Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About rsolutions
rsolutions
Path Finder
Member since:
08-29-2011
06-05-2020
Community Statistics
| Posts | 32 |
| Solutions | 0 |
| Karma Given | 6 |
| Karma Received | 4 |
| Member Since | 08-29-2011 |
Activity Feed
- Got Karma for Re: Splunkweb Self-Signed SSL certificates not working with Chrome. 08-17-2020 06:12 AM
- Got Karma for Re: Splunkweb Self-Signed SSL certificates not working with Chrome. 06-05-2020 12:49 AM
- Karma Does Cisco eStreamer for Splunk support eStreamer 6? for Olli1919. 06-05-2020 12:47 AM
- Karma Re: Does Cisco eStreamer for Splunk support eStreamer 6? for douglashurd. 06-05-2020 12:47 AM
- Karma Re: Why am I getting an installation failure for Splunk 6.2.2, 6.2.3, and 6.2.4 in OS X 10.11 beta and how do I fix this? for gbeddow. 06-05-2020 12:47 AM
- Got Karma for Timestamp Issue with Splunk Add-on for McAfee. 06-05-2020 12:47 AM
- Karma Re: Where do you download SA-ldapsearch? for ahall_splunk. 06-05-2020 12:46 AM
- Karma Re: What is the easiest way to get data from a Kiwi Syslog server into Splunk? for andykiely. 06-05-2020 12:46 AM
- Karma Re: When it is coming out for Splunk 6 ? for rblair978. 06-05-2020 12:46 AM
- Got Karma for Re: e-mail body indexing. 06-05-2020 12:46 AM
- Posted Re: Splunkweb Self-Signed SSL certificates not working with Chrome on Security. 04-15-2020 11:27 PM
- Posted Re: Does Cisco eStreamer for Splunk support eStreamer 6? on All Apps and Add-ons. 08-16-2016 07:37 AM
- Posted Re: Does Cisco eStreamer for Splunk support eStreamer 6? on All Apps and Add-ons. 08-15-2016 02:43 PM
- Posted Re: Can the IMAP Mailbox App be used with Office365? on All Apps and Add-ons. 04-15-2016 02:41 PM
- Posted Re: Can the IMAP Mailbox App be used with Office365? on All Apps and Add-ons. 04-04-2016 04:15 PM
- Posted Re: How do I find out which hosts are pushing the most data to our Splunk Cloud account? Volume usage showing a spike. on Getting Data In. 12-15-2015 08:56 PM
- Posted Re: How do I find out which hosts are pushing the most data to our Splunk Cloud account? Volume usage showing a spike. on Getting Data In. 12-15-2015 08:49 PM
- Posted Re: Aside from disabling Redhat's Out of Memory (OOM) Manager that is killing splunkd, is there any other way to manage the splunk-optimize process to reduce the memory it uses? on Getting Data In. 10-26-2015 07:58 AM
- Posted Re: Why am I getting an installation failure for Splunk 6.2.2, 6.2.3, and 6.2.4 in OS X 10.11 beta and how do I fix this? on Installation. 10-07-2015 08:21 AM
- Posted Re: SA-ldapsearch upgrade to 2.0 ERROR on executing ldapfilter command on All Apps and Add-ons. 02-10-2015 11:23 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 |
04-15-2020
11:27 PM
2 Karma
click anywhere on the screen and type:
thisisunsafe
It will let continue to the page.
... View more
08-16-2016
07:37 AM
I am working on a Splunk implementation for a large Telco... I'll ask, but I'm pretty sure the comment will be all fields as they have an extensive Splunk deployment.
... View more
08-15-2016
02:43 PM
I think the issue is the current app doesn't pull in all of the new fields that v6 has to offer.
... View more
04-15-2016
02:41 PM
It does work... by default it is on and we just finished this setup on Splunk getting mail from Office 365. You can get your specific IMAP server by logging into Office 365 and going into your mail. Click on settings (the cog in the top right), then mail, accounts, POP and IMAP on the left. You'll see the IMAP server documented there.
... View more
04-04-2016
04:15 PM
There is an IMAP interface. For most clients it is at outlook.office365.com
... View more
12-15-2015
08:56 PM
This looks good as a line or area chart... you can easily see what host has has a significant increase. If you find the host... add it to the base search and the edit the timechart to be by sourcetype. This should help you zero in on what has caused the recent increase in logging.
