About aojie654

aojie654 · ‎03-21-2021

Hi, Splunkers: I have a customer want to reformat the log with Splunk every 1 hour. Then I created a report runs every 1 hour to export a CSV file but the problem is there will be "," as delimiter，and the customer is only want export to log delimit with " "，is there any way to export the search results to log format directly? Or could replace the "," with " " in the results file? By the way, the data size is about 30GB/hour so I don't think python is a good way to process the exported result...

aojie654 · ‎03-05-2020

Hello? Is anybody here?

aojie654 · ‎03-01-2020

Hi, splunkers: My customer want to monitoring the following 2 things: 1. The status of logs collection. Thats means they wan to ensure that all logs were indexed to splunk. 2. The status of splunk. Send the splunk web message (like the message in the image) to their centralized monitoring platform them in real time if there are any warn or error occured because they almost don't care about splunk monitoring console. Any idea for these?

aojie654 · ‎02-17-2020

As I said in reply to @gcusello Thanks for your reply.

aojie654 · ‎02-17-2020

In actually, the customer has a cluster with 2 peers... I was forgot the data copy on cluster..... Anyway, thanks for your help.

aojie654 · ‎02-16-2020

Hi, splunkers: Is there any way to special the storage ratio? Like 30% log store on indexer A and the other 70% store one indexer B?

aojie654 · ‎01-27-2020

Hi, Splunkers: I found a bug of fields extraction in Splunk Web like following picture: As you can see, I was extract the v2ray_access_method which has the value : "tcp" OR "", and the next field is v2ray_access_ip. When I click the tag "v2ray_access_method" after "Events", there will be only shows "tcp" in the list but there are some IP shows in blue in the tag "Event". So I think maybe there is a bug in the fields extractor fuctions.

aojie654 · ‎01-12-2020

Ok, thanks for you reply, I'll delete some bucket event we will lost some data.

aojie654 · ‎01-12-2020

Hi, Splunkers: I have a question about retention policy that I had configured my index linux_log of frozenTimePeriodInSecs in stanza default in indexes.conf, then the result after splunk btool as following: # splunk btool --debug indexes list linux_log | grep frozenTimePeriodInSecs /opt/splunk/etc/system/local/indexes.conf frozenTimePeriodInSecs = 31624400 but I saw the index info of linux_log in monitoring console like this: Thats obvious that there are some data is older than retention settings! And I can searching the retention data also: The timestamp of first event is the time when I started this server... That is, no data was deleted from splunk even they were older than retention limit. In actually, we had configured the retention limit to 1 year in my customer's splunk but there are 6 years' data, and their disk will be fill full in next 3 days. There are 3 questions: 1. Why is this? 2. How can I delete the old data? I know that I can identify the timestamp then delete the bucket folder in db path, but the timestamp in bucket name is index_time but not event_timestamp, isn't it? 3. I can't using delete in a search for the command is only remove the event from search result and will not clean up the disk, right?

aojie654 · ‎01-12-2020

Hi, Splunkers: I have a question about retention policy that I had configured my index linux_log of frozenTimePeriodInSecs in stanza default in indexes.conf, then the result after splunk btool as following: # splunk btool --debug indexes list linux_log | grep frozenTimePeriodInSecs /opt/splunk/etc/system/local/indexes.conf frozenTimePeriodInSecs = 31624400 but I saw the index info of linux_log in monitoring console like this: Thats obvious that there are some data is older than retention settings! And I can searching the retention data also: The timestamp of first event is the time when I started this server... That is, no data was deleted from splunk even they were older than retention limit. In actually, we had configured the retention limit to 1 year in my customer's splunk but there are 6 years' data, and their disk will be fill full in next 3 days. There are 3 questions: 1. Why is this? 2. How can I delete the old data? I know that I can identify the timestamp then delete the bucket folder in db path, but the timestamp in bucket name is index_time but not event_timestamp, isn't it? 3. I can't using delete in a search for the command is only remove the event from search result and will not clean up the disk, right?

aojie654 · ‎11-06-2019

Hi, nplamondon: I means that: Which port is forwarder using when it send data to indexer? Is there any impact after I changed the management port of forwarder when the 8089 is used on it?

aojie654 · ‎11-06-2019

Hi, splunkers: I assume that there are lots forwarder in a environment but the forward port 9997 and management port 8089 are already used on some forwarders by the other applications. I can modified the management port on forwarders, but I think I don't need to change the forward port on forwarders either. What I am concerned are: 1. What's the default forward port on splunk forwarder? 2. What's the use of management port on forwarder?

aojie654 · ‎10-16-2019

Hi, Giuseppe: It missing about 6 hours ago after I restart the forwarder. In actually, 3 forwarders and indexer are in 4 different LAN, maybe there are some issue occures in the network of missing forwarder.

aojie654 · ‎10-16-2019

There is no errors occured when I restart splunk with CLI, and the other 2 forwarders is running well... At now, I want to know did I need to wait the forwarder block time expired and no the other method to make the block time reset?

aojie654 · ‎10-16-2019

I was restarted the forwarder after fixed the configuration file.

aojie654 · ‎10-16-2019

Emmm... For example, 1. I want configure forwarder forward data to 192.168.3.2:9997 but I make a mistike when edit the outputs.conf like follow: [tcpout:jinmu] server = 192.168.3.2:9998 Then, the following message appears in splunkd.log on forwarder: 10-16-2019 16:56:03.398 +0800 WARN TcpOutputProc - The TCP output processor has paused the data flow. Forwarding to output group jinmu has been blocked for 3900 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data. I fixed configuration in outputs.conf: [tcpout:jinmu] server = 192.168.3.2:9997 I can't recieve the forwarder data yet. (Maybe for the forwarder is blocked? )

aojie654 · ‎10-16-2019

Hi, Giuseppe: I means that I was configured forwarder send data to an incorrect IP address and I was fixed it, now the forwarder could get connection with indexer but not start send data for it was been blocked. So how should I do next to enable data sending on forwarder?

