Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About some_guy
some_guy
Path Finder
Member since:
03-19-2014
06-21-2022
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 6 |
| Karma Received | 5 |
| Member Since | 03-19-2014 |
Activity Feed
- Karma Re: Clustered indexes not showing up in the index list. for Steve_G_. 06-05-2020 12:47 AM
- Karma Re: embed a graphic on a dashboard, splunk 6.2 for pradeepkumarg. 06-05-2020 12:47 AM
- Karma Re: embed a graphic on a dashboard, splunk 6.2 for sanjay_shrestha. 06-05-2020 12:47 AM
- Karma Re: How will removing a heavy forwarder from my current environment affect indexing performance? for esix_splunk. 06-05-2020 12:47 AM
- Karma Re: What are recommendations for our current file monitoring setup? for aaronkorn. 06-05-2020 12:47 AM
- Got Karma for Clustered indexes not showing up in the index list.. 06-05-2020 12:47 AM
- Got Karma for Splunk ES Incident Review Suppression. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk ES Incident Review Suppression. 06-05-2020 12:47 AM
- Got Karma for Re: embed a graphic on a dashboard, splunk 6.2. 06-05-2020 12:47 AM
- Got Karma for How will removing a heavy forwarder from my current environment affect indexing performance?. 06-05-2020 12:47 AM
- Karma SearchPostProcess within Dashboard for mcwomble. 06-05-2020 12:45 AM
- Posted Re: show unconfigured forwarders from deployment server search on Deployment Architecture. 04-07-2020 08:12 AM
- Posted show unconfigured forwarders from deployment server search on Deployment Architecture. 04-06-2020 09:36 AM
- Tagged show unconfigured forwarders from deployment server search on Deployment Architecture. 04-06-2020 09:36 AM
- Tagged show unconfigured forwarders from deployment server search on Deployment Architecture. 04-06-2020 09:36 AM
- Posted Re: Using regex, how to exclude any events in the host field and keep the rest? on Splunk Search. 06-14-2018 12:07 PM
- Posted Using regex, how to exclude any events in the host field and keep the rest? on Splunk Search. 06-14-2018 10:29 AM
- Tagged Using regex, how to exclude any events in the host field and keep the rest? on Splunk Search. 06-14-2018 10:29 AM
- Tagged Using regex, how to exclude any events in the host field and keep the rest? on Splunk Search. 06-14-2018 10:29 AM
- Tagged Using regex, how to exclude any events in the host field and keep the rest? on Splunk Search. 06-14-2018 10:29 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 1 |
04-07-2020
08:12 AM
Brilliant, thank you. Ended up going with instanceName to display clients...
| rest /services/deployment/server/clients splunk_server=local | table instanceName applications.* | untable instanceName, applications | append [| rest /services/deployment/server/clients splunk_server=local | table instanceName] | stats count(applications) as cnt by instanceName | where cnt = 0
... View more
04-06-2020
09:36 AM
We use Deployment Server for managing all our universal forwarder inputs.
I need to take an accounting of all devices, from the deployment server, where the Universal Forwarder has been installed (and phones home), but has NOT been configured (no inputs forwarding). Already using the UFMA app, but this particular search isn't jumping out at me.
Anyone got a one-liner for this? Thank you.
... View more
Labels
- Labels:
-
deployment server
-
universal forwarder
06-14-2018
12:07 PM
Alleluia, its finally working!!! The key is, as you said:
SOURCE_KEY = MetaData:Host
THANKS!
... View more
06-14-2018
10:29 AM
One big syslog file I need to index (monitor) daily. Many hosts log to this syslog file.
I want to exclude any events that contain 'server1' in the host field, and keep the rest.
On the receiving indexer, the following is in /opt/splunk/etc/system/local
props.conf:
[source::/syslog/Security/*.log]
TRANSFORMS-set = setnull, setparsing
transforms.conf:
[setnull]
REGEX = server1
DEST_KEY = queue
FORMAT = nullQueue
[setparsing]
REGEX = .
DEST_KEY = queue
FORMAT = indexQueue
Where might I have gone wrong? This does not seem to work.
