About anilyelmar

anilyelmar · ‎01-18-2019

Can someone please help me here :I have a search giving me the details of users who modified macros index=_internal method=POST sourcetype=splunkd_ui_access uri_path=/en-US/manager/search/admin/macros/my_*indexes | rex field=uri_path "\/en-US\/manager\/search\/admin\/macros\/(?<macro>.*)" |table _time host user macro How can I add more details to it like what the current and previous definition for each of macro. only what I can get the current definition is by | rest /servicesNS/-/-/admin/macros splunk_server=local |search title=<macro> So my current version of search is below and I am looking the way how I can add the previousDefinition of macro before it was edited . index=_internal method=POST sourcetype=splunkd_ui_access uri_path=/en-US/manager/search/admin/macros/my_*indexes | rex field=uri_path "\/en-US\/manager\/search\/admin\/macros\/(?<title>.*)" | join type=left title [ | rest /servicesNS/-/-/admin/macros splunk_server=local]|rename definition as currentDef |table _time host user title currentDef

anilyelmar · ‎01-18-2019

thanks , let me clarify my question: I do see a lot of errors in my search head internal logs as "SearchResults - Corrupt csv header, 2 columns with the same name '__mv_Calling_Station_Identifier' (col #xx and #xxx, #xxx will be ignored)" which means I have some users running ad-hoc/scheduled searches and resulting duplicate field names like ...|fields a b c a d b e ( here a and b are duplicated unnecessary) I have hundreds of users running thousands of searches daily and its impossible to look manually each of them for above issue) I am looking a way to identify those users and their search strings.

anilyelmar · ‎01-18-2019

How Splunk admin can find a search executed by user which causing SearchResults - Corrupt csv header, 2 columns with the same name '__mv_Calling_Station_Identifier' (col #xx and #xxx, #xxx will be ignored)

anilyelmar · ‎10-23-2018

You can do this from Setting >>Distributed search >>Distributed search>>Timeout settings and changing the Status timeout (in seconds) from default value 10 to something larger considering your environment.

anilyelmar · ‎06-30-2017

I submitted P4. By the way, My customized installation of 6.5.3 is no more logging anything related to THP in splukd.log where as vanilla 6.5.3 does. Do you know which config controls this logging? I will have to check and correct it. I can not easily compare my customized 6.5.3 config with vanilla 6.5.3 . thanks

anilyelmar · ‎06-29-2017

Regarding the splunkd.log related to THP If you are setting transparent_hugepage=never in grub.conf (disable THP at boot time) then "Linux transparent hugetables support, enabled="never" **defrag="always**"" in splunkd.log is also a GOOD condition. Please see - https://access.redhat.com/solutions/46111 and section below. Splunk must reword their logging message in splund.log NOTE: Some third party application install scripts check value of above files and complain even if THP is disabled at boot time using transparent_hugepage=never, this is due to the fact when THP is disabled at boot time, the value of /sys/kernel/mm/redhat_transparent_hugepage/defrag will not be changed, however this is expected and system will never go in THP defragmentation code path when it is disabled at boot and THP defrag need not to be disabled separately

anilyelmar · ‎06-29-2017

If you are setting transparent_hugepage=never in grub.conf (disable THP at boot time) then "Linux transparent hugetables support, enabled="never" defrag="always"" in splunkd.log is also a GOOD condition. Please see - https://access.redhat.com/solutions/46111 and section below. Splunk must reword their logging message NOTE: Some third party application install scripts check value of above files and complain even if THP is disabled at boot time using transparent_hugepage=never, this is due to the fact when THP is disabled at boot time, the value of /sys/kernel/mm/redhat_transparent_hugepage/defrag will not be changed, however this is expected and system will never go in THP defragmentation code path when it is disabled at boot and THP defrag need not to be disabled separately.

anilyelmar · ‎01-29-2017

Splunk 6.4+ comes with easy option to roll the buckets remotely. You can ask your cluster master to identify cluster peer(remote indexer) and roll the buckets automatically. Execute below curl curl -k -u username:password https://localhost:/services/cluster/master/control/control/roll-hot-buckets -X POST -d "bucket_id=<...>" Just make sure to put correct port of your cluster master and bucket_id as you see in error messages.

anilyelmar · ‎01-29-2017

Splunk 6.4+ comes with easy option to roll the buckets remotely. You can ask your cluster master to identify cluster peer(remote indexer) and roll the buckets automatically. Execute below curl curl -k -u username:password https://localhost:/services/cluster/master/control/control/roll-hot-buckets -X POST -d "bucket_id=<...>" Just make sure to put correct port of your cluster master and bucket_id as you see in error messages.

anilyelmar · ‎02-28-2016

its issue with your logging of syslog as its getting re-indexed. You can check inputs and get that fixed though if you want to continue as it is and remove duplicates use : source="/var/adm/syslog/syslog.log" ERRLOGGER | dedup _raw

Posts	10
Solutions	0
Karma Given	5
Karma Received	4
Member Since	‎02-24-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Splunk Auding for changes in macro

How Splunk admin can find a search executed by use...

Splunk Auding for changes in macro

Re: How Splunk admin can find a search executed by...

How Splunk admin can find a search executed by use...

Re: Why am I getting a false DMC Alert that search...

Re: How do I disable Transparent Huge Pages (THP) ...

Re: How do I disable Transparent Huge Pages (THP) ...

Re: Splunk 6.x and Linux? not so fast?

Re: Why is cluster master reporting "Cannot fix se...

Re: Why is cluster master reporting "Cannot fix se...

Re: Can I get search script to filter only errpt e...