Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jfaldmomacu
jfaldmomacu
Path Finder
Member since:
06-11-2019
02-09-2023
Community Statistics
| Posts | 12 |
| Solutions | 2 |
| Karma Given | 7 |
| Karma Received | 3 |
| Member Since | 06-11-2019 |
Activity Feed
- Posted Re: How do you set alert severity? on Alerting. 02-09-2023 01:16 PM
- Karma [powershell://...] input working example and some pitfalls for ololdach. 01-09-2023 10:42 AM
- Posted Re: sourcetype based upon host on Getting Data In. 10-27-2022 08:35 AM
- Karma Re: sourcetype based upon host for mkalyakin. 10-27-2022 08:32 AM
- Karma Re: Alerts How to determine how many times (frequency) Alert has been fired in a /day/month/week. for skoelpin. 10-24-2022 10:43 AM
- Got Karma for Re: Search Factor and Replication factory not met. Frozen=1. 04-11-2022 10:39 AM
- Posted Failed to make bucket searchable, Bad Splunk Support advice? on Getting Data In. 01-11-2022 08:51 AM
- Got Karma for Re: how to install ITE Work ?. 05-14-2021 01:47 PM
- Posted Re: how to install ITE Work ? on All Apps and Add-ons. 05-14-2021 01:18 PM
- Posted Re: Search Factor and Replication factory not met. Frozen=1 on Splunk Enterprise. 05-10-2021 12:36 PM
- Posted Search Factor and Replication factory not met. Frozen=1 on Splunk Enterprise. 01-07-2021 10:02 AM
- Posted Re: Monotonic Time Stuck and Search_Telemetry on Splunk Search. 12-09-2020 11:31 AM
- Karma Re: Complex line breaking configuration help needed for woodcock. 06-05-2020 12:51 AM
- Karma Re: Complex line breaking configuration help needed for woodcock. 06-05-2020 12:51 AM
- Karma Re: How can i query to get all alerts which are configured? for aokur_splunk. 06-05-2020 12:48 AM
- Karma Re: How to setup an alert if any index size goes over 90%? for MuS. 06-05-2020 12:47 AM
- Posted Re: Complex line breaking configuration help needed on Getting Data In. 03-17-2020 09:42 AM
- Posted Re: Complex line breaking configuration help needed on Getting Data In. 03-17-2020 08:34 AM
- Posted Re: Complex line breaking configuration help needed on Getting Data In. 03-16-2020 02:33 PM
- Posted Complex line breaking configuration help needed on Getting Data In. 03-16-2020 01:50 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
10-27-2022
08:35 AM
This does not work anymore. I'm not sure if it would have ever worked, but according to the documentation sourcetype=something only works when applied to a source. A transforms.conf file is needed. The example given in another reply almost works, it was missing the "sourcetype::" on the FORMAT line. [syslog] TRANSFORMS-set_sourcetype = set_sourcetype transforms.conf [set_sourcetype] FORMAT = sourcetype::new_sourcetype REGEX = myserver SOURCE_KEY = MetaData:Host DEST_KEY = MetaData:Sourcetype
... View more
01-11-2022
08:51 AM
I've been getting this error for a few weeks. Search peer <indexer> has the following message: Failed to make bucket = main~5360~4D6B6D21-6F08-44EA-B793-EFEB8C344E21 searchable, retry count = 743. I have a case open with Splunk Support and I wanted to know if their logic or feedback is sound. After stopping the indexer I ran fsck and saw multiple buckets have needed to be rebuilt. They all rebuilt successfully except the one was in the error message. After sharing this information and the logs with Support I was told that "For a single bucket you can ignore this warning. Data will still be searchable for this bucket. " So, should I think all is well because Support told me so and ignore the Health of Splunk Deployment report that shows the "red exclamation mark" icons for Buckets and Data Durability?
... View more
Labels
- Labels:
-
index
05-14-2021
01:18 PM
1 Karma
Will the instructions for a distributed environment be coming?
... View more
05-10-2021
12:36 PM
1 Karma
I found I needed to Resync the buckets and that fixed the issue.
... View more
01-07-2021
10:02 AM
I have started seeing this message often on my Indexer Cluster Master, when I view the Bucket Status page. bid=_internal~7404~4D6B6D21-6F08-44EA-B793-XXXXXXXXXXXX removed from peer=4D6B6D21-6F08-44EA-B793-XXXXXXXXXXXX, frozen=1 The status for these buckets is-- Cannot fix search count as the bucket hasn't rolled yet. I try to roll them but nothing happens. Does frozen=1 mean it is old data and since we don't have a frozen volume then I can delete these buckets? Any other suggestions on how to address this?
... View more
Labels
12-09-2020
11:31 AM
I just saw the message "ERROR PipelineComponent - Monotonic time source didn't increase; is it stuck?" come in every 2-3 seconds or about 24 per minute. It did indicate a problem with my system which I am troubleshooting.
... View more
03-17-2020
09:42 AM
I guess this wasn't as complex as I initially thought. I was getting wrapped up in all the options. In reading the documentation for LINE_BREAKER I was able to get a simple solution. Thank you @to4kawa for prompting me to get to the right answer.
SHOULD_LINEMERGE = false
LINE_BREAKER = .*]\*.*([\r\n]+)\[.*\]Line
I swapped out Line for [^*] as I saw some edge cases where I needed some an event breaking there as well. So I really ended up with this.
