Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About craigwilkinson
craigwilkinson
Path Finder
Member since:
08-21-2016
06-10-2021
Community Statistics
| Posts | 23 |
| Solutions | 0 |
| Karma Given | 10 |
| Karma Received | 3 |
| Member Since | 08-21-2016 |
Activity Feed
- Posted Re: useack in distributed environment 2 sets of heavy forwaders on Splunk Enterprise. 06-10-2021 04:44 PM
- Posted useack in distributed environment 2 sets of heavy forwaders on Splunk Enterprise. 06-10-2021 02:18 AM
- Karma Re: Aliasing and Graphing events at search for HiroshiSatoh. 06-05-2020 12:48 AM
- Karma Re: Aliasing and Graphing events at search for jplumsdaine22. 06-05-2020 12:48 AM
- Karma Re: How to set a single value result to show the Total and have a sparkline showing the trending average underneath? for jluo_splunk. 06-05-2020 12:48 AM
- Karma Re: How to troubleshoot why hot buckets are not rolling after exceeding maxHotSpanSecs? for esix_splunk. 06-05-2020 12:48 AM
- Karma FEATURE REQUEST: Splunk Alert: All Clear Notification for bandit. 06-05-2020 12:48 AM
- Karma Re: FEATURE REQUEST: Splunk Alert: All Clear Notification for mattymo. 06-05-2020 12:48 AM
- Karma Re: Splunk XML Parsing for woodcock. 06-05-2020 12:48 AM
- Karma Re: Splunk XML Parsing for beatus. 06-05-2020 12:48 AM
- Karma Re: Splunk Alerts & Dashboard Panels for martin_mueller. 06-05-2020 12:48 AM
- Got Karma for Monitor Queue Size Without access to Search Head or Apps. 06-05-2020 12:48 AM
- Got Karma for Re: How to troubleshoot why hot buckets are not rolling after exceeding maxHotSpanSecs?. 06-05-2020 12:48 AM
- Got Karma for Single Value Sparklines. 06-05-2020 12:48 AM
- Karma Re: How to create a search to show a trending single value for the last 60 minutes of data with a trending arrow comparing the previous 60 minutes? for hylam. 06-05-2020 12:47 AM
- Posted Splunk Add-on For Tenable No JSON object could be decoded on All Apps and Add-ons. 06-05-2018 05:55 PM
- Tagged Splunk Add-on For Tenable No JSON object could be decoded on All Apps and Add-ons. 06-05-2018 05:55 PM
- Posted Re: Splunk Add-on For Tenable connection reset by peer on All Apps and Add-ons. 05-24-2018 04:55 PM
- Posted Splunk Add-on For Tenable connection reset by peer on All Apps and Add-ons. 05-23-2018 11:44 PM
- Tagged Splunk Add-on For Tenable connection reset by peer on All Apps and Add-ons. 05-23-2018 11:44 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
06-10-2021
04:44 PM
Hi could you please explain by "its exactly that way" If 2 sets of our heavy forwarders have useACK... but 1 of of the set of Heavy Forwarders doesnt have useACK before indexing.. what happens? Will the first 2 set of Heavy forwarders continue to hold the data until an ACK is recieved? Which I assume it enver will, because HFWC doesnt have this enabled?
... View more
06-10-2021
02:18 AM
Hi Splunk Support! We currently have a large Distributed Envirionment where we have 3 sets of Heavy forwarders which have 2 nodes, before hitting an indexer. Set HFWA --> Has 2 Heavy forwarders Set HFWB --> has 2 heavy forwarders Set HFWC --> has 2 heavy forwarders The data flow goes HFWA ---> HFWB ---> HFWC ---> Indexer. HFWA outputs.conf has useACK=true. HFWB & HFWC have useACK=false. So The data flow goes HFWA (useACK=true) ---> HFWB (useACK=false) ---> HFWC(useACK=false) ---> Indexer. What is the expected output? Will HFWB Give an acknowledgement back to HFWA? Is this an issue in our environment? Thanks! -Craig
... View more
Labels
- Labels:
-
configuration
-
troubleshooting
06-05-2018
05:55 PM
Hi All,
Am having issues with the Splunk Add-on for Tenable - receiving the error connection closed - hoping you guys can help!
