Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About quixand
quixand
Path Finder
Member since:
11-07-2010
06-05-2020
Community Statistics
| Posts | 17 |
| Solutions | 0 |
| Karma Given | 44 |
| Karma Received | 23 |
| Member Since | 11-07-2010 |
Activity Feed
- Got Karma for Re: Permissions on /var/log. 12-29-2022 08:47 AM
- Got Karma for Re: Recommended permissions on /var/log for Splunk_TA_nix. 10-07-2021 01:51 PM
- Karma Re: Calculate the difference between two values by time division for somesoni2. 06-05-2020 12:48 AM
- Karma Feroda logs for templier. 06-05-2020 12:47 AM
- Karma Re: Feroda logs for MuS. 06-05-2020 12:47 AM
- Karma Monitoring of Java Virtual Machines with JMX: How to troubleshoot error "Unable to initialize modular input "jmx""? for abassili. 06-05-2020 12:47 AM
- Karma On Linux, how can I leverage operating system facilities to limit the aggregated physical memory usage of all Splunk processes? for hexx. 06-05-2020 12:47 AM
- Karma How to Create a Gantt Chart in Splunk? for skoelpin. 06-05-2020 12:47 AM
- Karma Re: What more can I do to solve: File too small to check seekcrc, probably truncated. Will re-read entire file for rune_hellem. 06-05-2020 12:46 AM
- Karma What more can I do to solve: File too small to check seekcrc, probably truncated. Will re-read entire file for rune_hellem. 06-05-2020 12:46 AM
- Karma WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file for ben_leung. 06-05-2020 12:46 AM
- Karma How to exclude specific time ranges in search results for jedatt01. 06-05-2020 12:46 AM
- Karma How does the deployment server detect app changes? for eugenekogan. 06-05-2020 12:46 AM
- Karma How to show a timeline of concurrent transactions for joelbyrnes. 06-05-2020 12:46 AM
- Karma Splunk doesn't index new file (after log rotation) for gozulin. 06-05-2020 12:46 AM
- Karma Is it possible to perform stats within a transaction? for the_wolverine. 06-05-2020 12:46 AM
- Karma Re: delete and create same index, data does not index for MuS. 06-05-2020 12:46 AM
- Karma Re: Splunk server stops taking client data for jgauthier. 06-05-2020 12:46 AM
- Karma Re: How much splunk memory use should I expect while monitoring a directory with many entries? for jrodman. 06-05-2020 12:46 AM
- Karma Re: How to set the default search time in Splunk 6? for ChrisG. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 1 |
Does anyone know what the permissions are to run this? I get a forbidden response on our production install. I assume i need some extra permissions.
... View more
07-29-2016
06:26 AM
systemd will send events to syslog. Which should write out to /var/log/..
enable in
/etc/systemd/journald.conf
set
ForwardToSyslog=yes
rsyslog appears to have a listener configured (on centos at least) in
/etc/rsyslog.d/listen.conf
$SystemLogSocketName /run/systemd/journal/syslog
I guess you will need to restart the service
systemctl restart systemd-journald
see also
https://www.loggly.com/docs/systemd-logs/
https://forums.opensuse.org/showthread.php/488025-Syslog-and-journalctl
https://www.freedesktop.org/software/systemd/man/journald.conf.html
... View more
07-27-2016
04:55 AM
1 Karma
perhaps the timeline plugin will help?
http://docs.splunk.com/Documentation/CustomViz/1.0.0/Timeline/TimelineInstall
... View more
06-01-2016
08:31 AM
see: https://answers.splunk.com/answers/4253/how-to-monitor-root-owned-logs-while-running-splunk-as-a-non-root-user.html#answer-408258
... View more
see: https://answers.splunk.com/answers/4253/how-to-monitor-root-owned-logs-while-running-splunk-as-a-non-root-user.html#answer-408258
... View more
06-01-2016
02:55 AM
also posted to serverfault http://serverfault.com/questions/258827/what-is-the-most-secure-way-to-allow-a-user-read-access-to-a-log-file/780226#780226
... View more
05-31-2016
05:18 AM
for more info on ACLs take a look at https://help.ubuntu.com/community/FilePermissionsACLs
... View more
On Redhat we run splunk in its own user/group. Then add read only ACL permissions to the splunk group to specific files.
You can manually set the ACL with
sudo setfacl -m g:splunk:rx /var/log/messages
This will not persist as logrotate will not re-apply the ACL setting so for a more permanent solution we have added a rule to logrotate to reset the ACL.
we added the file..
/etc/logrotate.d/Splunk_ACLs with
{
postrotate
/usr/bin/setfacl -m g:splunk:rx /var/log/cron
/usr/bin/setfacl -m g:splunk:rx /var/log/maillog
/usr/bin/setfacl -m g:splunk:rx /var/log/messages
/usr/bin/setfacl -m g:splunk:rx /var/log/secure
/usr/bin/setfacl -m g:splunk:rx /var/log/spooler
endscript
}
Check the ACL status of a file with $ getfacl /var/log/messages
... View more
05-24-2016
08:42 AM
2 Karma
I downvoted this post because running any applications as root is considered a severe security risk and most organisations with any sense will laugh at this recommendation. use acls on the host or add the splunk user to a group that has read access
... View more
04-14-2016
08:50 AM
Thanks, this is exactly what I needed.
... View more
04-12-2016
07:50 AM
Hi all,
I need to get some stats from an Apache ActiveMQ message broker. The broker has a web dashboard of broker queue depths.
- current queue depth
- messages dequeued (since last restart)
As far as I'm aware, there are no other stats available.
I want to know the number of messages that have dequeued from the broker by time division (say 1h but could be by 3h or day or week). I simply want to know the total number of messages that have been consumed per queue so I can visualize queue performance over time.
We have a bash script that harvests the counter and records to a log, something like
Tue Apr 12 15:01:02 BST 2016 AppQueueA_depth="10" AppQueueA_dequeue="500"
This is recorded every 5 minutes, but because this is a total since application restart, I need to subtract the first occurrence of AppQueueA_dequeue from the first occurrence from the previous hour, and so on and so forth.
I think i need to bucket the events by hour and extract the first event per bucket, then calculate the difference between each one.
Any help appreciated.
... View more
08-09-2011
07:29 AM
1 Karma
I can't access the google code location, wheres it gone?
code.google.com/p/splunk-php-sdk/
... View more
07-25-2011
07:02 AM
This is driving me mad - have gone through the documentation and responses to queries in here but still can't get sourcetype overrided by using a transform. I'm missing something, I'm guessing obvious, but not obvious to me!
inputs.conf
[monitor:///Users/admin/Documents/splunkDataToIndex/automation_logs/]
disabled = 0
followTail = 0
index = automationlogs
props.conf
[source::/Users/admin/Documents/splunkDataToIndex/automation_logs/...]
TRANSFORMS-set_sourcetype_for_scriptlogs = set_sourcetype_for_scriptlogs
priority = 10
transforms.conf
[set_sourcetype_for_scriptlogs]
SOURCE_KEY = MetaData:Source
DEST_KEY = MetaData:Sourcetype
REGEX = .*/(.*?)\..*
FORMAT = Sourcetype::$1
... View more
03-16-2011
06:20 PM
Im having the same problem.
OSX 10.5.8
PPC Quad G5
using splunk-4.2-96430-Darwin-universal.tgz
... View more
11-07-2010
12:51 AM
1 Karma
Hi all
How do you configure colour coding in general search results. I know i can use the rangemap command but in apps like OSSEC some general results are highlighted in a red border without using rangemap in the search string?
cheers
... View more
