01 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
09-26-2013
10:59 AM
After playing a bit more in Splunk/Windows Management/Performance Monitoring, I think I need to pick the right counter to bring up all hosts. So TA is actually working as expected.
... View more
09-26-2013
08:54 AM
Hi,
I am trying to figure out how to configure Splunk TA for windows so that I can forward all machines' performance counters. So far, I have installed Splunk for Windows in two search heads and use deployment server to distribute Splunk TA to all UF. I enabled windowsupdate.log in Splunk_TA_windows\local\inputs.conf.
###### Windows Update Log ######
[monitor://$WINDIR\WindowsUpdate.log]
disabled = 0
sourcetype = WindowsUpdateLog
So, for sourcetype = windowsupdatelog, I can see all machines showed up in host. It is working as expected. But when I turned on Splunk 5.0+ Performance Counters, by set disabled = 0:
## CPUTime
[perfmon://CPUTime]
counters = % Processor Time;% User Time
disabled = 0
instances = _Total
interval = 10
object = Processor
## Disk
[perfmon://FreeDiskSpace]
counters = Free Megabytes;% Free Space
disabled = 0
instances = *
interval = 10
object = LogicalDisk
I verified the change has been deployed to all UFs. However, I can't find such info showed up in my search head by checking Windows Management dashboard (only SH itself has those infos like CPU metrics, memory metrics... in there). Did I miss something here? The online document for latest TA is broken (link in the old version http://docs.splunk.com/Documentation/WindowsApp/4.6.3TA/User/AbouttheSplunkTechnologyAdd-on(TA)forWindows).
Thanks!
... View more
09-06-2013
10:58 AM
Thanks a lot. Have tried it out and worked great. So basically I can move the whole dbx\local folder to my own managed app which will pick up first before dbx.
... View more
09-06-2013
06:51 AM
Is it possible to make deployment server to manage only configuration part of DB Connect app? Basically, I like etc\apps\dbx\local folder to be managed by DP server. I have given a try by adding in serverclass, but the whole dbx folder is wiped and left only local folder. Any suggestion?
Thanks!
... View more
07-25-2013
01:49 PM
Somehow I need to move that configuration into indexers, rather than in DB connect dedicated server. Now those calculated fields work as expected.
... View more
07-24-2013
03:18 PM
If I want to move/test EVAL-field to indexer (instead of defining it in the dedicated forwarder server with dbx), it's not clear to me what exactly the steps I should do? How does indexer know I want add additional calculated fields? Where do I need to put such props.conf?
... View more
07-24-2013
09:36 AM
Forgot to mention, those existing EVAL- from other apps managed by deployment server are working fine. Only DB Connect that I configured in this dedicated box did not work as I expected.
... View more
07-24-2013
09:34 AM
I checked all splunk servers (search head/indexer) and can only find props.conf with EVAL- in indexer. So, I configured the dedicated heavy forwarder with dbx installed and enabled indexAndForward = true in outputs.conf. I am expecting it will do calculated field in this box before sending to splunk receiver.
... View more
07-24-2013
07:18 AM
gfuente, Thanks for reply. Both CPU and Duration were showing up just fine. I also tried with fixed value like EVAL_test = 'test', but no such field showed up.
... View more
07-23-2013
03:38 PM
I have done testing the calculated fields for Splunk DB Connect in my local machine. Basically I added props.conf file to the following folder: %SPLUNK_HOM%\etc\apps\dbx\local
In the file, I have something like this
[MySoureType]
EVAL-cpu_time_s = CPU / 1000
EVAL-duration_s = Duration / (1000 * 1000)
It works perfectly in my local environment, I can see those fields (cpu_time_s, duration_s) show up in the search. However, when I implement in the actual server (a dedicated heavy forwarder installed with Dbx in a distributed environment), I can't find those fields anymore.
Any reason why it behaves differently? How should I troubleshoot this situation.
Thanks!
... View more
- Tags:
- Splunk DB Connect 1
06-27-2013
10:01 AM
1 Karma
Has anyone successfully provided TimeStamp.Format in DB Connect for DateTimeOffset type (SqlSever)? The time is in UTC and looks like this (2013-05-15 04:26:24.249 -05:00).
I know I can convert it into DateTime type with proper format and it will work, but I am curious if I can simply provide a format that will work with time zone. One thing I notice, if I don't provide any format and choose not to output timestamp, Splunk still parse it correctly (in _time) with warning. It could be it just ignore the rest of time zone info and leave date time part which looks right.
output.timestamp = 0
output.timestamp.column = TimeStamp
dbx2941:WARN:ResultSetOutputPayload - Unrecognized timestamp format:'2013-05-15 04:26:24.249 -05:00'
... View more
