Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About premg
premg
Engager
Member since:
06-20-2013
06-05-2020
Community Statistics
| Posts | 17 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 06-20-2013 |
Activity Feed
- Karma Re: DOWN! Error: skipped indexing of internal audit event will keep dropping events until indexer congestion is remedied. Check disk space and other issues that may cause indexer to block for Lowell. 06-05-2020 12:45 AM
- Posted How to configure forwarder to filter and forward data to a third party system? on Getting Data In. 08-19-2014 07:32 AM
- Tagged How to configure forwarder to filter and forward data to a third party system? on Getting Data In. 08-19-2014 07:32 AM
- Tagged How to configure forwarder to filter and forward data to a third party system? on Getting Data In. 08-19-2014 07:32 AM
- Tagged How to configure forwarder to filter and forward data to a third party system? on Getting Data In. 08-19-2014 07:32 AM
- Tagged How to configure forwarder to filter and forward data to a third party system? on Getting Data In. 08-19-2014 07:32 AM
- Posted Re: App 'search' was installed or modified, and the following objects required a restart: default on Deployment Architecture. 04-18-2014 01:31 AM
- Posted Re: Search Head Polling with mounted Bundles on Knowledge Management. 04-08-2014 07:24 AM
- Posted Re: Search Head Polling with mounted Bundles on Knowledge Management. 04-08-2014 06:30 AM
- Posted Search Head Polling with mounted Bundles on Knowledge Management. 04-08-2014 05:33 AM
- Tagged Search Head Polling with mounted Bundles on Knowledge Management. 04-08-2014 05:33 AM
- Tagged Search Head Polling with mounted Bundles on Knowledge Management. 04-08-2014 05:33 AM
- Tagged Search Head Polling with mounted Bundles on Knowledge Management. 04-08-2014 05:33 AM
- Posted Re: [indexer] Streamed search execute failed because: User 'nobody' could not act as: on Splunk Search. 04-03-2014 01:46 AM
- Posted Re: Could a saved search be linked to a URL(hyperlink) in a dashboard and the saved search must be run when the URL is clicked? on Dashboards & Visualizations. 04-03-2014 01:46 AM
- Posted Re: Could a saved search be linked to a URL(hyperlink) in a dashboard and the saved search must be run when the URL is clicked? on Dashboards & Visualizations. 04-03-2014 01:45 AM
- Posted Re: How to make transforms.conf to pick from the default group of outputs.conf on Getting Data In. 04-03-2014 12:39 AM
- Posted Could a saved search be linked to a URL(hyperlink) in a dashboard and the saved search must be run when the URL is clicked? on Dashboards & Visualizations. 04-02-2014 11:35 PM
- Tagged Could a saved search be linked to a URL(hyperlink) in a dashboard and the saved search must be run when the URL is clicked? on Dashboards & Visualizations. 04-02-2014 11:35 PM
- Posted How to make transforms.conf to pick from the default group of outputs.conf on Getting Data In. 04-01-2014 02:01 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-19-2014
07:32 AM
We need to forward data to a third party system.
I would need to forward all data with sourcetype as *_syslog to the third party system via UDP.
I need to forward data to third party system before indexing the data.
so in heavyforwarder props.conf
[sourcetype::*_syslog]
TRANSFORMS-routingxxxx=routeToxxxxxxx
in transforms.conf
[routeToxxxxxxx]
REGEX=(.)
DEST_KEY=_SYSLOG_ROUTING
FORMAT=outputs_xxxxxxx
in outputs.conf
[syslog:outputs_xxxxxxx]
syslogSourceType=syslog
server=ip
type=udp
The above setting is not sending any data to the third party system.
Please suggest is there is any error in the above configurations.
... View more
04-18-2014
01:31 AM
We are also facing same issue in our Search heads.
... View more
04-08-2014
07:24 AM
We have two search heads and two search peers + 1 master.
We have indexer clustering, searchhead pooling and NAS mounted bundles in place.
Everything works fine.
However, for seperate requirement, I have to introduce new indexer with no NAS.
And I have reuse existing search heads.
Now, I want existing searchheads not to share bundle to existing indexers and share bundles to new stand-alone indexer.
How do I achieve that?
... View more
04-08-2014
06:30 AM
okies.. With two search heads is it possible to achieve the same.
... View more
04-08-2014
05:33 AM
Hi,
In our platform we are using search head pooling with mounted bundles.