SHOULD_LINEMERGE = false
LINE_BREAKER = .*]\*.*([\r\n]+)\[.*\][^\*]
... View more
03-17-2020
08:34 AM
That made it so there are no line breaks, or so that everything comes through as one event. The source is a bunch of small files, less than a hundred lines, and each file is now one event.
... View more
03-16-2020
02:33 PM
The five events in my original post should be lines--
1-4,
5-9,
10-11,
12-15,
16-21.
Or like this--
Event 1
[2019-12-18 07:00:01.070924-07:00|info]Line 3: :begin
[2019-12-18 07:00:01.070924-07:00|info]Line 4:
[2019-12-18 07:00:01.070924-07:00|info]Line 5: WORKINGDIR "C:\Download\Server1"
[2019-12-18 07:00:01.070924-07:00|info]*Working directory: C:\Download\Server1\
Event 2
[2019-12-18 07:00:01.070924-07:00|info]Line 6:
[2019-12-18 07:00:01.070924-07:00|info]Line 7: FTPLOGON "Server1" /timeout=60
[2019-12-18 07:00:01.070924-07:00|info]*Logging on to <server1> as SFTP (SSH File Transfer Protocol)
[2019-12-18 07:00:01.070924-07:00|info]*Logon in progress...
[2019-12-18 07:00:03.055523-07:00|info]*Logon successful.
Event 3
[2019-12-18 07:00:03.055523-07:00|info]Line 8: FTPCD "Extracts"
[2019-12-18 07:00:03.164909-07:00|info]*Current FTP site directory: /Extracts/
Event 4
[2019-12-18 07:00:03.164909-07:00|info]Line 9: IFERROR= $ERROR_SUCCESS GOTO Operation1
[2019-12-18 07:00:03.164909-07:00|info]Line 21: :Operation1
[2019-12-18 07:00:03.164909-07:00|info]Line 22: FTPGETFILE "*na_alert_subs*" /newest
[2019-12-18 07:00:03.164909-07:00|info]*Hint: FTPGETFILE /newest always returns the newest file
Event 5
[2019-12-18 07:00:03.430561-07:00|info]Line 22: *%sitefile has been set to: na_alert_subs_20191217.txt
[2019-12-18 07:00:03.446223-07:00|info]Line 23: RCVFILE %sitefile /delete
[2019-12-18 07:00:03.446223-07:00|info]*Receiving to "C:\Download\Server1\na_alert_subs_20191217.txt"
[2019-12-18 07:00:12.947244-07:00|info]*Complete, received 1394788 bytes in 9 seconds (1513.44K cps)
[2019-12-18 07:00:13.103506-07:00|info]*File deleted on FTP site.
[2019-12-18 07:00:13.103506-07:00|info]*Download complete, 1 file received.
... View more
03-16-2020
01:50 PM
Here is a snippet of a log file that I am trying to do line breaking on. I want it to only break when one line has matches "info]*" and the next line has "info]Line"
[2019-12-18 07:00:01.070924-07:00|info]Line 3: :begin
[2019-12-18 07:00:01.070924-07:00|info]Line 4:
[2019-12-18 07:00:01.070924-07:00|info]Line 5: WORKINGDIR "C:\Download\Server1"
[2019-12-18 07:00:01.070924-07:00|info]*Working directory: C:\Download\Server1\
[2019-12-18 07:00:01.070924-07:00|info]Line 6:
[2019-12-18 07:00:01.070924-07:00|info]Line 7: FTPLOGON "Server1" /timeout=60
[2019-12-18 07:00:01.070924-07:00|info]*Logging on to <server1> as SFTP (SSH File Transfer Protocol)
[2019-12-18 07:00:01.070924-07:00|info]*Logon in progress...
[2019-12-18 07:00:03.055523-07:00|info]*Logon successful.
[2019-12-18 07:00:03.055523-07:00|info]Line 8: FTPCD "Extracts"
[2019-12-18 07:00:03.164909-07:00|info]*Current FTP site directory: /Extracts/
[2019-12-18 07:00:03.164909-07:00|info]Line 9: IFERROR= $ERROR_SUCCESS GOTO Operation1
[2019-12-18 07:00:03.164909-07:00|info]Line 21: :Operation1
[2019-12-18 07:00:03.164909-07:00|info]Line 22: FTPGETFILE "*na_alert_subs*" /newest
[2019-12-18 07:00:03.164909-07:00|info]*Hint: FTPGETFILE /newest always returns the newest file
[2019-12-18 07:00:03.430561-07:00|info]Line 22: *%sitefile has been set to: na_alert_subs_20191217.txt
[2019-12-18 07:00:03.446223-07:00|info]Line 23: RCVFILE %sitefile /delete
[2019-12-18 07:00:03.446223-07:00|info]*Receiving to "C:\Download\Server1\na_alert_subs_20191217.txt"
[2019-12-18 07:00:12.947244-07:00|info]*Complete, received 1394788 bytes in 9 seconds (1513.44K cps)
[2019-12-18 07:00:13.103506-07:00|info]*File deleted on FTP site.
[2019-12-18 07:00:13.103506-07:00|info]*Download complete, 1 file received.
So in that snippet it would break down into five events.
... View more
07-09-2019
07:29 AM
This helped me out. Thank you!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-09-2023
05:52 PM
|
