Hello Team, We have use case where we need to map/identify people's region in Splunk and create dashboard. Can we do something in Splunk? we want to be able to write some performance dashboards and categorise people as internal/external and what region (UK/US/APAC/Other) thanks Nik ... View more

We are currently using TCP capability to index REST API logs in Splunk. We now have requirement to use UDP instead of TCP. When I select UDP capabilities under same role nothing happens. I am keeping rest all setting (port, URL etc. ) same and adding UDP capability for the role. Do I need to make any other changes to index REST logs using UDP? Source setting are as follows: 1.) Add slpunk Nuget Package 2.) Add a class SplunkAppender.cs internal class SplunkAppender : log4net.Appender.AppenderSkeleton { … public SplunkAppender() { var connectArgs = new ServiceArgs { //TODO: Read this from config file Host = {splunk url}, Port = 8089 }; var service = new Service(connectArgs); service.Login(username, password); _receiver = new Splunk.Receiver(service); } protected override void Append(log4net.Core.LoggingEvent loggingEvent) { string data = RenderLoggingEvent(loggingEvent); _receiver.Submit(new ReceiverSubmitArgs() { Index = _index, Source = _source, SourceType = _sourceType }, data); } } 3.) Change Configuration – Add a new appender 4.) For logging to splunk end point var logger = LogManager.GetLogger("SplunkLogger"); logger.Info("logged to splunk! GFX2Client Plugin Loaded"); ... View more

Hi I want to discard log lines which includes specific tag "reversed position attributes " in log file. We want to avoid lines which includes these specific tags and index rest of the log file. Is it possible to discard these log lines on forwarder level? Please suggest suitable solution. If you need more information please let me know. Thanks. ... View more

We have recently upgraded the Splunk SearchHead and Indexer to Splunk V6. Since afternoon we are facing below error and no logs are coming on Indexer or Search head. 1. Search peer lonrs10215 has the following message: Tcp output pipeline blocked. Attempt '400' to insert data failed. I looked at the splunkd.log on indexer and can see below error message:( 11.192.36.204 is the Indexer server lonrs10215 mentioned in above error) 01-07-2014 18:10:33.233 +0000 WARN TcpOutputFd - Connect to 11.192.36.204:9997 failed. Connection refused 01-07-2014 18:10:33.234 +0000 ERROR TcpOutputFd - Connection to host=11.192.36.204:9997 failed 01-07-2014 18:11:03.235 +0000 WARN TcpOutputFd - Connect to 11.192.36.204:9997 failed. Connection refused 01-07-2014 18:11:03.235 +0000 ERROR TcpOutputFd - Connection to host=11.192.36.204:9997 failed 01-07-2014 18:11:23.237 +0000 WARN TcpOutputProc - Shutdown timed out for 11.192.36.204:9997 01-07-2014 18:11:23.237 +0000 WARN TcpOutputFd - Connect to 11.192.36.204:9997 failed. Connection refused 01-07-2014 18:11:23.237 +0000 ERROR TcpOutputFd - Connection to host=11.192.36.204:9997 failed 01-07-2014 18:11:23.421 +0000 WARN TcpOutputFd - Connect to 11.192.36.204:9997 failed. Connection refused When i tried the command (netstat -an | grep 9997) on indexer I can see its connecting and have established connections: tcp 24778 0 11.192.36.204:9997 11.182.8.168:2621 ESTABLISHED tcp 1304190 0 11.192.36.204:9997 11.182.8.168:2620 ESTABLISHED tcp 1613142 0 11.192.36.204:9997 11.192.36.204:46875 ESTABLISHED Can you please suggest to resolve this? Thanks Nik ... View more

We have situation where other team want to manage their own instance of universal forwarder on the same Windows box. Is it possible to run multiple forwarder under different dir on Windows box? Thanks Nik ... View more

Anybody can suggest how to setup email alerts if Splunk service is down. I am trying to configure alerts in a way so we get email alert if service is down. Any sort of help will be appreciated. Thanks Nik ... View more

I am working on new setup for splunk and facing "Unable to distribute to peer named lonrs10457 at uri https://SPLUNK-IDX1:8089 because peer has status = "Authentication Failed" " error on SearchHead. I have distributed search setup. I have checked the status under Manager » Distributed search » Search peers> Status: Authentication Failed; Replication status:Initial Forwarder are not enabled at the moment. indexer is up and running. Any suggestion please. ... View more