If I have one search head and two indexer(search peers) and i would like to share bundles configuration to one search peer alone.
How can I achieve this?
... View more
04-03-2014
01:46 AM
I am using 6.0.2.
We have 3 Search Heads and 4 Indexers with Search head pooling and mounted bundles.
I'm getting the same error.
Any idea on this?
... View more
04-03-2014
01:46 AM
thanks Mus
... View more
04-03-2014
01:45 AM
Thanks martin_mueller
... View more
04-03-2014
12:39 AM
Many thanks MuS.
I'll leave [routeAllEvents].
However, how do Splunk pick up default group in [routeFilteredEvents] stanza?
... View more
04-02-2014
11:35 PM
Could a saved search be linked to a URL(hyperlink) in a dashboard and the saved search must be run when the URL is clicked?
We are trying to embed a link to a saved search in a dashboard and the saved search must be run when a user clicks on it.
The saved search need not display the results to the user rather it must trigger a script after the serach is complete that inturm will update a file and the file to be mailed to the user.
... View more
- Tags:
- nil
04-01-2014
02:01 AM
Hi,
We need to forward all events to indexer group_A and filtered events to indexer group_B.
We are applying some transformations on a data.
We are forwarding this data in such a way that the data with transformations are sent to server 'A' and the data without transformations are sent to server 'B'.
The props, transforms and outputs are given as follows.
props.conf
[sourcetype]
TRANSFORMS-routing=routeAllEvents,routeFilteredEvents
transforms.conf
[routeAllEvents]
REGEX=(.)
DEST_KEY=_TCP_ROUTING
FORMAT=indexers_group_A
[routeFilteredEvents]
REGEX=(some_filter)
DEST_KEY=_TCP_ROUTING
FORMAT=indexers_group_A,indexers_group_B
outputs.conf
[tcpout]
forwardedindex.filter.disable=true
defaultGroup=indexers_group_A
[tcpout:indexers_group_A]
server=server1:9997
disabled=false
autoLB=true
[tcpout:indexers_group_B]
server=server2:9997
disabled=false
autoLB=true
[tcpout:indexers_group_C]
server=server3:9997
disabled=false
autoLB=true
This works fine.
Question:
If I want to forward all events (default group) to Indexers_group_C instead of indexer_group_A, I had to change in both outputs.conf and transforms.conf.
Is there any way to make transforms.conf to pick from the default group of outputs.conf?
... View more
- Tags:
- outputs
- transforms
03-13-2014
03:34 AM
Thanks MuS.
I have also tried with index=_audit. But no luck.
Also I am able to see /opt/splunk/var/log/splunk/audit.log path in the list monitor. So I believe it is monitored.
But not able to search.
Do I need to change anything else?
... View more
03-13-2014
02:35 AM
Hi,
I make use of _internal call to add users to the splunk as follows.
/opt/splunk/bin/splunk _internal call /services/authentication/users/ -post:name "prem" -post:password "pass" -post:roles "admin" -auth user:pwd
But here i want to assign multiple roles to an user.Is it possible to assign multiple values during user creation or append any role to the user after the user got created?If yes please help with the synatx .
... View more
- Tags:
- _internalcall
03-13-2014
12:29 AM
Splunk by default monitors /opt/splunk/var/log/splunk folder in Splunk Universal Forwarder.
But I am not able to see "audit.log" file in Splunk Web.
I am able to see the file when I execute list monitor command.
Also I tried to monitor that file separately by putting a monitor statement in etc/apps folder.
But still I'm not able to see that file in the Splunk Web.
The monitor statements looks as below.
[monitor:///opt/splunkforwarder/var/log/splunk/audit.log]
disabled = false
index = test_index
sourcetype = test_audit_log
Could you please help me in getting the audit.log file?
... View more
- Tags:
- default
03-11-2014
02:31 AM
Hi,
We have a scenario like one deployment server and two search heads. Can we bulk load the users from deployment servers for the searchheads?
... View more
03-11-2014
02:26 AM
Hi,
Do we need to restart the splunk instances for the passwords to work?
... View more
03-07-2014
01:06 AM
Hi,
Even we are trying something similar.
In our system we have search heads in two different sites and we are using Splunk authentication\NO LDAP. we want to create users in each search head and need to replicate the same in all search heads.Is it possible to do this via Deployment server? what is the best/optimized way of doing it.
question posted :http://answers.splunk.com/answers/125959/user-replication-in-search-heads-at-two-different-sites
... View more
