Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About patng_nw
patng_nw
Communicator
Member since:
10-19-2016
03-05-2025
Community Statistics
| Posts | 58 |
| Solutions | 5 |
| Karma Given | 6 |
| Karma Received | 10 |
| Member Since | 10-19-2016 |
Activity Feed
- Got Karma for Re: Install Python for Scientific Computing on cluster - tarball too large and caused Network-layer error: Broken pipe. 12-04-2024 09:34 PM
- Got Karma for Re: Install Python for Scientific Computing on cluster - tarball too large and caused Network-layer error: Broken pipe. 04-05-2024 12:22 PM
- Posted Re: Attempting to revert the SPLUNK_HOME ownership on Splunk Enterprise. 11-13-2023 06:40 PM
- Posted Re: Bin bucket to start with event value on Deployment Architecture. 10-17-2023 08:58 PM
- Got Karma for Re: Install Python for Scientific Computing on cluster - tarball too large and caused Network-layer error: Broken pipe. 09-20-2023 04:24 PM
- Got Karma for Install Python for Scientific Computing on cluster - tarball too large and caused Network-layer error: Broken pipe. 09-20-2023 04:24 PM
- Posted Re: How to change the default colors of 9.X back to 8.X. (9 is very bright)? on Dashboards & Visualizations. 04-02-2023 11:38 PM
- Got Karma for Install Python for Scientific Computing on cluster - tarball too large and caused Network-layer error: Broken pipe. 01-26-2022 09:53 AM
- Got Karma for Re: Rolling restart hung on "Reassigning primaries". 01-06-2022 05:10 PM
- Got Karma for Re: Install Python for Scientific Computing on cluster - tarball too large and caused Network-layer error: Broken pipe. 11-17-2021 12:57 AM
- Posted Re: Install Python for Scientific Computing on cluster - tarball too large and caused Network-layer error: Broken pipe on Installation. 11-16-2021 11:45 PM
- Posted Install Python for Scientific Computing on cluster - tarball too large and caused Network-layer error: Broken pipe on Installation. 11-08-2021 11:11 PM
- Posted Re: Can't log in on command line on Security. 10-19-2021 01:30 AM
- Posted Re: Rolling restart hung on "Reassigning primaries" on Splunk Enterprise. 10-11-2021 09:06 PM
- Posted Re: Setting up HEC (HTTP Event Collector) in a indexer cluster on Getting Data In. 07-27-2021 02:15 AM
- Posted Re: Setting up HEC (HTTP Event Collector) in a indexer cluster on Getting Data In. 07-27-2021 01:48 AM
- Posted Setting up HEC (HTTP Event Collector) in a indexer cluster on Getting Data In. 07-27-2021 01:10 AM
- Posted Re: Search Head Cluster: how to modify and replicate props.conf and transforms.conf? on Splunk Enterprise. 07-21-2021 08:41 PM
- Posted Search Head Cluster: how to modify and replicate props.conf and transforms.conf? on Splunk Enterprise. 07-21-2021 07:15 PM
- Posted Re: How to get the search query from a search sid using restful API? on Splunk Enterprise. 03-28-2021 09:53 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
11-13-2023
06:40 PM
I want to point out that these two warnings are breaking my jobs because on some machines I am using the splunkforwarder CLI to run query on the splunk cluster and export the result to files. https://docs.splunk.com/Documentation/Splunk/9.1.1/Search/ExportdatausingCLI These two extra warning lines were now written to the export files as well. I think it is ok for the CLI to print warnings, but the splunk CLI should follow the best practice and write these warnings to the stderr. But it's writing them to the stdout, so that we can't use the standard practice of " 2> err.txt 1> export.csv" to handle warnings. Now I have to add these to ALL the script files which are running the splunkforwarder CLI, which is pretty ugly: " | grep -vi "warning:" > export.csv" Wish there is a flag to disable warnings, or the splunkforwarder CLI should at least write them to stderr instead of stdout.
