About kawashita_t

kawashita_t · ‎12-28-2017

I want to transfer indexed data to another server. I did the following method to realize it. Migration of index "main_export". １、Copy the db folder under the main_export folder of the server before migration. ２、Create index of main_export at destination server. ３、Stopping SPlunk on destination server. ４、Copy the contents copied earlier to the db folder under main_export of the destination server. ５、Start Splunk of the destination server. However, with this method the index was not successfully migrated. This is the error content at this time. 12-29-2017 10:52:07.837 +0900 INFO DatabaseDirectoryManager - Getting size on disk: Unable to get size on disk for bucket id=main_export~137~8804D8D6-CCD6-43A2-8F60-4949589D231D path="C:\Program Files\Splunk\var\lib\splunk\main_export\db\db_1509511194_1509506867_137" (This is usually harmless as we may be racing with a rename in BucketMover or the S2SFileReceiver thread, which should be obvious in log file; the previous WARN message about this path can safely be ignored.) caller=getCumulativeSizeForPaths 12-29-2017 10:52:07.837 +0900 INFO DatabaseDirectoryManager - Getting size on disk: Unable to get size on disk for bucket id=main_export~138~8804D8D6-CCD6-43A2-8F60-4949589D231D path="C:\Program Files\Splunk\var\lib\splunk\main_export\db\db_1509508148_1509503968_138" (This is usually harmless as we may be racing with a rename in BucketMover or the S2SFileReceiver thread, which should be obvious in log file; the previous WARN message about this path can safely be ignored.) caller=getCumulativeSizeForPaths I would like to tell you how to deal with it. The SPlunk you use is 6.6 series. if you'd kindly teach me.

kawashita_t · ‎06-27-2017

I would like to tag you at search time. I'd like to tag the result of the calculation when searching. ex ) LogID Data1 Data2 1 323 421 2 391 117 3 341 221 4 268 230 5 182 311 6 277 213 7 57 177 8 27 251 9 72 235 10 201 257 Tag the sum of Data 1 and Data 2. result: LogID Data1 Data2 tag 1 　　323 　　421 　　744 2 　　391 　　117 　　508 3 　　341 　　221 　　562 4 　　268 　　230 　　498 5 　　182 　　311 　　493 6 　　277 　　213 　　490 7 　　57 　　177 　　234 8 　　27 　　251 　　278 9 　　72 　　235 　　307 10 　　201 　　257 　　458 index=sample | eval sum=Data1+Data2 | tags outputfield=sum tag ###Example Tagging syntax I want you to tell me. If I can not do that, will I use a summary index etc?

kawashita_t · ‎04-21-2017

Thank you for answer. It was not a problem of Splunk, it was a network problem. I want to investigate the network.

kawashita_t · ‎04-17-2017

The following error message is output. Error Message : Problem replicating config (bundle) to search peer 'IP:Port', can't establish http connection. I thought that the bundle size is affecting and I created the following distsearch.conf file in / etc / sytem / local. However, it did not solve it. Also, until the other day I was able to connect without problems. [replicationSettings] sendRcvTimeout = 120 [replicationWhitelist] allConf = *.conf [replicationBlacklist] vr = apps/app1/... risona = apps/app2/... [distributedSearch] servers = https://xx.xx.xx.xx:xxxx The only change is that the search peer's license was exceeded. Below is the contents of the splunkd.log 04-18-2017 10:27:38.787 +0900 INFO NetUtils - Connect timeout - waited for 60 seconds. ip=xx.xx.xx.xx port=xxxx 04-18-2017 10:27:38.787 +0900 WARN HTTPClient - Connect to=xx.xx.xx.xx:xxxx timed out; exceeded 60sec, as per=distsearch.conf/[replicationSettings]/connectionTimeout 04-18-2017 10:27:38.787 +0900 WARN DistributedBundleReplicationManager - Bundle upload error: Connect to=https://xx.xx.xx.xx:xxxx timed out; exceeded 60sec, as per=distsearch.conf/[replicationSettings]/connectionTimeout 04-18-2017 10:27:38.787 +0900 ERROR DistributedBundleReplicationManager - Unable to upload bundle to peer named splunk01 with uri=https://xx.xx.xx.xx:xxxx. 04-18-2017 10:27:38.787 +0900 WARN DistributedBundleReplicationManager - Asynchronous bundle replication to 1 peer(s) succeeded; however it took too long (longer than 10 seconds): elapsed_ms=63086, tar_elapsed_ms=2136, bundle_file_size=126300KB, replication_id=1492478795, replication_reason="async replication allowed" 04-18-2017 10:27:38.787 +0900 WARN DispatchReaper - Spent 35559ms reaping bundle tarballs in $SPLUNK_HOME/var/run 04-18-2017 10:27:38.789 +0900 INFO PipelineComponent - MetricsManager:probeandreport() took longer than seems reasonable (61310 milliseconds) in callbackRunnerThread. Might indicate hardware or splunk limitations. 04-18-2017 10:28:01.174 +0900 WARN DistributedPeerManager - Unable to distribute to peer named splunk01 at uri https://xx.xx.xx.xx:xxxx because replication was unsuccessful. replicationStatus Failed failure info: failed_because_HTTP_CONNECTION_FAILURE

kawashita_t · ‎12-20-2016

ありがとうございます。 Ver 4.2.2は間違いでした、すみません。いまは6.4.2を利用しております。

kawashita_t · ‎12-20-2016

Thank You!! And I'm Sorry. My Splunk Version is 6.4.2. I mistook the other day's remarks.

