Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ebaileytu
ebaileytu
Communicator
Member since:
08-27-2013
09-22-2021
Community Statistics
| Posts | 53 |
| Solutions | 3 |
| Karma Given | 5 |
| Karma Received | 5 |
| Member Since | 08-27-2013 |
Activity Feed
- Posted Re: How to parse windows data from wincollect (Qradar)? on All Apps and Add-ons. 09-22-2021 01:23 PM
- Posted Re: How to parse windows data from wincollect (Qradar)? on All Apps and Add-ons. 09-22-2021 01:10 PM
- Posted Re: issue with batch input that has stopped working on Getting Data In. 04-21-2021 03:17 PM
- Posted issue with batch input that has stopped working on Getting Data In. 04-20-2021 01:47 PM
- Tagged issue with batch input that has stopped working on Getting Data In. 04-20-2021 01:47 PM
- Karma Re: It is possible to "tag" all data coming into a particular HEC token? for MuS. 10-21-2020 10:30 AM
- Karma Re: Why is the Universal Forwarder also sending internal logs when only told to send certain data to different indexer via _TCP_ROUTING in inputs.conf? for dineshraj9. 09-24-2020 10:03 AM
- Posted Re: Hunk and MapR 6.x on All Apps and Add-ons. 09-09-2020 07:58 PM
- Posted Has anyone gotten Splunk Analytics for Hadoop to work with MapR 6.x? on Installation. 09-09-2020 07:56 PM
- Tagged Has anyone gotten Splunk Analytics for Hadoop to work with MapR 6.x? on Installation. 09-09-2020 07:56 PM
- Posted Re: Can we configure multiple Defense Center's in estreamer app? on All Apps and Add-ons. 07-07-2020 03:12 PM
- Karma Re: How to edit my search to track event counts by Index/Sourcetype to see when data is no longer being received? for mattymo. 06-05-2020 12:48 AM
- Got Karma for Splunk Search Head Cluster 6.5.3 issue - cluster members stop running scheduled searches. 06-05-2020 12:48 AM
- Karma Re: sorting by date timestamp not working as expected for gfuente. 06-05-2020 12:47 AM
- Karma How to configure Chrome as a search engine for Splunk queries? for oxnard. 06-05-2020 12:47 AM
- Got Karma for Re: Can Splunk handle indexing a CSV file containing more than 6000 fields/columns?. 06-05-2020 12:47 AM
- Got Karma for Re: sorting by date timestamp not working as expected. 06-05-2020 12:47 AM
- Got Karma for Re: sorting by date timestamp not working as expected. 06-05-2020 12:47 AM
- Got Karma for Re: Connection errors to heavy forwarders. 06-05-2020 12:46 AM
- Posted Re: Splunk Universal Forwarder missing events on Getting Data In. 02-01-2018 09:33 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-22-2021
01:23 PM
I was able to get the agent and figure it out. Just syslog on the backend. Thanks Ed
... View more
09-22-2021
01:10 PM
How did you get Windows logs from WinCollect into Splunk? Did you just point it to a TCP input? Thanks Ed
... View more
04-21-2021
03:17 PM
i turned the debug logs on but that just confirmed Splunk is ignoring the files even though the paths are present in list monitor. Just opened a case. Thanks
... View more
04-20-2021
01:47 PM
We have a long standing batch input that has stopped working. No matter how i change the input including pointing the input directly at a singe file, nothing changes. Any way to get more information? Right now I have no information about why the files are not being ingested anymore. Can I change a logging config to get more info? I have cleared the fishbucket with no changes. We are using the 7.3.3 UF. I do notice more latency when i ls the file. Could the shared file system be too slow? I am baffled so any ideas are more than welcome. Thanks!
... View more
Labels
- Labels:
-
inputs.conf
-
other
-
universal forwarder
09-09-2020
07:56 PM
Has anyone gotten Splunk Analytics for Hadoop to work with MapR 6.x? If so what are you using for the JobTracker node and what port? Any special config to get it working?
Thanks!
... View more
07-07-2020
03:12 PM
Doug are you saying we can now configure more than one FMC in the TA? We have 13 FMCs and I dont want to have to manage 13 HFs to support this use case. Would much prefer to load it all into one or two TAs. We have tried to use the Encore command line client, but it is not super stable and disconnects a lot. What you have configured in the TA is much more stable. Thanks!
