Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About tgfurnish
tgfurnish
Engager
Member since:
05-02-2012
08-23-2021
Community Statistics
| Posts | 4 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 05-02-2012 |
Activity Feed
- Posted Re: Can a 6.5.2 universal forwarder send data to an http event collector? on Splunk Enterprise. 08-23-2021 07:27 AM
- Posted Can a 6.5.2 universal forwarder send data to an http event collector? on Splunk Enterprise. 08-23-2021 06:58 AM
- Posted Programmatically detect age of oldest record to be sure splunk isn't discarding old data too soon? on Getting Data In. 05-24-2018 11:51 AM
- Tagged Programmatically detect age of oldest record to be sure splunk isn't discarding old data too soon? on Getting Data In. 05-24-2018 11:51 AM
- Tagged Programmatically detect age of oldest record to be sure splunk isn't discarding old data too soon? on Getting Data In. 05-24-2018 11:51 AM
- Tagged Programmatically detect age of oldest record to be sure splunk isn't discarding old data too soon? on Getting Data In. 05-24-2018 11:51 AM
- Tagged Programmatically detect age of oldest record to be sure splunk isn't discarding old data too soon? on Getting Data In. 05-24-2018 11:51 AM
- Tagged Programmatically detect age of oldest record to be sure splunk isn't discarding old data too soon? on Getting Data In. 05-24-2018 11:51 AM
- Posted Easy newbie question: How to make a modified version of Splunk's built-in knowledge about Apache access logs on Getting Data In. 12-02-2014 04:01 PM
- Tagged Easy newbie question: How to make a modified version of Splunk's built-in knowledge about Apache access logs on Getting Data In. 12-02-2014 04:01 PM
- Tagged Easy newbie question: How to make a modified version of Splunk's built-in knowledge about Apache access logs on Getting Data In. 12-02-2014 04:01 PM
- Tagged Easy newbie question: How to make a modified version of Splunk's built-in knowledge about Apache access logs on Getting Data In. 12-02-2014 04:01 PM
- Tagged Easy newbie question: How to make a modified version of Splunk's built-in knowledge about Apache access logs on Getting Data In. 12-02-2014 04:01 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
08-23-2021
07:27 AM
Thank you!
... View more
08-23-2021
06:58 AM
Is it possible to configure a 6.5.2 universal forwarder to send events to an http event collector (on 7.2)? I have a series of universal forwarders that had been sending logs to an old indexer on port 9997 -- both the forwarders and the indexer are slated for retirement "soon", part of an app that's been mostly retired already, but I need to keep them going a few more months. The indexer hardware died badly, and I thought I'd easily be able to switch these UFs over to our current indexer, which runs 7.2 (upgrading soon to 8.x), but that indexer only listens using the HEC on port 8088. It's behind an AWS ALB, so opening up port 9997 would be problematic. Is this even *supposed* to be possible (sending events from 6.5.2 UF to 7.2 HEC)? I've tried putting the following into local/outputs.conf, but it seems to have no impact. Splunk isn't complaining about the statements when it starts up, and it also isn't sending any network traffic on port 8088. [httpout]
httpEventCollectorToken = [642bc63f-8e62-4b3e-9579-f146345eeaa2]
uri = http://splunk.domain-name.com:8088
batchSize = 65536
batchTimeout = 5
... View more
Labels
05-24-2018
11:51 AM
I'm looking for suggestions on the best way to programmatically check the age of the oldest record in an index. If I can figure out a light-weight way to do this, then I'd wrap it into a Nagios check and run that check a few times per day to validate that I'm not deleting data too quickly within Splunk. Any suggestions?
I'm looking to do this because despite my settings, Splunk's sometimes unexpectedly deleting data too quickly -- I think I have everything configured to use up to 1.6 TB of storage (and I'm using less than half that) and keep data for 18 months (frozenTimePeriodInSecs = 48211200), but in practice sometimes Splunk is nuking data at three months. Worse, I have to keep manually checking a search of old data just to detect that the problem is happening.
If I can automate the checking, then I can spot this more quickly and hopefully limit the damage. Any thoughts?
... View more
12-02-2014
04:01 PM
I have a pile of Apache access logs where the format is just slightly modified from the default. Is there any way I can leverage Splunk's existing knowledge of the "apache-common" sourcetype to get more intelligent parsing of my slightly modified format?
Here's the original 'common' format definition:
LogFormat"%h %l %u %t \"%r\" %>s %b" common
...and here's the modified version:
LogFormat "%{X-Forwarded-For}i %h %D %l %u %t \"%r\" %>s %b" common
Basically we prepended the contents of the X-Forwarded-For header (a comma-and-space-separated list of IP addresses or "-") and then shifted around the other fields.
Clearly there's no way Splunk is going to automagically figure that out -- but I'm stumped on where to start with telling it about the new format.
So I am hoping there's some way in which I can look at what tells Splunk how to understand the default format, just as a starting point for building my new version.
Seems like this must be a basic newbie question -- any tips would be appreciated.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-23-2021
10:58 AM
|
