Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About sirkgm14vg
sirkgm14vg
Explorer
Member since:
08-01-2011
09-26-2024
Community Statistics
| Posts | 8 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 08-01-2011 |
Activity Feed
- Got Karma for Event Breaks with FlexLM Licenses not ingesting consistently. 06-05-2020 12:46 AM
- Posted Re: When trying to create a self-sign certificate, why am I receiving "unknown option -config" and "can't open config file" errors? on Getting Data In. 01-20-2017 09:57 AM
- Posted Re: How do I count the number of each of the different options for a field and present it in a table? on Splunk Search. 01-20-2017 09:42 AM
- Posted Re: How do I count the number of each of the different options for a field and present it in a table? on Splunk Search. 01-20-2017 09:39 AM
- Posted Re: Why is the Deployment Server Forwarder Management slow to return the number of clients connected after specifying an SslKeysFile value in server.conf? on Deployment Architecture. 12-13-2016 01:24 PM
- Posted Re: Has anyone used the Kafka Messaging Modular Input 1.0 against an older 0.8.1.1 version of Kafka? on All Apps and Add-ons. 12-13-2016 01:15 PM
- Posted Re: Event Breaks with FlexLM Licenses not ingesting consistently on Splunk Search. 12-13-2016 01:03 PM
- Posted Re: Getting request timed out error when I launch the Splunk console in browser after a fresh Splunk install on a new Linux VM? on Deployment Architecture. 08-23-2016 12:06 PM
- Posted Event Breaks with FlexLM Licenses not ingesting consistently on Splunk Search. 03-06-2014 11:49 AM
- Tagged Event Breaks with FlexLM Licenses not ingesting consistently on Splunk Search. 03-06-2014 11:49 AM
- Tagged Event Breaks with FlexLM Licenses not ingesting consistently on Splunk Search. 03-06-2014 11:49 AM
- Tagged Event Breaks with FlexLM Licenses not ingesting consistently on Splunk Search. 03-06-2014 11:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 |
01-20-2017
09:57 AM
Are you trying to do this on Linux machine, or on a Windows machine? I see references to C:\ but then switching of the folder separator. That's more than likely the issue.
... View more
01-20-2017
09:42 AM
If you want to format your tables using ASCII, use something like https://ozh.github.io/ascii-tables/
... View more
01-20-2017
09:39 AM
This is one way you can do it. You will use the chart command with the class over to break out the User by the Action. Then using the join command you will do a subsearch which will get the total docs and actions by the user. Append will not work as it will create another set over users in the first column.
source="splunk_answers_example_490188.csv" | chart count(Action) over User by Action | join [search source="splunk_answers_example_490188.csv" | stats count(File) as TotalDocs, count(Action) as TotalActions by User]
=====
+-------+---+---+---+---+---+--------------+-----------+
| User | A | B | C | D | E | TotalActions | TotalDocs |
+-------+---+---+---+---+---+--------------+-----------+
| User1 | 3 | 1 | 1 | 0 | 1 | 6 | 6 |
| User2 | 1 | 0 | 0 | 0 | 0 | 1 | 1 |
| User3 | 0 | 0 | 0 | 1 | 0 | 1 | 1 |
| User4 | 1 | 0 | 0 | 1 | 0 | 2 | 2 |
+-------+---+---+---+---+---+--------------+-----------+
... View more
12-13-2016
01:24 PM
Going to have to agree here. In Splunk Documentation it recommends SSL Compression for the reason you are posting about.
Note: We do not recommend that you
disable tls compression, as it can
cause bandwidth issues.
Configure Splunk forwarding to use your own certificates
... View more
12-13-2016
01:15 PM
Haven't directly looked at it, but I think a better option might be to use NiFi and subscribe to the topics on NiFi, then use the Processor, PutSplunk in conjunction with a heavy forwarder on the same machine.
https://nifi.apache.org/
https://nifi.apache.org/docs/nifi-docs/components/org.apache.nifi.processors.splunk.PutSplunk/
... View more
12-13-2016
01:03 PM
Actually I was able to figure this out. I haven't circled back on this. I was able to get this to ingest correctly, but I need to check with colleagues at a previous employer for what I did.
