Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About nplamondon
nplamondon
Communicator
Member since:
08-23-2016
10-02-2024
Community Statistics
| Posts | 46 |
| Solutions | 4 |
| Karma Given | 88 |
| Karma Received | 20 |
| Member Since | 2016-08-23 |
Activity Feed
- Karma Re: How to extract key value pairs out of a multivalue field? for javiergn. 10-02-2024 03:13 PM
- Karma Why are source/host/sourcetype fields dropping through HEC? for Mels. 05-16-2023 11:22 AM
- Got Karma for Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?. 10-20-2021 06:23 AM
- Karma Re: Radial gauge and max value for niketn. 09-14-2021 12:37 PM
- Got Karma for Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?. 07-19-2021 09:48 AM
- Karma Re: Transpose and Timechart giving unnecessary fields for cmerriman. 07-14-2021 01:37 PM
- Karma Re: Transpose and Timechart giving unnecessary fields for woodcock. 07-14-2021 01:37 PM
- Karma Re: License usage dashboard results vary when using split for dflodstrom. 05-28-2021 03:24 PM
- Got Karma for Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?. 04-07-2021 08:45 AM
- Karma Splunk Connect for Syslog: How do I source? for millarma. 02-17-2021 02:19 PM
- Karma Re: Why does splunk add junk to the front of a search when a field search is defined before the first pipe? for dwaddle. 11-13-2020 10:33 AM
- Got Karma for Re: How did forwarder use management port?. 08-24-2020 02:14 PM
- Karma Re: How to hide panels with no results from a dashboard? for proylea. 07-06-2020 12:38 PM
- Karma Re: Why do set/unset change conditions for a checkbox input not work on Splunk 6.4.x? for andrewtrobec. 07-02-2020 12:39 PM
- Got Karma for Post formatting consumes characters. 06-22-2020 07:37 AM
- Got Karma for Post formatting consumes characters. 06-22-2020 02:57 AM
- Karma Re: How do you display multiple column headers on a table? for jkat54. 06-19-2020 07:31 AM
- Posted Post formatting consumes characters on Feedback. 06-18-2020 08:40 AM
- Karma How do I set up to subscribe to a specific person's answers? for to4kawa. 06-10-2020 02:01 PM
- Karma Re: Best practices - Syslog-ng to splunk for Richfez. 06-05-2020 12:51 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 2 | |||
| 0 | |||
| 0 |
06-18-2020
08:40 AM
2 Karma
Posts appear to now be interpreted as markdown, so there are lots of instances of broken answers since not everyone properly uses code tags. For example, if I had posted an unformatted props.conf on the old site, it now looks like: [sample]
INDEXEDEXTRACTIONS = csv
SHOULDLINEMERGE = False
TIMEFORMAT = %Y%m%d
TIMEPREFIX = ^
MAXTIMESTAMP_LOOKAHEAD = 8
MAXDAYS_AGO=10000s
Real example of SPL being mangled: https://community.splunk.com/t5/All-Apps-and-Add-ons/SAI-Windows-entity-does-not-show-up/m-p/480674/highlight/true#M59093
... View more
05-21-2020
02:56 PM
This is likely not an option for most people, as it would probably require firewall rules that no sane fw admin would create.
The existing answers are a much better solution.
... View more
04-13-2020
10:40 AM
1 Karma
@niketnilay is off by 10x, but otherwise correct.
If the base search is a non-transforming search, the Splunk platform retains only the first 500,000 events that it returns.
... View more
02-13-2020
11:19 AM
With some tweaks, I believe this will do exactly what I want. Nicely done!
Namely, I want to have checkpointing done per log, not file, so I'll use the timestamp rather than filename. I will also need to tweak it to accept filenames and clean up checkpoints for non-existent filenames.
This is a great start, and I'm happy to give you credit in this project. Thanks!
... View more
02-12-2020
04:03 PM
I have a log source with a terrible timestamping scheme. The first line contains the startup date/time, and each event in the log is marked with a seconds.millis offset from that time (left space-padded).
I know how I would go about this if I wanted to ingest the whole file in one go after it's closed (use python to make a copy with calculated times replacing the offset), but I'm interested in ingesting as the log's written. I have no idea where to start for that.
Does anyone have a ready solution for something like this? If not, I'd appreciate some guidance toward a useful direction to research.
0.012 2020-02-05 17:35:53; Factorio 0.18.3 (build 49258, win64, alpha)
0.013 Operating system: Windows 10 (build 18363)
0.013 Program arguments: "E:\GOG\Factorio\bin\x64\factorio.exe" "--force-opengl"
0.013 Read data path: E:/GOG/Factorio/data
0.013 Write data path: C:/Users/Nate/AppData/Roaming/Factorio [626596/1907076MB]
0.013 Binaries path: E:/GOG/Factorio/bin
0.032 System info: [CPU: AMD Ryzen 7 2700X Eight-Core Processor, 16 cores, RAM: 6553/16310 MB, page: 9579/24406 MB, virtual: 4251/134217727 MB, extended virtual: 0 MB]
0.032 Display options: [FullScreen: 1] [VSync: 1] [UIScale: custom (150.0%)] [Native DPI: 1] [Screen: 255] [Special: lmw] [Lang: en]
0.036 Available displays: 1
0.036 [0]: \\.\DISPLAY1 - NVIDIA GeForce GTX 1070 {0x05, [0,0], 2560x1440, 32bit, 59Hz}
0.684 Initialised OpenGL:[0] GeForce GTX 1070/PCIe/SSE2; driver: 3.3.0 NVIDIA 432.00
0.684 [Extensions] s3tc:yes; KHR_debug:yes; ARB_clear_texture:yes, ARB_copy_image:yes
0.684 [Version] 3.3
0.684 Verbose GraphicsInterfaceOpenGL.cpp:896: [Caps] Tex:32768, TexArr:2048, TexBufSz:131072kB; TexUnits:192; UboSz:64kB
