Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About rmanrique
rmanrique
Path Finder
Member since:
10-17-2018
01-28-2022
Community Statistics
| Posts | 21 |
| Solutions | 1 |
| Karma Given | 89 |
| Karma Received | 1 |
| Member Since | 17-10-2018 |
Activity Feed
- Got Karma for Re: How to use the stored results in variables after stats command using by clause in calculation ?. 11-09-2023 01:25 AM
- Karma Re: Ingestion Latency after updating to 8.2.1 for PeteAve. 01-28-2022 11:34 AM
- Karma run splunk commands from linux home for splunkcol. 01-17-2022 12:12 PM
- Karma Re: splunk starting as root user how to change this one? for beatus. 03-30-2021 10:25 AM
- Posted Re: Splunk Searches delayed on Splunk Enterprise Security. 03-26-2021 09:14 AM
- Karma Re: Splunk Searches delayed for jadengoho. 03-26-2021 09:14 AM
- Karma Re: 97% skipped searches ratio with most count of Skipped Reports is from Accelerated Data model uninstalled apps for woodcock. 01-14-2021 01:53 AM
- Karma Re: Accelerated data model 100% complete even though most populating searches are skipped for helge. 01-14-2021 01:45 AM
- Karma Re: 97% skipped searches ratio with most count of Skipped Reports is from Accelerated Data model uninstalled apps for woodcock. 01-14-2021 01:34 AM
- Karma Re: What is the significance of the base_max_search constant? for hsesterhenn_spl. 01-13-2021 06:51 PM
- Posted Re: xml file re-indexed when new event is added on Dashboards & Visualizations. 12-09-2020 12:56 PM
- Karma Re: What are the definitions of Tag and Eventtype and what are the differences between the two? for woodcock. 11-04-2020 07:47 AM
- Karma Re: How to deploy application in cluster environment? for koshyk. 11-03-2020 02:43 PM
- Karma Re: How do you add a new Search Head to Splunk Monitoring Console? for isoutamo. 10-12-2020 05:06 PM
- Karma Re: The percentage of high priority searches delayed for Nisha18789. 10-08-2020 08:01 AM
- Karma Re: The percentage of high priority searches delayed for richgalloway. 10-08-2020 07:59 AM
- Karma Re: Summary indexing for rewritex. 10-02-2020 04:06 PM
- Karma Re: Why is there a 10000 rows limit? for vnravikumar. 09-30-2020 08:28 AM
- Posted Re: Summary index limits events to 50000 on Knowledge Management. 09-30-2020 07:40 AM
- Karma Re: Summary index limits events to 50000 for mayurr98. 09-30-2020 07:21 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-09-2020
12:56 PM
How do I do that? Do you have an example?
... View more
09-30-2020
07:40 AM
I followed your first recommendation and it hasn't worked for me. In my case I have to distributed search, I have one SH and two IDX. I created the limits.conf file in SH. Should I do it in IDXs?
... View more
07-09-2020
09:26 AM
But finally how do I solve this problem?
... View more
07-09-2020
09:26 AM
But finally how do I solve this problem?
... View more
07-08-2020
03:33 PM
This is the result. C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows_8_0_0\local\inputs.conf [perfmon://CPU]
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows_8_0_0\default\inputs.conf counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows_8_0_0\local\inputs.conf disabled = 0
host = ADVANCE-PC
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows_8_0_0\local\inputs.conf index = windows
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows_8_0_0\default\inputs.conf instances = *
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows_8_0_0\default\inputs.conf interval = 10
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows_8_0_0\local\inputs.conf mode = single
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows_8_0_0\default\inputs.conf object = Processor
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows_8_0_0\default\inputs.conf useEnglishOnly = true
... View more
07-08-2020
07:24 AM
That Btool command I ran on my instance which is Deployment server. My question is why should I create that configuration that you mention in my deployment-server. If I create the local folder and specify the perfmon disable = 0 there, I will start receiving logs from that server, which I don't want to do. In the UF I have the correct configuration, where I put disable = 0.
... View more
07-08-2020
06:49 AM
This is the output of the command you gave me: /opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf [perfmon://CPU]
/opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec
/opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf disabled = 1
host = splunk.cyberline.com.pe
index = default
/opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf instances = *
/opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf interval = 10
/opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf mode = multikv
/opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf object = Processor
/opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf useEnglishOnly = true * Regarding the universal forwarder. What I meant to say is that when I installed version 8.0 of the UF, it does not catch me perfmon of CPU, Memory, Logical Disk, etc. Capture only perfmon: process. Instead, when I installed version 7.2.1.0, it was only here that I was able to capture that data.
... View more
07-07-2020
04:06 PM
When I installed the universal forwarder version 7.2.1.0 I was just able to capture the data like CPU, MEMORY, LOGICAL DISK, etc. But with the version 8.0.4 or 7.3.6, it doesn't allow me to capture the data, only Perfmon:Process.e
... View more
07-03-2020
03:42 PM
But I have this problem... https://community.splunk.com/t5/All-Apps-and-Add-ons/Windows-Add-on-Perfmon-not-working/m-p/506751#M62274
... View more
06-30-2020
04:21 PM
Could you do it using props and transforms?
