Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About supabuck
supabuck
Path Finder
Member since:
04-06-2016
10-26-2021
Community Statistics
| Posts | 22 |
| Solutions | 2 |
| Karma Given | 37 |
| Karma Received | 7 |
| Member Since | 04-06-2016 |
Activity Feed
- Got Karma for Re: How to trim away the port and use only URL after ":"?. 09-08-2023 02:56 PM
- Posted Re: Can a multi-cluster Splunk Enterprise exist on a hybrid environment - On premise as well as on AWS? on All Apps and Add-ons. 10-21-2021 06:45 AM
- Got Karma for Take down a site temporarily in a Multisite Cluster. 12-10-2020 10:29 AM
- Posted Take down a site temporarily in a Multisite Cluster on Deployment Architecture. 12-10-2020 08:33 AM
- Karma Where is the CSS file to edit to revert the SplunkWeb UI to the font used before v7.1? for orion44. 06-05-2020 12:49 AM
- Got Karma for Re: How to trim away the port and use only URL after ":"?. 06-05-2020 12:49 AM
- Karma Re: I have installed the Splunk forwarder, but why am I unable to search the event logs from all machines? for Raghav2384. 06-05-2020 12:48 AM
- Karma Why is splunkd.log not getting indexed? Receiving error "The file 'E:\Splunk\var\log\splunk\splunkd.log' is invalid. Reason: binary" for scottrunyon. 06-05-2020 12:48 AM
- Karma Re: Splunk local account login to splunkweb when SAML authentication is enabled? for suarezry. 06-05-2020 12:48 AM
- Karma Re: How to write a search to show any scheduled search jobs that may have been delayed and for how long? for Raghav2384. 06-05-2020 12:48 AM
- Karma Re: How to write a search to show any scheduled search jobs that may have been delayed and for how long? for Runals. 06-05-2020 12:48 AM
- Karma Re: Why is my Splunk REST API search not working and getting error "curl: (56) Failure when receiving data from the peer"? for jkat54. 06-05-2020 12:48 AM
- Karma Panels that use basesearch won't display different times for hajducko. 06-05-2020 12:48 AM
- Karma Re: Panels that use basesearch won't display different times for Raghav2384. 06-05-2020 12:48 AM
- Karma Re: How to troubleshoot why I am getting no data in the App for Twitter Data? for Raghav2384. 06-05-2020 12:48 AM
- Karma Re: How to check the most accessed/searched index/sourcetypes/source by user..? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: Are there recommendations on teaching users how to get current data from reports without hitting concurrent search limits? for Raghav2384. 06-05-2020 12:48 AM
- Karma Re: How To Alert if SourceType is Not Logging? for JDukeSplunk. 06-05-2020 12:48 AM
- Karma Re: How To Alert if SourceType is Not Logging? for Raghav2384. 06-05-2020 12:48 AM
- Got Karma for Re: How to configure all nodes in a clustered environment to forward internal Splunk logs to the clustered indexers?. 06-05-2020 12:48 AM
Topics I've Started
10-21-2021
06:45 AM
Hello, Did you find an answer to this question? I am faced with a similar situation.
... View more
12-10-2020
08:33 AM
1 Karma
We have a 2 site multisite cluster with the following cluster configuration. The cluster contains 30 indexers total, 15 at each site. There is over a petabyte of data stored across the two sites. [clustering]
cluster_label = StarfishCluster
mode = master
multisite = true
replication_factor = 2
search_factor = 2
available_sites = site1,site2
site_replication_factor = origin:1,site1:1,site2:1,total:2
site_search_factor = origin:1,site1:1,site2:1,total:2 We may have to move the servers that are in site 1 from one datacenter to another data center. The data center is several hundred miles away so these servers will be offline for over a week. How can we safely take down a site, then re-enable that site at a later time without losing data or having Splunk encounter issues with ingest. As a test we have put the cluster in maintenance mode then taken down all of the hosts within a single site but Splunk stopped indexing data in the other site which remained online. We also experienced an increase in resources which was expected. Is there documentation available on exactly how to safely take down a site without impacting indexing and search availability?
... View more
Labels
- Labels:
-
indexer clustering
-
Linux
02-12-2018
11:44 AM
2 Karma
Hello,
You want to use a regular expression to complete this.
If your field is called ipaddr the following code would apply. Replace the word ipaddr with whatever field you have which captures the IP address.
index=foo sourcetype=bar | rex field=ipaddr "(?P<ipaddr>.*):"
This returns everything before the : and places it in the field called ipaddr.