Splunk Version: 6.55
Tenable version: 5.12
Tenable SecurityCenter 5.6.0.1 (build: 201711093168)
2018-06-06 00:52:38,013 +0000 log_level=INFO, pid=319, tid=Thread-2, file=scheduler.py, func_name=get_ready_jobs, code_line_no=100 | Get 1 ready jobs, next duration is 119.998971, and there are 1 jobs scheduling
2018-06-06 00:52:38,014 +0000 log_level=INFO, pid=319, tid=Thread-5, file=ta_data_collector.py, func_name=index_data, code_line_no=112 | [stanza_name="TNS_VM_SC_INPUT" data="sc_vulnerability" server="TNS_VM_SC"] Start indexing data for checkpoint_key=TNS_VM_SC_INPUT___sc_vulnerability___TNS_VM_SC
2018-06-06 00:52:38,018 +0000 log_level=ERROR, pid=319, tid=Thread-5, file=ta_data_collector.py, func_name=index_data, code_line_no=118 | [stanza_name="TNS_VM_SC_INPUT" data="sc_vulnerability" server="TNS_VM_SC"] Failed to index data
Traceback (most recent call last):
File "/apps/pcehr/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_data_collector.py", line 115, in index_data
self._do_safe_index()
File "/apps/pcehr/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_data_collector.py", line 148, in _do_safe_index
self._client = self._create_data_client()
File "/apps/pcehr/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_data_collector.py", line 89, in _create_data_client
ckpt = self._get_ckpt()
File "/apps/pcehr/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_data_collector.py", line 80, in _get_ckpt
return self._checkpoint_manager.get_ckpt()
File "/apps/pcehr/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_checkpoint_manager.py", line 31, in get_ckpt
return self._store.get_state(key)
File "/apps/pcehr/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktalib/state_store.py", line 141, in get_state
state = json.load(jsonfile)
File "/apps/pcehr/splunk/lib/python2.7/json/__init__.py", line 291, in load
**kw)
File "/apps/pcehr/splunk/lib/python2.7/json/__init__.py", line 339, in loads
return _default_decoder.decode(s)
File "/apps/pcehr/splunk/lib/python2.7/json/decoder.py", line 364, in decode
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
File "/apps/pcehr/splunk/lib/python2.7/json/decoder.py", line 382, in raw_decode
raise ValueError("No JSON object could be decoded")
ValueError: No JSON object could be decoded
2018-06-06 00:52:38,024 +0000 log_level=INFO, pid=319, tid=Thread-5, file=ta_data_collector.py, func_name=index_data, code_line_no=120 | [stanza_name="TNS_VM_SC_INPUT" data="sc_vulnerability" server="TNS_VM_SC"] End of indexing data for checkpoint_key=TNS_VM_SC_INPUT___sc_vulnerability___TNS_VM_SC
2018-06-06 00:52:38,025 +0000 log_level=INFO, pid=319, tid=Thread-5, file=thread_pool.py, func_name=_run, code_line_no=261 | Thread work_queue_size=0
Could someone please assist? Having been trying to troubleshoot this for a while now 😞
Regards,
Craig
... View more
05-24-2018
04:55 PM
Thanks for the reply xpac.
From the SecurityCenter POV - can see from the logs that the user/TA app is logging in successfully, but there is a delay from the Splunk TA error message, and successful login.
The service is running too 😕
... View more
05-23-2018
11:44 PM
Hi All,
Am having issues with the Splunk Add-on for Tenable - receiving the error connection closed - hoping you guys can help!
