About ewoo

ewoo · ‎12-02-2016

do I need to click on each object and then edit the role permission or is there a way I can edit the permission for all the objects at a single go (like if I wanted to edit and give power role for all the 50 + objects) In my opinion, the most effective way to edit the permissions of a large number of objects, in bulk, is to use some shell/Python scripting plus Splunk's REST API. See "Example 2" here: http://docs.splunk.com/Documentation/Splunk/6.5.0/RESTUM/RESTusing#Access_Control_List Also: https://answers.splunk.com/answering/7788/view.html

ewoo · ‎12-02-2016

Note: the original question here pertains to the ability to share objects to an app, i.e. move them from private to shared. The read/write permission on an individual object are a related-but-different matter. That being said ... though I edited the access permissions of the app to "power " however when I looked into the permission of the objects in the app they still donot have power user read/write... do I need to explicitly check the option in the objects as well ? Objects within an app only inherit the app-level permission if they lack an explicit permission themselves. This is commonly the case for objects that ship with an app by default. Objects created via UI, CLI, or REST API typically have explicit permissions. In this case, you must grant write permission on the objects themselves, to make them editable by the desired roles.

ewoo · ‎07-22-2016

When I go Field Transformations to look for this it isnt there, not even under the All category. I see. It looks like the Field Transformations settings page only supports REGEX/FORMAT-based transforms and not DELIMS/FIELDS-based ones. Do you have REST API access to the search head? If so, you should be able to use the REST API directly to fix up the transform. For example, something like: curl -sku admin:admin_password https://searchhead-hostport/servicesNS/original_owner/search/configs/conf-transforms/REPORT-LoadTest1/acl -d sharing=app -d perms.read=* -d owner=original_owner

ewoo · ‎07-21-2016

If you can't find "yourtransform" in the "Field transformations" listing, it might be worth looking at the field extraction directly, to see what transform it references -- Settings > Fields > Field extractions > jmetter_logs : REPORT-LoadTest1

ewoo · ‎07-21-2016

that I dont know. How would I change the permissions on the associated transform? Settings > Fields > Field transformations > yourtransform > Permissions (Sidenote: I recreated this comment as a new "thread". Adding new comments to the existing thread doesn't seem to be working ...)

ewoo · ‎07-21-2016

How would I change the permissions on the associated transform? Settings > Fields > Field transformations > yourtransform > Permissions

ewoo · ‎07-21-2016

Thats Uses Transform Oh, this prop references a transform? Does the field extraction work for other users if the associated transform also has its permissions set appropriately (share to app, set read permissions) ...? My understanding is that, if you create a field extraction via the UI that references a transform, then share the extraction via the UI, the associated transform is left private. I believe this is a known issue (internal bug: SPL-118752).

ewoo · ‎07-21-2016

Does the field extraction work for you (admin) if you modify the search string to require the extracted-field explicitly -- e.g. index=dice_loadtest source=*.jtl myfield=* | fields + myfield ...?

ewoo · ‎07-21-2016

Im an admin and it doesnt work for me either. Are you saying the field extraction just doesn't work at all, even for admin? Or it works when it is private, then stops working when it is shared to the app level?

ewoo · ‎07-21-2016

Some questions, to help narrow things down: is the user running a search that explicitly requires the field in question, e.g. "* | fields + myfield" ... or is the user running an "exploratory" search? if "exploratory": is it possible that the user in question has other field extractions in effect, causing this specific field extraction to be skipped due to the default system limit on extractions?' is the user in question running an event-based search or a reporting search? if event-based: is the user running the search in smart, verbose, or fast mode? if fast mode: does the extraction work if the user runs in verbose mode instead?

ewoo · ‎07-21-2016

@shawnbeard: does the user in question have read access to the app containing the field extraction?

ewoo · ‎06-04-2015

To my knowledge, in 6.2.x and prior, running a custom search command requires a Python process to be forked. I'd expect use of a macro to be significantly faster, especially for search strings containing multiple inline comments.

ewoo · ‎06-04-2015

By using a macro, I think it's possible to get the benefits of both the "eval method" (inline comments near the relevant parts of the search string) and the "rename method" (no per-event search-time performance overhead). In macros.conf: [comment(1)] args = text definition = noop description = Throw away comment text. Usage: | table ... | `comment("first comment")` | fields ... | `comment("second comment")`

ewoo · ‎02-03-2015

Mounted bundles introduce their own maintainence costs, especially in terms of understanding the performance requirements on the NFS server as search concurrency increases and the number of indexers grows. Do you know why/how bundle replication is failing? What ERRORs/WARNs do you see on the search head in splunkd.log and on the indexers in splunkd.log/splunkd_access.log? If it's not possible to make bundle replication work (e.g. due to network usage constraints), one other option is to blacklist the large lookup (via distsearch.conf) and then perform the lookup locally on the search head ( with "| lookup local=true").

