About groland

groland · ‎07-06-2018

I don't know why you are not the top answer, this is perfect and more performant than the BREAK_ONLY_BEFORE. I like the usage of the positive lookahead on the regex, that is exactly what I was looking for.

groland · ‎03-23-2018

I tried with your file (I had almost the same) and I have the same result. To reproduce the issue, Splunk need to be started with systemctl (it work if you do a /opt/splunk/bin/splunk start) and you can try to restart Splunk from the web interface. Splunk will shutdown but will not restart.

groland · ‎03-19-2018

I have the same kind of issue when I'm using systemd here. On my side, it's happens when I'm adding an indexer (or a search head) into a cluster. When an indexer join a cluster, the cluster master will send a configuration bundle and will ask splunk to restart. It seems with systemd, splunk stop properly but does not start again after. You may want to add something like that into the unit file: Restart=on-failure RestartSec=30s But you will be forced to use systemctl to stop splunk (if not, systemctl will start it again after 30s). I'm still looking for another solution, maybe someone else can help here. Thanks.

groland · ‎02-24-2017

Hi, Thanks for the answer. Maybe things have changed now with DBX 3.0.0 (I haven't tested). For the documentation, is seem talking about the inputs and on my side, I've an issue with the dbxquery so those parameters aren't available (because it's not indexation).

groland · ‎01-17-2017

Hi everyone, When I used Splunk DB Connect v1 on MS SQL, I was able to something like that (very simplified): | dbquery mssql "SELECT GETDATE() AS getdate" | eval _time = getdate | timechart count But with Splunk DB Connect v2, the datetime is output as string and wasn't recognized as a timestamp, so this doesn't work anymore: | dbxquery connection=mssql query="SELECT GETDATE() AS getdate" | eval _time = getdate | timechart count The workaround is to convert the date to timestamp before using it in the timechart: | dbxquery connection=mssql shortnames=t query="SELECT GETDATE() AS getdate" | eval getdate = strptime(getdate, "%Y-%m-%d %H:%M:%S.%3Q") | eval _time = getdate | timechart count Is this a desired feature or an issue on my side? Thanks!

groland · ‎01-05-2017

I have the same issue on my side, unable to accelerate datamodels using KV lookups, error message is This search does not support summarization, evenif I set the replicate setting to true. When I remove the KV lookup, everything back to normal and the datamodels is accelerated. Workaround is to setup automatic lookup and in the datamodels, use those new fields like regular fields.

groland · ‎03-23-2016

Another really good app for this: https://splunkbase.splunk.com/app/2664/

groland · ‎03-07-2016

You have to edit the admin role (Settings > Access controls > Roles > admin) to add the splunk_ontap_admin role. Once done, you will be able to save the window.

groland · ‎11-24-2015

I've installed the Splunk App for NetApp Data ONTAP and we currently are in 8.3P2, everything seem to works without any issue. I still have issue with LUN dashboard and the Controller View dashboard but I don't think it's caused by the NetApp version.

Posts	9
Solutions	1
Karma Given	21
Karma Received	6
Member Since	‎01-14-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

After migrating from Splunk DB Connect version 1 t...

Re: line break help with incoming logging data

Re: systemd start restart for splunk not working a...

Re: systemd start restart for splunk not working a...

Re: After migrating from Splunk DB Connect version...

After migrating from Splunk DB Connect version 1 t...

Re: Why am I getting "Error in 'summarize' command...

Re: Splunk implements Graphite?

Re: Splunk App for NetApp Data ONTAP: Why am I una...

Re: Is NetApp® versions 8.3 in mode cluster suppor...