Splunk Version: 6.55
Tenable version: 5.12
Error
2018-05-24 06:09:25,812 +0000 log_level=ERROR, pid=19741, tid=Thread-4, file=ta_data_collector.py, func_name=index_data, code_line_no=118 | [stanza_name="TSC_INPUT" data="sc_vulnerability" server="TNS_VM_SC"] Failed to index data
Traceback (most recent call last):
File "/apps/pcehr/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_data_collector.py", line 115, in index_data
self._do_safe_index()
File "/apps/pcehr/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_data_collector.py", line 148, in _do_safe_index
self._client = self._create_data_client()
File "/apps/pcehr/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_data_collector.py", line 95, in _create_data_client
self._checkpoint_manager)
File "/apps/pcehr/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_data_client.py", line 55, in __init__
self._ckpt)
File "/apps/pcehr/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/ta_tenable_sc_data_collector.py", line 18, in do_job_one_time
return _do_job_one_time(all_conf_contents, task_config, ckpt)
File "/apps/pcehr/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/ta_tenable_sc_data_collector.py", line 53, in _do_job_one_time
logger_prefix=logger_prefix)
File "/apps/pcehr/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/security_center.py", line 219, in get_security_center
sc.login(username, password)
File "/apps/pcehr/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/security_center.py", line 45, in login
result = self.perform_request('POST', 'token', data)
File "/apps/pcehr/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/security_center.py", line 133, in perform_request
self._uri(path), method, data, headers)
File "/apps/pcehr/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/httplib2/__init__.py", line 1609, in request
(response, content) = self._request(conn, authority, uri, request_uri, method, body, headers, redirections, cachekey)
File "/apps/pcehr/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/httplib2/__init__.py", line 1351, in _request
(response, content) = self._conn_request(conn, request_uri, method, body, headers)
File "/apps/pcehr/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/httplib2/__init__.py", line 1272, in _conn_request
conn.connect()
File "/apps/pcehr/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/httplib2/__init__.py", line 1075, in connect
raise socket.error, msg
error: [Errno 104] Connection reset by peer
... View more
11-20-2017
02:44 PM
Hey @damode,
Apologies, I think there was an error with my initial configuration.
We're currently running maxWarmDBCount=3.
I'm not 100% sure what the reasoning was as this was a year ago sorry.
But setting this value above 1 addressed the issue of buckets not rolling.
-Craig
... View more
04-17-2017
07:27 PM
1 Karma
Hi All,
I've recently created a single value dashboard panel with % trend, and sparkline underneath showing the current Splunk transmission speed, using the following search:
earliest=-24h@h latest=@h index=_internal sourcetype=*splunkd* source=*metrics* group=per_index_thruput series=*app* OR series=_* | eval gb=(kb/1024/1024) | timechart span=1h sum(gb) AS totalGB
However, notice that the sparkline is constantly near zero, as the single value fluctuates around 0.65.
Is there a way to increase the scale/resolution of the sparkline so it will show fluctuations, rather than just showing 0 all the time.
Thanks,
Craig
... View more
04-13-2017
01:26 AM
Thanks for the quick response - I noticed this, but i am still keen override for testing purposes.
Alternatively another way to achieve the desired result?
... View more
04-13-2017
12:08 AM
Hi All,
Is there a way to manipulate the font color of a Single Value panel?
I'm looking to use dark.css but notice the single value font color is a dark grey, which is nearly unreadable on the black background.
Would just like the font color to be white, with a green/red trend value.
Here's what I have tried to so far in editing dark.css:
/* SingleValue */
.SingleValueHolder {
font-size: 14px;
font-weight: bold;
color: #ffffff !important;
}
.SingleValue .singleResult {
font-size: 28px;
vertical-align: -4px;
margin: 0px 6px;
color: #ffffff !important;
}
.SingleValue .None .singleResult {
color: #ffffff !important;
}
.singleLabel {
color: #ffffff !important;
}
The code for my single value:
<panel>
<single>
<title>HFW01 DEV TCP OUT QUEUE</title>
<search>
<query>earliest=-10m index=_internal host=*hfw* source=*metrics.log group=queue name=tcpout_devidx | eval queuecapacity_percent=round((current_size/max_size)*100,2) | eval current_size_mb=round((current_size/1024/1024),2) | eval max_size_mb=round((max_size/1024/1024),2) | timechart span=1m max(queuecapacity_percent)</query>
<earliest>-1d</earliest>
<latest>now</latest>
</search>
<option name="refresh.auto.interval">300</option>
<option name="afterLabel">%</option>
<option name="colorBy">value</option>
<option name="colorMode">block</option>
<option name="numberPrecision">0.00</option>
<option name="rangeColors">["0x65a637","0x65a637","0xf7bc38","0xf58f39","0xd93f3c"]</option>
<option name="rangeValues">[0,50,70,90]</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">0</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="trendInterval">-10m</option>
<option name="underLabel">compared to 10mins before</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
<option name="linkView">search</option>
<option name="drilldown">none</option>
</single>
</panel>
Is there something I'm missing here?
