Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jet1276
jet1276
Path Finder
Member since:
08-17-2016
09-23-2021
Community Statistics
| Posts | 28 |
| Solutions | 0 |
| Karma Given | 7 |
| Karma Received | 3 |
| Member Since | 08-17-2016 |
Activity Feed
- Posted Re: How to Splunk the SAP Security Audit Log on Getting Data In. 10-04-2020 10:22 PM
- Karma Re: How to parse and index thread dump in Splunk? for FrankVl. 06-05-2020 12:49 AM
- Got Karma for Splunk 7 shows Splunk version as 4. 06-05-2020 12:49 AM
- Got Karma for Splunk 7 shows Splunk version as 4. 06-05-2020 12:49 AM
- Got Karma for Re: Splunk 7 shows Splunk version as 4. 06-05-2020 12:49 AM
- Karma Re: Why am unable to uninstall Splunk universal forwarder? for nmohammed. 06-05-2020 12:48 AM
- Karma Re: How does Splunk define and assign urgency in Splunk Enterprise Security? for AnthonyTibaldi. 06-05-2020 12:48 AM
- Karma Does Splunk recommend 1200 IOPS or 1200 Random Seeks per second? for alexandercouto. 06-05-2020 12:47 AM
- Karma Re: How can I use the eval function mvzip with 8 attributes? for gcato. 06-05-2020 12:47 AM
- Karma Re: How to setup universal forwarder on linux for bhavya_shah. 06-05-2020 12:46 AM
- Karma Re: How to setup universal forwarder on linux for dhyanmohandas. 06-05-2020 12:46 AM
- Posted Re: Index is showing 0 data. on All Apps and Add-ons. 11-13-2019 10:28 AM
- Posted Re: props.conf on Splunk Enterprise. 08-13-2019 12:12 AM
- Posted Re: Notable Event Urgency issues on Splunk Enterprise Security. 02-14-2019 11:47 PM
- Posted Re: How can I use the eval function mvzip with 8 attributes? on Splunk Search. 11-19-2018 06:36 AM
- Posted Re: What is the recommended hardware requirement for Heavy Forwarder that is indexing? on Getting Data In. 09-17-2018 11:01 PM
- Posted Re: How to parse and index thread dump in Splunk? on Getting Data In. 05-30-2018 08:54 AM
- Posted Re: How to parse and index thread dump in Splunk? on Getting Data In. 05-30-2018 08:20 AM
- Posted Re: How to parse and index thread dump in Splunk? on Getting Data In. 05-30-2018 07:41 AM
- Posted How to parse and index thread dump in Splunk? on Getting Data In. 05-30-2018 05:21 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 |
10-04-2020
10:22 PM
Hey @afx @becksyboy, Do we have any solution for the same? I am also getting similar issue in my SAP environment.
... View more
11-13-2019
10:28 AM
Hi @rajuljain2605
The Path you have mentioned for $SPLUNK_DB seems different. You should check that.
And also I'll suggest to mention full path in defining index instead of mentioning $SPLUNK_DB.
... View more
08-13-2019
12:12 AM
If set to true, it will not check whether the file is binary OR not. It will just process it.
However if set to false it will check whether the file is binary or not. And if it's binary, Not to process the same.
It's like, (-)(-) = (+).
Hope you understand.
... View more
02-14-2019
11:47 PM
Due to same names in the ES App and your correlation search the severity values will be overwritten.
Check if you have any other field as "severity" in the correlation search output. If so then just rename the field to something else. Your problem should be resolved after.
... View more
11-19-2018
06:36 AM
This works like a charm. Thanks.
... View more
09-17-2018
11:01 PM
I have seen Heavy Forwarder with 12 Core CPU and 12 GB RAM handling 500 GB/day logs.
But everything depends on how you configure the Splunk Deployment and Server configurations.
... View more
05-30-2018
08:54 AM
Yup That works Perfectly Fine. I tried removing \s from the GUI but at that time it was not working. But when I changed it in props.conf file and restarted the splunk it started breaking the events perfectly.
Thanks so much @FrankVI.
