About kmower

kmower · ‎10-21-2019

I am trying to find a way to correlate Splunk Stream TDS events from SQL Server to CPU utiization. That is, I want to know which queries are impacting the server and by how much. If anyone has an idea on how to do this, I would be very happy to know it. Thanks.

kmower · ‎10-16-2019

I have noticed a big spike in Memory with Splunk Stream on one of our SQL Servers. It climbed up to 30GB and caused some performance degradation. this is a 7.3.1 universal forwarded, but splunk stream may be incompatible with 7.3.x Can anyone confirm that Splunk Stream works on 7.3.x and that memory should not be a problem.I found one post here from Splunk version 6.6 reporting the same phenomenon. Thanks.

kmower · ‎10-14-2019

Hi guys, I have installed DB connect successfully using the JRE some time ago. The trick is that you have to have Java installed, and JAVA_HOME installed before you install DB Connect for the first time (clean install). Otherwise, the install would not work. Fast Forward to now, and I needed to install the JDK on my server for another piece of software. I installed it, and reset JAVA_HOME and then changed to the DB connect JAVA_HOME path. It did not work. Now, I can do a clean install, that doesn't bother me, but I wanted to know from Splunk if: Splunk DB Connect will work with the JDK and not just the JRE; and What is the path I should use for the Splunk JAVA_HOME - is it {jdk_path}/jre/bin , {jdk_path}/jre or simply {jdk_path} Thanks/

kmower · ‎08-15-2019

I was looking at the standard dashboards in the Splunk Stream App - for example for top 10 Longest Running Queries for Database. My question is that my understanding is that time_taken is in Milliseconds, but the dashboard uses eval(time_taken/1000000) which makes those time_taken(s) look a lot shorter in terms of time. So, my question is if I am missing something, or are those time_taken evals actually wrong for calculating seconds from milliseconds (which my little brain seems to think)? Thanks.

kmower · ‎08-15-2019

You also should make sure that you have installed the stream TA on your splunk Instance/search head.

kmower · ‎08-13-2019

OK, I have answered this myself. The permissions for the Event Types for Splunk_TA_stream were restricted to 'The App' which is Splunk_TA_Stream, bit of course the Stream App is splunk_stream_app ... So the fix is to enable the Permissions for All apps so that splunk_stream_app can access the Event Types.

kmower · ‎08-13-2019

I have had Splunk Stream up and running for a while, but after upgrading to 7.3.1 some of my Eventtypes that drive the Stream dashboards seem to have gone AWOL. For example, I am mainly using Stream to monitor my sql database activity (tds). The Admin dashboard for databases used to work just fine, but now it is throwing the error: Eventtype 'stream_agg_databases' does not exist or is disabled. I checked the Eventtypes after reading a post that said sometimes Eventtypes are disabled on upgrades, but this one is gone altogether. So I was wondering if anyone knows how to restore the Eventtypes for Stream? Thanks.

kmower · ‎08-11-2019

When the User setting for default App is set at the User level in 'Access Controls' - if the Launcher is not the default app then clicking the Splunk Enterprise Logo will always take the user back to the Default App.

kmower · ‎07-01-2019

Right. I'll jump on and lodge it now. Thanks.

kmower · ‎07-01-2019

Yes, I have set the time preference for the user that the Alert is run as ... but I still get GMT instead of my adjusted TZ. I have tried different users and have the same thing. I am running 7.3

kmower · ‎07-01-2019

Good idea. How would I overwrite (or get a handle on) the trigger time key? Thanks.

kmower · ‎06-25-2019

Hmmm. Well, I definitely created it as the Admin user (me) and the Admin user's prefs are in GMT+10 , but the 'Trigger Time' is getting sent as GMT. I am running 7.3 ... perhaps it is a bug? Weird. I set the local time a long time ago.... the 'T-1' added on the back of the Trigger Time makes me wonder if there are other 'times' such as T-2, T-3, etc. Do you you know why that 'T-1' is appended?

kmower · ‎06-25-2019

Anyway, I am in GMT+10, and that is set in my user preferences. I had an Alert generated at 12:55pm my time (half an hour ago) and the 'Triggered Time' showed as 03:55:02 T-1 which is GMT ... 12:55pm - 10 hours = 3:55am

kmower · ‎06-25-2019

Aww Snap ... not enough Karma for attachments 😞 happy to send wherever ...

kmower · ‎06-25-2019

OK, I am the Admin for our on prem instance ... and my time zone was set correctly in preferences... but the Alert 'Trigger Time' in the email is GMT. Is there a .conf file where I can make the change for Alerts? Other than that I can just untick 'Triggered Time' but I would prefer to have 'Trigger Time' instead of relying on the email time. Thanks again.