... View more
08-23-2016
12:06 PM
Let's start with basic troubleshooting:
Check to see if splunk is running: ps -ef | grep splunk
Check to see if splunk is running on the port you think it is: netstat -tulpn
Which OS are you using?
If you are using CentOS, check to make sure firewalld is not started and also check to see if selinux is running. Disable those and see if you can see if Splunk Web works then.
You can also comment on which user you installed Splunk as, anything but root without the actual requirement of being a separate user might be your issue also.
Let's start there and then see what we can find out!
-Kristerpher
... View more
03-06-2014
11:49 AM
1 Karma
I'm individually bringing in FlexLM files into Splunk, but alas, some of them are not parsing correctly. Some are fine, and what makes them unique is the timestamping.
The log file inserts timestamps without dates per line, but uses a timestamp with data to show the date, and each event on that date. It appears some of the FlexLM files are captured correctly. And some are not. Example.
Timestamp Event
1 3/4/14 12:58:59.000 PM
12:58:59 (lmgrd) -----------------------------------------------
12:58:59 (lmgrd) Please Note:
12:58:59 (lmgrd)
12:58:59 (lmgrd) This log is intended for debug purposes only.
12:58:59 (lmgrd) In order to capture accurate license
12:58:59 (lmgrd) usage data into an organized repository,
12:58:59 (lmgrd) please enable report logging. Use Macrovision's
12:58:59 (lmgrd) software license administration solution,
12:58:59 (lmgrd) FLEXnet Manager, to readily gain visibility
12:58:59 (lmgrd) into license usage data and to create
12:58:59 (lmgrd) insightful reports on critical information like
12:58:59 (lmgrd) license availability and usage. FLEXnet Manager
12:58:59 (lmgrd) can be fully automated to run these reports on
12:58:59 (lmgrd) schedule and can be used to track license
12:58:59 (lmgrd) servers and usage across a heterogeneous
12:58:59 (lmgrd) network of servers including Windows NT, Linux
12:58:59 (lmgrd) and UNIX. Contact Macrovision at
12:58:59 (lmgrd) www.macrovision.com for more details on how to
12:58:59 (lmgrd) obtain an evaluation copy of FLEXnet Manager
12:58:59 (lmgrd) for your enterprise.
12:58:59 (lmgrd)
12:58:59 (lmgrd) -----------------------------------------------
12:58:59 (lmgrd)
12:58:59 (lmgrd)
2 1/20/11 12:58:59.000 PM
12:58:59 (lmgrd) FLEXnet Licensing (v10.8.0.7 build 26147) started on warehouse (linux) (1/20/2011)
12:58:59 (lmgrd) Copyright (c) 1988-2006 Macrovision Europe Ltd. and/or Macrovision Corporation. All Rights Reserved.