Let me know if this works.
Thank you,
Supabuck
... View more
02-01-2017
12:32 PM
Hi dcroteau,
Let me know if the suggestion below worked.
Thanks!
-supabuck
... View more
01-05-2017
12:48 PM
That's great! Would you mind accepting the answer below?
... View more
01-05-2017
12:47 PM
Hello,
I think for some reason it believes that it is a binary file rather than ascii. I recommend stopping Splunk, copy the contents of it, delete the file and create a new file with that name with appropriate permissions in the $SPLUNK_HOME/var/log/splunk/ directory then paste back in the plain text to your new file and restart Splunk.
Regards,
supabuck
... View more
01-05-2017
07:57 AM
In this case, I'm not too sure. I would open a case with Splunk to see if they have ever seen this issue. The answer below also has a valid situation but it doesn't explain how it was created which I am unsure of.
... View more
01-04-2017
02:21 PM
Hello,
I would try to stop the splunk process on that host, move the splunkd.log file to another name in the same directory such as splunkd.log.txt and let splunk re-create the file as it should be. I think for some reason it believes that it is a binary file rather than ascii. You could also probably just copy the contents of it, delete the file and create a new file with that name with appropriate permissions in the $SPLUNK_HOME/var/log/splunk/ directory then paste back in the plain text to your new file and restart Splunk.
Let me know if this works.
Regards,
supabuck
... View more
01-04-2017
01:52 PM
Hello,
Try looking in splunkd.log. It contains information on what is occurring at the time which you are trying to start the service and while the service is running it will log events informing you of how it is running.
Lets say you have it installed in linux, the path would be $SPLUNK_HOME/var/log/splunk/splunkd.log
In the case of my personal instance I would use the following command to see what splunk is doing while it is starting up:
tail -f /opt/splunk/var/log/splunk/splunkd.log
Let us know what you find within this file.
Regards,
supabuck
... View more
01-04-2017
01:19 PM
Hello dcroteau,
This absolutely can be done.
Based upon your example here is what you would do for the case of your index named mynewindex wanted to be changed to a year of retention:
curl -k -u admin:changeme https://127.0.0.1:8089/servicesNS/admin/search/data/indexes/mynewindex -d frozenTimePeriodInSecs=31536000
Specifying it in the path will alter the settings on that index via the REST endpoint.
Regards,
supabuck
... View more
08-22-2016
12:20 PM
1 Karma
I had the same issue, and this method worked for me. Thank you jkat!
... View more
08-19-2016
01:39 PM
Yes, this change can be made to the indexer. If you have multiple indexers you would want to make sure it is changed on them all. Find the props.conf file which defines how this sourcetype is being interpreted and update it. Within Linux you can use the following command from the $SPLUNK_HOME directory.
find ./* -name props.conf | xargs grep -i catalina
In the case that you have the sourcetype of catalina defined extractions 🙂
... View more
08-18-2016
01:35 PM
Hello user12345a_2,
In order to accomplish this you will need to use a file called props.conf.
http://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Propsconf
Props.conf is used to manipulate how files are read by Splunk. So if you were to add a directive within props.conf such as
<catalina>
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE= (?m)^\={60}$
CHARSET=UTF-8
disabled=false
Where 'catalina' is the sourcetype and 'BREAK_ONLY_BEFORE= (?m)^={60}$' matches the second set of equal signs being that there are 60 for the multi-line event.
Within your monitor stanza in inputs.conf it would remain as you have it above:
[monitor://C:\test_dir\]
index=my_test_index
sourcetype=catalina
There are other things which can be done to clean it up thereafter but that should get you on the right path. Remember to test in a lab prior to applying to production. The props.conf must also be changed on a heavy forwarder which is configured to forward these logs to the indexer(s) or on the indexer(s) themselves. Unfortunately you cannot apply these types of rules to universal forwarders. Let me know if this works.
... View more
08-17-2016
12:18 PM
1 Karma
Hi ppablo, thank you very much for this information. I will read through the entries within this blog series. It's great that the Splunk community is so helpful!
... View more
08-17-2016
07:38 AM
Hi Runals,
Thank you very much. I will add these searches to my list and use it when troubleshooting scheduled searches in the future. I also like those tips concerning the scheduling of cron jobs!
Best regards,
Supabuck
... View more
08-16-2016
08:27 PM
Wow Raghav, thank you. I did a quick test and it looks like what I need. You da man! 🙂
... View more
08-16-2016
08:15 PM
We have a problem with scheduled searches where they will sometimes be delayed due to heavy load on our search heads/indexers. I want to know what jobs have been delayed and how long in minutes if possible so that they can be scheduled for a new time or backfilled.
