Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About ddrillic
ddrillic
Ultra Champion
Member since:
12-26-2014
Monday
Community Statistics
| Posts | 2280 |
| Solutions | 53 |
| Karma Given | 326 |
| Karma Received | 290 |
| Member Since | 12-26-2014 |
Activity Feed
- Posted Re: how to monitor switch, router, firewall, etc? on Getting Data In. Monday
- Posted Re: Data Onboarding CPU consumption 150% system stuck. on Getting Data In. Monday
- Posted Re: Forward ingested data on Splunk Cloud Platform. a week ago
- Posted Re: How to rename dynamic fields ? on Splunk Search. 2 weeks ago
- Karma Re: High Percentage of Small Buckets on Indexer – Mostly on _internal Index for richgalloway. 2 weeks ago
- Karma Re: Does the REST API allow to retrieve the XML source code of Classic Dashboards? for livehybrid. 3 weeks ago
- Karma Re: Does the REST API allow to retrieve the XML source code of Classic Dashboards? for bowesmana. 3 weeks ago
- Got Karma for Re: Who should be the owner of my Saved Search and Reports in Splunk?. 3 weeks ago
- Posted Re: uberAgent on Getting Data In. 4 weeks ago
- Posted Re: How to configure Unviversal forwarder Props.conf for Truncate on Getting Data In. 4 weeks ago
- Karma Re: Easily find the conf of an extracted field for livehybrid. a month ago
- Posted Re: How to configure Unviversal forwarder Props.conf for Truncate on Getting Data In. a month ago
- Posted Re: Events in the Future from a UF on Getting Data In. 11-01-2025 02:26 PM
- Got Karma for Re: Slow Performance in the Deployment Server UI. 07-01-2025 10:33 AM
- Got Karma for Re: Data Model vs. Datasets - when to use?. 05-16-2025 05:26 AM
- Got Karma for Re: Is it safe to delete .bundle files ?. 12-10-2024 06:45 AM
- Got Karma for Re: Do I need to make outputs.conf for all apps?. 07-10-2024 08:08 AM
- Got Karma for Re: Couldn't determine $SPLUNK_HOME or $SPLUNK_ETC ,SETTING $SPLUNKHOME (LINUX). 07-25-2023 03:13 PM
- Got Karma for Re: Use of _indextime field in table or stats command. 04-06-2023 03:46 AM
- Got Karma for Re: How to avoid reindexing files after setting crcSalt=. 01-13-2023 08:44 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-04-2016
09:05 AM
Lots of threads are out there about the topic such as - https://answers.splunk.com/answers/49521/splunk-why-must-xml-sources-be-so-complicated.html
... View more
03-03-2016
02:46 PM
1 Karma
Raanan, working with Jeff and we realized that the extra json level happens when the hive data definition holds Char(N). When the hive data definition is String, we see the expected presentation.
Just to keep in mind, the upgrade of the hive libraries last week solved the immediate fatal error when issuing a query. Now we have a different related issue.
... View more
03-03-2016
07:28 AM
Makes perfect sense - much appreciated.
... View more
03-03-2016
07:26 AM
Maybe I'm not clear - we want the users to know whether a MapR job was produced and that they are not running Hunk in Splunk mode. How can they know for sure that they are in Hunk mode?
Raanan explained that adding the stats command triggers the MapR job, but I'm sure whether it's the only way.
Regards,
Dan
... View more
03-03-2016
07:07 AM
Fair enough, but why do we see one level of nesting for some tables and two levels of nesting for other tables, while the hive and the hdfs data look identical?
... View more
03-02-2016
06:12 AM
Great. About the implicit search modes part of the question - how do we know for sure that we converted the "regular" Splunk search to an Hunk MapR based search?
... View more
03-02-2016
06:09 AM
Very much appreciated!!
... View more
03-02-2016
06:08 AM
Hi Raanan, David,
The thing is that for some tables we see one level of json nesting and for others we see a nesting for each field with the creation of new fields on the left pane.
So, that's the issue.
Regards,
Dan
... View more
03-01-2016
11:35 AM
The input looks like -
01Arabian U2007-05-08TSUAS63 2016-01-06201
6-01-06
... View more
03-01-2016
10:18 AM
Hi David,
The records are in text, space separated. The preferred way to view the data is in a non-json way. What do you think?
Regards,
Dan
... View more
03-01-2016
09:12 AM
We see the following:
On the HDFS file system, the values are space separated. How can we "fix" the loading process so it won't show as json?
... View more
03-01-2016
08:21 AM
We're wondering what is the proper way to remove a list of forwarders from a cluster and all the data associated with their index?
... View more
03-01-2016
07:47 AM
Great. Can I use the Fast mode for Hunk?
... View more
03-01-2016
07:35 AM
You are absolutely right -
We see -
234G _internaldb
14G _introspection
Can we handle them like any other index?
... View more
02-29-2016
09:03 AM
The indexes almost consumed the entire terabyte of space allocated for them. What would be a simple way to clear some space?
... View more
02-29-2016
08:44 AM
We would like to know how to use the three different explicit modes correctly and how to use the implicit ones correctly in the context of Hunk.
https://answers.splunk.com/answers/239341/in-hunk-verbose-mode-vs-smart-mode-for-vix-virtual.html touches on the subject...
... View more
02-29-2016
07:03 AM
http://docs.splunk.com/Documentation/Splunk/6.1/Indexer/Restartthecluster says -
"When you restart a master or peer node, the master rebalances the primary bucket copies across the set of peers,..."
For some reason, it doesn't describe the toll on the cluster when doing the rolling restart.
... View more
02-28-2016
05:11 PM
Please keep in mind that the Hunk solution requires an Hadoop cluster ; -) if it's not clear...
... View more
02-28-2016
04:58 PM
Please keep in mind the following -
http://docs.splunk.com/Documentation/Splunk/6.1/Indexer/Automatearchiving
Caution: By default, the indexer deletes all frozen data. It removes the data from the index at the moment it becomes frozen. If you need to keep the data around, you must configure the indexer to archive the data before removing it. You do this by either setting the coldToFrozenDir attribute or specifying a valid coldToFrozenScript in indexes.conf.
... View more
02-26-2016
04:49 PM
How does the directory structure look under /mapr/tmp/dispatch? Each search job should have its own directory...
... View more
02-26-2016
03:46 PM
http://stackoverflow.com/questions/35335128/grep-thinks-text-file-is-binary-but-it-isnt speaks about the issue.
... View more
02-26-2016
03:15 PM
Interestingly, the Out-Of-The-Box props.conf has a number of NO_BINARY_CHECK = 1 within it, such as -
[WinNetMonMk]
KV_MODE = multi_WinNetMonMk
NO_BINARY_CHECK = 1
pulldown_type = 0
... View more
02-23-2016
07:42 AM
https://answers.splunk.com/answers/1001/how-do-i-determine-when-an-event-was-indexed.html speaks about it -
"Since Splunk 4.0, the indexing machine will add an index time field called _indextime to events as they are written to disk."
.. | eval indextime = _indextime
You can also run the following -
eval latency=_time-_indextime|
... View more
02-23-2016
07:27 AM
Similar but different case - https://answers.splunk.com/answers/177137/why-my-splunk-alert-only-include-1000-results-in-a.html
... View more
02-22-2016
10:18 AM
http://docs.splunk.com/Documentation/Splunk/6.3.0/Forwarding/UpgradetheNixforwarder is very interesting as you install the universal forwarder package over the existing deployment.
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Monday
|
Karma from
Karma given to
