About _d_

_d_ · ‎06-27-2016

You're good: https://docs.splunk.com/Documentation/Forwarder/6.4.1/Forwarder/Compatibilitybetweenforwardersandindexers

_d_ · ‎06-16-2016

Filtering data out before indexing does not impact license.

_d_ · ‎06-09-2016

Ah okay, in that case - to scope filtering on a specific string of the event you need to use props/transforms. There is a sample here: http://docs.splunk.com/Documentation/Splunk/6.4.1/Forwarding/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest

_d_ · ‎06-09-2016

Chris, note that for CloudTrail you can blacklist based on event names. E.g.: this blacklist regex will omit Describes, List and Get events: blacklist = ^(?:Describe|List|Get) See more here: http://docs.splunk.com/Documentation/AddOns/latest/AWS/CloudTrail

_d_ · ‎12-29-2015

Will this work as configured? Yes, as long as the credentials you configure Splunk with have the right permissions on the SQS queue you should be fine.

_d_ · ‎11-19-2015

You can change the center of the panel two ways: Edit Source and enter your own center coordinates which are currently set as such: (42.879094,-97.381205) Edit Panel, zoom/pane to your desired location and click on "Populate with current map settings"

_d_ · ‎11-06-2015

The short answer is no. The Universal Forwarder will happily send data to a set of Splunk receivers but not directly to S3. However, you can chose to retire Splunk data to S3 if you'd like.

_d_ · ‎02-19-2015

So, what is your actual question then? Is it about scaling of Search Head Clustering or whether or not you can cluster 10 servers or are you looking for advice on whether clustering 10 4CPU machines is a good idea? They're all completely different questions, but i'll address them here for you: - Yes, SHC scales - Yes, SHC will work on 10 machines - Creating a 10 node cluster of 4CPU machines is not necessarily a good idea. 4CPU machines are really difficult to find nowadays and therefore they're not commodity. You are more likely to find 12, 16 CPU machines than anything else in today's market. Chances are you're referring to VMs, in which case you're much better off with a lower number of machines with more cores than the opposite. Anytime you introduce a overlay mechanism, such as clustering, you're inevitably paying one way or another with overhead - nothing is free - so, the fewer machines that you can use that satisfy your requirement, the better. If you have 10 4CPU VMs you'd have a better experience if you make them into 5 8CPU VMs.

_d_ · ‎02-19-2015

You can cluster search heads as long they satisfy the minimum Splunk Enterprise system requirements.

_d_ · ‎02-18-2015

Have you enabled the search that generates the dataset? Go to Settings | Searches, Reports, and Alerts. Locate the search named AWS Config Relationship Generator. Click Enable.

_d_ · ‎02-13-2015

Couple of things: - You're using the wrong Add-on version. You'll need 1.1.0 instead of 1.0.1. https://apps.splunk.com/app/1274/#/documentation - You will need to use the AWS Config input instead of the AWS CloudTrail input to collect Config data. Update the Add-on to 1.1.0 and you should be fine.

_d_ · ‎02-09-2015

In addition to being a number, N needs to be within the range of the length of the multivalued field.

_d_ · ‎02-09-2015

That should work if 'PAYXLINE_MV' is indeed a multivalued field and 'N' is a number.

_d_ · ‎02-09-2015

Pipegrep, unfortunately it wont because the add-on requires Python that ships with Splunk. A Heavy Forwarder is simply a Splunk instance that does not do any indexing or searching; it only forwards processed data to your indexers.

_d_ · ‎02-09-2015

Well, in your first two statements you're evaluating PAYXLINE_MV2 on the first and then calling it again on the second. Calculated fields are evaluated in parallel and not in sequence; i.e. PAYXLINE_MV2 is not availalbe to the 2nd statement when it tries to execute. Try something like this: EVAL-PAYXLINEGLOB=mvjoin(mvindex(PAYXLINE_MV,N,-1)," ")

_d_ · ‎02-07-2015

I'll address your questions sequentially: Where exactly do these apps get installed? On the instance? on the Searchhead? If you have a single Splunk instance (search head), they both get installed and configured in there. If you have a distributed Splunk environment: (1) Install and configure the App on the Search Head (2) Install and configure Add-on on a Heavy Forwarder (one that forwards to the indexers. You should not configure the add-on on the indexers because each will try to pull data and you'll have duplicates), (3) Install (but not configure) Add-on on search head(s). This last point is about making sure you have all the necessary search-time logic on the Search Head; field extractions, tags, eventtypes etc. How can we “bake” splunk in to our instances? Search for the Splunk AMI in the AWS Marketplace and use that to source your instances. Otherwise, if you're referring to your on-prem instances then simply install Splunk. How will we tell which instance the logs are from? Logs will be fetched from AWS by the instance that you install the Add-on to. Make sure you follow the documentation for the add-on and the app: Splunk App for AWS: https://apps.splunk.com/app/1274/#/documentation Splunk Add-on for Amazon Web Services: https://apps.splunk.com/app/1876/#/documentation

