Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About pschildein
pschildein
Explorer
Member since:
05-14-2018
01-05-2023
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 05-14-2018 |
Activity Feed
- Posted Re: How do I disable redirection warning? on Dashboards & Visualizations. 01-05-2023 05:45 AM
- Got Karma for How to increase performance for large (automatic) lookups. 05-18-2022 02:05 AM
- Posted Re: Large JSONs are truncated at 4KB on All Apps and Add-ons. 11-29-2020 09:23 PM
- Posted Re: Why is the field count double the amount of total events? on Splunk Search. 03-12-2020 05:08 AM
- Posted How to increase performance for large (automatic) lookups on Splunk Search. 12-06-2019 05:45 AM
- Tagged How to increase performance for large (automatic) lookups on Splunk Search. 12-06-2019 05:45 AM
- Tagged How to increase performance for large (automatic) lookups on Splunk Search. 12-06-2019 05:45 AM
- Tagged How to increase performance for large (automatic) lookups on Splunk Search. 12-06-2019 05:45 AM
- Tagged How to increase performance for large (automatic) lookups on Splunk Search. 12-06-2019 05:45 AM
- Posted Re: Large JSONs are truncated at 4KB on All Apps and Add-ons. 01-03-2019 01:59 AM
- Posted Re: Large JSONs are truncated at 4KB on All Apps and Add-ons. 01-03-2019 01:58 AM
- Posted Re: Large JSONs are truncated at 4KB on All Apps and Add-ons. 05-14-2018 09:11 PM
- Posted Large JSONs are truncated at 4KB on All Apps and Add-ons. 05-14-2018 07:49 AM
- Tagged Large JSONs are truncated at 4KB on All Apps and Add-ons. 05-14-2018 07:49 AM
- Tagged Large JSONs are truncated at 4KB on All Apps and Add-ons. 05-14-2018 07:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 |
01-05-2023
05:45 AM
Hi, is there also a solution for on-premise installations?
... View more
03-12-2020
05:08 AM
If you have json field extraction at index time via
INDEXED_EXTRACTIONS = JSON
You need two additional lines to solve this problem
AUTO_KV_JSON = false
KV_MODE = none
Then stats are correct.
... View more
12-06-2019
05:45 AM
1 Karma
Hi,
I have a large CSV lookup (~200MB and 6+ million lines). As I need the lookup information for eventtypes I tried to invoke it as an automatic lookup. As an automatic lookup it is a big performance killer (up to 50 sec in a test query) as it is not when I use it in the search window with the SPL (3 sec in the same test query with inputlookup).
I tried both KVStore and CSV lookup and also raised max_memtable_bytes to 250 MB.
... View more
01-03-2019
01:59 AM
Hi, thanks but I think that does not apply to our case. We are handling large individual json objects not arrays. Also it is not an API input but stdout.
... View more
01-03-2019
01:58 AM
Hi, we still have the above mentioned problem, anything new there? Thanks! If you need more information please let me know.
... View more
05-14-2018
09:11 PM
No error in the logs
[amqp://alerts]
ack_messages = 1
hec_batch_mode = 0
hec_https = 0
hostname = amqp-server
index_message_envelope = 0
index_message_propertys = 0
output_type = stdout
password = xxx
port = 5672
queue_name = amqp-queue
sourcetype = alerts
use_ssl = 0
username = xxxx
index = index
disabled = 0
exchange_name = alerts
hec_token = yyyyyyyyyyyyyyyyyyyy
host =
... View more
05-14-2018
07:49 AM
TRUNCATE is set to 0 => so no truncation there, still events are truncated after 3969 signs => 4 KB on disk
Splunk runs on one system, RabbitMQ on another system, events are ingested via STDOUT
We already checked that the events are correctly transferred via RabbitMQ so there must be something in Splunk and/or the add-on. Maybe this is a problem in the Python wrapper or Java? Or are there additional settings for STDOUT?
Thanks in advance for your replies!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-05-2023
09:41 AM
|
