About nickhaj

nickhaj · ‎08-06-2020

Hi - we upgraded the Forwarder to Version 7.3.6 (For W2012 svr) from 7.3.0 in the the hope this would cure the problem with the Forwarder restarts per the release notes below, but the issue outlined previously has occurred again. Can you just confirm this is definitely a problem at the UF end rather than at the Indexer end given the nature of the error ? Many Thanks! 2020-05-07 SPL-188620, SPL-184263 UFs stop forwarding after some time and need constant restarting

nickhaj · ‎06-12-2020

Can anyone advise on this issue please ???

nickhaj · ‎06-01-2020

Hi - having issues with a Windows UF we are having to restart circa weekly to clear the issue below which happens at random times (the parsingQueue error being the first in the chain); the TcpOutProc errors continue until the UF is restarted. The amount of data being sent [hourly, on the hour] is very small. Is this issue with the Forwarder or with the remote Splunk indexer, the forwarder seems to work OK at all other times ? NB : 'Phone Home' msgs removed. I can't see this exact scenario in other related Splunk Qs. MANY THANKS!! "05-14-2020 14:45:37.371 +0100 WARN TcpOutputProc - The TCP output processor has paused the data flow. Forwarding to output group default-autolb-group has been blocked for 300 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data "05-14-2020 14:43:57.048 +0100 WARN TcpOutputProc - The TCP output processor has paused the data flow. Forwarding to output group default-autolb-group has been blocked for 200 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data"05-14-2020 14:43:40.009 "05-14-2020 14:43:22.638 +0100 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...","2020-05-14T14:43:22.638+0100",PRDU0000001,"_internal",1,"C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log",splunkd

nickhaj · ‎05-28-2020

Hi - ignoring the Answer below can anyone help please ? THANKS !!

nickhaj · ‎05-27-2020

Hi all - anyone got any ideas please - MANY THANKS!

nickhaj · ‎05-26-2020

Are you in the right forum ?? That wasnt the kind of answer I was expecting !!

nickhaj · ‎05-25-2020

Hi - having issues with a Windows UF we are having to restart circa weekly to clear the issue below which happens at random times (the parsingQueue error being the first in the chain); the TcpOutProc errors continue until the UF is restarted. The amount of data being sent [hourly, on the hour] is very small. Is this issue with the Forwarder or with the remote Splunk indexer, the forwarder seems to work OK at all other times ? NB : 'Phone Home' msgs removed. I can't see this exact scenario in other related Splunk Qs. MANY THANKS!! "05-14-2020 14:45:37.371 +0100 WARN TcpOutputProc - The TCP output processor has paused the data flow. Forwarding to output group default-autolb-group has been blocked for 300 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data "05-14-2020 14:43:57.048 +0100 WARN TcpOutputProc - The TCP output processor has paused the data flow. Forwarding to output group default-autolb-group has been blocked for 200 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data"05-14-2020 14:43:40.009 "05-14-2020 14:43:22.638 +0100 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...","2020-05-14T14:43:22.638+0100",PRDU0000001,"_internal",1,"C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log",splunkd

nickhaj · ‎12-06-2019

Yep, thats exactly whats occurring Guiseppe ! We will get the correct Timestamp format added to the non-standard data. Many Thanks! Nick

nickhaj · ‎12-06-2019

Hi Giuseppe - many thanks for the prompt response! All the events are in one (type of) log which I am ingesting (both the OK events and the 'non-standard' ones). I can probably get the non-standard log output brought into line(ish) with the standard, was just wondering if there was a way round it via splunk config, but reading your response it looks like I ideally need to add the timestamp....if thats my correct interpretation please confirm and I will accept your response as the answer. Many Thanks again! Nick