... View more
10-17-2023
08:58 PM
I think the bin command never really works with the start or end parameter as documented. 😟 For me, I need a simple behavior like this: For a span of 10: 1 = 1-10 2 = 1-10 10 = 1-10 11 = 11-20 19 = 11-20 20 = 11-20 21 = 21-30 So I created a macro called bin2 like this: macro body: eval $data$=$data$-1 | bin span=$span$ $data$ as bucket | eval $data$=$data$+1 | rex field=bucket "^(?<_bin_start>\d+)" | rex field=bucket "\-(?<_bin_end>\d+)$" | eval _bin_start=_bin_start+1 | eval bucket=_bin_start."-"._bin_end | fields - _bin_start, _bin_end marco arguments: data,span And here is an example query: | makeresults count=1 | eval data = "1,5,9,10,11,19,20,25,29" | makemv data delim="," | mvexpand data | `bin2(data, 10)` | table data, bucket And here is the result: data bucket 1 1-10 5 1-10 9 1-10 10 1-10 11 11-20 19 11-20 20 11-20 25 21-30 29 21-30
... View more
04-02-2023
11:38 PM
I have the same question. The new color scheme is not easy on the eyes of our users.
... View more
11-16-2021
11:45 PM
4 Karma
I have resolved the problem myself. On the deployer, the size of the folder /opt/splunk/etc/shcluster/apps/Splunk_SA_Scientific_Python_linux_x86_64 kept growing because several older versions of "Python for Scientific Computing" were deployed in the past (which is normal) and the libraries for Python 2.7, 3.7 and 3.8 (the latest one) were all inside, resulting in the folder's total size becoming like 5GB. The solution is to remove the Splunk_SA_Scientific_Python_linux_x86_64 folder, then un-tar the python-for-scientific-computing-for-linux-64-bit_300.tgz file, and then masterBundlePush.sh won't fail this time.
... View more
11-08-2021
11:11 PM
2 Karma
I tried to upgrade Python for Scientific Computing to v5.3 on my cluster. I followed the instructions in here and first un-tar the add-on on my master node. However, whenever I ran /opt/splunk/bin/splunk apply shcluster-bundle, I will always get this error. Error while deploying apps to first member, aborting apps deployment to all members: Error while updating app=Splunk_SA_Scientific_Python_linux_x86_64 on target=https://172.18.109.2:8089: Network-layer error: Broken pipe This kind of error didn't happen when I installed another smaller add-on earlier this morning. And after failing with that error multiple times, I noticed the doc says: If you attempt to push a very large tarball (>200 MB), the operation might fail due to various timeouts. Delete some of the contents from the tarball's app, if possible, and try again. Since the original python-for-scientific-computing-for-linux-64-bit_300.tgz is already 480MB, and the size of the un-tar and unzipped /opt/splunk/etc/shcluster/apps/Splunk_SA_Scientific_Python_linux_x86_64 folder on the master node is 2.5G! I bet the large tarball size is the problem. But how can I solve this problem? What contents from the tarball's app can I delete?
... View more
10-19-2021
01:30 AM
I hit the same problem recently. At the end I resolved the problem by using the -auth CLI parameter instead of inputing the password at the "Password:" prompt.
... View more
10-11-2021
09:06 PM
1 Karma
Currently at 8.0.7, but I had this same issue many times before across many other versions. Each time I resolved this by restarting the Splunk service on the indexer which has the status "reassigning primaries".
... View more
07-27-2021
02:15 AM
Thanks for the links. I have read them before I post this question here, as they don't provide a clear high-level picture which list out the options we have.
... View more
07-27-2021
01:48 AM
That's clear now. I hope Splunk can update their doc to at least give us a high level picture.
... View more
07-27-2021
01:10 AM
I am trying to set up HEC for my indexer cluster (v8.0.7), with 2 indexers (and 3 search heads) managed by a master node. I read multiple docs and articles already, but I want to make sure I get some basic ideas correct first. In a non-clustered env, it's simple and each HEC client will talk to port 8088 of one indexer. But in an indexer cluster environment: Which server will an HEC client talk to? How can "load balancing of indexing" be achieved? Is the master node in any way involved?
... View more
Labels
- Labels:
-
HTTP Event Collector
07-21-2021
08:41 PM
Thanks. I can do a searchable rolling restart through the UI as well, which is what I am doing. I think my question is whether config changes such as new configured prop extraction can be added / modified without requiring any rolling restart.
