Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About markucsb
markucsb
Explorer
Member since:
07-19-2011
06-05-2020
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 5 |
| Karma Received | 0 |
| Member Since | 07-19-2011 |
Activity Feed
- Karma Splunk Search Head Cluster scheduler errors for nwales. 06-05-2020 12:47 AM
- Karma Read time out while opening Job manager in Splunk UI for prosenjit. 06-05-2020 12:46 AM
- Karma Re: internal splunk sockets stuck in CLOSE_WAIT for simon_vans-coli. 06-05-2020 12:45 AM
- Karma backfilled summary index searches time out and fail for mjch. 06-05-2020 12:45 AM
- Karma Re: backfilled summary index searches time out and fail for daskuntal. 06-05-2020 12:45 AM
- Posted Re: Splunk Search Head Cluster scheduler errors on Splunk Search. 02-19-2015 10:57 AM
- Posted Re: Is Sideview Utils version 3.3 compatible with Splunk version 6.2.X? on All Apps and Add-ons. 02-13-2015 02:48 PM
- Posted Re: Splunk Search Head Cluster scheduler errors on Splunk Search. 02-13-2015 10:18 AM
- Posted Re: Is Sideview Utils version 3.3 compatible with Splunk version 6.2.X? on All Apps and Add-ons. 02-03-2015 12:08 PM
- Posted Re: Read time out while opening Job manager in Splunk UI on Splunk Search. 04-02-2014 04:03 PM
- Posted Re: Read time out while opening Job manager in Splunk UI on Splunk Search. 04-02-2014 04:02 PM
- Posted Re: Timestamp extraction problem, not pulling timestamp from field on Getting Data In. 03-18-2014 03:30 PM
- Posted Re: Timestamp extraction problem, not pulling timestamp from field on Getting Data In. 03-18-2014 03:25 PM
- Posted Re: Timestamp extraction problem, not pulling timestamp from field on Getting Data In. 03-18-2014 12:19 PM
- Posted Re: Timestamp extraction problem, not pulling timestamp from field on Getting Data In. 03-18-2014 12:18 PM
- Posted Re: Timestamp extraction problem, not pulling timestamp from field on Getting Data In. 03-18-2014 11:44 AM
- Posted Timestamp extraction problem, not pulling timestamp from field on Getting Data In. 03-18-2014 11:32 AM
- Tagged Timestamp extraction problem, not pulling timestamp from field on Getting Data In. 03-18-2014 11:32 AM
- Posted Re: nomv seems to add whitespace on All Apps and Add-ons. 02-06-2013 05:23 PM
- Posted nomv seems to add whitespace on All Apps and Add-ons. 02-06-2013 04:08 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
02-19-2015
10:57 AM
All CLUSTER members need to be on the same version, there is another section that states that 6.2 Search Head Cluster members are backwards compatible with 6.1 Search peers(indexers).
... View more
02-13-2015
02:48 PM
I don't think sideview utils is properly handling the UseHistory=Auto setting in 6.2 with Search Head Clustering, if I put this same search in a simple dashboard it loads properly but if I use your sideview utils dashboard it intermittently fails to pull the saved results and instead kicks off a new search. I do have a message module because I see other messages on the page.
... View more
02-13-2015
10:18 AM
I'm seeing similar problems with that error message. Additionally my scheduled searches are not consistently firing off at their scheduled times and the dashboards are not reliably retrieving scheduled search results for display. Are you or anyone else experiencing this problem.
... View more
02-03-2015
12:08 PM
Not sure if this is related to sideview utils related or 6.2 related or neither, but I upgraded to 6.2 with Search Head Clustering and I'm seeing some odd behavior with the the UseHistory = auto functionality of a dashboard. Intermittently, when I go to one of my sideview utils dashboards I am seeing that some of the panels don't load the pre-run search results even though they show as available and not expired in the jobs page.
... View more
04-02-2014
04:03 PM
this was supposed to be a comment, not an answer, sorry about that.
... View more
04-02-2014
04:02 PM
I am having the exact same issue, I am using search head pooling and everything else seems to be working properly, when I ping the NFS where the job dispatch directory is, I see approx 1 ms of latency, the RAID1 drives are rated together to give me over 12000 IOPS
... View more
03-18-2014
03:30 PM
Events are broken correctly, the thing I pasted above is from the _raw field, however I went in and changed the numbers so I'm not showing real people's data, the events are being broken up correctly. This can be in a props.conf under an app correct? I don't need to put this in a props.conf at the $SPLUNK_HOME\etc\system\local\ level right?
... View more
03-18-2014
03:25 PM
Still not working, any other ideas?
... View more
03-18-2014
12:19 PM
I don't see why I'd need the NO_BINARY_CHECK, can you explain that a little bit more please. And for the TIME_PREFIX why would I make it less explicit?
... View more
03-18-2014
12:18 PM
Tried this one, it is not working still.
... View more
03-18-2014
11:44 AM
I thought it says to use %t for all white space characters, but I will make the changes.
... View more
03-18-2014
11:32 AM
I have the following events that I am trying to pull the timestamp out of the Time field, seems pretty straightforward however I am unable to get it working properly. The data is coming in over the http-simple REST endpoint and the data looks like the following :
Time=03-18-2014 18:25:04.775 UTC, ip=0.0.0.0, MajVer=0, MinVer=0, BuildNum=69180, UAModel=BR100, SnsId=0000000, HHId=Sonos_000000000, SN=00-00-00-00-00-00:G, Model=000, Ver=2, fq=2462, phyErr=1126, latThreshold=50, pktsAboveThreshold=0, pktsBelowThreshold=1082, link0=[ mac=000E58762555, tx=299, pktErrRate=1, sigStrength=30],
And the props.conf looks like this:
[source::http-simple]
TZ = UTC
TIME_PREFIX = ^Time=
TIME_FORMAT = %m-%d-%y%t%H:%M:%S.%3N
This is not working correctly and the indexing time is used instead of the event's Time field.
... View more
- Tags:
- timestamp
02-06-2013
05:23 PM
I think I answered my own question, use "eval newField=mvjoin(oldField,"")
... View more
02-06-2013
04:08 PM
I have a multi-valued field that I'm trying to collapse down to a single value but the nomv command adds a whitespace character between the individual values of the field. This is a Base64 encoded string that needs to be a single continuous line with no added characters or whitespace, I have a checksum with the number of characters that needs to match the value of this field's character count.
I have tried trimming the individual values prior to combining however it seems that the actual nomv command adds the whitespace characters, does anyone have any ideas of how I can solve this or is this a limitation of nomv?
... View more