kawashita_t · ‎12-13-2016

I am using Splunk Ver 6.4.2

kawashita_t · ‎12-13-2016

私はいまAWSのサーバでSplunkを利用しています。先日サーバのインスタンスタイプを「C4.2xlarge」に変更しました。こちらのインスタンスタイプは、下記のスペックです。 CPU コア数：8 メモリ：15GB しかし、SplunkのDMCでマシン情報を確認した際にメモリは15GBと認識されているのですが CPUのコア数が「4コア」と表示されています。これはSplunkの設定で、コア数を制限しているのでしょうか。私はパフォーマンス向上のためにもCPUのコア数をすべて活用できるようにしたいです。 limits.confをいじればよいのでしょうか。どなたか解決方法をご教示いただけると幸いです。よろしくお願いします。 ENGLISH TRANSLATION Title: Why is the number of server CPU cores different from the number of CPU cores recognized by Splunk Post: I am currently using Splunk on the AWS server. I recently changed the instance type of the server to "C4.2 xlarge". This instance type is the spec below. Number of CPU cores: 8 Memory: 15 GB However, when checking the machine information with Splunk's DMC The memory is recognized as 15 GB The number of CPU cores is indicated as "4 cores". Is this setting of Splunk limiting the number of cores? I would like to make full use of the number of CPU cores for performance improvement. Should I fiddle with limits.conf? It would be greatly appreciated if anyone could tell me how to solve it. Nice to meet you.

kawashita_t · ‎10-10-2016

Results come out but, "program" is not output. Output Example: Bob , 2016/10/10 , 0830 , 0930 ,

kawashita_t · ‎10-10-2016

Thank you. i will try

kawashita_t · ‎10-10-2016

| stats values(prog) as program values(viewend) as viewend by name ch viewrange This search content did not have the results. 「Viewrange」 it might cause.

kawashita_t · ‎10-10-2016

index=tv | rename setai_no as name rt_code as ch | eval viewstart=strptime(date."#".start_time, "%Y-%m-%d#%H%M") | eval viewend=strptime(date."#".end_time, "%Y-%m-%d#%H%M") | eval viewrange=mvrange(viewstart, viewend, "30m") | mvexpand viewrange | fields name viewrange ch viewend | append [search index=tv_program | rename BROADCAST_DATE as date START_TIME as starttime END_TIME as endtime PROGRAM_NAME as prog STATION_CODE as ch | eval viewstart=strptime(date."#".starttime, "%Y/%m/%d#%H%M") | eval viewend=strptime(date."#".endtime, "%Y/%m/%d#%H%M") | eval viewrange=mvrange(viewstart, viewend, "30m") | mvexpand viewrange | fields viewrange ch prog viewend ] | stats values(prog) as program values(viewend) as viewend by name ch viewrange | dedup name viewend | rename viewrange as start viewend as end | eval date=strftime(start, "%Y/%m/%d") | eval start=strftime(start, "%H:%M") | eval end=strftime(end, "%H:%M") | table name date start end program This is.

kawashita_t · ‎10-10-2016

Thank you for answering. I tried, but it did not work. Until the 「append ~~」 was operating properly. I do not understand did not work the part. One by one to confirm.

kawashita_t · ‎10-10-2016

Thank you for answering. I tried it but it did not work. Have been combined in time and channel, data corresponding to the part of 「eval watched = ~~ 」is not. Perhaps, because the date and channel is a plurality of the same data set. Example) 1.TV viewing log Example ) Bob , 2016/10/10 , 0800 , 0830 , 6ch 2.TV Prgram Data Example ) 2016/10/10,0500,0600,6ch,24 1st season ←←This data set is joined 2016/10/10,0730,0900,6ch,24 2nd season 2016/10/10,0930,1000,6ch,24 3rd season

kawashita_t · ‎10-09-2016

Please tell me the way of the binding of data. I want to combine the two data. These data How can you join?

kawashita_t · ‎01-19-2016

■ErrorMessages 01-20-2016 16:35:21.999 +0900 ERROR TailReader - File will not be read, seekptr checksum did not match (file=path\DhcpSrvLog-Wed.log). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info. ■inputs.conf [monitor://path] disabled = false index = main host = *** sourcetype = DHCP whitelist = DhcpSrvLog-Wed.log crcSalt = TestDHCP ■props.conf [DHCP] CHARSET = SHIFT-JIS DATETIME_CONFIG = NO_BINARY_CHECK = true category = Custom disabled = false pulldown_type = true

Posts	16
Solutions	0
Karma Given	0
Karma Received	2
Member Since	‎12-16-2015

Online Status	Offline
Date Last Visited	‎01-21-2025 08:27 PM

【emergency】I can not migrate indexed data

Can I tag with search?

I can not connect to the search peer

サーバのCPUコア数とSplunkで認識されているCPUコア数が違う

I want to know whether Bob had se

Why am I getting forwarder error "TailReader - Fil...

【emergency】I can not migrate indexed data

Can I tag with search?

Re: I can not connect to the search peer

I can not connect to the search peer

Re: サーバのCPUコア数とSplunkで認識されているCPUコア数が違う

Re: サーバのCPUコア数とSplunkで認識されているCPUコア数が違う

Re: サーバのCPUコア数とSplunkで認識されているCPUコア数が違う

サーバのCPUコア数とSplunkで認識されているCPUコア数が違う

Re: I want to know whether Bob had se

Re: I want to know whether Bob had se

Re: I want to know whether Bob had se

Re: I want to know whether Bob had se

Re: I want to know whether Bob had se

Re: I want to know whether Bob had se

I want to know whether Bob had se

Why am I getting forwarder error "TailReader - Fil...

Are you a member of the Splunk Community?