Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About rrmavani
rrmavani
Engager
Member since:
07-14-2011
06-05-2020
Community Statistics
| Posts | 9 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 07-14-2011 |
Activity Feed
- Karma Re: Will our current configuration work for monitoring our application logs and changing the sourcetype? for woodcock. 06-05-2020 12:47 AM
- Posted execute a saved search in sh cluster captain on Deployment Architecture. 01-14-2020 07:47 PM
- Tagged execute a saved search in sh cluster captain on Deployment Architecture. 01-14-2020 07:47 PM
- Tagged execute a saved search in sh cluster captain on Deployment Architecture. 01-14-2020 07:47 PM
- Tagged execute a saved search in sh cluster captain on Deployment Architecture. 01-14-2020 07:47 PM
- Tagged execute a saved search in sh cluster captain on Deployment Architecture. 01-14-2020 07:47 PM
- Tagged execute a saved search in sh cluster captain on Deployment Architecture. 01-14-2020 07:47 PM
- Posted How to avoid same file get indexed multiple times on All Apps and Add-ons. 12-06-2019 03:40 AM
- Tagged How to avoid same file get indexed multiple times on All Apps and Add-ons. 12-06-2019 03:40 AM
- Tagged How to avoid same file get indexed multiple times on All Apps and Add-ons. 12-06-2019 03:40 AM
- Tagged How to avoid same file get indexed multiple times on All Apps and Add-ons. 12-06-2019 03:40 AM
- Tagged How to avoid same file get indexed multiple times on All Apps and Add-ons. 12-06-2019 03:40 AM
- Posted What needs to be installed and configured to give users access to the Splunk CLI to run searches? on Splunk Search. 11-11-2015 09:07 AM
- Tagged What needs to be installed and configured to give users access to the Splunk CLI to run searches? on Splunk Search. 11-11-2015 09:07 AM
- Tagged What needs to be installed and configured to give users access to the Splunk CLI to run searches? on Splunk Search. 11-11-2015 09:07 AM
- Tagged What needs to be installed and configured to give users access to the Splunk CLI to run searches? on Splunk Search. 11-11-2015 09:07 AM
- Posted Will our current configuration work for monitoring our application logs and changing the sourcetype? on Getting Data In. 04-01-2015 10:03 AM
- Tagged Will our current configuration work for monitoring our application logs and changing the sourcetype? on Getting Data In. 04-01-2015 10:03 AM
- Tagged Will our current configuration work for monitoring our application logs and changing the sourcetype? on Getting Data In. 04-01-2015 10:03 AM
- Tagged Will our current configuration work for monitoring our application logs and changing the sourcetype? on Getting Data In. 04-01-2015 10:03 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-14-2020
07:47 PM
I have a python script.
I have configured commands.conf accordingly.
Now I want to execute it using saved search at regular interval.
How to make sure that this saved search execute on Search Head Cluster captain only.
I do not want it to be executed on any other server.
... View more
12-06-2019
03:40 AM
I have configured ftp pull add-on.
It fetches file correctly but it index all the files multiple times and show all the contents as many times as it fetches.
As per nature of the add-on it reads the file each time it access it but indexing the same content and showing in search result is really not wanted.
... View more
11-11-2015
09:07 AM
We have cluster environment in Splunk.
We want to give access to Splunk CLI to users.
They should be able to execute CLI commands from their local computers or from the servers where just a Splunk Forwarder is installed.
Users already have access in the Splunk GUI.
What need to be installed in their local computers?
What need to be configured to be able to perform search?
... View more
04-01-2015
10:03 AM
Hello Splunk Guru,
In our environment, we have many Universal forwarders, few indexers and couple of search heads.
Files to monitor from many forwarders
/application/app1/logs/*
/application/app2/logs/*
/application/app3/logs/*
Will the configuration below work? If not work, what should we do?
In Forwarder
inputs.conf
[monitor:///application/*/logs/*]
followTail = 0
props.conf
[source::/application/*/logs/*]
TRANSFORMS-change_stuff = change_sourcetype
In Indexer
transforms.conf
[change_sourcetype]
SOURCE_KEY = MetaData:Source
REGEX = /application/*/logs/*
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::$1
... View more
01-25-2014
07:29 AM
ok..
So you mean
in forwarder I can put at '/opt/splunkforwarder/etc/apps/glassfish/local/props.conf'
in indexer I can put at
'/opt/splunk/etc/system/local/props.conf'
is my understanding right ??
... View more
01-25-2014
05:28 AM
so do I need to configure and install the apps in indexer also ??
... View more
01-25-2014
05:12 AM
Yes but what is the path of props.conf in indexer (for the applications configured in UF) ??
... View more
01-25-2014
04:40 AM
In our environment,
We have Universal forwarder, Indexers and search head.
We have different approximate 20-22 splunk apps for different kind of configurations.
All apps are configured In Universal Forwarders at '/opt/splunkforwarder/etc/apps/'
No Apps are configured in indexers.
For each applications, props.conf are configured separately.
Some threads are saying "time stamping" and "line breaking" should be configured in indexers only not in UF.
Where should I place the props.conf in indexer for "time stamping" and "line breaking" for each splunk apps. ?
... View more