... View more
05-30-2018
08:20 AM
PFB link to the screenshot from Splunk. These are the raw events after line breaking.
https://answers.splunk.com/storage/temp/251822-2018-05-30-20-40-30-root.png
... View more
05-30-2018
07:41 AM
Hi @FrankVl,
Thanks so much for your quick response. I really appreciate it.
I tried your method and logically that's exactly what I want.
But the props.conf is not working. It is breaking the lines unevenly. Here I suspect that I need to tweak the regex.
Do you have any alternate regex OR any platform where I can test and build regex's for line breaking?
... View more
05-30-2018
05:21 AM
I have custom Thread Dump data and I want to index them in Splunk. So far I have applied almost all methods to index and parse them but I'm not able to get meaningful information from them.
Below is the sample from it.
Total threads: 434 on 2018-04-29T17-00-03+0800
Name CPU Time (ms) User Time (ms) Id State
IPC Parameter Sending Thread #868 0 0 17782 TIMED_WAITING
waiting on java.util.concurrent.SynchronousQueue$TransferStack@4d974d1c at sun.misc.Unsafe.park(Native Method)
at java.util.concurrent.locks.LockSupport.parkNanos(LockSupport.java:215)
at java.util.concurrent.SynchronousQueue$TransferStack.awaitFulfill(SynchronousQueue.java:460)
at java.util.concurrent.SynchronousQueue$TransferStack.transfer(SynchronousQueue.java:362)
at java.util.concurrent.SynchronousQueue.poll(SynchronousQueue.java:941)
at java.util.concurrent.ThreadPoolExecutor.getTask(ThreadPoolExecutor.java:1066)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1127)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
IPC Client (2006835220) connection to abcd.com/10.21.216.71:8020 from hdfs 0 0 17781 TIMED_WAITING
waiting on org.apache.hadoop.ipc.Client$Connection@5be22c7a at java.lang.Object.wait(Native Method)
at org.apache.hadoop.ipc.Client$Connection.waitForWork(Client.java:931)
at org.apache.hadoop.ipc.Client$Connection.run(Client.java:976)
1306724746@qtp-695248316-10273 29 10 17780 TIMED_WAITING
waiting on org.mortbay.thread.QueuedThreadPool$PoolThread@4de3098a at java.lang.Object.wait(Native Method)
at org.mortbay.thread.QueuedThreadPool$PoolThread.run(QueuedThreadPool.java:626)
2125946201@qtp-695248316-10271 40 20 17776 TIMED_WAITING
waiting on org.mortbay.thread.QueuedThreadPool$PoolThread@7eb75d59 at java.lang.Object.wait(Native Method)
at org.mortbay.thread.QueuedThreadPool$PoolThread.run(QueuedThreadPool.java:626)
1805988475@qtp-695248316-10269 133 70 17772 TIMED_WAITING
waiting on org.mortbay.thread.QueuedThreadPool$PoolThread@6ba5327b at java.lang.Object.wait(Native Method)
at org.mortbay.thread.QueuedThreadPool$PoolThread.run(QueuedThreadPool.java:626)
402769840@qtp-695248316-10266 161 90 17766 TIMED_WAITING
waiting on org.mortbay.thread.QueuedThreadPool$PoolThread@1801c7b0 at java.lang.Object.wait(Native Method)
at org.mortbay.thread.QueuedThreadPool$PoolThread.run(QueuedThreadPool.java:626)
FastExecutor-3-60 1 0 17747 WAITING
waiting on java.util.concurrent.locks.AbstractQueuedSynchronizer$ConditionObject@476f266c at sun.misc.Unsafe.park(Native Method)
at java.util.concurrent.locks.LockSupport.park(LockSupport.java:175)
at java.util.concurrent.locks.AbstractQueuedSynchronizer$ConditionObject.await(AbstractQueuedSynchronizer.java:2039)
at java.util.concurrent.LinkedBlockingQueue.take(LinkedBlockingQueue.java:442)
at java.util.concurrent.ThreadPoolExecutor.getTask(ThreadPoolExecutor.java:1067)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1127)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at com.xyz.shadow.io.netty.util.concurrent.DefaultThreadFactory$DefaultRunnableDecorator.run(DefaultThreadFactory.java:145)
at java.lang.Thread.run(Thread.java:745)
How can I get them in a Single Event?
