About jimodonald

trashyroadz · ‎02-02-2025

A standalone Deployment Server that is not functioning with any other server roles should be able to handle up to 25,000 forwarders. In the past, customers with large deployments have set up Deployment Servers behind a load balancer and kept apps sync'd between them using tools such as Puppet or Ansible. Since 9.2.0, Splunk Deployment Servers have been architected to work as a "cluster" behind a load balancer and to keep apps and client status sync'd between them via a shared network directory. This allows any number of forwarders to be managed. For example, for an environment capturing data from 100,000 forwarders, a cluster of at least 4 Deployment Servers would be a good place to start.

Afiyat_09 · ‎05-06-2023

Can anyone please help me how to do this.. I want to use my lookup ccsid.csv which only contains one column named CCS_ID This CCS_ID should be taken from lookup only as a subsearch output and given to main query with a different index to fetch cif_no Please help, it's not taking my lookup data as input for subsearch

wcampos · ‎04-28-2021

Hello. I know its an old topic but did you get it to work? I'm doing it right now, the basic stuff untill now, like Logins, libname mapping, sas compress effect, sas procs used, errors...

13tsavage · ‎01-23-2020

Try this: | eval Timenow=now() | convert timeformat="%Y/%m/%d" mktime(_time) as date_provisioned | eval days_since_provisioned=Timenow-floor(date_provisioned) | eval bucket=case(days_since_provisioned<=179, "Less Than 180", days_since_provisioned<=210, "180-210", days_sinced_provisioned>=210, "Greater Than 210") | chart count by bucket I do not think you had your date_provisioned field is configured in your last search so that screwed up your days_since_provisioned eval. I created a date_provisioned field using the convert timeformat=... mktime(_time) as date_provisioned . Then added in the rest of your search with some minor tweaks. Hope this helps!

jimodonald · ‎01-09-2020

I would recommend adding more CPUs to your search head before you go adjusting those limits. You'll be happier in the long run.

vrmandadi · ‎01-14-2020

Thank You @jimodonald .One last question what would be the default hot bucket setting when an index is created .Below is the index setting we have and what is the setting should we change to make the hot bucket 30 days [aws_abc] coldPath = $SPLUNK_DB/aws_abc/colddb homePath = $SPLUNK_DB/aws_abc/db thawedPath = $SPLUNK_DB/aws_abc/thawedb repFactor=auto frozenTimePeriodInSecs = 31536000

jimodonald · ‎07-26-2019

Yes, this is possible. I copy/pasted your small snippet of log and set up an ingestion into Splunk and extracted the fields you had identified (the field extraction might need some tweaking depending on your usage). Props.conf is as follows: [phonelog] DATETIME_CONFIG = LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Custom pulldown_type = true EXTRACT-transaction_id,user_id,state = ^[^$\n]*\((?P<transaction_id>[^$]+)[^:\n]*:\s+(?P<user_id>\w+)[^\(\n]*\((?P<state>\w+) One you have the data extraction you should be able to find the duration of calls with the transaction command. It will look something like: your_search | transaction state startswith="OffHook" endswith="OnHook" Hope that helps!

mccartneyc · ‎01-09-2020

The solution I found for this issue in our environment was to install UFs on each Splunk server alongside the enterprise install. Installed UFs in /opt/splunkforwarder and created a custom service for the UF to use in /etc/init.d by copying the /etc/init.d/splunk to /etc/init.d/splunkfwd and changing the paths from /opt/splunk to /opt/splunkforwarder and the cache path from splunk to splunkfwd. When splunk is installed and you install splunkforwarder on the same machine, the UF chooses the next available port to run on. Did this all through a puppet module and currently have it deployed and running successfully to the following servers: Master Indexers Intermediate Forwarder - This receives cloned data from all UFs and forwards externally. The UF sends data to our local indexers. Search Heads For whatever reason, I was unable to get the indexers to receive all data and then forward to the intermediate forwarder. When setting up forwarding on the indexers, they would either stop indexing and not forward anything or they would index and still not forward anything. For the time being, this solution works and has not had an impact on performance. The UFs on the splunk servers are configured to forward only local data to our indexers and the intermediate, while the enterprise installation only indexes internal logs.

garujoey · ‎05-10-2018

Thanks woodcock, I used "| rex max_match=0 field=_raw "(?)Dest : (?.*)" | table path" in the end, but your suggestion to use "max_match=0" really helps!