This is even better example
24 1/25/11 7:00:51.000 PM
19:00:51 (lmgrd) TIMESTAMP 1/25/2011
25 1/26/11 1:00:51.000 AM
1:00:51 (lmgrd) TIMESTAMP 1/26/2011
26 1/26/11 7:00:51.000 AM
7:00:51 (lmgrd) TIMESTAMP 1/26/2011
27 1/26/11 1:00:51.000 PM
13:00:51 (lmgrd) TIMESTAMP 1/26/2011
17:39:41 (toolworks) OUT: "TotalView_Team" Jeffrey.Durachta@an006
17:43:40 (toolworks) IN: "TotalView_Team" Jeffrey.Durachta@an006
28 1/26/11 7:00:51.000 PM
19:00:51 (lmgrd) TIMESTAMP 1/26/2011
29 1/27/11 1:00:51.000 AM
1:00:51 (lmgrd) TIMESTAMP 1/27/2011
30 1/27/11 7:00:51.000 AM
7:00:51 (lmgrd) TIMESTAMP 1/27/2011
31 1/27/11 1:00:51.000 PM
13:00:51 (lmgrd) TIMESTAMP 1/27/2011
13:01:47 (toolworks) OUT: "TotalView_Team" mjn@mjn
13:04:57 (toolworks) IN: "TotalView_Team" mjn@mjn
13:05:15 (toolworks) OUT: "TotalView_Team" mjn@mjn
13:07:50 (toolworks) IN: "TotalView_Team" mjn@mjn
13:08:21 (toolworks) OUT: "TotalView_Team" mjn@mjn
13:09:42 (toolworks) IN: "TotalView_Team" mjn@mjn
13:32:19 (toolworks) OUT: "TotalView_Team" mjn@mjn
13:32:26 (toolworks) IN: "TotalView_Team" mjn@mjn
32 1/27/11 7:00:51.000 PM
19:00:51 (lmgrd) TIMESTAMP 1/27/2011
33 1/28/11 1:00:51.000 AM
1:00:51 (lmgrd) TIMESTAMP 1/28/2011
34 1/28/11 7:00:51.000 AM
7:00:51 (lmgrd) TIMESTAMP 1/28/2011
35 1/28/11 1:00:51.000 PM
13:00:51 (lmgrd) TIMESTAMP 1/28/2011
13:07:35 (toolworks) OUT: "TotalView_Team" Peter.Phillipps@an003
13:57:12 (toolworks) IN: "TotalView_Team" Peter.Phillipps@an003
However in my other log is PGI (not working):
2 3/5/14 12:58:02.000 PM
12:58:02 (pgroupd) OUT: "pgf90-linux86" gkv@class07
3 3/5/14 12:58:02.000 PM
12:58:02 (pgroupd) IN: "pgf90-linux86" gkv@class07
4 3/5/14 12:58:02.000 PM
12:58:02 (pgroupd) OUT: "pgf90-linux86" gkv@class07
5 3/5/14 12:58:02.000 PM
12:58:02 (pgroupd) IN: "pgf90-linux86" gkv@class07
6 3/5/14 12:59:26.000 PM
12:59:26 (pgroupd) OUT: "pgf90-linux86" gkv@class07
7 3/5/14 12:59:26.000 PM
12:59:26 (pgroupd) IN: "pgf90-linux86" gkv@class07
8 3/5/14 12:59:26.000 PM
12:59:26 (pgroupd) OUT: "pgf90-linux86" gkv@class07
9 3/5/14 12:59:26.000 PM
12:59:26 (pgroupd) IN: "pgf90-linux86" gkv@class07
10 3/5/14 1:17:42.000 PM
13:17:42 (pgroupd) OUT: "pgf90-linux86" gkv@class07
11 3/5/14 1:17:43.000 PM
13:17:43 (pgroupd) IN: "pgf90-linux86" gkv@class07
12 3/5/14 1:17:43.000 PM
13:17:43 (pgroupd) OUT: "pgf90-linux86" gkv@class07
13 3/5/14 1:17:43.000 PM
13:17:43 (pgroupd) IN: "pgf90-linux86" gkv@class07
14 3/4/14 4:32:33.000 PM
16:32:33 (lmgrd) TIMESTAMP 5/9/2001
15 3/3/14 10:32:33.000 PM
22:32:33 (lmgrd) TIMESTAMP 5/9/2001
16 3/3/14 4:32:33.000 AM
4:32:33 (lmgrd) TIMESTAMP 5/10/2001
17 3/2/14 10:32:33.000 AM
10:32:33 (lmgrd) TIMESTAMP 5/10/2001
18 3/1/14 4:32:33.000 PM
16:32:33 (lmgrd) TIMESTAMP 5/10/2001
19 2/28/14 10:32:33.000 PM
22:32:33 (lmgrd) TIMESTAMP 5/10/2001
20 2/28/14 4:32:33.000 AM
4:32:33 (lmgrd) TIMESTAMP 5/11/2001
I understand that I could simply start with the props.conf, and if someone wants to take a whack a solution, that'd be awesome. With that I'd really like someone to provide me the syntax to remove the banner/header that appears in the logs. But also to help capture that date correctly the way it's distributed in the TotalViewFile.
... View more