Till now most helpful was the "tsv" structured parsing, as It was able to get Name, CPU Time, ID, State but what i'm not getting is the Stack Trace. it is going in next line and in "CPU Time" field. Is there any way I can get them all in single event?
If it is not being parsed also that is fine. But it should come in Single Event.
... View more
03-18-2018
12:02 AM
@p_gurav
It's running on Single instance. And I even tried installing in different versions of splunk. But everywhere I'm getting the same result.
... View more
03-15-2018
01:23 AM
Hi @deepashri_123,
I have gone through all the details and pre-requisites and all the properties are met.
I have all the details from API, key and Clinet ID. But the only thing is after installing the App I am not getting the Input tab.
... View more
03-15-2018
12:05 AM
Cisco AMP for Endpoints Events Input is stuck at "Please Wait" for all the tabs, Input, New Input and Configuration.
I can not perform any configuration or Input.
... View more
02-27-2018
05:05 AM
Hi @schose,
I tried "frozenTimePeriodInSecs = x secs" parameter. but Instead of deleting the data from disk, it deleted the tsidx files and moved the raw data files to frozen directory.
Any idea on how can I permanently remove that data from disk?
... View more
02-21-2018
10:07 PM
Hi @alexandercouto,
Were you able to figure out resolution for the same??
Because in iostats "tps" we are observing result upto "1400" while executing bonnie++, but when I see the output of bonnie, it shows only 246 Random Seeks/Sec.
Checking Random seek was also recommended by Splunk Support.
... View more
02-01-2018
10:18 PM
No I am not overriding the data anywhere. And the installation of Universal Forwarder was also through GUI. So not overriding through any configuration files.
Also the data I am fetching are simple Windows Log Events which doesn't have other host keyword which can override the data.
... View more
02-01-2018
09:56 PM
Hi,
I am aware with the host change methods. And I am not looking for solution to the problem.
What i would like to know is that the reason behind the problem. Because the logs are being forwarded from only 1 server that is also via Universal Forwarder. Then why am I getting two different host values.
... View more
01-31-2018
09:45 PM
I am getting two separate values in host field for the same host!
Both the values are:
Hostname and hostname.
I am not sure why it is coming because I am getting logs from only one host via Splunk Universal Forwarder but still in splunk I am getting two different values for them.
... View more
10-26-2017
03:45 AM
Thanks so much @cusello for your help.
... View more
10-26-2017
03:22 AM
Hi @cusello,
I have 48 CPU server and its utilization max goes to 60%. And I have changed settings of "max_searches_per_cpu" in limits.conf to 2. So at least 96 realtime searches can run at a time.
So thats why I think I have enough resources.
And I do not have DMC at the moment but I will integrate it in some time and check the utilization again.
Please let me know if I need to do anything else.
Thanks.
... View more
10-26-2017
02:58 AM
Hi @cusello,
I am having system with large resources and there are sufficient resources available for the new queries to run.
Also I confirmed that by opening dashboards and putting Indexer in Down state while monitoring CPU and Memory resources.
CPU utilization was below 50% and Memory still 2 to 3 GB was available during that period.
... View more
10-26-2017
02:31 AM
Hi,
I have one indexer and 3 search heads in cluster mode. And I have developed too many dashboards with graphic representation.
Now when ever i open 2 or more dashboards from my search head, which will be having total 30 or 40 searches, my Indexer is gong down for some time and again its coming back up.
Is there any connection restriction from Search Head to Indexer? Or Could this be some other issue?
... View more
10-04-2017
01:58 AM
1 Karma
Can you provide any link for the same where splunk has provided any information regarding the same??
... View more
10-03-2017
11:40 PM
2 Karma
Hi,
Sometimes when I open my Splunk 7 web interface, it shows splunk version as 4. All the functionalities and features are of Splunk 7 only but only visually the vesion seems as Splunk 4.
Is it a known or unknown bug ?? What can I do to resolve the issue?
... View more
09-13-2017
03:56 AM
Even if I use two search heads instead of three, still I should be able to use them as my search head cluster right?? Only thing is I won't able to get node failure benefit.
Even though it being part of the architecture, can it be bypassed or not??
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-23-2021
12:36 AM
|
Karma given to
