Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About bigtyma
bigtyma
Communicator
Member since:
12-17-2012
06-05-2020
Community Statistics
| Posts | 45 |
| Solutions | 2 |
| Karma Given | 7 |
| Karma Received | 10 |
| Member Since | 12-17-2012 |
Activity Feed
- Karma Limit which search peers are used by default for redman1138. 06-05-2020 12:47 AM
- Got Karma for Re: Why Afterglow Visualization image map links to localhost instead of the search head?. 06-05-2020 12:47 AM
- Got Karma for Re: Why Afterglow Visualization image map links to localhost instead of the search head?. 06-05-2020 12:47 AM
- Got Karma for Which of the Splunk CIM data models apply to the Forescout CounterACT App?. 06-05-2020 12:47 AM
- Got Karma for bundle replication and delta. 06-05-2020 12:47 AM
- Karma Re: Subsearch NOT in for sideview. 06-05-2020 12:46 AM
- Karma Re: process control chart e.g. upper/lower control limit. for jonuwz. 06-05-2020 12:46 AM
- Karma Re: Not getting any Data with Xenapp. for jconger. 06-05-2020 12:46 AM
- Karma Re: How do I find events that appear today that did not appear yesterday? for jlanders. 06-05-2020 12:46 AM
- Karma how to show metrics for individual pie chart wedges directly? for yzhou. 06-05-2020 12:46 AM
- Karma Re: current_only=1 for /var/log/messages for yannK. 06-05-2020 12:46 AM
- Got Karma for Re: Splunk DB Connect - How to reset tail.rising state?. 06-05-2020 12:46 AM
- Got Karma for Re: What's the most Splunk-tastic revelation you've experienced using analytics?. 06-05-2020 12:46 AM
- Got Karma for WARN DeploymentClient - DeploymentClient has been asked to redo-handshake. Resetting to initial state.. 06-05-2020 12:46 AM
- Got Karma for How do I find events that appear today that did not appear yesterday?. 06-05-2020 12:46 AM
- Got Karma for How do I find events that appear today that did not appear yesterday?. 06-05-2020 12:46 AM
- Got Karma for Re: replacing host values in a chart. 06-05-2020 12:46 AM
- Posted Re: Why are we getting error "The search for datamodel 'TS2' failed to parse, cannot get indexes to search" on a search head with the OPTIC Splunk App? on All Apps and Add-ons. 12-03-2014 08:24 AM
- Posted Why are we getting error "The search for datamodel 'TS2' failed to parse, cannot get indexes to search" on a search head with the OPTIC Splunk App? on All Apps and Add-ons. 12-03-2014 06:57 AM
- Posted Re: HTTP Client Timeout on Monitoring Splunk. 10-29-2014 12:34 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-03-2014
08:24 AM
Update: I have disabled acceleration for this data model and now the pivot is working correctly. However we would like for acceleration to work. Ideas?
... View more
12-03-2014
06:57 AM
"The search for datamodel 'TS2' failed to parse, cannot get indexes to search"
We are receiving this error on a search head that is hosting the Threatstream/Optic app.
The data model is accelerated and the base search used to generate the constraints is working.
Any ideas or troubleshooting advice is appreciated.
Thank you
... View more
10-29-2014
09:19 AM
Thank you for the explanation. I am trying to find a explanation in the documentation but it's vague here.
It seems like it would be the opposite, it would be need to transfer the entire contents if the CRC changed and then extract the delta after it has copies of both files. I wish the admin guide is more clear on this.
http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Whatisdistributedsearch#What_search_heads_send_to_search_peers
The process of distributing knowledge bundles means that indexers by default receive nearly the entire contents of all the search head's apps. If an app contains large binaries that do not need to be shared with the indexers, you can reduce the size of the bundle by means of the [replicationWhitelist] or [replicationBlacklist] stanza in distsearch.conf. See "Limit knowledge bundle size" in this manual.
... View more
10-29-2014
08:50 AM
Would Splunk not need to copy the entire bundle (after a change) to determine the delta of two bundles?
... View more
10-29-2014
07:06 AM
1 Karma
Does the bundle replication happen every time there is a change the bundle?, If the CRC changes, is the latest bundle replicated too all of the search peers? or only the .delta file?