0.684 Graphics settings preset: very-high
0.684 Dedicated video memory size 8192 MB
1.095 Verbose PipelineStateObject.cpp:85: Time to load shaders: 0.411126 seconds.
1.149 Desktop composition is active.
1.150 Graphics options: [Graphics quality: high] [Video memory usage: all] [Light scale: 100%] [DXT: high-quality] [Color: 32bit]
1.150 [Max threads (load/render): 32/16] [Max texture size: 0] [Tex.Stream.: 0] [Rotation quality: normal] [Other: STDC] [B:0,C:0,S:100]
... View more
- Tags:
- splunk-enterprise
11-11-2019
05:11 PM
Maybe I don't understand your questions....
Indexers receive on 9997 by default.
All Splunk management is over 8089 by default. That can be changed, but you have to pay attention when doing so, as you can easily misconfigure and break things.
... View more
11-06-2019
05:16 PM
I don't have experience with this TA, but it sounds like you're getting incomplete data. i'd first check the source to confirm those drops are being logged where Splunk can see them, then verify your inputs are set to collect that source properly.
That said, I notice the app is only known to work (according to splunkbase) up to Splunk 6.6, so I'd be concerned about its ability to function on 7+. If this app is something you have a need for, I'd recommend contacting the author to see if they have plans to update it.
... View more
11-06-2019
05:02 PM
1 Karma
I'll assume here that you're referring to the universal forwarder (UF) installed on your endpoint systems, rather than heavy forwarders (HF), which really shouldn't be running anything but Splunk.
You've answered half of your question already: 9997 is the default port for forwarding traffic. This is the destination port on your indexers (or an intermediate forwarder), so it doesn't need to be open on your UFs.
8089 is the management port. Your Splunk servers use this internally to communicate. Your forwarders (UF and possibly HF) will reach out to your deployment server on this port to report status and ask for apps. Again, this is a destination port on your deployment server, and does not need to be open on your UFs.
While these ports are configurable (use caution; there be dragons), it sounds to me like you don't need to change anything. Splunk on the hosts running UFs aren't listening for anything from the rest of your Splunk environment, and so don't need any incoming ports configured.
When in doubt regarding ports, I refer to @rob_jordan's excellent diagram in response to https://answers.splunk.com/answers/118859/diagram-of-splunk-common-network-ports.html
... View more
11-04-2019
04:27 PM
1 Karma
We're going to need more information to work with. For starters, what app are you working in? What have you tried? What isn't working? Screenshots are often helpful, too.
... View more
11-04-2019
04:22 PM
1 Karma
@woodcock answered a very similar question a while back. Check out https://answers.splunk.com/answers/566928/how-to-find-missing-values-from-a-search-events-co-1.html
... View more
11-04-2019
03:33 PM
I was able to work with one of my Tableau users today, and found something interesting. Tables aren't showing up for him, either, but he's able to use the browse function (top-right of the page) to find them. See anything using that route?
Sidenote: We have a convention of prepending these report names with "Exportable Data - " to differentiate reports intended for Tableau use from those that may not work in Tableau.
... View more
10-31-2019
01:05 PM
And you're not getting any connection errors? It's been a while, but I recall the ODBC driver choking on Splunk messages (not errors, not relevant, but apparently show-stopping). Do you see your Tableau activity in _internal?
... View more
10-31-2019
12:23 PM
It looks like your post got truncated; I don't see the complete event or your results.
... View more
10-31-2019
12:20 PM
Two things to start:
Make sure your user has access to the saved searches
Tableau only understands table-formatted search results, not visualizations.
... View more
10-31-2019
12:05 PM
Your load balancer should only send each event to one host, so duplication shouldn't be an issue.
One thing to be mindful of is how your LB treats UDP traffic. I found that my F5s were fixating on one server unless I set the stream timeout to 0.
... View more
10-31-2019
12:00 PM
If the problem is that you're seeing the graph go to zero between readings on a line chart, under Format, you'll find a setting for Null Values. Set that to "Connect" and you should see those gaps go away.
If I've misunderstood your issue, please expand your explanation. Screenshots for this sort of thing are helpful, too.
... View more
10-31-2019
11:40 AM
1 Karma
You could try where with timestamp boundaries. For example, this excludes 10/31/2019 09:00 - 10:00:
... | where _time<1572537600 OR _time>1572541200
... View more
07-25-2019
10:18 AM
What have you tried? Where are you getting stuck?
... View more
04-05-2019
11:53 AM
1 Karma
Per the app devs, the Splunk ODBC driver is not compatible with Splunk 7.x.
I'm also trying to figure out how to get the two talking to each other again.
... View more
03-01-2019
12:22 PM
Excellent solution, and added to my serverclass!
... View more
01-30-2019
08:34 AM
3 Karma
I downvoted this post because this isn't a realistic answer and should very clearly state that all data in that index will be destroyed.
... View more
12-14-2018
01:45 PM
Sample data and desired results would help here.
... View more
