Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About cfrantsen
cfrantsen
Explorer
Member since:
10-27-2010
06-05-2020
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 10-27-2010 |
Activity Feed
- Got Karma for Re: Observing Oracle Forms on the net. 06-05-2020 12:45 AM
- Posted Re: What is the best strategy to handing overlapping data? on Splunk Search. 10-29-2010 10:58 AM
- Posted Re: Observing Oracle Forms on the net on Splunk Search. 10-28-2010 08:36 PM
- Posted Re: How can I avoid duplicates when indexing logfiles on a cluster filesystem? on Getting Data In. 10-27-2010 09:44 PM
- Posted Re: How can I avoid duplicates when indexing logfiles on a cluster filesystem? on Getting Data In. 10-27-2010 08:33 PM
- Posted Re: How can I avoid duplicates when indexing logfiles on a cluster filesystem? on Getting Data In. 10-27-2010 08:30 PM
- Posted Re: How do I recognize a time in epoch seconds? on Getting Data In. 10-27-2010 05:33 PM
- Posted Re: How can I avoid duplicates when indexing logfiles on a cluster filesystem? on Getting Data In. 10-27-2010 05:21 PM
- Posted How can I avoid duplicates when indexing logfiles on a cluster filesystem? on Getting Data In. 10-27-2010 04:49 PM
- Tagged How can I avoid duplicates when indexing logfiles on a cluster filesystem? on Getting Data In. 10-27-2010 04:49 PM
- Tagged How can I avoid duplicates when indexing logfiles on a cluster filesystem? on Getting Data In. 10-27-2010 04:49 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
10-29-2010
10:58 AM
Regarding option c, what is the best way to "save off the results into a new index"?
... View more
10-28-2010
08:36 PM
1 Karma
While I haven't worked with Oracle Forms I know that alot of other oracle software (OC4J, WebCache, OHS, SOA, etc) utilize something called Execution Context ID (ECID) which is used to track transaction.
I have previously used this for stuff like finding out what request in the access_log generated a specific cluster of errors in the error_log.
... View more
10-27-2010
09:44 PM
Speed and space is probably not an issue as the log volume would be quite small, what kind of search could I use to only find the duplicates (something like an opposite of dedupe)?
... View more
10-27-2010
08:33 PM
I was thinking, would it be possible to just let all nodes index the logfiles in question and then delete all duplicates on the central splunk server using a scheduled search of some kind? I haven't been able to find a search command that could be used to list all duplicate events that I could feed to "| delete", does something like this exist?
... View more
10-27-2010
08:30 PM
Sounds like a workable solution, I would have to run n+1 splunk forwarders as I still need to index local files and run scripts on each node, but that's minor problem.
... View more
10-27-2010
05:33 PM
Try adding TIME_PREFIX=^ and perhaps take a look at MAX_TIMESTAMP_LOOKAHEAD if the rest of the event text might include something that looks like an epoch time.
... View more
10-27-2010
05:21 PM
The problem with having only one node monitor everything is that we would need to reconfigure the forwarder on another node if the first one is down for whatever reason (maintenance, crash, etc). These are all high availability clusters designed to be able to loose one or more nodes without requiring reconfigurations.
It would have been great if one splunk instance could let other instances know that certain files are already being indexed (perhaps using some sort of lockfile).
... View more
10-27-2010
04:49 PM
I have a couple of clusters with logfiles that reside on a shared cluster filesystem that all hosts in the cluster logs data to. The clustered applications can execute on any node but will always log to the same directory and file.
How can I prevent multiple cluster hosts running splunk from indexing the same logfile? The filename and paths to the logfiles does not contain any useful information such as hostname that could help me narrow the input stanza.
... View more
- Tags:
- duplication
- indexing