What exactly is the purpose of the .delta bundle?
... View more
10-01-2014
11:53 AM
Curious if you use srcFilter to explictly deny the search 'index=*' and start training users they required to either specify the indexes, or use the macros.
... View more
09-22-2014
11:43 AM
2 Karma
n/m
I needed to update the /opt/splunk/etc/apps/afterglow/sample.properties
file.
... View more
09-22-2014
11:01 AM
Afterglow 1.6.3 is working, however the resulting generated image map, contains link that refer to localhost:8000 instead of the search head. Any ideas where to look?
Thank you,
... View more
07-10-2014
08:06 AM
1 Karma
Is anyone the using Forescout CounterAct App? Can anyone tell me which which if any of the Splunk CIM data models apply?
http://docs.splunk.com/Documentation/CIM/3.0.2/User/RelationshipofCIMappstodata
Thank you,
... View more
11-12-2013
06:31 AM
I am interested if anything further was learned about this issue? Did you find a root cause?
... View more
10-21-2013
10:23 AM
I noticed we can enabled the 'current_only' feature for Windows event logs, Does the UF for *NIX support the same type of functionality?
Thank you!
... View more
10-09-2013
06:56 AM
I was concered since it appeared to he happening every few minutes causing restarts on all of the UF's it appears to have settled down at this point.
... View more
10-09-2013
06:55 AM
Thank you for the response!
... View more
10-08-2013
08:09 AM
1 Karma
I am seeing this error happen frequently in our configuration with multiple DeploymentServers. Can anyone tell me what this mean, and maybe why it is happening?
Thank you!
... View more
I was able to measure a big problem and work through a solution for my last company using Splunk and likely saved a small fortune in producivity. Login times had become excessively long, causing nurses and physicians to spend time waiting to finish logging into our primary EHR application.
I collected data sources from Epic, two different performance monitoring solutions, WMI performance monitor and Citrix Profile manager.
I was able to demonstrate the relationship between a bloated roaming profile and the duration of the login as well as illustrate the changes as the profiles were slowly brought back down to size.
The end result is consisently faster login times and happier staff. Splunk is the only solution that can get into any source of data and visualize it to share with leadership.
... View more
09-27-2013
01:12 PM
You might need to adjust firewall rules to allow the forwarders to reach the indexers over tcp/9997
... View more
09-27-2013
01:11 PM
Check your PowerShell execution policy, I believe you want 'RemoteSigned'
... View more
08-12-2013
09:00 AM
Thank you, if you have any other suggested reading please let me know!
... View more
08-09-2013
07:50 AM
I have been asked to help a co-worker create a process control chart to understand an applications response time.
The following three events are generated for each test.
INFO=Signon_Screen RESPONSE_TIME=2.1000
INFO=Signon_Dept_Screen RESPONSE_TIME=0.6000
INFO=Citrix_Login_Comp RESPONSE_TIME=7.6000
The link below is a step in the right direction but I am having trouble getting this to work.
http://splunk-base.splunk.com/answers/73300/which-search-is-faster-reusing-a-calculation-in-an-if-clause-or-using-the-defined-variable-from-the-original-eval
... View more
07-23-2013
01:31 PM
Nice!
Thank you!
... View more
07-22-2013
05:51 AM
I need to show the difference between three different types of servers for example.
CitrixServer TotalStartupTime
OAIMFEP06 15.609
OAIMFEPV94 27.876
OAIMFEPT07 17446.984
Virtual servers have 'v' in the name, test servers have 't' in the name and physical servers have neither T or V in the name.
I would like to show the average TotalStartupTime for each type of server.
Thank you SplunkBase!
CitrixServer TotalStartupTime
1 OAIMFEPV94 27.876
2 OAIMFEPV89 20.095
3 OAIMFEPV13 36.08
4 oaimfep03 51.654
5 OAIMFEP22 779.027
6 OAIMFEP02 52.532
7 OAIMFEPV83 67.69
8 OAIMFEPV80 15.25
9 OAIMFEPV40 98.207
10 OAIMFEP06 15.609
... View more
- Tags:
- search