... View more
05-11-2015
08:57 AM
My Splunk partition is filling, due to one file...
/opt/splunk/var/lib/splunk/rscache.data
...this file contains logging from a DBconnect v2 connection that I setup last week.
Deleted the file. How can I tune this? Nothing jumps out at me within dbx.
Thanks.
... View more
- Tags:
- dbconnect
03-17-2015
09:24 AM
My setup looks like this:
syslog collector with UF -> HF -> Index cluster
File input in a directory on the syslog collector: /log/logfile.log
logfile.log is continuously monitored. File size approaching 22GB as I write this.
This was the approach recommended by our Splunk subject-matter-expert. However, Splunk Education tells me that tiny logfiles are always preferable (I can split the logfiles up into smaller files with logrotate).
What would you do? Thanks.
... View more
03-06-2015
05:55 AM
Thank you for the insight.
At present we don't have a need for any sophisticated index routing. This enterprise is large, but centralized to one campus (fairly flat network). The input parsing is being handled largely by syslogNG, but an upstream HF might be useful for parsing in the near future (thus keeping some load off the indexers).
I've read that you shouldn't use an HF unless you absolutely need it. I've also read that there is benefit in having a buffer before the indexers. While our specific immediate use-case doesn't call for anonymization, index routing or detailed parsing...I can't say it never will.
... View more
03-05-2015
03:01 PM
1 Karma
My clustered index sizes/event counts seem to occasionally mismatch a bit from indexer-to-indexer. This might result in search weirdness.
Right now, it looks like this:
server A (syslog collector/universal forwarder) -> server B (heavy forwarder) -> Index (cluster)
I'm thinking of removing the heavy forwarder:
server A (syslog collector/universal forwarder) -> Index (cluster)
Might this help indexing performance? Am I losing much by not using a heavy forwarder?
Any advice appreciated.
... View more
02-13-2015
01:00 PM
1 Karma
Ok, got it. Thanks for the suggestions, which did set me on the right path...
copied the logo image to:
$SPLUNKHOME$/etc/apps/search/static
then referenced it in the html file:
<img src="{{SPLUNKWEB_URL_PREFIX}}/static/app/search/logo.PNG" alt="logo"></img>
... View more
02-13-2015
11:37 AM
1) Created a simple dashboard. Want to add a logo. App context=search.
2) Uploaded logo.jpg to $SPLUNKHOME$/etc/apps/search/appserver/static
3) Converted dashboard to html.
4) Added this to html dashboard in an appropriate place in the body:
<img src="../appserver/static/logo.jpg" alt="logo" height="100" width="100"></img>
5) Image will not load. Alt text does show up.
(troubleshooting: bounced splunk, verified graphic isn't corrupt)
How can I get this graphic to show up? is my src path incorrect?
... View more
02-09-2015
11:22 AM
These indexes are indeed empty. That must be it. Thanks!
(my test indices do show up when editing a role...ie: "Indexes searched by default" )
... View more
02-09-2015
11:03 AM
1 Karma
Hello. Splunk 6.2.1. Built a single-site index cluster. Two search heads. I can create test indexes across the cluster by editing indexes.conf on the cluster-master, then deploying a config bundle. Works great.
Problem: My search heads don't see the test indexes in an index list. In splunkweb, Settings->Indexer Clustering, I've configured the master as a searched cluster, and everything is up/searchable/met. Still, my new test indices only show up on the master and the indexers themselves.
Any help appreciated. Thanks.
... View more
07-18-2014
06:32 AM
1 Karma
One associated default correlation search for which I cannot suppress notables is 'threat list activity detected'. thanks.
... View more
07-15-2014
06:51 AM
1 Karma
Having an issue within Splunk ES Incident Review.
The option to suppress events from most correlation searches works fine. A handful of events
do NOT offer the option to suppress.
The offending non-suppressible events are a consequence of the same few correlation searches. No other commonalities exist, as far as I'm able to tell. My user context has full rights to the instance, so I'm stumped.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-21-2022
02:25 PM
|
Karma given to
