Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About lbur
lbur
Explorer
Member since:
03-25-2014
06-05-2020
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 03-25-2014 |
Activity Feed
- Got Karma for Where does Cisco eStreamer for Splunk app need to be installed in a distributed search environment?. 06-05-2020 12:47 AM
- Got Karma for Where does Cisco eStreamer for Splunk app need to be installed in a distributed search environment?. 06-05-2020 12:47 AM
- Posted Re: How to troubleshoot the setting screen in Splunk for Unix app? Stuck on "loading" on All Apps and Add-ons. 08-20-2018 01:27 PM
- Posted Re: Can a Heavy Forwarder send cooked but unparsed data? on Getting Data In. 03-04-2017 07:05 AM
- Posted Re: Can a Heavy Forwarder send cooked but unparsed data? on Getting Data In. 03-03-2017 06:44 PM
- Posted Re: Can a Heavy Forwarder send cooked but unparsed data? on Getting Data In. 03-03-2017 06:43 PM
- Posted Can a Heavy Forwarder send cooked but unparsed data? on Getting Data In. 03-03-2017 01:54 PM
- Tagged Can a Heavy Forwarder send cooked but unparsed data? on Getting Data In. 03-03-2017 01:54 PM
- Tagged Can a Heavy Forwarder send cooked but unparsed data? on Getting Data In. 03-03-2017 01:54 PM
- Tagged Can a Heavy Forwarder send cooked but unparsed data? on Getting Data In. 03-03-2017 01:54 PM
- Posted Enabling and Disabling DB Inputs in Splunk DB Connect 2 in inputs.conf; Can changes be made effective without a Splunk restart? on All Apps and Add-ons. 11-13-2015 04:16 AM
- Tagged Enabling and Disabling DB Inputs in Splunk DB Connect 2 in inputs.conf; Can changes be made effective without a Splunk restart? on All Apps and Add-ons. 11-13-2015 04:16 AM
- Tagged Enabling and Disabling DB Inputs in Splunk DB Connect 2 in inputs.conf; Can changes be made effective without a Splunk restart? on All Apps and Add-ons. 11-13-2015 04:16 AM
- Tagged Enabling and Disabling DB Inputs in Splunk DB Connect 2 in inputs.conf; Can changes be made effective without a Splunk restart? on All Apps and Add-ons. 11-13-2015 04:16 AM
- Tagged Enabling and Disabling DB Inputs in Splunk DB Connect 2 in inputs.conf; Can changes be made effective without a Splunk restart? on All Apps and Add-ons. 11-13-2015 04:16 AM
- Posted Where does Cisco eStreamer for Splunk app need to be installed in a distributed search environment? on All Apps and Add-ons. 08-21-2014 07:27 PM
- Tagged Where does Cisco eStreamer for Splunk app need to be installed in a distributed search environment? on All Apps and Add-ons. 08-21-2014 07:27 PM
- Tagged Where does Cisco eStreamer for Splunk app need to be installed in a distributed search environment? on All Apps and Add-ons. 08-21-2014 07:27 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 2 |
08-20-2018
01:27 PM
We recently had this same problem on version 5.2.4.
We solved it by copying default/macros.conf to local/macros.conf and modified the following stanza:
[metadata_index]
CHANGED FROM index=* to index=os
definition = index=os
... View more
03-04-2017
07:05 AM
No, I want to send from a Heavy Forwarder (because I need the full Splunk Installation for other purposes, like estreamer and dbconnect), but for normal file monitor functions (for instance) I want to forward cooked, unparsed data, in order to limit the network bandwidth. However, it seems as if the Heavy Forwarder can only be configured to send either raw, or cooked parsed data, which is much larger than unparsed data.
... View more
03-03-2017
06:44 PM
Thanks Koshyk, but that didn't answer the question. I want the Heavy Forwarded to send unparsed cooked data to the indexers. You addressed sending raw and parsed.
... View more
03-03-2017
06:43 PM
Thanks Koshyk, but that didn't answer the question. I want the Heavy Forwarded to send unparsed cooked data to the indexers. You addressed sending raw and parsed.
... View more
03-03-2017
01:54 PM
Is it possible to have a heavy forwarder send unparsed (not raw) cooked data?
I have a server which needs to forward data, and a universal forwarder sending compressed, unparsed data would be fine.
However, I would like to use that same server to do some data collection as well.
This data collection requires a full Splunk install and a 3rd party app (estreamer to be specific).
However, as I understanding it using a full Splunk install as a heavy forwarder will, by default send parsed data.
This is a much heavier network load, which I would like to avoid.
The only option in outputs.conf related to this is: sendCookedData = true | false.
If I set this to false, then it will be sending raw (uncooked data to the forwarder).
If I set this to true, then it appears the heavy forwarder will send all data as cooked, parsed data.
I'm looking for an option to send cooked, unparsed data.
Thanks for any help!
... View more
11-13-2015
04:16 AM
I have a requirement to disable and enable database inputs defined in the Splunk DB Connect 2 app. The nature of the requirement necessitates editing the inputs.conf files directly (not through the GUI). Additionally, when enabling the inputs, I also have to set a new (current) tail_rising_column_checkpoint_value.
Is there a way to make these changes to inputs.conf without having to restart Splunk?
I attempted the following CLI command as suggested in this answer, but it does not work.:
http://answers.splunk.com/answers/205534/can-i-restart-splunk-db-connects-input-without-res.html
./splunk _internal call /services/apps/local/splunk_app_db_connect/_reload -auth admin:$ADMINPWD
Splunk Enterprise 6.2.2
Splunk DB Connect 2.0.2
Thanks for any help.
... View more
08-21-2014
07:27 PM
2 Karma
We have a distributed search environment with 3 Search Heads and 6 Indexers. All of them are linux. Does anyone know where the eStreamer app needs to be installed.
Does it get installed on both the Indexer, so that the app will obtain the logs from Defense Center and put them into the eStreamer index, and on the Search Head, so that users have access to the dashboards? Or is it possible this app only works on a Search Head / Indexer combination, and not in a distributed search environment?
Thank you.
... View more