... View more
06-30-2020
10:33 AM
I have configured the inputs.conf to monitor these points: ###### Splunk 5.0+ Performance Counters ######
## CPU
[perfmon://CPU]
counters = % Processor Time; % User Time; % Privileged Time
disabled = 0
instances = *
interval = 10
mode = single
object = Processor
useEnglishOnly=true
index=perfmon
## Logical Disk
[perfmon://LogicalDisk]
counters = % Free Space; Free Megabytes; Current Disk Queue Length; % Disk Time; Avg. Disk Queue Length; % Disk Read Time
disabled = 0
instances = *
interval = 10
mode = single
object = LogicalDisk
useEnglishOnly=true
index=perfmon
## Physical Disk
[perfmon://PhysicalDisk]
counters = Current Disk Queue Length; % Disk Time
disabled = 0
instances = *
interval = 10
mode = single
object = PhysicalDisk
useEnglishOnly=true
index=perfmon
## Memory
[perfmon://Memory]
counters = Page Faults/sec; Available Bytes; Committed Bytes
disabled = 0
interval = 10
mode = single
object = Memory
useEnglishOnly=true
index=perfmon
## Process
[perfmon://Process]
counters = % Processor Time; % User Time
disabled = 0
instances = *
interval = 10
mode = single
object = Process
useEnglishOnly=true
index=perfmon
## ProcessInformation
[perfmon://ProcessorInformation]
counters = % Processor Time; Processor Frequency
disabled = 0
instances = *
interval = 10
mode = single
object = Processor Information
useEnglishOnly=true
index=perfmon
## System
[perfmon://System]
counters = File Read Operations/sec; File Write Operations/sec; File Control Operations/sec
disabled = 0
instances = *
interval = 10
mode = single
object = System
useEnglishOnly=true
index=perfmon but I am only getting from "Perfmon:Process" I don't have any error messages. I don't know why I am not receiving other data too. I am indexing two windows servers and in both cases the same thing happens to me: I only receive data from "Perfmon:Process".
... View more
Labels
- Labels:
-
configuration
06-18-2020
09:10 AM
1 Karma
I'm not sure that works. In my case it doesn't show anything and I'm using the same as you. index=blueprism sourcetype=BP_Parkour_Status source=TABLA::RPA_BLUEPRISM
| bin span=1d _time
| stats count as total by _time
| where tipoexcep="Business Exception"
| stats count as totalDetalle by detalexcep _time
| eval porc=totalDetalle/total*100
| table totalDetalle total porc
... View more
06-17-2020
10:40 AM
Thank you! I finally used MAX_DAYS_AGO to make it work. BREAK_ONLY_BEFORE_DATE =
DATETIME_CONFIG =
LINE_BREAKER = </Interceptor>([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category =
disabled = false
pulldown_type = true
TIME_FORMAT = %Y-%m-%d</ActionDate>%n<ActionTime>%H:%M:%S
TIME_PREFIX = <ActionDate>
MAX_DAYS_AGO = 3650
... View more
06-17-2020
09:21 AM
I don't know what to specify in the time_format so that it captures the date (<ActionDate>) and time (<ActionTime>), whose data is separated into separate lines. XML file <Interceptor>
<AttackCoords>-80.33100097073213,25.10742916222947</AttackCoords>
<Outcome>Interdiction</Outcome>
<Infiltrators>23</Infiltrators>
<Enforcer>Ironwood</Enforcer>
<ActionDate>2013-04-24</ActionDate>
<ActionTime>00:07:00</ActionTime>
<RecordNotes></RecordNotes>
<NumEscaped>0</NumEscaped>
<LaunchCoords>-80.23429525620114,24.08680387475695</LaunchCoords>
<AttackVessel>Rustic</AttackVessel>
</Interceptor> This is the configuration that I have in my props.conf BREAK_ONLY_BEFORE_DATE =
DATETIME_CONFIG =
LINE_BREAKER = </Interceptor>([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category =
disabled = false
pulldown_type = true
TIME_FORMAT = %Y-%m-%d %H:%M:%S
TIME_PREFIX = <ActionDate> The TIME_FORMAT part is what I have to correct. I tried to put this in, but it didn't work. TIME_FORMAT= %Y-%m-%d</ActionDate>%n<ActionTime>%H:%M:%S Any ideas
... View more
Labels
- Labels:
-
simple XML
02-01-2020
03:31 PM
I don't find anywhere accurate information about what TailReader is.
... View more
10-26-2018
07:59 AM
To limit the queries with the "chart" command, just use the "sort" command and then indicate the number of lines you want to display:
index=foo | eval length=length(_raw) | chart eval(sum(length)/1024/1024) as MiB by application | sort 15 -MiB
... View more
10-19-2018
10:08 AM
I want to understand what the values of request time, response time and time_taken
... View more
10-19-2018
08:45 AM
Thank you very much for your contribution.
... View more