Thanks,
Craig
... View more
04-11-2017
04:45 PM
Ahh ok. So just to clarify, it is common to the have 2 separate scheduled searches running:
1st - to display the current queue size metric on a dashboard panel (and update as specified - using timechart)
2nd - to send an alert when the capacity exceeds 80%. (using "where")
It kind of seems inefficient to me - having two searches for essentially the same output.
The alerts are to be used for OOB hours, and when staff are away from their desks - where as the dashboard is to display pretty metrics during the office for management etc.
... View more
04-10-2017
10:50 PM
Hi All,
I have configured an alert to trigger based on when a the tcpout queue size breaches 80% - as per the SPL below:
earliest=-10m index=_internal host=*hfw* source=*metrics.log group=queue name=tcpout*
| eval queuecapacity_percent=round((current_size/max_size)*100,2), eval current_size_mb=round((current_size/1024/1024),2), eval max_size_mb=round((max_size/1024/1024),2)
| where queuecapacity_percent >= 80
| fields host, index, name, group, current_size, largest_size, max_size, date_year, date_month, date_mday, date_hour, date_minute, date_second, queuecapacity_percent, current_size_mb, max_size_mb
In addition to this, I'd like to have a Single Value panel on a dashboard, which will display the current TCP Output queue size - which I have written so far with:
earliest=-10m index=_internal host=*hfw* source=*metrics.log group=queue name=tcpout* | eval queuecapacity_percent=round((current_size/max_size)*100,2) | eval current_size_mb=round((current_size/1024/1024),2) | eval max_size_mb=round((max_size/1024/1024),2) | timechart span=1m max(queuecapacity_percent)
My Question is: What are the best practices when creating alerts, and dashboard panels?
These two objects are looking at the same data, however I want an alert & email to trigger when the threshold breaches 80%.
Is it common to have a search dedicated to the alert, and one dedicated to the dashboard panel?
How can I combine these into a single splunk object to save on performance?
Is there are better way to approach this?
Any help is greatly appreciated!
Apologies if this question has been asked before.
Thanks,
Craig
... View more
04-06-2017
07:23 PM
Hey,
Sorry to bump an old threat. But is there a solution to this?
Thanks,
Craig
... View more
03-29-2017
07:58 PM
Awesome thanks!
Any help with regards to the field extraction, just 1-2 examples would be great. can figure out the others 🙂
... View more
03-29-2017
05:46 PM
Hey Guys,
Is someone able to assist me with line breaking and field extraction XML output from Splunk REST API - which is fed into splunk.
I'd like to split the events based on <entry> . Any ideas and help greatly appreciated!
<?xml version="1.0" encoding="UTF-8"?>
<!--This is to override browser formatting; see server.conf[httpServer] to disable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .-->
<?xml-stylesheet type="text/xml" href="/static/atom.xsl"?>
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
<title>tcpout-server</title>
<id>https://22.33.444.55:8089/servicesNS/nobody/system/data/outputs/tcp/server</id>
<updated>2017-03-29T15:51:40+11:00</updated>
<generator build="f44afce176d0" version="6.3.3"/>
<author>
<name>Splunk</name>
</author>
<link href="/servicesNS/nobody/system/data/outputs/tcp/server/_new" rel="create"/>
<link href="/servicesNS/nobody/system/data/outputs/tcp/server/_reload" rel="_reload"/>
<link href="/servicesNS/nobody/system/data/outputs/tcp/server/_acl" rel="_acl"/>
<opensearch:totalResults>2</opensearch:totalResults>
<opensearch:itemsPerPage>30</opensearch:itemsPerPage>
<opensearch:startIndex>0</opensearch:startIndex>
<s:messages/>
<entry>
<title>33.44.555.69:9997</title>
<id>https://22.33.444.55:8089/servicesNS/nobody/system/data/outputs/tcp/server/33.44.555.69%3A9997</id>
<updated>2017-03-29T15:51:40+11:00</updated>
<link href="/servicesNS/nobody/system/data/outputs/tcp/server/33.44.555.69%3A9997" rel="alternate"/>
<author>
<name>nobody</name>
</author>
<link href="/servicesNS/nobody/system/data/outputs/tcp/server/33.44.555.69%3A9997" rel="list"/>
