About jgreenleaf

jgreenleaf · ‎06-19-2014

Licenses are only valid after they are issued, not before. This is to prevent you from buying a license and then sending it x time_units in the past, as that way splunk would miss out on x time_units of license fees. To resolve this issue just run "ntpdate pool.ntp.org".

jgreenleaf · ‎03-21-2014

We don't use simple xml dashboards (we convert them all to advanced xml before deploying them) and have noticed a dramatic performance improvement with splunk 6.

jgreenleaf · ‎02-11-2014

I didn't have to do steps 1b) or 3) btw. Also, I just copied over the recompiled native library, as that's all you really need.

jgreenleaf · ‎01-10-2014

This is a message printed out by apache hadoop because its binary distribution compiles libhadoop.so for 32-bit systems, while my system was 64. This is fine from hadoop's standpoint http://stackoverflow.com/questions/19943766/hadoop-unable-to-load-native-hadoop-library-for-your-platform-error-on-centos , however splunk treats this as a CRITICAL ERROR, so it has to be resolved to get hunk to work properly. The solution is to get the source distribution of apache hadoop, and recompile it yourself (which is a HUGE PAIN, the java build conventions are the worst).

jgreenleaf · ‎01-10-2014

When running queries against a VIX backed by an instance of apache hadoop, my searches would raise the following error: 01-08-2014 15:34:24.386 ERROR ChunkedOutputStreamReader - Invalid header line="OpenJDK 64-Bit Server VM warning: You have loaded library /opt/hadoop-2.2.0/lib/native/libhadoop.so.1.0.0 which might have disabled stack guard. The VM will try to fix the stack guard now." 01-08-2014 15:34:24.386 ERROR ChunkedOutputStreamReader - Invalid header line="It's highly recommended that you fix the library with 'execstack -c ', or link it with '-z noexecstack'." 01-08-2014 15:34:24.386 ERROR SearchOperator:stdin - Cannot consume data with unset stream_type 01-08-2014 15:34:24.386 ERROR ResultProvider - Error in 'SearchOperator:stdin': Cannot consume data with unset stream_type And an error would be reported in the webui.

jgreenleaf · ‎11-13-2013

^.{5,6}(?<!p)a$ should do what you want

Posts	6
Solutions	1
Karma Given	9
Karma Received	12
Member Since	‎08-19-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Hunk Reports an Error with Apache Hadoop

Re: Why does Splunk enterprise license show: Statu...

Re: Folks finding 6x as snappy as 5x?

Re: Hunk Reports an Error with Apache Hadoop

Re: Hunk Reports an Error with Apache Hadoop

Hunk Reports an Error with Apache Hadoop

Re: good regex (fast)