... View more
07-21-2021
07:15 PM
The env is a search head cluster with 3 search heads. Whenever I need to add a new transforms-extract, or a new props-extract, I need to modify the file /opt/splunk/etc/apps/search/local/props.conf, copy it over to all search heads, and then do a rolling restart. The copy part isn't a problem (just run a script), but the rolling restart is disruptive to the production environment and every time it causes a long wait. Is there a smoother way to modify props.conf and transforms.conf and replicate their contents in a search head cluster environment?
... View more
Labels
- Labels:
-
configuration
03-28-2021
09:53 PM
It works. Thanks a lot!
... View more
03-28-2021
09:07 PM
I have a search SID, and currently I am getting its result using the API api/search/jobs/<sid>/results However, I also need to access the search query string behind this search result. Is there an API for getting that?
... View more
12-18-2020
01:58 AM
Same here. I also ran these tests against my S3-compliant remote storage, and I have a similar set of errors (see attached). However, according to this article, even AWS S3 itself can't pass all the tests. So which tests failures are acceptable? s3tests.functional.test_s3.test_bucket_list_delimiter_prefix ... FAIL s3tests.functional.test_s3.test_bucket_list_delimiter_prefix_underscore ... FAIL s3tests.functional.test_s3.test_bucket_list_return_data ... FAIL s3tests.functional.test_s3.test_bucket_list_return_data_versioning ... FAIL s3tests.functional.test_s3.test_bucket_list_marker_versioning ... ERROR s3tests.functional.test_s3.test_bucket_notexist ... FAIL s3tests.functional.test_s3.test_bucket_delete_notexist ... FAIL s3tests.functional.test_s3.test_bucket_delete_nonempty ... ERROR s3tests.functional.test_s3.test_bucket_create_delete ... ERROR s3tests.functional.test_s3.test_object_read_notexist ... ERROR s3tests.functional.test_s3.test_object_create_unreadable ... ERROR s3tests.functional.test_s3.test_bucket_create_naming_bad_long ... FAIL s3tests.functional.test_s3.test_bucket_create_naming_bad_punctuation ... FAIL s3tests.functional.test_s3.test_bucket_delete_nonowner ... FAIL s3tests.functional.test_s3.test_bucket_create_naming_good_starts_alpha ... ERROR s3tests.functional.test_s3.test_bucket_create_naming_good_starts_digit ... ERROR s3tests.functional.test_s3.test_bucket_create_naming_good_contains_period ... ERROR s3tests.functional.test_s3.test_bucket_create_naming_good_contains_hyphen ... ERROR s3tests.functional.test_s3.test_object_copy_bucket_not_found ... FAIL s3tests.functional.test_s3.test_multipart_upload_empty ... ERROR s3tests.functional.test_s3.test_multipart_upload_small ... ERROR s3tests.functional.test_s3.test_multipart_upload ... ERROR s3tests.functional.test_s3.test_multipart_copy_special_names ... ERROR s3tests.functional.test_s3.test_multipart_upload_resend_part ... ERROR s3tests.functional.test_s3.test_multipart_upload_multiple_sizes ... ERROR s3tests.functional.test_s3.test_multipart_upload_size_too_small ... ERROR s3tests.functional.test_s3.test_multipart_upload_contents ... ERROR s3tests.functional.test_s3.test_multipart_upload_overwrite_existing_object ... ERROR s3tests.functional.test_s3.test_list_multipart_upload ... ERROR s3tests.functional.test_s3.test_multipart_upload_missing_part ... ERROR s3tests.functional.test_s3.test_multipart_upload_incorrect_etag ... ERROR s3tests.functional.test_s3.test_bucket_acls_changes_persistent ... ERROR s3tests.functional.test_s3.test_ranged_request_response_code ... ERROR s3tests.functional.test_s3.test_ranged_request_skip_leading_bytes_response_code ... ERROR s3tests.functional.test_s3.test_ranged_request_return_trailing_bytes_response_code ... ERROR s3tests.functional.test_s3.test_ranged_request_invalid_range ... ERROR s3tests.functional.test_s3.test_ranged_request_empty_object ... ERROR s3tests.functional.test_s3.test_versioning_obj_create_read_remove ... ERROR s3tests.functional.test_s3.test_versioning_obj_create_read_remove_head ... ERROR s3tests.functional.test_s3.test_versioning_obj_create_versions_remove_all ... ERROR s3tests.functional.test_s3.test_versioning_obj_create_versions_remove_special_names ... ERROR s3tests.functional.test_s3.test_versioning_obj_create_overwrite_multipart ... ERROR s3tests.functional.test_s3.test_versioning_multi_object_delete ... ERROR s3tests.functional.test_s3.test_versioning_multi_object_delete_with_marker ... ERROR s3tests.functional.test_s3.test_versioned_concurrent_object_create_concurrent_remove ... ERROR s3tests.functional.test_s3.test_versioned_concurrent_object_create_and_remove ... ERROR s3tests.functional.test_s3.test_versioning_bucket_atomic_upload_return_version_id ... ERROR s3tests.functional.test_s3.test_versioning_bucket_multipart_upload_return_version_id ... ERROR
... View more
12-16-2020
02:14 AM
That's very clear now. Thanks a lot!