aojie654 · ‎10-15-2019

Hi, Splunkers: I have a forwarder that is target to a incorrect indexer and it was paused to send data for 3700s. Now I have configured to a correct indexer URI and how can I make the forwarder restarting send the data to indexer?

aojie654 · ‎10-07-2019

Hi, Splunkers: About a week ago, a customer asked me that is there a reference for deployment server which has 1200+ client? They have the high speed LAN but not sure about CPU and Memory should configure to server. Any idea for this?

aojie654 · ‎07-10-2019

I'll using python to replace hostname with IP and thanks a lot for you help ^_^

aojie654 · ‎07-10-2019

Hi, woodcock: I used the search query following you like this: index=_internal error | stats count by host | appendpipe [|rest/services/deployment/server/clients | table hostname ip | rename hostname As host ] | stats values(*) AS * BY host | eval host=if(isnotnull(ip), ip, host) | fields host count And the result is looks like this: host count 10.6.10.132 12834 aojie654-splunk-aab4 2806 sja-q-sh0-110 80 10.6.11.10 14 10.6.10.111 10 It looks like the fowarders result is good and the indexers and search head is still display their hostname, any idea to replace their hostname with IP?

aojie654 · ‎07-10-2019

Hi, splunkers: I have a puzzle that I need to show host IP in result but not the hostname. E.g. after I ran the search query index=* error | stats count by host the result looks like following: host count aj-ins5577 229 sja_v_jp0_236 4 But I need to show the IP in the result bu not hostname just like: host count 10.6.10.132 229 10.6.11.10 4 And I have no lookup table on my server. So is there any method to get ip in splunk? I found a REST way to list all forwarders IP in search like run | rest /services/deployment/server/clients | table hostname, ip and the result is: hostname ip aj-ins5577 10.6.10.132 sja_v_jp0_236 10.6.11.10 sja_b_us0_139 10.6.10.111 I think maybe I can append a output command to export the result then I can use the lookup table to display the IP in result. But there are obviously a disadvantage is there is only the forwarders IP in it but no indexer and search heads in it. Is there any good ideas? Thanks! Best regards, Shengjyer Ao

aojie654 · ‎04-26-2019

Hi, @Gregory Lapchenko: I'll use _ in this answer to recognize space. I feel sorry about that I'm not very clearly to understand your puzzle. From what I understand, are you want to match just _info but not abc_info ? If so, maybe the regex expression is \s+info to match _info , or [^\s]*?\sinfo to match abc_info .

aojie654 · ‎04-26-2019

I'm agree with @whrg. In my opinion, I think the boolean operators ( AND , OR , NOT ) command should be included in "( )" such as index="_internal" (sourcetype=splunkd OR sourcetype=splunkd_access) (component=root OR component=Metric) When you are using command "search" without any boolean operators, splunk will fill an AND between the search conditions. For example, index=_internal sourcetype=splunkd is equals that index=_internal AND sourcetype=splunkd . In your case, sourcetype=* and component=* are not conflicting conditions so maybe you should better to use AND or nothing between them.

aojie654 · ‎04-24-2019

In the Readme.md in app, there is the debug search command: index=_internal sourcetype=splunkd sendmodalert action=sendxlsresults_alert STDERR | eval logmsg=substr(_raw,89) | append [search index=_internal source="/opt/splunk/var/log/splunk/sendxlsresults.log" | eval logmsg=_raw] | table _time,logmsg | reverse Then, juct check the message in the results. After I delete the Chinese characters in previous step, my error message shows me that the following informations: That's obvious that I had an error in connection to mail server, but I can send alert via splunk Email sender. Maybe I will spend a few time on it.

Posts	37
Solutions	1
Karma Given	0
Karma Received	2
Member Since	‎12-13-2018

Online Status	Offline
Date Last Visited	‎03-21-2021 07:09 AM

Export search results to log without ","

Log collect status monitoring and

How to specify the storage ratio?

The bug of fields extraction in Splunk Web

Question About Retetion Policy No Effect

Why did my data not deleted when reaching retentio...

How did forwarder use management port?

Forwarder Resend Data After Connect To Indexer

Deployment Server Performance Reference

How to replace hostname with IP in result?

Export search results to log without ","

Re: Log collect status monitoring and

Log collect status monitoring and

Re: How to specify the storage ratio?

Re: How to specify the storage ratio?

How to specify the storage ratio?

The bug of fields extraction in Splunk Web

Re: Question About Retetion Policy No Effect

Question About Retetion Policy No Effect

Why did my data not deleted when reaching retentio...

Re: How did forwarder use management port?

How did forwarder use management port?

Re: Forwarder Resend Data After Connect To Indexer

Re: Forwarder Resend Data After Connect To Indexer

Re: Forwarder Resend Data After Connect To Indexer

Re: Forwarder Resend Data After Connect To Indexer

Re: Forwarder Resend Data After Connect To Indexer

Forwarder Resend Data After Connect To Indexer

Deployment Server Performance Reference

Re: How to replace hostname with IP in result?

Re: How to replace hostname with IP in result?

How to replace hostname with IP in result?

Re: regex delimiters & config file formatting

Re: How to pull events with multiple sourcetype

Re: error STDERR