Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About adamguzek
adamguzek
Explorer
Member since:
06-20-2013
06-05-2020
Community Statistics
| Posts | 11 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 2 |
| Member Since | 06-20-2013 |
Activity Feed
- Got Karma for When adding an indexer to a distributed environment, is there a configuration that makes indexers exchange events to auto load balance them?. 06-05-2020 12:48 AM
- Got Karma for When adding an indexer to a distributed environment, is there a configuration that makes indexers exchange events to auto load balance them?. 06-05-2020 12:48 AM
- Karma Re: mkvalue - strange problem for richgalloway. 06-05-2020 12:46 AM
- Karma Re: Time modifiers in second search after pipe for martin_mueller. 06-05-2020 12:46 AM
- Posted Splunk Enterprise Security Online Sandbox on Splunk Enterprise Security. 09-25-2019 05:47 AM
- Tagged Splunk Enterprise Security Online Sandbox on Splunk Enterprise Security. 09-25-2019 05:47 AM
- Posted When adding an indexer to a distributed environment, is there a configuration that makes indexers exchange events to auto load balance them? on Getting Data In. 06-28-2016 03:02 PM
- Tagged When adding an indexer to a distributed environment, is there a configuration that makes indexers exchange events to auto load balance them? on Getting Data In. 06-28-2016 03:02 PM
- Tagged When adding an indexer to a distributed environment, is there a configuration that makes indexers exchange events to auto load balance them? on Getting Data In. 06-28-2016 03:02 PM
- Tagged When adding an indexer to a distributed environment, is there a configuration that makes indexers exchange events to auto load balance them? on Getting Data In. 06-28-2016 03:02 PM
- Tagged When adding an indexer to a distributed environment, is there a configuration that makes indexers exchange events to auto load balance them? on Getting Data In. 06-28-2016 03:02 PM
- Tagged When adding an indexer to a distributed environment, is there a configuration that makes indexers exchange events to auto load balance them? on Getting Data In. 06-28-2016 03:02 PM
- Posted Re: How to troubleshoot Splunk 6 search performance issues? on Splunk Search. 06-28-2016 01:30 AM
- Posted Re: How to troubleshoot Splunk 6 search performance issues? on Splunk Search. 06-27-2016 02:36 PM
- Posted How to troubleshoot Splunk 6 search performance issues? on Splunk Search. 06-27-2016 11:37 AM
- Tagged How to troubleshoot Splunk 6 search performance issues? on Splunk Search. 06-27-2016 11:37 AM
- Tagged How to troubleshoot Splunk 6 search performance issues? on Splunk Search. 06-27-2016 11:37 AM
- Tagged How to troubleshoot Splunk 6 search performance issues? on Splunk Search. 06-27-2016 11:37 AM
- Posted How to write a search to count variations (different order and number) of transaction events? on Splunk Search. 10-16-2015 02:09 AM
- Tagged How to write a search to count variations (different order and number) of transaction events? on Splunk Search. 10-16-2015 02:09 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-25-2019
05:47 AM
Started a trial ES sandbox (20-09-2019). Got a link. Everything was working properly till today. License is blocking all the searches as its over quota. What can I do?
... View more
06-28-2016
03:02 PM
2 Karma
Is there a configuration that makes indexers exchange events in order to auto load balance them? Let's say I add an indexer into distributed environment. I want to use it without reconfiguring syslog sources and forwarders.
Maybe it's a request - make indexers connect to each other, and move events between them to distribute in an optimal way...
Does indexer clustering with duplication of data give any advantage? Maybe then the search head is using first/second indexer to retrieve events... Not only "first copy"?
... View more
06-28-2016
01:30 AM
I presume CPU as iostats show that drives are not saturated, and top gives 1 process 100% usage in userspace.
Job inspection for short time - circa 200.000 in circa 20 sec.
