About samhughe

samhughe · ‎07-24-2016

I know this is an old thread, but in case it helps anyone else, this does work (in 6.3.3) but you have to import the 'search' app as well. It seems that the import command overrides rather than appends to a hidden default where all apps import the 'search' app. Without including the 'search' app in the import I got errors trying to load the default search/flashtimeline page in the top level app.

samhughe · ‎09-25-2015

Have you looked at https://wiki.splunk.com/Community:Troubleshooting_Monitor_Inputs in particular https://your-splunk-server:8089/services/admin/inputstatus/TailingProcessor:FileStatus ? Can be quite helpful in seeing why files aren't being processed.

samhughe · ‎09-24-2015

Have you looked at https://wiki.splunk.com/Community:Troubleshooting_Monitor_Inputs in particular https://your-splunk-server:8089/services/admin/inputstatus/TailingProcessor:FileStatus ? Can be quite helpful in seeing why files aren't being processed. My guess would be "ignoreOlderThan = 10m" is the issue. This means that Splunk ignores any files that is older than 10minutes when it first sees the file (on startup) even if it is written to later on while Splunk is still running. The only way to get Splunk to process the files once it has 'tagged' them as old, is to restart Splunk.

samhughe · ‎09-24-2015

That's an 'old' link, try: http://docs.splunk.com/Documentation/Splunk/6.3.0/Indexer/Upgradeacluster Or http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Upgradeacluster (currently the same page) And yes I upgraded our non-prod environment (small 5 node multi-site indexer cluster with search head pooling) from 6.2.2/6.2.3 (mixed versions) to 6.3.0 yesterday using the steps in the "Upgrade from 6.x" section of the links above, without any issues.

samhughe · ‎04-30-2014

In the Splunk log directory, eg $SPLUNK_HOME/var/log/splunk/ If it doesn't exist, good chance java's not in your path/java_home isn't set

samhughe · ‎04-30-2014

I had a similar issue recently, and mine was due to java not being in the path. Is it creating a SA-ldapsearch.log (or similar log file) in your Splunk logs directory? If not make sure you have JAVA_HOME set and java in your PATH (think it needs jdk1.7). If there is a log, that should give more info as to the error

samhughe · ‎04-29-2014

I've installed the application but when I try and run it via: http://hostname:8000/dj/en-gb/splunk_app_windows_infrastructure/home/ I get an error: Error: TypeError at /en-gb/splunk_app_windows_infrastructure/home/ unsupported operand type(s) for +: 'NoneType' and 'str' Request Method: GET Request URL: http://hostname:8000/dj/en-gb/splunk_app_windows_infrastructure/home/ Django Version: 1.5.1 Exception Type: TypeError Exception Value: unsupported operand type(s) for +: 'NoneType' and 'str' Python Version: 2.7.5 Server time: Tue, 29 Apr 2014 16:37:04 +0100 The stacktrace is: stack:Traceback (most recent call last): File "/local/0/splunk/LNTSPLKTST01/home/lib/python2.7/site-packages/django/core/handlers/base.py", line 115, in get_response response = callback(request, *callback_args, **callback_kwargs) File "/local/0/splunk/LNTSPLKTST01/home/etc/apps/framework/server/splunkdj/decorators/render.py", line 74, in wrapper output = function(request, *args, **kwargs) File "/local/0/splunk/LNTSPLKTST01/home/lib/python2.7/site-packages/django/contrib/auth/decorators.py", line 25, in _wrapped_view return view_func(request, *args, **kwargs) File "/local/0/splunk/LNTSPLKTST01/home/lib/python2.7/site-packages/django/contrib/auth/decorators.py", line 25, in _wrapped_view return view_func(request, *args, **kwargs) File "/local/0/splunk/LNTSPLKTST01/home/etc/apps/framework/server/splunkdj/setup/__init__.py", line 20, in wrapper return HttpResponseRedirect(reverse(app_name + ':setup')) TypeError: unsupported operand type(s) for +: 'NoneType' and 'str' Anyone got any ideas?

samhughe · ‎01-14-2014

I've had a few issues with this on our setup similar to yours. I'd suggest running ./splunk cmd <path to your python> <jmx script> --scheme (to show the introspection scheme as shown http://docs.splunk.com/Documentation/Splunk/6.0/AdvancedDev/ModInputsScripts#Define_a_scheme_for_introspection) That was they way I managed to find the issues with ours. Also if deploying via a deployment server then it copies the app but leaves out one of the directories that is empty which caused us issues.