<link href="/servicesNS/nobody/system/data/outputs/tcp/server/33.44.555.69%3A9997/_reload" rel="_reload"/>
<link href="/servicesNS/nobody/system/data/outputs/tcp/server/33.44.555.69%3A9997" rel="edit"/>
<link href="/servicesNS/nobody/system/data/outputs/tcp/server/33.44.555.69%3A9997" rel="remove"/>
<link href="/servicesNS/nobody/system/data/outputs/tcp/server/33.44.555.69%3A9997/allconnections" rel="allconnections"/>
<link href="/servicesNS/nobody/system/data/outputs/tcp/server/33.44.555.69%3A9997/disable" rel="disable"/>
<content type="text/xml">
<s:dict>
<s:key name="destHost">33.44.555.69</s:key>
<s:key name="destIp">33.44.555.69</s:key>
<s:key name="destPort">9997</s:key>
<s:key name="eai:acl">
<s:dict>
<s:key name="app">system</s:key>
<s:key name="can_change_perms">1</s:key>
<s:key name="can_list">1</s:key>
<s:key name="can_share_app">1</s:key>
<s:key name="can_share_global">1</s:key>
<s:key name="can_share_user">0</s:key>
<s:key name="can_write">1</s:key>
<s:key name="modifiable">1</s:key>
<s:key name="owner">nobody</s:key>
<s:key name="perms">
<s:dict>
<s:key name="read">
<s:list>
<s:item>*</s:item>
</s:list>
</s:key>
<s:key name="write">
<s:list>
<s:item>*</s:item>
</s:list>
</s:key>
</s:dict>
</s:key>
<s:key name="removable">1</s:key>
<s:key name="sharing">system</s:key>
</s:dict>
</s:key>
<s:key name="method">autobalance</s:key>
<s:key name="sourcePort">8089</s:key>
<s:key name="ssl">1</s:key>
<s:key name="sslCertPath">sslcerpathhere</s:key>
<s:key name="sslCommonNameToCheck">sllcommonnamehere</s:key>
<s:key name="sslPassword">sslpasswordhere</s:key>
<s:key name="sslRootCAPath">sslpathhere</s:key>
<s:key name="sslVerifyServerCert">1</s:key>
<s:key name="status">connect_done</s:key>
</s:dict>
</content>
</entry>
<entry>
<title>11.22.333.44:9997</title>
<id>https://22.33.444.55:8089/servicesNS/nobody/system/data/outputs/tcp/server/11.22.333.44%3A9997</id>
<updated>2017-03-29T15:51:40+11:00</updated>
<link href="/servicesNS/nobody/system/data/outputs/tcp/server/11.22.333.44%3A9997" rel="alternate"/>
<author>
<name>nobody</name>
</author>
<link href="/servicesNS/nobody/system/data/outputs/tcp/server/11.22.333.44%3A9997" rel="list"/>
<link href="/servicesNS/nobody/system/data/outputs/tcp/server/11.22.333.44%3A9997/_reload" rel="_reload"/>
<link href="/servicesNS/nobody/system/data/outputs/tcp/server/11.22.333.44%3A9997" rel="edit"/>
<link href="/servicesNS/nobody/system/data/outputs/tcp/server/11.22.333.44%3A9997" rel="remove"/>
<link href="/servicesNS/nobody/system/data/outputs/tcp/server/11.22.333.44%3A9997/allconnections" rel="allconnections"/>
<link href="/servicesNS/nobody/system/data/outputs/tcp/server/11.22.333.44%3A9997/disable" rel="disable"/>
<content type="text/xml">
<s:dict>
<s:key name="destHost">11.22.333.44</s:key>
<s:key name="destIp">11.22.333.44</s:key>
<s:key name="destPort">9997</s:key>
<s:key name="eai:acl">
<s:dict>
<s:key name="app">system</s:key>
<s:key name="can_change_perms">1</s:key>
<s:key name="can_list">1</s:key>
<s:key name="can_share_app">1</s:key>
<s:key name="can_share_global">1</s:key>
<s:key name="can_share_user">0</s:key>
<s:key name="can_write">1</s:key>
<s:key name="modifiable">1</s:key>
<s:key name="owner">nobody</s:key>
<s:key name="perms">
<s:dict>
<s:key name="read">
<s:list>
<s:item>*</s:item>
</s:list>
</s:key>
<s:key name="write">
<s:list>
<s:item>*</s:item>
</s:list>
</s:key>
</s:dict>
</s:key>
<s:key name="removable">1</s:key>
<s:key name="sharing">system</s:key>
</s:dict>
</s:key>
<s:key name="method">autobalance</s:key>
<s:key name="sourcePort">8089</s:key>
<s:key name="ssl">1</s:key>
<s:key name="sslCertPath">sslcerpathhere</s:key>
<s:key name="sslCommonNameToCheck">sllcommonnamehere</s:key>
<s:key name="sslPassword">sslpasswordhere</s:key>
<s:key name="sslRootCAPath">sslpathhere</s:key>
<s:key name="sslVerifyServerCert">1</s:key>
<s:key name="status">connect_done</s:key>
</s:dict>
</content>
</entry>
</feed>
-Craig
... View more
03-26-2017
05:01 PM
Very interested in this functionality! Was just about to raise a request for this myself.
