Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About gregbo
gregbo
Communicator
Member since:
01-28-2016
a month ago
Community Statistics
| Posts | 63 |
| Solutions | 4 |
| Karma Given | 2 |
| Karma Received | 13 |
| Member Since | 01-28-2016 |
Activity Feed
- Posted Has anyone ever mounted a RHEL partition that points to S3, and set indexes to that partition? on Splunk Enterprise. a month ago
- Got Karma for Is there a problem with splunk getting data from the Perfmon Process counter?. 06-05-2020 12:50 AM
- Got Karma for Re: How do I remove a corrupted bucket in an Indexer Cluster environment?. 06-05-2020 12:50 AM
- Got Karma for Re: How do I remove a corrupted bucket in an Indexer Cluster environment?. 06-05-2020 12:50 AM
- Got Karma for I've heard that once data is indexed, it cannot be modified. Is that documented somewhere?. 06-05-2020 12:49 AM
- Got Karma for The maximum number of concurrent historical searches on this instance has been reached.. 06-05-2020 12:49 AM
- Got Karma for The maximum number of concurrent historical searches on this instance has been reached.. 06-05-2020 12:49 AM
- Got Karma for Message "Eventtype 'wineventlog-ds' does not exist or is disabled" appears in splunk app for *nix. 06-05-2020 12:48 AM
- Got Karma for Message "Eventtype 'wineventlog-ds' does not exist or is disabled" appears in splunk app for *nix. 06-05-2020 12:48 AM
- Got Karma for Message "Eventtype 'wineventlog-ds' does not exist or is disabled" appears in splunk app for *nix. 06-05-2020 12:48 AM
- Got Karma for Message "Eventtype 'wineventlog-ds' does not exist or is disabled" appears in splunk app for *nix. 06-05-2020 12:48 AM
- Got Karma for Message "Eventtype 'wineventlog-ds' does not exist or is disabled" appears in splunk app for *nix. 06-05-2020 12:48 AM
- Got Karma for Running a single instance of Splunk, but why does Health Check in the Monitoring Console warn of non-indexer instances that are not sending logs to the indexer?. 06-05-2020 12:48 AM
- Got Karma for Running a single instance of Splunk, but why does Health Check in the Monitoring Console warn of non-indexer instances that are not sending logs to the indexer?. 06-05-2020 12:48 AM
- Karma Re: How can I control the size and number of Splunk's internal logs? for oreoshake. 06-05-2020 12:45 AM
- Karma Re: forward-server listed as inactive for ta_viewpointcs. 06-05-2020 12:45 AM
- Posted How do I migrate a Splunk indexer cluster to new hardware (RHEL 6 to RHEL 7)? on Installation. 04-22-2020 08:26 AM
- Tagged How do I migrate a Splunk indexer cluster to new hardware (RHEL 6 to RHEL 7)? on Installation. 04-22-2020 08:26 AM
- Posted Re: One UF isn't connecting to the indexer on Getting Data In. 03-05-2020 02:11 AM
- Posted One UF isn't connecting to the indexer on Getting Data In. 03-04-2020 07:57 AM
a month ago
I heard that RHEL 7 can have mount points that point to S3...has anyone tried setting that up and placing index buckets on that partition? Wondering if it's possible or not.
... View more
04-22-2020
08:26 AM
I have a Splunk cluster of 1 Search Head, 1 Index Master, and 2 Indexers in a cluster. I need to move all 4 to new hardware. What's the best way to do this?
... View more
Labels
03-05-2020
02:11 AM
I checked, and both outputs.conf are identical (except for the sslPassword hash). Could it be something else? Is there a way to increase the "Maximum message size" that's mentioned in the error?
... View more
03-04-2020
07:57 AM
One of my forwarders is not connecting with the indexers. Another system that is identical is connecting just fine. I keep getting errors about the message being rejected because it's too big, but I can't figure out where to adjust the allowed message size. This error is from the indexer:
03-04-2020 15:45:26.122 +0000 ERROR TcpInputProc - Message rejected. Received unexpected message of size=369295616 bytes from src=x.x.x.x:57186 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.