nickhaj · ‎12-06-2019

HI, I'm relatively new to Splunk and need a bit of guidance around whitelisting specific data via a Unix inputs.conf. The log being monitored contains some non-standard entries to confirm a NFS f/system is not 'stale' - these events are getting taken across to Splunk but NOT in a timely fashion as the sourcetype isnt recognising them, so they are not being sent until any standard input is written to the log/ingested - this can result in delays in getting these events into Splunk and consequent time mismatches. These events only occur on one server hence thinking it is much better to control the input via that box rather than changing the sourcetype. So, inputs.conf currently looks like this; [monitor:///path-to-log] disabled = 0 index = index sourcetype = sourcetype blacklist = list of logs to ignore The non-standard data looks like this : (and a line of stars) PULSE CHECK - Fri Dec 6 07:30:00 GMT 2019 (and a line of stars) Can someone advise the appropriate whitelist entry and where to place it in inputs.conf please ?

nickhaj · ‎07-04-2019

I did some tests adding one of the NOT statements at a time and the amount of events returned reduced accordingly each time, so i'm 99.99% sure the revisions suggested are doing the job.....but will monitor over the next week to be 100% certain 🙂

nickhaj · ‎07-04-2019

HI - that seems to have done the trick !!! MANY Thanks for your input !

nickhaj · ‎07-04-2019

I want to exclude events within my search which have a field (Message) which may contain certain values; so my Search is currently : index=a OR index=b SourceName=a OR sourcetype =a ERROR OR FAIL OR FAILED OR FAILURE | where NOT (Action="Fail.") AND NOT (Message=getservbyname) AND NOT (Message=UDP) The above doesnt work obviously, but the first bit (Action="Fail.") exclusion works OK on its own; so I'm looking for the syntax which will make the Message field includes values 'getservbyname' OR 'UDP' exclusions work too. The "Message" field is a long text field hence trying to filter these out using Key Values getservbyname and UDP. Many Thanks for any assistance!

nickhaj · ‎06-07-2019

Hi Rich - got there I think .... After finding the target records I add your suggested search and then | table Target_File to the end of it.... This returns 'no results found' into the Dashboard Panel if, as expected, no duplicates are detected.......and the Target_file value should a duplicate be detected. So your suggestion was spot on, I just needed to suss the end bit. Many Thanks for your guidance!

nickhaj · ‎06-07-2019

Hi, I want to know how many duplicates of a filename (in field Target_file) have been detected for events indexed daily (for 2 incoming files, 1 outgoing - the field Target_file is common to all 3 file transfers); I am expecting the result to be zero 99.99% of the time as the filenames should always be unique; the result then being displayed on a dashboard panel where it will go red if the count is greater than zero. I've tried faffing with dedup but that seems to count the unique occurences (3 per day) rather than duplicates detected so does not give my anticipated result (0) I've looked thru loads of the suggestions but can't seem to find this exact scenario, but I am a Splunk Beginner so BIG apols if I have missed it somehwere 🙂 Many Thanks for any assistance!

Posts	15
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎05-08-2019

Online Status	Offline
Date Last Visited	‎08-06-2020 03:29 AM

Restarting Splunk UF due to TcpOutputProc issues

UF restarts due to TcpOutputProc issue

whitelisting data from a unix log

Splunk - excluding fields which contain certain va...

How to count the number of duplicates detected?

Re: Restarting Splunk UF due to TcpOutputProc issu...

Re: Restarting Splunk UF due to TcpOutputProc issu...

Restarting Splunk UF due to TcpOutputProc issues

Re: UF restarts due to TcpOutputProc issue

Re: UF restarts due to TcpOutputProc issue

Re: UF restarts due to TcpOutputProc issue

UF restarts due to TcpOutputProc issue

Re: whitelisting data from a unix log

Re: whitelisting data from a unix log

whitelisting data from a unix log

Re: Splunk - excluding fields which contain certai...

Re: Splunk - excluding fields which contain certai...

Splunk - excluding fields which contain certain va...

Re: How to count the number of duplicates detected...

How to count the number of duplicates detected?