cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
scqing
Engager
Member since: ‎03-08-2016
‎02-09-2022
Community Statistics
Posts 7
Solutions 0
Karma Given 2
Karma Received 0
Member Since ‎03-08-2016
Activity Feed
View All

Re: The percentage of high priority searches skipp...

by in Splunk Enterprise
‎01-10-2022 11:00 PM
‎01-10-2022 11:00 PM
"Splunk stopped work" means all rules stopped working，until restart the splunk SH. 1) Re-schedule the searches so fewer try to run at the same time. I tried already。 2) Improve the performance of searches so they complete sooner. 3) Run heavy-weight searches during off hours so they're not competing with ad-hoc searches (which have priority). 4) Increase the number of searches per CPU (if the CPUs are not too busy) According to monitoring，I don't think CPU is busy。 5) Add more CPUs to the search head 6) Add more SHs to the SHC (or create a SHC if you don't have one)  For the same monitoring rules, my old environment is a stand-alone version of Splunk, version 6.5.1. Now the same host configuration is expanded to three hosts and clustered. Version 8.1.2 .however， performance is bad, so it's not easy to apply for resources again ... View more

The percentage of high priority searches skipped

by in Splunk Enterprise
‎11-02-2021 02:53 AM
‎11-02-2021 02:53 AM
Hello, My splunk cluster have a alert like" The percentage of high priority searches skipped (21%) over the last 24 hours is very high and exceeded the red thresholds (10%) on this Splunk instance. Total Searches that were part of this percentage=23. Total skipped Searches=5 The percentage of non high priority searches skipped (22%) over the last 24 hours is very high and exceeded the red thresholds (20%) on this Splunk instance. Total Searches that were part of this percentage=8835. Total skipped Searches=1947"。 What can I do，The Splunk stopped work now!! I have tried to Change the running time of rules and  to disperse them as much as possible,But still not work. Thanks, Jason ... View more

Re: How to correlate historical logs based on time...

by in Knowledge Management
‎03-25-2019 07:25 PM
‎03-25-2019 07:25 PM
Anyone who can answer this question? ... View more

How to correlate historical logs based on time per...

by in Knowledge Management
‎03-24-2019 11:43 PM
‎03-24-2019 11:43 PM
My computer's IP is based on DHCP allocation, so it changes dynamically from time to time. DHCP's log contains IP and host name, so you can know whose computer this is. The squid log contains IP and Internet address as follows. So the associated log can tell who visited what Internet address. Now my question is, because IP is dynamic, when I query logs, what if I automatically associate them? For example, I want to query someone's online records for a year, and this person's IP changes every week. I don't want to check it every week like this. ... View more

how to index a mysql without datetime

by in All Apps and Add-ons
‎06-02-2017 02:28 AM
‎06-02-2017 02:28 AM
I want to index a mysql .The table is named as "date+topic"，for example 20170601_action ，however ,the column time in table is in format "hh:mm:ss"，so,HOW could I index it with date+time as timestamp？ ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎02-09-2022 12:22 PM
Karma given to
View All