kmower · ‎06-25-2019

OK, great thanks. I will try that out.

kmower · ‎06-25-2019

I have set up some alerts and I noticed that when I include 'Trigger Time' it is sent as GMT. Now I want it to be the local (Australia Eastern Standard Time). I have adjusted for iis logs by putting the iis and ms:iis:auto sourcetypes in etc\system\local\props.conf ... but since an 'Alert' is not a sourcetype and is not 'indexed' per se - how do I designate the time zone for the Alert 'Trigger Time' ? Thanks.

kmower · ‎05-20-2019

Right, well, I guess I answered this one myself. There is no GUI to disable saved searches. Instead I went into savedsearches.conf and changed all of the orphaned searches in my warnings to disabled = 1. Restarted Splunk.

kmower · ‎05-20-2019

I have read through the Splunk documentation, but I cannot find a way to disable an orphaned scheduled search. There is information on how to reassign an orphaned Search to a new owner - https://docs.splunk.com/Documentation/Splunk/7.2.6/Knowledge/Resolveorphanedsearches - but no real information on disabling an Orphaned Search - https://docs.splunk.com/Documentation/Splunk/7.2.6/Knowledge/Disableordeleteknowledgeobjects I just want to disable the orphaned searches for now (in the Splunk app for Windows Infrastructure) so they don't run and throw warnings. I don't mind jumping into the config files, I just need some solid info on how to disable an orphaned search. I am Admin over my On Prem Splunk Enterprise, and there is no GUI control to 'disable' although there is a 'status' column with 'enabled'. There is also an 'is_scheduled' column/flag which I could change to 0 ... thanks.

kmower · ‎05-19-2019

Sure, whatever you want. Which log/log files would you like? Thanks.

kmower · ‎05-16-2019

Hi Johan, I ran that new version into my Test server, and I am still unable to generate pages. I can generate sessions. I can see your entries, such as WAYNE-Y13R4NAL1 etc. in the websites. However I am still hung up on being able to generate pages. Thanks.

kmower · ‎05-16-2019

It is the second step of setting up the Splunk App for Web Analytics - https://splunkbase.splunk.com/app/2699/#/details - after generating sessions.

kmower · ‎05-16-2019

Thanks for sticking with this Johan, I really appreciate it and I am sure that many other Splunkers with IIS logs will be very happy as well. I will give that new version a whirl ... is there anywhere you would like feedback from my testing of it? Thanks again.

kmower · ‎05-15-2019

I have not had any luck with generating pages. I have been able to generate sessions, but generating pages is still a no-go for sourcetype [ms:iis:auto]. I think it may have something to do with http_request and how it is defined in props.conf (or more specifically, not defined). Any help appreciated, I feel like I am very close, just one tweeked setting away ... I just wish I knew what that setting was. Thanks.

kmower · ‎05-15-2019

Hmmm .... I just looked at the 'web' Data Model and there is no http_request in there either. I am stuck. I tried adding in FIELDALIAS-http_request = cs_uri_stem AS http_request for [ms:iis:auto] and no luck with that either for generating pages.

Posts	56
Solutions	2
Karma Given	0
Karma Received	7
Member Since	‎08-20-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

CPU by SQL Query

Splunk Stream Memory

Splunk DB Connect and JDK

Is the Splunk Stream Dashboard time_taken calculat...

Eventtypes have gone missing

How do I change my Alert TZ?

How to Disable Orphaned Searches?

Unable to Generate Pages

SQL Server Agent Monitoring

No file field in IIS logs

CPU by SQL Query

Splunk Stream Memory

Splunk DB Connect and JDK

Is the Splunk Stream Dashboard time_taken calculat...

Re: Splunk stream

Re: Eventtypes have gone missing

Eventtypes have gone missing

Re: "The app "launcher" is not available"

Re: How do I change my Alert TZ?

Re: How do I change my Alert TZ?

Re: How do I change my Alert TZ?

Re: How do I change my Alert TZ?

Re: How do I change my Alert TZ?

Re: How do I change my Alert TZ?

Re: How do I change my Alert TZ?

Re: How do I change my Alert TZ?

How do I change my Alert TZ?

Re: How to Disable Orphaned Searches?

How to Disable Orphaned Searches?

Re: Unable to Generate Pages

Re: Unable to Generate Pages

Re: Unable to Generate Pages

Re: Unable to Generate Pages

Re: Is it easy to ingest advanced IIS Logs into th...

Re: Unable to Generate Pages