Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About jfaldmomacu
jfaldmomacu
Path Finder
Member since:
06-11-2019
04-02-2025
Community Statistics
| Posts | 17 |
| Solutions | 2 |
| Karma Given | 9 |
| Karma Received | 4 |
| Member Since | 06-11-2019 |
Activity Feed
- Karma Re: Cannot find bid for isoutamo. 04-02-2025 03:25 PM
- Karma Re: Cannot find bid for isoutamo. 04-02-2025 03:24 PM
- Posted Re: Cannot find bid on Splunk Enterprise. 04-02-2025 03:19 PM
- Posted Re: Cannot find bid on Splunk Enterprise. 04-02-2025 03:17 PM
- Posted Re: Cannot find bid on Splunk Enterprise. 04-02-2025 01:58 PM
- Posted Cannot find bid on Splunk Enterprise. 04-02-2025 09:40 AM
- Got Karma for Re: sourcetype based upon host. 10-30-2024 08:33 AM
- Posted Re: Splunk Secure Gateway in Splunk Cloud on Installation. 06-08-2023 03:33 PM
- Posted Re: How do you set alert severity? on Alerting. 02-09-2023 01:16 PM
- Karma [powershell://...] input working example and some pitfalls for ololdach. 01-09-2023 10:42 AM
- Posted Re: sourcetype based upon host on Getting Data In. 10-27-2022 08:35 AM
- Karma Re: sourcetype based upon host for mkalyakin. 10-27-2022 08:32 AM
- Karma Re: Alerts How to determine how many times (frequency) Alert has been fired in a /day/month/week. for skoelpin. 10-24-2022 10:43 AM
- Got Karma for Re: Search Factor and Replication factory not met. Frozen=1. 04-11-2022 10:39 AM
- Posted Failed to make bucket searchable, Bad Splunk Support advice? on Getting Data In. 01-11-2022 08:51 AM
- Got Karma for Re: how to install ITE Work ?. 05-14-2021 01:47 PM
- Posted Re: how to install ITE Work ? on All Apps and Add-ons. 05-14-2021 01:18 PM
- Posted Re: Search Factor and Replication factory not met. Frozen=1 on Splunk Enterprise. 05-10-2021 12:36 PM
- Posted Search Factor and Replication factory not met. Frozen=1 on Splunk Enterprise. 01-07-2021 10:02 AM
- Posted Re: Monotonic Time Stuck and Search_Telemetry on Splunk Search. 12-09-2020 11:31 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-02-2025
03:19 PM
But the ones that were missing the specified repFactor were the ones that had thousands of events. The other indexes that already had repFactor set to auto only had a few events with that error. So I think you may be on to something,
... View more
04-02-2025
03:17 PM
I've seen the repFactor set to auto or 0. I'm changing all the non-internal indexes to auto, (adding the line repFactor to the stanzas that are missing them. RF and SF are 2. I have a Single site cluster with 6 indexers.
... View more
04-02-2025
01:58 PM
I picked a bid and searched for it. The only events are about its creation. Then the errors immediately start I checked three other bids with the same results. I even see messages about moving from hot to warm. ("Cleaning up usage" events excluded in these search results.)
... View more
04-02-2025
09:40 AM
I'm getting thousands of log events that says -- ERROR CMSlave [2549383 CMNotifyThread] - Cannot find bid=wineventlog~157~96ECF7C4-1951-4288-B90A-9133E5408F14. cleaning up usage data It is on all my indexers and references multiple but not all indexes. Any ideas on how to fix that error?
... View more
Labels
- Labels:
-
using Splunk Enterprise
06-08-2023
03:33 PM
I'm in the same boat as you @anandhalagaras1 @kelstahl8705 Were you able to get an answer to this?