... View more
12-16-2020
12:04 AM
@scelikok Thanks a lot. It makes sense. But then what does the statement "The home path and cold path of each index must point to the same partition." in the doc really mean?
... View more
12-15-2020
11:10 PM
In https://docs.splunk.com/Documentation/Splunk/8.0.7/Indexer/AboutSmartStore, there is a statement saying that "The home path and cold path of each index must point to the same partition." I am considering migrating some of the indexes in my clustered indexers to SmartStore. However, most of my indexes have their home path on an SSD partition, with the cold path on a HDD partition. With the statement above, does it mean that I cannot migrate them to SmartStore?
... View more
Labels
- Labels:
-
smartstore
07-31-2020
02:14 AM
Tried this on the search heads. Restarted them but the default Time Picker in Pivot Edit is still "All Time". We are also trying to promote the user of Data Models, but the default "All Time" is a real concern, as most biz users will use whatever default is there, and all these will put lots of strain on the servers.
... View more
03-06-2020
08:06 PM
I have a similar problem, and I ended up writing a custom command which makes use of the Python emoji module to detect emoji in the string.
https://pypi.org/project/emoji/
And here are some info about custom commands, in case you're not familiar with it.
http://dev.splunk.com/view/python-sdk/SP-CAAAEU2
https://www.splunk.com/blog/2014/04/14/building-custom-search-commands-in-python-part-i-a-simple-generating-command.html
... View more
03-04-2020
07:50 PM
From here I know that there are two ways to update the MMDB, which is used by iplocation . https://www.splunk.com/en_us/blog/tips-and-tricks/updating-the-iplocation-db.html
My MMDB file is updated monthly. My question is: do I need to restart my indexer after the file upgrade? Or is there a better way?
... View more
- Tags:
- splunk-enterprise
Labels
- Labels:
-
upgrade
02-12-2019
08:51 PM
1 Karma
Below is the Bash script to change the ACL of a saved search:
URL="https://splunksearch3.shatin.link:8089/servicesNS/nobody/search_migration_app/saved/searches/discuss-user-vt-count/acl"
NEW_OWNER="user1"
READ="batch,teamA"
WRITE="teamB"
curl -k -u admin:$PWD $URL -d owner=$NEW_OWNER -d perms.read=$READ -d perms.write=$WRITE \
-d removable=1 -d sharing="global"
I found that I cannot change the removable attribute. After running the script, the permissions and owner are set correctly, but not the removable, it remains 0, as shown in the response below.