samhughe · ‎08-06-2013

Best way I've found so far is to use eval and case based on sowings answer in http://splunk-base.splunk.com/answers/43893/case-defaulting-to-value-rather-than-null

samhughe · ‎08-01-2013

Thanks for the suggestion but this just uses the default of NONE for all non matching values unfortunately

samhughe · ‎08-01-2013

One of our users has a lookup requirement that I'm struggling to find a workable solution. They want to have a number of fields automatically looked up, but need any non matching values to be returned 'as is' rather than a default generic value. I've tried csv lookups and they look fine except the non matching values I've tried scripted lookups and these can be used to return the non-matching values but introduce a new problem. They don't take effect at the right time so I have to have a " | search ...." after the initial search queries and so makes the usability of the lookups much less user friendly. Any suggestions?

samhughe · ‎07-15-2013

Based on your additional comments, try: (index=index1) OR (index=index2) TextToFind | eval newField=coalesce(Message,Content) | dedup newField Assuming there are no duplicates of 'Content' you want to keep. Or probably the better option is to use the keepempty=true parameter for dedup: http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Dedup

samhughe · ‎07-15-2013

Is the text you are looking for in index1's message field or is it in a different field? if so you could use the eval and coalesce functions (http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/CommonEvalFunctions) to put them into a new, single field and then dedup. If the text you are looking for isn't in index1's Message field not sure of your best option other than some of the join/subsearch type functions

samhughe · ‎07-10-2013

Assuming your sample event is accurate, I think you have an error with: TIME_PREFIX=^([^,]*,){14} shouldn't it be {9} not {14}? Just tested with http://gskinner.com/RegExr/ which I find is a useful test tool for regex issues and changing it to {9} picks up everything before the timestamp. Another thing to bear in mind is that the default lookahead is 150 characters, which shouldn't affect your sample line but might want to keep that in mind if you have longer lines.

samhughe · ‎07-01-2013

Can't help with the other bits as we're running search head pooling ourselves but the shared secret part of the following link might be useful for point 2: http://wiki.splunk.com/Community:How_to_add_a_search_head_to_your_pool

samhughe · ‎02-28-2013

Thanks, details added to the original post

samhughe · ‎02-28-2013

We have a forwarder monitoring a log file and are seeing duplicated data indexed from that file (by a number of indexers within the autoLB group) I'm seeing the following in the splunkd.log file on the forwarder: splunkd.log:02-28-2013 13:42:34.044 +0000 INFO WatchedFile - Will begin reading at offset=13142179 for file='<filename removed>'. splunkd.log:02-28-2013 13:43:34.043 +0000 INFO WatchedFile - Will begin reading at offset=13161047 for file='<filename removed>'. splunkd.log:02-28-2013 13:43:44.092 +0000 INFO WatchedFile - Will begin reading at offset=13138930 for file='<filename removed>'. splunkd.log:02-28-2013 13:49:44.297 +0000 INFO WatchedFile - Will begin reading at offset=13274923 for file='<filename removed>'. splunkd.log:02-28-2013 13:50:34.333 +0000 INFO WatchedFile - Will begin reading at offset=13329736 for file='<filename removed>'. splunkd.log:02-28-2013 13:50:54.349 +0000 INFO WatchedFile - Will begin reading at offset=13281747 for file='<filename removed>'. splunkd.log:02-28-2013 13:51:04.367 +0000 INFO WatchedFile - Will begin reading at offset=13281747 for file='<filename removed>'. splunkd.log:02-28-2013 13:54:14.523 +0000 INFO WatchedFile - Will begin reading at offset=13320589 for file='<filename removed>'. As you can see the offset position for where to start reading the file decreases occasionally. Any suggestions as to what the issue may be? (I know our indexers are a bit overloaded at present but I'm not seeing many failed ACKs in the log file) Edit: inputs.conf: [monitor://<path to file removed>/access_vap*.log] sourcetype = jboss-access-proxy outputs.conf [tcpout] defaultGroup = default-autolb-group disabled = false maxQueueSize = 6MB [tcpout:default-autolb-group] autoLB = true disabled = false server = <servernames> useACK = true

Posts	17
Solutions	3
Karma Given	1
Karma Received	8
Member Since	‎11-15-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Unable get Splunk app for Windows Infrastructure t...

Lookups and non matching values

Splunk data duplicated when reading offset decreas...

Re: Using import and export attributes in default....

Re: Log file not picked up by splunk

Re: Deployment App inputs.conf issues

Re: upgrade from splunk 6.x to 6.3 in cluster envi...

Re: sa-ldapsearch problem

Re: sa-ldapsearch problem

Unable get Splunk app for Windows Infrastructure t...

Re: Unable to initialize modular input "jmx" defi...

Re: Lookups and non matching values

Re: Lookups and non matching values

Lookups and non matching values

Re: search on multiple indexes

Re: search on multiple indexes

Re: Unable to extract timestamp from a CSV file

Re: Splunk high availability failover and loadbala...

Re: Splunk data duplicated when reading offset dec...

Splunk data duplicated when reading offset decreas...