... View more
03-03-2020
09:26 AM
The disk usage is at 17% and inode usage is at 1%. The error message from Splunk Web says minFreeSpace is 5000 and free space is 85711:
03-03-2020 16:16:48.266 +0000 WARN DiskMon - MinFreeSpace=5000. The diskspace remaining=85711 is less than 2 x minFreeSpace
... View more
08-02-2019
08:04 AM
Whelp, I learned I need to pay closer attention to my inputs.conf...I had it as renderXML, but it's supposed to be renderXml. It's working now.
... View more
08-02-2019
07:57 AM
I have a Windows 2016 Server and I've got a UF sending windows event logs. They only come in as xml, even if I put renderXML = false in inputs.conf. Anyone know what I'm missing?
... View more
06-26-2019
02:14 PM
1 Karma
Someone is telling me that Splunk doesn't grab Perfmon data properly...they are getting %Processor Time from both the Process and Processor counters. They say that if they grab the data from Process for each process and add them up, they don't get the same value as the value from the Processor counter (even taking the number of CPUs/Cores/Hyperthreading into account). They say they asked Splunk for updates and got some updates and they still don't work.
... View more
06-24-2019
03:49 AM
There's a Process object and a Processor object in Perfmon. The Processor object works fine. The user has all the necessary rights.
... View more
06-24-2019
03:36 AM
All the ones I ever see is Python. I need one that uses a bash script.
... View more
06-21-2019
08:00 AM
I have splunk getting data for the other objects, including Processor, but nothing happens for Process.
The process stanza:
[perfmon://Process]
interval = 60
object = Process
counters = _Total
instances = *
index = windows
showZeroValue = 1
disabled = 0
The processor stanza:
[perfmon://Proccesor]
interval = 60
object = Processor
counters = *
instances = *
index = windows
showZeroValue = 1
... View more
05-30-2019
05:14 AM
I have a splunk cluster (RHEL) with 2 indexers, and they seem to have a memory leak. Memory usage grows steadily until it runs out of memory and the OOM Killer kills the splunkd process. The only way to get the memory back is to restart the server (restarting splunk doesn't help). I've got two clusters that do this, and a few single instance splunk servers that never do this. Oddly enough, it's usually one of the indexers in the cluster that eats up memory first. ulimit and THP is set properly on all the servers. Has this happened to anyone?
... View more
04-17-2019
08:44 AM
I just installed a new UF on a Windows VM, and I'm getting an error that connection to the host failed, with "sock_error = 10054. SSL Error = No error"
The indexers I'm trying to connect to can talk to a bunch of other Windows VMs.
The ports to the indexers are open from the Windows VM that's having the problem.
This configuration worked when I installed it on other VMs
What does "SSL Error = No error" mean?
... View more
11-16-2018
01:52 AM
2 Karma
How about a non-clustered bucket? Can I just delete it from the OS?
... View more
09-13-2018
06:04 AM
Did you ever figure this out?
... View more
I know that once an event is indexed, it cannot be modified. But is that specifically stated somewhere in the Documentation? I need to provide proof of it for security documentation.
... View more
- Tags:
- splunk-enterprise
06-11-2018
08:52 AM
I answered my own question: "peer_nodes" is the name of my output stanza (duh). I changed the size of it under that stanza.
... View more
06-11-2018
07:50 AM
I'm seeing the queue "tcpoutpeernodes" almost fill up on my UF:
06-11-2018 10:40:18.384 -0400 INFO Metrics - group=queue, name=tcpout_peer_nodes, max_size=7340032, current_size=7296696, largest_size=7296696, smallest_size=7296696
Anybody know what it's for or how to change it? Google literally has 0 hits for "tcpoutpeernodes", same with Splunk Answers.
... View more
- Tags:
- splunk-enterprise
06-04-2018
05:30 AM
That's odd, I thought I did use Ctrl+K...I'll have to see what I did wrong..
... View more
06-04-2018
04:51 AM
I couldn't get the suggested methods to work (probably I'm doing something else wrong), but I managed to get what I needed by using a rex to pull the value out of the second field and then do a search like so:
| rex field=altpat "\w^\w^\w^\w^\w~(? \w )"
| search (patid = $patid$) OR (altpatid = $patid$)
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
a month ago
|
Karma from