<?xml-stylesheet type="text/xml" href="/static/atom.xsl"?>
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
<title>savedsearch</title>
<id>https://splunksearch3.shatin.link:8089/servicesNS/nobody/search_migration_app/saved/searches</id>
<updated>2019-02-13T12:47:43+08:00</updated>
<generator build="06d57c595b80" version="7.2.3"/>
<author>
<name>Splunk</name>
</author>
<link href="/servicesNS/nobody/search_migration_app/saved/searches/_new" rel="create"/>
<link href="/servicesNS/nobody/search_migration_app/saved/searches/_reload" rel="_reload"/>
<link href="/servicesNS/nobody/search_migration_app/saved/searches/_acl" rel="_acl"/>
<opensearch:totalResults>1</opensearch:totalResults>
<opensearch:itemsPerPage>30</opensearch:itemsPerPage>
<opensearch:startIndex>0</opensearch:startIndex>
<s:messages/>
<entry>
<title>discuss-user-vt-count</title>
<id>https://splunksearch3.shatin.link:8089/servicesNS/nobody/search_migration_app/saved/searches/discuss-user-vt-count</id>
<updated>2019-02-13T12:47:43+08:00</updated>
<link href="/servicesNS/nobody/search_migration_app/saved/searches/discuss-user-vt-count" rel="alternate"/>
<author>
<name>user1</name>
</author>
<link href="/servicesNS/nobody/search_migration_app/saved/searches/discuss-user-vt-count" rel="list"/>
<link href="/servicesNS/nobody/search_migration_app/saved/searches/discuss-user-vt-count/_reload" rel="_reload"/>
<link href="/servicesNS/nobody/search_migration_app/saved/searches/discuss-user-vt-count" rel="edit"/>
<link href="/servicesNS/nobody/search_migration_app/saved/searches/discuss-user-vt-count/disable" rel="disable"/>
<link href="/servicesNS/nobody/search_migration_app/saved/searches/discuss-user-vt-count/dispatch" rel="dispatch"/>
<link href="/servicesNS/nobody/search_migration_app/saved/searches/discuss-user-vt-count/embed" rel="embed"/>
<link href="/servicesNS/nobody/search_migration_app/saved/searches/discuss-user-vt-count/history" rel="history"/>
<content type="text/xml">
<s:dict>
<s:key name="eai:acl">
<s:dict>
<s:key name="app">search_migration_app</s:key>
<s:key name="can_change_perms">1</s:key>
<s:key name="can_list">1</s:key>
<s:key name="can_share_app">1</s:key>
<s:key name="can_share_global">1</s:key>
<s:key name="can_share_user">0</s:key>
<s:key name="can_write">1</s:key>
<s:key name="modifiable">1</s:key>
<s:key name="owner">user1</s:key>
<s:key name="perms">
<s:dict>
<s:key name="read">
<s:list>
<s:item>batch</s:item>
<s:item>teamA</s:item>
</s:list>
</s:key>
<s:key name="write">
<s:list>
<s:item>teamB</s:item>
</s:list>
</s:key>
</s:dict>
</s:key>
<s:key name="removable">0</s:key>
<s:key name="sharing">global</s:key>
</s:dict>
</s:key>
</s:dict>
</content>
</entry>
</feed>
How can I change the ACL's removable attribute thru RESTFUL API? I need to do that as it's part of a migration process.
... View more
- Tags:
- splunk-enterprise
02-10-2019
11:26 PM
I have figured out what's the problem. It turned out that:
- For the new lookup which I setup using the Web UI, it eventually (need to wait for a while) gets replicated to the search peers and is usable whenever the lookup is needed in the indexer.
- For the lookups which I migrated from an existing stand-alone Splunk, where the configurations are stored in $SPLUNK_HOME/etc/apps/search_migration_app (see here), they will also work on the search peer.
- In my case, it turns out the search_head-to-search_peer replication isn't working for one of the server, and thus I got the error.
... View more
02-08-2019
07:10 AM
The error is:
[splunkindexer1] Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup 'test-lookup, name, as, name, output, id'. See search.log for more details..
I can get it to work by using local=true
lookup local=true ...
... View more
02-08-2019
02:46 AM
Re: Also, only if the lookup is needed in the indexer [ for example to lookup/transforms the data as part of indexing pipeline], you need them in the indexer cluster.
But that's not what I experienced. The lookup works in my dummy search:
| stats count | eval name="joe" | lookup test-lookup name as name output id
However, if I change it to this, it will fail as the indexer tries to use the lookup (that I found out from the search.log on the indexer):
index=some_index | rex field=uri "[?&]name=(?<name>[^\s&]+)" | lookup test-lookup name as name output id
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-05-2025
11:55 PM
|
Karma from
