Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About cdevoe57
cdevoe57
Explorer
Member since:
10-19-2015
09-18-2024
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 10-19-2015 |
Activity Feed
- Posted App Icon covers App Name on Splunk Dev. 09-18-2024 11:49 AM
- Posted Re: Deploying DB Connect in a search head cluster. on Splunk Enterprise. 01-31-2024 06:36 AM
- Posted Deploying DB Connect in a search head cluster. on Splunk Enterprise. 01-30-2024 07:45 AM
- Got Karma for How do I troubleshoot why indexing performance is slow?. 06-05-2020 12:47 AM
- Posted Re: How to get the difference of two different fields? on Splunk Search. 05-15-2017 02:03 PM
- Posted How to get the difference of two different fields? on Splunk Search. 05-15-2017 10:55 AM
- Tagged How to get the difference of two different fields? on Splunk Search. 05-15-2017 10:55 AM
- Tagged How to get the difference of two different fields? on Splunk Search. 05-15-2017 10:55 AM
- Tagged How to get the difference of two different fields? on Splunk Search. 05-15-2017 10:55 AM
- Tagged How to get the difference of two different fields? on Splunk Search. 05-15-2017 10:55 AM
- Posted Re: How do I troubleshoot why indexing performance is slow? on Getting Data In. 10-20-2015 07:54 AM
- Posted Re: How do I troubleshoot why indexing performance is slow? on Getting Data In. 10-20-2015 05:28 AM
- Posted How do I troubleshoot why indexing performance is slow? on Getting Data In. 10-19-2015 08:20 AM
- Tagged How do I troubleshoot why indexing performance is slow? on Getting Data In. 10-19-2015 08:20 AM
- Tagged How do I troubleshoot why indexing performance is slow? on Getting Data In. 10-19-2015 08:20 AM
- Tagged How do I troubleshoot why indexing performance is slow? on Getting Data In. 10-19-2015 08:20 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
09-18-2024
11:49 AM
I have several apps setup to segregate our various products. I’ve added icons to the apps. My issue is the icon is being placed over the app name. It should place the icon next to the app name. For example, the Search and Reporting app has the White arrow on a green background to the left of the app name. How do I get the icon to be placed left of the app name?
... View more
01-31-2024
06:36 AM
Yes, I use ansible to push the app to the deployer. Then from within ansible I run the splunk apply shcluster.
... View more
01-30-2024
07:45 AM
I have a splunk distributed system with 3 indexers, 3 search heads, a manger, and 2 heavy forwarders. I am attempting to deploy the DB Connect application to the HF and the SHC. The SHC has 3 member nodes and the deployer on the manger node. Ideally, this would all be done with ansible, sadly, the deployer gets in the way. I can deploy to the HF with ansible, but the deployer keeps removing the db connect app on the SHC. That said, to deploy I install the app on the manager node, install the drivers, and then copy it to the ...shcluster/apps directory and run the splunk schcluster apply command. I've done this both manually and using ansible. When I run the apply the deployer does not put the entire app on the search heads, it only puts the default and metadata directories on the Search heads in the splunk_app_db_connect directory. When I go into the manage apps on the GUI I see the app installed but it is not visible. I would prefer not to use the GUI for management and perform all management task via the cli and ansible. The code is stored in a version control system and gives not only control over the deployments but also trakcs who did what, when, why, and how. So I guess there are multiple questions. Why is the deployer not pushing the entire application to the search heads? How can I disable the deployer and just use ansible?
... View more
Labels
05-15-2017
02:03 PM
Thanks!! Works perfectly. And yes, I found the round!!!!
... View more
05-15-2017
10:55 AM
I have a log file that produces two fields - kernel_packets and kernel_drops. These values are updated every 5 minutes, and accumulate until the app is restarted. That is, each value is larger than the previous. I need to calculate the percent loss over that 5 minute interval. I want to be able to chart these values over time.
To do this
(kernel_drops(at T=0) - kernel_drops (T-5) / kernel_packets (T=0) - kernel_packets(T-5)) *100
I can use the delta function to get on of the values for on or the other but not both
index=data host="server_name" source="/usr/local/var/log/suricata/stats.json" | stats count by _time,stats.capture.kernel_packets |delta stats.capture.kernel_packets p=1
How can I get the delta function to work on both parameters?
... View more
10-20-2015
07:54 AM
We did an interesting thing. We moved the json files to a directory that is directly accessible by the splunk instance doing the indexing. Rates went to over 20KB/s. This tells me it is an issue with the universal forwarder. We are running these in batch mode to index the files then delete them.
... View more
10-20-2015
05:28 AM
When I run that Query I get all 0.0. There are no blocked events.
Is there a way to force Splunk to use more cores?
I just believe there is a configuration setting somewhere slowing things down.
... View more
10-19-2015
08:20 AM
1 Karma
Operating System: Oracle Linux 3.8.13-55.1.5, 64 bit
2 CPUs, total of 40 cores, 128 gb memory, 1 GB network, 6 300 GB, 15K SAS drives
The only thing running on this system is Splunk Enterprise. Indexing Performance is 250KB/S approximately 20GB per day. According to the Capacity Planning Documents, this system should easily handle 250 GB per day. The files are JSON files.
Memory Usage and CPU usage are WAY LOW.
What could be slowing down the indexing?
... View more