_d_ · ‎02-07-2015

You need to do the eval and rename after your stats: sourcetype=syslog | stats count by srcip | eval srcip = case(srcip = "192.168.x.5","Samsung S4", srcip = "192.168.x.8","iPhone5", srcip = "192.168.x.10","Laptop", true(), srcip) | rename "srcip" as "Device Name"

_d_ · ‎02-04-2015

Field extractions go on the search head, not indexers. Also, your capture group in the regex is missing a name; myField above

_d_ · ‎02-03-2015

An even easier props.conf method is to use EXTRACT- without referencing transforms.conf: [LogFiles] TIME_FORMAT = %m/%d/%Y ... ... EXTRACT-myfield = instances/(?<myField>[^/]*)/diagnostics in source

_d_ · ‎02-03-2015

Unclear as to what you're asking, but if you want to plot the state of each neighbor/interface over time then you can use this search (on your data): | eval upordown=if(state_to="Up",10,-10) | timechart max(upordown) by neighbor | fillnull value=1 with Column visualization and Format with Multi-series Mode as "Yes". It should produce a chart as attached. alt text

_d_ · ‎01-30-2015

See if this works for you: index=index1 host=scan1 OR host=scan2 PAddressText=* IPHost=* | where IPAddressText=IPHost

_d_ · ‎01-27-2015

Not sure what search you're using or what other configs you have in place, but with the configs above this search emits the correct multiline event on my end: Search: index=my_index source=my source code=35194 Result: 2015-01-26 22:38:11.150,POC1,2,35194,Exception Report: null java.lang.NullPointerException at com.fundtech.core.paymentprocess.data.tx.IncomingFormattingContext.getParseObject(IncomingFormattingContext.java:48) at backend.paymentprocess.interfaces.handlers.FEDInterfaceHandler.processABMS(FEDInterfaceHandler.java:411) at backend.paymentprocess.interfaces.handlers.FEDInterfaceHandler.parseMsg(FEDInterfaceHandler.java:88) at backend.paymentprocess.businessflowselector.businessobjects.BOBusinessFlowSelector.executeBusinessFlowInner(BOBusinessFlowSelector.java:130) at com.ibm.ws.asynchbeans.WorkWithExecutionContextImpl.go(WorkWithExecutionContextImpl.java:199) at com.ibm.ws.asynchbeans.CJWorkItemImpl.run(CJWorkItemImpl.java:188) at com.ibm.ws.util.ThreadPoolWorker.run(ThreadPool.java:1613) .... more stack lines will be here...... File:sun.reflect.NativeMethodAccessorImpl, Line:48, User ID:, IP Address:192.168.168.121

_d_ · ‎01-27-2015

Well, feel free to paste more data.

_d_ · ‎01-27-2015

That basically means that the field that you searching with is not being extracted correctly. Given that you have a combination of single and multiline events you can try extracting the line with fields first and then apply DELIMS on it. This way you're guaranteed that the extractor will work on clean lines: props.conf [gpp_error_log] SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+####) REPORT-fields = error_fields EXTRACT-first = (?<first_line>.*?)$|\n transforms.conf [error_fields] SOURCE_KEY = first_line DELIMS = "," FIELDS = timestamp,profile,severity,code,message

_d_ · ‎01-27-2015

Not sure what "only stacks count up" means. The chart above was produced by applying the search on a table as below. _time, MemberCount, JobRunTime, JobName 1422336123, 100, 15, Job1 1422336423, 200, 30, Job2 1422337023, 300, 50, Job3 1422337923, 80, 10, Job4

Posts	287
Solutions	88
Karma Given	48
Karma Received	422
Member Since	‎07-27-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Certain REGEX strings in transforms.conf will fail

Re: Is it expected behavior for 6.4.1 universal fo...

Re: Splunk App for AWS: How to prevent Splunk AWS ...

Re: Splunk App for AWS: How to prevent Splunk AWS ...

Re: Splunk App for AWS: How to prevent Splunk AWS ...

Re: Splunk App for AWS: Will my current configurat...

Re: Splunk App for AWS Cloudtrail activity by loca...

Re: Can the Universal Forwarder send logs to an AW...

Re: If search head clustering can use "commodity" ...

Re: If search head clustering can use "commodity" ...

Re: Splunk App for AWS: Why is the Resource Relati...

Re: How to configure the Splunk App for AWS and Sp...

Re: Why are mvindex and mvjoin not working while u...

Re: Why are mvindex and mvjoin not working while u...

Re: Where in our Splunk environment do we install ...

Re: Why are mvindex and mvjoin not working while u...

Re: Where in our Splunk environment do we install ...

Re: Eval for known and unknown field values

Re: How to do a field extraction on the source fie...

Re: How to do a field extraction on the source fie...

Re: Uptime Graph for Multiple Objects

Re: Show only matching IP's from two different fie...

Re: Why isn't my LINE_BREAKER configuration breaki...

Re: How to compute concurrent members in events?

Re: Why isn't my LINE_BREAKER configuration breaki...

Re: How to compute concurrent members in events?

Are you a member of the Splunk Community?