... View more
08-16-2016
02:04 PM
Hello Brent,
Given with what you are doing I believe that this configuration should work. According to https://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Outputsconf:
# If the [tcpout] stanza configures the indexAndForward attribute, the value
# of that attribute overrides the default value of "index". However, if you
# set "index" in the [indexAndForward] stanza, described below, it
# supersedes any value set in [tcpout].
[indexAndForward]
index = [true|false]
* If set to true, data is indexed.
* If set to false, data is not indexed.
* Default depends on whether the Splunk instance is configured as a
forwarder, modified by any value configured for the indexAndForward
attribute in [tcpout].
So, you probably would not need
indexAndForward = false
Within the outputs.conf [tcpout] configuration stanza.
... View more
08-16-2016
09:37 AM
1 Karma
This can be accomplished by setting up monitoring statements:
[splunk@hostname default]$ pwd
/opt/splunk/etc/apps/SplunkLightForwarder/default
[splunk@hostname default]$ cat inputs.conf
# Version 6.2.0
# these here just override and disable stuff that in system/default.
################################
# Data thru parsingQueue always
################################
[splunktcp]
route=has_key:tautology:parsingQueue;absent_key:tautology:parsingQueue
################################
# Make sure these get forwarded
################################
[monitor://$SPLUNK_HOME/var/log/splunk/splunkd.log]
_TCP_ROUTING = *
index = _internal
[monitor://$SPLUNK_HOME/var/log/splunk/metrics.log]
_TCP_ROUTING = *
index = _internal
It should then accept whatever you have in place for your outputs.conf in your case I would specify the ip addresses and ports for the indexers so that it is load balanced. You can set it up within that app folder in outputs.conf so that it only affects the data listed respective of the app context:
[tcpout:my-indexers]
autoLB = true
autoLBFrequency = 60
compressed = true
server = 10.0.0.4:9997,10.0.0.5:9997,10.0.0.6:9997
Basically with monitor stanzas on those files Splunk will be able to ingest it from my experience.
... View more
06-03-2016
11:55 AM
Sorry, I am pretty new to regex built within searches. What I usually do is copy a sample message and paste it into the TEST STRING at regex101.com.
After doing that you can work on building your regex and it will highlight the groups in real time!
For searches to rex out result fields I usually will do something like:
index=myIndex sourcetype=jws | rex "^\d+\s+\w+\s\d+\s\d+:\d+:\d+,\d+\s(?P<value1>\w+)\s\[]\[]\[]\s\[(?P<value2>\w+)\]\s(?P<value3>(.*))\s\[]\[(.*)\n(?P<value3>(.*))" | table _time host value1 value2 value3 value4
Then if you want to do another search on the results for that you can add this onto the search
| search value1="somevalue"
and it will narrow down the results to only include it where value1="somevalue" in the resulting table.
... View more
06-02-2016
01:29 PM
1 Karma
Hi Packet Hunter,
This probably is not the cleanest but here is how I would pull all the fields from that simultaneously.
index=blah sourcetype=blah
| rex "Group\s<(?P<Group>\w+)>\sUser\s<(?P<User>\w+)>\sIP\s<(?P<IP_Address>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})>\sSVC\sMessage:\s(?P<Message_Num>\d+)\/\w+:\s(?P<Message>(.*))"
| table Group User IP_Address Message_Num Message
... View more
04-21-2016
06:23 PM
Try this:
You can press Windows + R to access RUN for Server 2008 R2 or prior versions.
Now, type in RUN program %Temp%
Windows Explorer will bring you to Temp folder, you can select all and hit DELETE.
Follow these few steps to install your program under “Administrative privileges mode”
Locate your installation file and remember the path to it.
Let’s say I copy my installation file to C drive and its name is “UniversalForwarder6.4.0\blah\blah.msi“. So, the path to it is “C:\UniversalForwarder6.4.0\blah\blah.msi”
Press Windows key to bring up the menu, and then type cmd
A tiny black DOS icon will show up in your search box. Now, right click on that and choose Run as administrator
MSIexec /i “C:\UniversalForwarder6.4.0\blah\blah.msi”
Press Enter and you can start installing your program
Let me know if this works 🙂
Source: http://ephams.com/2013/03/10/msi-installer-error-installation-directory-local-hard-drive/
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-26-2021
06:18 AM
|