... View more
10-27-2022
08:35 AM
1 Karma
This does not work anymore. I'm not sure if it would have ever worked, but according to the documentation sourcetype=something only works when applied to a source. A transforms.conf file is needed. The example given in another reply almost works, it was missing the "sourcetype::" on the FORMAT line. [syslog] TRANSFORMS-set_sourcetype = set_sourcetype transforms.conf [set_sourcetype] FORMAT = sourcetype::new_sourcetype REGEX = myserver SOURCE_KEY = MetaData:Host DEST_KEY = MetaData:Sourcetype
... View more
01-11-2022
08:51 AM
I've been getting this error for a few weeks. Search peer <indexer> has the following message: Failed to make bucket = main~5360~4D6B6D21-6F08-44EA-B793-EFEB8C344E21 searchable, retry count = 743. I have a case open with Splunk Support and I wanted to know if their logic or feedback is sound. After stopping the indexer I ran fsck and saw multiple buckets have needed to be rebuilt. They all rebuilt successfully except the one was in the error message. After sharing this information and the logs with Support I was told that "For a single bucket you can ignore this warning. Data will still be searchable for this bucket. " So, should I think all is well because Support told me so and ignore the Health of Splunk Deployment report that shows the "red exclamation mark" icons for Buckets and Data Durability?
... View more
Labels
- Labels:
-
index
05-14-2021
01:18 PM
1 Karma
Will the instructions for a distributed environment be coming?
... View more
05-10-2021
12:36 PM
1 Karma
I found I needed to Resync the buckets and that fixed the issue.
... View more
01-07-2021
10:02 AM
I have started seeing this message often on my Indexer Cluster Master, when I view the Bucket Status page. bid=_internal~7404~4D6B6D21-6F08-44EA-B793-XXXXXXXXXXXX removed from peer=4D6B6D21-6F08-44EA-B793-XXXXXXXXXXXX, frozen=1 The status for these buckets is-- Cannot fix search count as the bucket hasn't rolled yet. I try to roll them but nothing happens. Does frozen=1 mean it is old data and since we don't have a frozen volume then I can delete these buckets? Any other suggestions on how to address this?
... View more
Labels
12-09-2020
11:31 AM
I just saw the message "ERROR PipelineComponent - Monotonic time source didn't increase; is it stuck?" come in every 2-3 seconds or about 24 per minute. It did indicate a problem with my system which I am troubleshooting.
... View more
03-17-2020
09:42 AM
I guess this wasn't as complex as I initially thought. I was getting wrapped up in all the options. In reading the documentation for LINE_BREAKER I was able to get a simple solution. Thank you @to4kawa for prompting me to get to the right answer.
SHOULD_LINEMERGE = false
LINE_BREAKER = .*]\*.*([\r\n]+)\[.*\]Line
I swapped out Line for [^*] as I saw some edge cases where I needed some an event breaking there as well. So I really ended up with this.
SHOULD_LINEMERGE = false
LINE_BREAKER = .*]\*.*([\r\n]+)\[.*\][^\*]
... View more
03-17-2020
08:34 AM
That made it so there are no line breaks, or so that everything comes through as one event. The source is a bunch of small files, less than a hundred lines, and each file is now one event.
... View more
03-16-2020
02:33 PM
The five events in my original post should be lines--
1-4,
5-9,
10-11,
12-15,
16-21.
Or like this--
Event 1
[2019-12-18 07:00:01.070924-07:00|info]Line 3: :begin
[2019-12-18 07:00:01.070924-07:00|info]Line 4:
[2019-12-18 07:00:01.070924-07:00|info]Line 5: WORKINGDIR "C:\Download\Server1"
[2019-12-18 07:00:01.070924-07:00|info]*Working directory: C:\Download\Server1\
Event 2
[2019-12-18 07:00:01.070924-07:00|info]Line 6:
[2019-12-18 07:00:01.070924-07:00|info]Line 7: FTPLOGON "Server1" /timeout=60
[2019-12-18 07:00:01.070924-07:00|info]*Logging on to <server1> as SFTP (SSH File Transfer Protocol)
[2019-12-18 07:00:01.070924-07:00|info]*Logon in progress...
[2019-12-18 07:00:03.055523-07:00|info]*Logon successful.