Duration (seconds) Component Invocations Input count Output count
0.02 command.fields 26 197,038 197,038
19.78 command.search 26 - 197,038
0.38 command.search.calcfields 25 197,038 197,038
0.15 command.search.fieldalias 25 197,038 197,038
0.08 command.search.index 26 - -
0.00 command.search.index.usec_1_8 6 - -
0.00 command.search.index.usec_8_64 36 - -
9.75 command.search.kv 25 - -
6.51 command.search.typer 25 197,038 197,038
1.41 command.search.rawdata 25 - -
0.83 command.search.lookups 25 197,038 197,038
0.32 command.search.tags 25 197,038 197,038
0.00 command.search.summary 26 - -
0.00 dispatch.check_disk_usage 2 - -
0.00 dispatch.createdSearchResultInfrastructure 1 - -
0.10 dispatch.evaluate 1 - -
0.10 dispatch.evaluate.search 1 - -
9.24 dispatch.fetch 27 - -
19.77 dispatch.localSearch 1 - -
0.02 dispatch.preview 16 - -
0.04 dispatch.readEventsInResults 1 - -
19.78 dispatch.stream.local 26 - -
8.14 dispatch.timeline 27 - -
0.17 dispatch.writeStatus 38 - -
0.02 startup.configuration 1 - -
0.06 startup.handoff 1 - -
... View more
06-27-2016
02:36 PM
Type of data: mostly cisco asa logs. No more than 300 bytes per event.
Distributed two indexers one search head. But all data on one indexer and I am temporarily do searchea on it to benchmark.
Index=test for testing worst case scenario.
Done all linux optimize stuff i am aware of. Bottleneck is cpu.
I am surprised because fast search without extraction (as I understand it) is doing so poorly. 200bytes multiply by 10k is 2MB per sec reading raw data. I should get something near my io performance 500MB/s.
Am I missing something?
... View more
06-27-2016
11:37 AM
Doing a simple search index=test over 10mln events gives me browsing speed around 5000 events per second. Extremely slow timeline build. Cpu load 100%. Doing that in fast mode gives 20k per second. In my opinion, too slow. Modern RAID with high iops and xenon cpu. Lots of cores and ram 64gigs... It's faster on my laptop with a similar dataset.
How to investigate?
... View more
10-16-2015
02:09 AM
I need a search to count variations of event occurance. Lets say we have events:
A,B,C,D,E which are combined into transaction by sessionid.
Event A is a start
Event E is an end.
In time, I have to search for transactions which have a different order and number of middle steps:
ABCDE
ACBDE
ABCDBCDE
and so on...
I need a stats count how many all of variations have occurred... I cannot predict all of the possible variations as steps are repeating between start and stop.
I need a table:
VARIANT - COUNT
ABCDE - 10
ABBE - 3
etc...
Any useful searches/commands I can try?
... View more
05-08-2014
07:47 AM
Can I use other time modifiers in second search - is it only earliest/latest problematic?
... View more
05-08-2014
07:37 AM
On data with recent timestamps I do search:
index=test * | search earliest="1/1/1990:20:00:00"
No results found, but I was expecting all my events.
Yes I do need this timemodifier in my second search I want to narrow time appending search one after another...
... View more
- Tags:
- timemodifier
05-07-2014
05:40 AM
You are right, Splunk indexed only one value for domain field... but why?
Where and how should I configure that source to index data correctly?
... View more
05-07-2014
05:10 AM
Log line:
eventDate="2014-03-24 14:42:00.945" eventType="adam.test" eventDevice="test.client" dstip="44.184.5.99" srcip="44.184.5.99" domain="value6" domain="value9" ver="5" dstport="5" srcport="4" user="value4" proto="value8"
Search:
eventType="adam.test" | eval domain1=mvindex(domain,1)
Result? Everything but no domain1 field.
I am trying to search by second or first "domain" field value eval'ing it into domain1 - no luck.
... View more
- Tags:
- mvindex
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