IRHM73 · ‎05-10-2018

Hi, thank you for coming back to me with this. I didn't know about using the 'report' command in this way. Many thanks and kind regards Chris

jimodonald · ‎01-08-2018

There are several solutions for sending SNMP traps from Splunk. Here's one over on Splunkbase that is pretty basic. Here is another.

woodcock · ‎06-15-2017

Make sure that you are NOT setting SHOULD_LINEMERGE=true and keep the default (do not specify any LINE_BREAKER= ).

appalisudhakar · ‎12-28-2018

Hi, Remove Scope from inputs.conf and try loglevel as DEBUG to see performance data in Splunk. Below inputs works. [vnx_data_loader://sf_vnx_block] network_addr = 10.X.X.X username = vnxuser password = vnxpassword platform = VNX Block index = emc_vnx loglevel = DEBUG site = SF disabled = 0 Thanks, Sai

adonio · ‎04-14-2017

absolutely, well aware of the techniques and how to use the license usage data, the challenge here as i understand it is that @pmerlin1 wants to have a report on license per instance and there are multiple instances per host. if there are naming conventions and each instance has different source you can split your license search by s (for source) and alert on that. something like: earliest=-1d@d latest=@d index=_internal source=*license_usage.log* type=Usage s=<yourJBOSSnamingConvention> | stats sum(b) AS Bytes by s | eval MB = Bytes/1024/1024 | table s MB | sort -MB | addcoltotals

jimodonald · ‎09-30-2016

The "power" role does much of what you're looking to accomplish. http://docs.splunk.com/Documentation/Splunk/6.4.3/Admin/Aboutusersandroles#About_roles

mikelauth · ‎06-14-2019

This worked perfect! Thank you!

pargupta1234 · ‎04-18-2020

As Splunk has 4 GB RAM limitation so KV store with such number of rows (7 crore) will not raise issue ?

instrumental · ‎05-14-2018

Installed on 10.11 without any xcode. Hit the DeRez requires dev tools dialogue. Hoping to avoid installing xcode and more heft/cruft/config, but also reluctant to fake the path as per the above solution as it means my notes on recovering the solution become pages long. Found an alternate temporary solution; just Install the command line tools http://osxdaily.com/2014/02/12/install-command-line-tools-mac-os-x/ Hopefully Splunk will find it!

jimodonald · ‎07-10-2015

You can also use the xmlkv command to extract the fields from xml. http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/Xmlkv

mmohiuddin · ‎05-19-2015

Thanks Jim, I was able to establish the connection.

cjenning · ‎05-14-2015

I want the sparkline to be used for the total column. I tried going through that documentation but it didn't help me with this problem. Anyway I formulate my search I either get 5 sparklines or a chart way off from what I'm looking for with 1 broken sparkline.

jimodonald · ‎01-20-2015

When you reinstalled splunk, did you remove the /opt/splunk directory first, or just re-install splunk on top of what was there? if you re-installed on top of what was there, Splunk would have kept all the modifications you made to config files in the "local" directories.

dshakespeare_sp · ‎04-28-2016

It appears this behavior is by design and is not really a bug. All "disabled = 1" means is the inheriting input stanzas should be disabled, not that the modular input is disabled. A notion of disabled modular inputs does not exist in Splunk. Though, a modular input can be part of a disabled app, in which case the modular input will not be initialized (behaves as if it didn't exist). So this is by design to allow maximum flexibility. Even if all input stanzas are disabled, it may be appropriate for a process to start and "do something". The only way to get around this design annoyance is to also add "interval=-1" to the disabled stanza. This means the processes will run ONCE only at startup

jzapantis · ‎04-04-2017

I used the following syntax to count the frequency of terms in my field: | rename COMMENTS_4 AS text | rex mode=sed field=text "s/[,|.|!]/ /" | makemv text | mvexpand text | eval wordCount = mvcount(text) | stats sum(wordCount) as "Word Map Text Analysis" by text the line: | rename COMMENTS_4 AS text just names my field variable to "text". So assuming you rename your field variable with text, you can count the terms using MV* commands

jimodonald · ‎12-05-2014

Try to modify the chart command as follows: ... | chart count over eventtype by c_time limit=0 useother=false The limit argument will specify that no filtering occurs.

Posts	96
Solutions	17
Karma Given	13
Karma Received	59
Member Since	‎09-30-2010

Online Status	Offline
Date Last Visited	‎06-15-2020 06:56 AM

Any suggestions for Splunking SAS logs?

Relocate KVstore files on filesystem

Windows Universal Forwarder default scripted input...

Re: Recommended sizing for deployment server?

Re: How to use a lookup in a subsearch to search r...

Re: Any suggestions for Splunking SAS logs?

Re: Case Statement Issue

Re: Help with limits.conf

Re: Question on data retention

Re: Is it possible to parse daily log file to repo...

Re: Forward specific inputs from indexer to interm...

Re: How to rex multiple lines

Re: Ingestion of Data in Summary Index

Re: Hi Experts,Could you please give me the script...

Re: Hi, Want to break event using line_breaker pro...

Re: Splunk EMC VNX add-on not working

Re: How optimize a search to calculate data volume...

Re: How to set-up permissions for "app level" admi...

Re: Relocate KVstore files on filesystem

Re: Is there any KV Store Limits setting Documenta...

Re: Why am I getting an installation failure for S...

Re: Is Splunk preferable for XML data?

Re: Getting error connecting to informix database ...

Re: Adding sparklines to chart

Re: Problem to forward data from W7 to splunk(set ...

Re: Windows Universal Forwarder default scripted i...

Re: How can I calculate the term frequency for all...

Re: How to edit my search to get a tabular report ...

Are you a member of the Splunk Community?