Event 3
[2019-12-18 07:00:03.055523-07:00|info]Line 8: FTPCD "Extracts"
[2019-12-18 07:00:03.164909-07:00|info]*Current FTP site directory: /Extracts/
Event 4
[2019-12-18 07:00:03.164909-07:00|info]Line 9: IFERROR= $ERROR_SUCCESS GOTO Operation1
[2019-12-18 07:00:03.164909-07:00|info]Line 21: :Operation1
[2019-12-18 07:00:03.164909-07:00|info]Line 22: FTPGETFILE "*na_alert_subs*" /newest
[2019-12-18 07:00:03.164909-07:00|info]*Hint: FTPGETFILE /newest always returns the newest file
Event 5
[2019-12-18 07:00:03.430561-07:00|info]Line 22: *%sitefile has been set to: na_alert_subs_20191217.txt
[2019-12-18 07:00:03.446223-07:00|info]Line 23: RCVFILE %sitefile /delete
[2019-12-18 07:00:03.446223-07:00|info]*Receiving to "C:\Download\Server1\na_alert_subs_20191217.txt"
[2019-12-18 07:00:12.947244-07:00|info]*Complete, received 1394788 bytes in 9 seconds (1513.44K cps)
[2019-12-18 07:00:13.103506-07:00|info]*File deleted on FTP site.
[2019-12-18 07:00:13.103506-07:00|info]*Download complete, 1 file received.
... View more
03-16-2020
01:50 PM
Here is a snippet of a log file that I am trying to do line breaking on. I want it to only break when one line has matches "info]*" and the next line has "info]Line"
[2019-12-18 07:00:01.070924-07:00|info]Line 3: :begin
[2019-12-18 07:00:01.070924-07:00|info]Line 4:
[2019-12-18 07:00:01.070924-07:00|info]Line 5: WORKINGDIR "C:\Download\Server1"
[2019-12-18 07:00:01.070924-07:00|info]*Working directory: C:\Download\Server1\
[2019-12-18 07:00:01.070924-07:00|info]Line 6:
[2019-12-18 07:00:01.070924-07:00|info]Line 7: FTPLOGON "Server1" /timeout=60
[2019-12-18 07:00:01.070924-07:00|info]*Logging on to <server1> as SFTP (SSH File Transfer Protocol)
[2019-12-18 07:00:01.070924-07:00|info]*Logon in progress...
[2019-12-18 07:00:03.055523-07:00|info]*Logon successful.
[2019-12-18 07:00:03.055523-07:00|info]Line 8: FTPCD "Extracts"
[2019-12-18 07:00:03.164909-07:00|info]*Current FTP site directory: /Extracts/
[2019-12-18 07:00:03.164909-07:00|info]Line 9: IFERROR= $ERROR_SUCCESS GOTO Operation1
[2019-12-18 07:00:03.164909-07:00|info]Line 21: :Operation1
[2019-12-18 07:00:03.164909-07:00|info]Line 22: FTPGETFILE "*na_alert_subs*" /newest
[2019-12-18 07:00:03.164909-07:00|info]*Hint: FTPGETFILE /newest always returns the newest file
[2019-12-18 07:00:03.430561-07:00|info]Line 22: *%sitefile has been set to: na_alert_subs_20191217.txt
[2019-12-18 07:00:03.446223-07:00|info]Line 23: RCVFILE %sitefile /delete
[2019-12-18 07:00:03.446223-07:00|info]*Receiving to "C:\Download\Server1\na_alert_subs_20191217.txt"
[2019-12-18 07:00:12.947244-07:00|info]*Complete, received 1394788 bytes in 9 seconds (1513.44K cps)
[2019-12-18 07:00:13.103506-07:00|info]*File deleted on FTP site.
[2019-12-18 07:00:13.103506-07:00|info]*Download complete, 1 file received.
So in that snippet it would break down into five events.
... View more
07-09-2019
07:29 AM
This helped me out. Thank you!
... View more