ewoo · ‎11-14-2014

Considerations regarding NFS for hot/warm buckets: http://docs.splunk.com/Documentation/Splunk/latest/Installation/Systemrequirements#Considerations_regarding_Network_File_System_.28NFS.29 Is this something I can suppress or at least expand the threshold for? In 6.1.4 and 6.2, the message is restricted to admins only. We don't currently allow any tuning of the message threshold, as it's something we always want our support folks and engineers to see when examining diags and other forensics. It's a pretty serious red flag. Have you tuned your NFS client-side parameters to allow for sufficient concurrency? For example, your NFS client should support enough concurrency for your search load -- one NFS client connection per concurrent search is a good starting point. http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Searchheadpoolingconfigurationissues#NFS_client_concurrency_limits_can_cause_search_timeouts_or_slow_search_behavior

ewoo · ‎11-14-2014

Any chance the version discrepancy has something to do with this? The message is new in 6.2 and 6.1.4, so if your other indexers are running older versions, they're likely just not emitting any message (while still suffering from the same slowness). the networked storage is solid It's possible that networked storage performs fine in general, yet still isn't quite up to the task here. How are you using networked storage here? Is this an indexer using mounted bundles?

ewoo · ‎11-10-2014

Are you using search head pooling? If search head pooling is enabled, "active" configurations are located on shared storage instead of in $SPLUNK_HOME/etc. The mount point splunk uses is set in $SPLUNK_HOME/etc/system/local/server.conf, in the "storage" attribute of the [pooling] stanza.

ewoo · ‎11-06-2014

This error shouldn't be specific to any particular index. No matter what index you search against, the search process initializes the same configurations. The time-to-initialize could depend on the app from which the search is run and the user who runs the search, though.

ewoo · ‎11-05-2014

This message means your search processes are taking >1s to read initial configuration information from disk. What does the I/O subsystem underneath $SPLUNK_HOME/etc look like in your environment? If $SPLUNK_HOME/etc is networked storage, for example, there might be disk/network performance issues affecting search startup time.

ewoo · ‎11-04-2014

I've opened a JIRA to cover this issue: SPL-92694. Looks like a regression in Dash, unrelated to search head clustering.

ewoo · ‎09-03-2014

The most common reasons are mentioned in the comment immediately preceding yours: 1) stale lock file (caused by a crash, for example), or 2) poor performance of shared storage, leading to slow I/O and contention on the lock file. Some improvements to splunkd were made to reduce the amount of I/O we perform against sentinel.txt; these improvements landed in 5.0.6 and 6.0 (SPL-66563)

ewoo · ‎09-02-2014

2ms ping is not good. For NFS to perform acceptably, you typically need sub-1ms ping. Is your NFS server on the same LAN, in the same datacenter as your search heads?

ewoo · ‎08-28-2014

theunf: Is your NFS infrastructure sufficiently robust, based on your performance needs? If you haven't already, please check out the "Performance analysis" section here: http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Searchheadpoolingconfigurationissues Some common issues include: - latency to the NFS server is too high, e.g. search heads and NFS server are in different datacenters - concurreny settings on NFS clients are too low Does your NFS setup pass the validation "tests" described in the performance analysis documentation?

ewoo · ‎08-14-2014

Which splunkbase app contains these saved searches? Likely, the app's permissions need to be updated so that the viewstates it contains are visible globally, across apps. For more information on a fix: http://answers.splunk.com/answer_link/77691/

ewoo · ‎08-14-2014

Are you hitting this error for saved searches in a custom app or in an app that ships as part of splunk? If the former, you probably have to change your app's permissions, per my answer (see above).

Posts	72
Solutions	13
Karma Given	3
Karma Received	72
Member Since	‎11-06-2009

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Re: Power user permission to change ownership of o...

Re: Power user permission to change ownership of o...

Re: Sharing field extraction, saved search or dash...

Re: Sharing field extraction, saved search or dash...

Re: Sharing field extraction, saved search or dash...

Re: Sharing field extraction, saved search or dash...

Re: Sharing field extraction, saved search or dash...

Re: Sharing field extraction, saved search or dash...

Re: Sharing field extraction, saved search or dash...

Re: Sharing field extraction, saved search or dash...

Re: Sharing field extraction, saved search or dash...

Re: Add a comment to a search?

Re: Add a comment to a search?

Re: Issues with Knowledge Bundle in Splunk Cluster...

Re: Splunk App for Service Now: What does "Configu...

Re: Splunk App for Service Now: What does "Configu...

Re: Where to find dashboard source files in a Splu...

Re: Splunk App for Service Now: What does "Configu...

Re: Splunk App for Service Now: What does "Configu...

Re: Why did my dashboards disappear after upgradin...

Re: Searchhead Pooling: Failed to lock sentinel.t...

Re: Search head pooling performance with NFS

Re: Search head pooling performance with NFS

Re: After updating an app's saved search by web th...

Re: Viewstate error messages when trying to save s...