... View more
02-01-2018
09:33 AM
How is it going? Any luck? We have confirmed with Splunk support certain version of the 6.5 and 6.6 UFs have issues with the tailing processor and will drop/miss events. We were able to upgrade all UFs to 6.6.3 to get past it.
... View more
11-01-2017
12:30 PM
This is a search time extraction so same issue as I mentioned above.
... View more
11-01-2017
12:21 PM
sure - still produces a ton overhead because it is search time. The events are between 500k and 1 million bytes each.
... View more
11-01-2017
12:06 PM
We have a use case where index time extractions for XML data makes a lot of sense yet I do not see an easy way go make it happen. I see that common fomats like csv and json as well supported but nothing for xml. Any ideas?
I see some creative work around but would prefer something more common.
The XML events are very very large so search time xmlkv is very slow. We have the indexer resources to support index time extraction.
Thanks!
... View more
07-31-2017
09:15 PM
I am getting this same message in my splunkd.log on the indexers. Any idea what it means? Thanks!
... View more
06-16-2017
08:17 AM
for anyone interested you can get this information by turning on access to syslog_transaction table in the SN add-on inputs section under inputs. Ne warned it is a lot of data and you can only pull 1000 events per collection interval so plan accordingly.
... View more
06-15-2017
07:27 AM
I have been asked to capture user login information from our SN instance and I am not sure how to get that data into Splunk. I have the SN add-on installed and I see lots of audit information once someone logs in, but I do not see login info such as username, success or failure and src ip. Can that info be pulled into Splunk? Any idea how?
Thanks!
... View more
05-29-2017
06:32 PM
I tried that and I also added executor_workers = 20 to server.conf but no change. I have an open case and hoping for a response soon. Thanks!
... View more
05-27-2017
03:47 PM
another common error message from the captain for each member that stops running scheduled searches
05-27-2017 15:02:32.502 -0500 ERROR SHCMasterArtifactHandler - failed on handle async replicate request sid=scheduler_adminxxxxRMD52a88c92ed83e8b0e_at_1495915200_11776_2E1C054F-9A8B-4D4A-BBC0-29F0562C7AED err='targetPeer="member", targetGuid="88275523-AE18-4CD9-AD67-7956E06449C1" cannot be valid target for artifactId=scheduleradmincaptain_RMD52a88c92ed83e8b0e_at_1495915200_11776_2E1C054F-9A8B-4D4A-BBC0-29F0562C7AED srcPeer="captain", srcGuid="A6A2F1D5-37C9-419C-A85E-A42376EDD483" reason="peer already has artifact"'
... View more
05-27-2017
11:07 AM
That is really interesting since I am running the UF on the same host as the search head but I also have the management port for the UF turned off
[httpServer]
disableDefaultPort = true
and it is talking to another server for its deployment information.
I am going to turn the UF off for a bit to see if it helps.
Thanks!
... View more
05-27-2017
10:38 AM
1 Karma
We have a 6.5.3 - 9 node search cluster where at any time 2 members will stop running scheduled searches which is causing scaling issue.
from the captain I see the following message for nodes that stop running scheduled searches
05-27-2017 12:16:08.110 -0500 WARN SHCMaster - did not schedule removal for peer='56B4C21B-0B26-4BA2-826C-148E069F5FD0', err='SHPMaster::scheduleRemoveArtifactFromPeer_locked: aid=scheduler_adminbatch_RMD5ebd970f44716db9c_at_1495904700_9854_2E1C054F-9A8B-4D4A-BBC0-29F0562C7AED peer="xxxxx", guid="56B4C21B-0B26-4BA2-826C-148E069F5FD0" is pending some change, status='PendingDiscard''
I restart these nodes but then they stop running schedules searches a couple of hours later.
I cannot find anything in the docs or in answers for this message. Do i need just need to rsync the baseline?
Thanks!
... View more
03-22-2017
09:11 PM
I just deployed the latest version of the VMware app into our 6.5.2 Sh cluster. Everything looks fine, but I do not see either the user or admin roles for the vmware app when I go to update roles per the instructions. I do see the configs in the TA for the roles called Splunk_TA_vmware which I deployed into the cluster using the cluster deployer. With no roles I am limited how I can use the app in the SH cluster till this gets resolved.
Any ideas?
Thanks!
... View more
03-06-2017
07:59 AM
This is awesome - Thanks!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-22-2021
01:35 PM
|