... View more
12-15-2015
08:49 PM
You could always just search the raw logs (may take a while if you have a lot of data)... index=* earliest=-7d@d latest=@d | eval size=len(_raw)/1024/1024 | timechart sum(size) by host
... View more
10-26-2015
07:58 AM
The initial problem was the indexers were crashing. Splunk determined it was a bug a a fix was released as part of 6.0.3 I believe. The cause was an error with memory mapping between Splunk, the OS and VMware.
... View more
10-07-2015
08:21 AM
This worked for me.. just changed the path to /opt/splunk/lib as I did customize my install path.
... View more
02-10-2015
11:23 AM
Upgrading to 2.0.1 fixed our issue.
... View more
01-06-2015
08:43 PM
The splunk-optimize process is using way too much memory in our environment (with ES installed) and is crashing the indexers... were you able to resolve your issue and if so... how?
... View more
01-06-2015
08:37 PM
We have confirmed THP is disabled. We also set the OOM manager to -16 for the Splunk process. We bumped the memory on the indexers to 32GB, but the indexers have since crashed again. We'll get back to Splunk support, but something has to be causing the splunk-optimize process to use much more memory than normal.
Little lost on this one as we have never seen this before. We do have ES running in this environment, but other than that there isn't too much data, nor too many indexes created. Any other thoughts or suggestions?
... View more
12-30-2014
10:22 PM
Are you running Splunk on linux (RHEL)? How much memory do you have on the server? Have you looked at this:
http://docs.splunk.com/Documentation/Splunk/6.2.1/ReleaseNotes/SplunkandTHP
This may cause Splunk to under perform with THP enabled and even not release memory back to the server. The linux out of memory manager can also start to kill splunkd if it consumes too much memory.
http://www.oracle.com/technetwork/articles/servers-storage-dev/oom-killer-1911807.html
... View more
12-30-2014
10:13 PM
This is the article from Oracle that explains how to manage the OOM. While you can tell it to be "nicer" to Splunk, even they don't recommend turning it off.
http://www.oracle.com/technetwork/articles/servers-storage-dev/oom-killer-1911807.html
We are going to disable THP too and see if it helps with our issue (seems to be the same). You should manually look at the /var/log/messages to confirm if OOM is killing splunkd. For some reason we we not seeing the messages in Splunk, but they were in /var/log/messages.
... View more
12-30-2014
10:05 PM
I will definitely try disabling THP and see what happens. I'll let you know how it goes.
... View more
12-30-2014
09:37 PM
This is the article from Oracle that explains how to manage the OOM. While you can tell it to be "nicer" to Splunk, even they don't recommend turning it off.
http://www.oracle.com/technetwork/articles/servers-storage-dev/oom-killer-1911807.html
... View more
12-30-2014
09:18 PM
Thanks Martin. We originally started with 12GB of ram, but bumped it to 16GB. The only time we seem to run into issues is when the splunk-optimize process runs. Otherwise it is fine. The only other thing that is unique to this environment is that it does run Splunk ES (with a select few other apps that).
I realize we can add more ram, and that may ultimately be what is necessary. Just trying to figure out if there is anything else we can do to help manage it or reduce the memory requirements for the splunk-optimize process.
... View more
12-30-2014
04:02 PM
Splunk-optimize is launching on our indexers and eating up a few GB of memory, then Redhat's out-of-memory manager kills the splunkd process (as seen in /var/log/messages). The 3 indexers have 16 CPUs and 16GB of ram (total logging of 70GB/day across the 3 indexers), so shouldn't be a resource issue. So aside from disabling the OOM (or reducing the likelihood of OOM killing Splunk http://www.oracle.com/technetwork/articles/servers-storage-dev/oom-killer-1911807.html ), is there any other way to manage the splunk-optimize process to reduce the memory it use?
... View more
12-02-2014
09:19 PM
We are having the same issue (just on a new install). I opened a suport case up today and will see what they say.
... View more
12-02-2014
07:33 PM
Have you tried searching all of the indexes:
index=*
By default the Windows TA's log to a wineventlog index. Only the main index is searched by default (unless you change it in the roles).
... View more
11-29-2014
08:57 PM
Hmm. Having the same issue with a brand new deployment....
... View more
07-21-2014
12:13 PM
I had an email from the folks at f5 and they said this version of the app will work on Splunk v6.
... View more
07-16-2014
01:27 PM
This worked, though I will forward this along to Splunk to see if they can integrate it into the TA. I commented out the LINE_BREAKER and used the above BREAK_ONLY_BEFORE line above in a props.conf saved in the local directory of the Splunk Add-on for McAfee app.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma given to