... View more
01-05-2017
03:31 PM
Thanks for the reply mate.
Interested to investigate this method a little further,
When I run your command, it doesn't seem to return any results :s
... View more
01-04-2017
08:38 PM
Hi All,
Apologies if this is too simple question and has been asked 100 times, But i can't seem to find the answer I'm looking for..
For the time being, I simply want to graph the number transaction status over time from a sourcetype which shows the following: "SUCCESS" "FAILED", "BLOCKED"...
However, for failed transactions, the data is coming in with failed status= "FAIL" or "FAILURE".
How can I make "FAILED = FAIL + FAILURE", and plot the status = SUCCESS & status = BLOCKED along side it?
I'm currently using the search:
sourcetype= mydata | stats count by status
As per below:
Cheers,
Craig
... View more
12-19-2016
01:39 AM
Ok, sure.
So if we increase maxWarmDBCount > 0, to say: maxWarmDBCount = 6.
This should fix the issue of Hot buckets not rolling when the hot bucket timespan exceeds: maxHotSpanSecs = 86401 ?
So our new configuration would be:
Indexes.conf Snippet:
[my_index]
frozenTimePeriodInSecs = 604800
maxTotalDataSizeMB = 400000
maxWarmDBCount = 0
maxHotSpanSecs = 86401
maxHotBuckets = 1
maxWarmDBCount = 6
coldToFrozenDir =
Will this work as expected?
Currently hot, warm and cold directories are on the same type of storage - however initially, there was a requirement to move to cold directory, as this would be cheaper disk space. As this is not the case anymore we can neglect this requirement.
... View more
12-18-2016
09:51 PM
1 Karma
Oh ok! This is news to me.
The indexes.conf suggests that it's possible to roll from Hot > Cold directly:
maxWarmDBCount =
* The maximum number of warm buckets.
* Warm buckets are located in the for the index.
* If set to zero, Splunk will not retain any warm buckets
(will roll them to cold as soon as it can)
* Highest legal value is 4294967295
* Defaults to 300.
Are you able to elaborate further as to why it's not achievable to roll directly from Hot > Cold ?
Or is this just known functionality?
... View more
12-18-2016
05:33 PM
Hi All,
My hot bucket is not rolling when its span has exceeded maxhotspansecs. Could you please provide assistance?
We are currently using a Splunk index, purely for data archiving purposes with the requirements as per below:
- The data will be captured in single bucket of 24hour period for Reingestion purposes.
- The hot bucket will roll straight from Hot to Cold.
- Data will sit in cold for 6 days
- Data will roll to frozen after a period of 7 days.
After applying the configuration (indexes.conf as per below): I have noticed that the bucket span has exceeded 86401 as defined.
Bucket Start epoch time: 1481822441
Bucket End Epoch time: 1482106850
Hence Span sec = 284409 - which is greater than 86401.
Indexes.conf Snippet:
[my_index]
frozenTimePeriodInSecs = 604800
maxTotalDataSizeMB = 400000
maxWarmDBCount = 0
maxHotSpanSecs = 86401
maxHotBuckets = 1
coldToFrozenDir =
Kind regards,
Craig
... View more
08-21-2016
11:12 PM
1 Karma
Hi All,
Is it possible to monitor the queue size without access to the search head or related applications ?
I currently have a general system setup: Universal Forwarder→Heavy Forwarder→Indexer→Search Head.
And only have access to the Universal and Heavy forwarders.
I understand queue information can be found in metrics.log
How could I approach this?
Cheers,
Craig
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-10-2021
09:45 PM
|
Karma given to
