Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Beaker77
Beaker77
Explorer
Member since:
11-24-2015
07-11-2020
Community Statistics
| Posts | 12 |
| Solutions | 0 |
| Karma Given | 7 |
| Karma Received | 2 |
| Member Since | 11-24-2015 |
Activity Feed
- Karma Re: Does dbinspect output include cluster replication (RF) configuration? for amitm05. 06-05-2020 12:50 AM
- Karma Re: Does dbinspect output include cluster replication (RF) configuration? for harsmarvania57. 06-05-2020 12:50 AM
- Karma Re: Can you regex or wildcard props Sourcetype stanzas? for jplumsdaine22. 06-05-2020 12:48 AM
- Karma Re: Alert script : HOW TO fix the column order in the result.csv.gz for Micmac. 06-05-2020 12:47 AM
- Karma Re: Is Splunk Cloud HIPAA compliant? for esix_splunk. 06-05-2020 12:47 AM
- Got Karma for Is there a list of what Splunk Cloud API Access is available automatically on sign-up, which have to be requested, and which aren't allowed?. 06-05-2020 12:47 AM
- Got Karma for Is there a list of what Splunk Cloud API Access is available automatically on sign-up, which have to be requested, and which aren't allowed?. 06-05-2020 12:47 AM
- Karma Re: Input source path case sensitive? for gbronner_rbc. 06-05-2020 12:46 AM
- Karma Re: XPath Two Levels of Attributes for Kyle_Brandt. 06-05-2020 12:45 AM
- Posted Re: Determining bytes scanned during a search? on Splunk Search. 12-06-2019 03:45 PM
- Posted Determining bytes scanned during a search? on Splunk Search. 12-05-2019 11:33 PM
- Tagged Determining bytes scanned during a search? on Splunk Search. 12-05-2019 11:33 PM
- Tagged Determining bytes scanned during a search? on Splunk Search. 12-05-2019 11:33 PM
- Posted Does dbinspect output include cluster replication (RF) configuration? on Getting Data In. 06-20-2019 05:06 PM
- Tagged Does dbinspect output include cluster replication (RF) configuration? on Getting Data In. 06-20-2019 05:06 PM
- Tagged Does dbinspect output include cluster replication (RF) configuration? on Getting Data In. 06-20-2019 05:06 PM
- Tagged Does dbinspect output include cluster replication (RF) configuration? on Getting Data In. 06-20-2019 05:06 PM
- Tagged Does dbinspect output include cluster replication (RF) configuration? on Getting Data In. 06-20-2019 05:06 PM
- Tagged Does dbinspect output include cluster replication (RF) configuration? on Getting Data In. 06-20-2019 05:06 PM
- Posted Re: Routing received data TO an external HEC via HTTPS? on Getting Data In. 12-20-2017 03:04 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 |
12-06-2019
03:45 PM
Hey @gcusello - By scanned I mean the total number of bytes examined in a search (not necessarily the number of bytes returned in the results).
The docs say diskUsage is "The total amount of disk space used, in bytes." so I think that's the compressed size of the matching events returned from a search as stored on disk in the dispatch folder.
Thanks for chiming in 🙂
... View more
12-05-2019
11:33 PM
Hey there Splunkers!
Similar to the question "How is the Size value on the job page calculated and logged in Splunk?" how can I determine how much disk is scanned when a search is run?
I can get the event_count and scan_count from the search head logs, but are bytes scanned logged in a file anywhere, or do I have to use diskUsage in | rest splunk_server=local /services/search/jobs ?
Gracias!
... View more
06-20-2019
05:06 PM
Oh Hai Splunkers!
I've been trying to find out how much disk is being used and the associated compression ratio for a specific index. There's been some great examples using dbinspect like the following:
| dbinspect index=myIndexName
| fields state,id,rawSize,sizeOnDiskMB
| stats sum(rawSize) AS rawTotal, sum(sizeOnDiskMB) AS diskTotalinMB
| eval rawTotalinMB=(rawTotal / 1024 / 1024) | fields - rawTotal
| eval compression=tostring(round(diskTotalinMB / rawTotalinMB * 100, 2)) + "%"
| table rawTotalinMB, diskTotalinMB, compression
The output of this is what I'm after but I'm using a clustered environment, and am wondering if the sizeOnDiskMB value includes the replication factor or not?
For example, if I have an effective RF of 2, would I have to device the results of the above search by two to get the true size value of a single copy of the data?
Thanks in advance!
... View more
12-20-2017
03:04 PM
Hi @abhijeet01 - Thanks for that. Unfortunately this covers only a raw TCP stream or forwarding to a Syslog server, and is restricted to a server:port target as opposed to a HTTPS or REST-based endpoint.
Also, because the endpoint is not Splunk, sendCookedData must be set to false, and (as far as I am aware) this will result in the data being sent in cleartext which is not an option (at minimum we require HTTPS/TLS1.2)
... View more
12-19-2017
06:10 PM
Is it possible to route a stream of data from a heavy forwarder or indexer TO an external non-Splunk HTTPS endpoint (HEC)? We have the requirement to forward off a subset of data to a third-party that has a HEC-equivalent endpoint, but need to do so securely (and be selective about what we send)
Any help greatly appreciated!
... View more
02-15-2016
02:05 PM
Hi Jplumsdaine22 - Will do thanks!
... View more
02-11-2016
02:45 PM
Hi yannk - thanks for your response (and sorry about my slow one!). Is there a list of what functions are available for the smaller instances?
Also, for larger deployments, if we have to ask for API access in larger deployments is access guaranteed upon request? What are the criteria for approval?
We are currently examining our options of Cloud vs. Enterprise in a healthcare environment so we'd like to understand what we can expect if we go down the Cloud path.
Great product by the way 🙂
... View more
02-11-2016
02:40 PM
Hi Acorman (apologies for the delay here!) - I'm still interested in an answer. We use Splunk Enterprise which have all functionality via the REST API. So yes, understanding what we can & can't do in Splunk Cloud by default (i.e. without asking for additional functionality) would be great.
... View more
02-11-2016
02:35 PM
Hi Splunkers 🙂
We're looking at Splunk Cloud as a possible solution in our environment, but compliance across various attestations is key. Currently Splunk Cloud are SOC2 compliant for everything 50GB/day and above. Is there any reason why this does not apply for lower ingestions?
Thanks!
... View more
02-02-2016
10:33 PM
Hey There - Just a quick question. I know Splunk Enterprise is being used extensively in healthcare, but is Splunk Cloud HIPAA compliant today?
Thanks! 🙂
... View more
- Tags:
- splunk-cloud
11-24-2015
02:57 PM
2 Karma
Greetings - With Splunk Cloud, there is a RESTful API available for use, however, many of these functions overlap with administration & configuration tasks (which are not allowed and have to be done by the Splunk Cloud team).
Is there a list of what API's are available automatically on sign-up, those which have to be requested, and those which aren't allowed? Integration is a key component of what we do, and the ability to automate is crucial.
Thanks!
Beaker77 (meep-meep-meep)
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-11-2020
09:42 AM
|
Karma given to
