About danielbb

danielbb

At the moment, our tiny indexer has very little disk space and _introspection consumes roughly GB of storage a day, is there a way to minimize the space consumed by the index besides making the retention very short?

danielbb

Great, so how do I configure the SH to send uncooked data?

danielbb

I got it, however, I'm setting these three machines and I would like the HF to send cooked data while the SH should send uncooked data to the indexer. Based on what you're saying, it appears that whenever we forward the data, it is already cooked, is it right?

danielbb

That's great, but what defines in the configurations an HF to be an HF?

danielbb

It's not clear to me how indexAndForward works, the documentation says - "Set to 'true' to index all data locally, in addition to forwarding it." Does it mean that the data is being indexed in two places? if so, what should we do to produce cooked data AND forward it to the indexer?

danielbb

We have a case where we can search and find events that match the search criteria. The client would like to see the events that are prior in time to the one that we matched via the SPL. Can we do that?

danielbb

Thank you for your insight. I do see it via https://<indexer>:8089

danielbb

We see the following on the server via the ss -tulpn tcp LISTEN 0 128 0.0.0.0:8089 0.0.0.0:* users:(("splunkd",pid=392724,fd=4)) However, the browser at http://<Indexer>:8089 returns ERR_CONNECTION_RESET. What can it be? while http://<Indexer>:8000 works as expected.

danielbb

That's gorgeous @gcusello, I see the process running - syslog 930 1 0 Jan03 ? 00:00:01 /usr/sbin/rsyslogd -n -iNONE Thank you very much! Where is the default configuration/data mount point?

danielbb

I have an indexer, a search head, and a heavy forwarder for a small installation. How do I configure them to communicate correctly?

danielbb

I'm in the process of creating a small Splunk installation and I would like to know from where I would download the syslog-ng Linux Ubuntu installation for version 20.x.

danielbb

Thanks @kiran_panchavat, About the ulimits, what are the minimal ulimits requirements?

danielbb

We are creating an installation of one indexer, one search head, and one universal forwarder with syslog, and I wonder what the minimal OS requirements are--such as disabling transparent huge pages on the indexer, file descriptors, etc. we are speaking about a bare minimum installation.

danielbb

Thank you @kiran_panchavat, How do I ensure that?

danielbb

We are about to create new VMs with the Ubuntu OS. Which version of Ubuntu is supported and recommended?

danielbb · ‎12-18-2024

I'm under the impression that HEC ingestion directly to the indexers is supported natively on cloud. I wonder whether the HEC ingestion on-prem to the indexers is supported in the same way?

danielbb · ‎12-18-2024

We have a case in which each email message is stored on the file system as a distinct file. Is there a way to ingest each file as a distinct Splunk event? I assume that UF is the right way but I might be wrong.

danielbb · ‎12-16-2024

Thank you all, since I have already the HEC cluster and it is with HFs, wouldn't it be better to have UFs since my understanding is that data flows quicker through UFs? and we don't process the data at all at this HEC cluster level.

danielbb · ‎12-13-2024

I see - $ ps -ef | grep splunk splunk 2802446 2802413 0 Dec08 ? 00:00:08 [splunkd pid=2802413] splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd [process-runner] Meaning, the user splunk runs on the host and when I sudo to be the splunk user, I don't have access the these logs files, even though they are being ingested.

danielbb · ‎12-13-2024

I love of the idea of the - HEC inputs directly on indexers (and have an LB in front of them) !

danielbb · ‎12-13-2024

We fail again and again these days when we have major spikes in ingestion, primarily with HEC. What would be a good and efficient way to detect major up/down spikes in data ingestion.

danielbb · ‎12-13-2024

On Splunk cloud, we can receive HEC ingestion directly to the cloud whereas on-prem we install distinct subclusters for HEC and struggle to scale them up with multiple down-times cases. I wonder whether it's possible for an on-prem installation to send HEC data directly to the indexers.

danielbb · ‎12-13-2024

We have a case where the data resides under /usr/feith/log/*.log and the Splunk process can read these files however, when I log in to the unix server I cannot navigate into this directory as the Splunk user. What's going on? bash-4.4$ whoami splunk bash-4.4$ pwd /usr/feith bash-4.4$ \ls -tlr total 388 ... drwxr-xr-x. 2 feith feith 4096 Dec 12 12:17 lib drwx------. 19 feith feith 4096 Dec 13 01:00 log bash-4.4$ cd log/ bash: cd: log/: Permission denied

danielbb · ‎11-29-2024

We are building a small Splunk installation in Azure and I'm not sure what the architecture should look like. The client came up with the idea based on the following link - Deploying Splunk on Microsoft Azure. They created an indexer, a search head, and a license server/cluster master. We do need to ingest syslog data from Meraki devices, so I wonder whether we need a heavy forwarder. Any thoughts?

danielbb · ‎11-29-2024

I want to use HTML on multiple panels in order to create a custom layout of my Splunk Dashboard. I want to use this layout where each rectangle is a panel - Please advise. Is this possible to implement in a Splunk Dashboard?

Posts	562
Solutions	3
Karma Given	341
Karma Received	30
Member Since	‎07-24-2019

Online Status	Online
Date Last Visited	Friday

How do I minimize the stored data of _introspectio...

How do I configure the HF to produce raw data and ...

How can we show events prior to the one that match...

Why is port 8089 not available via the UI?

How do I configure a small installation?

Where do I download the syslog-ng open source inst...

What are the requirements for a minimal Splunk ins...

On which version of Ubuntu should we install Splun...

Is there a difference between HEC ingestion on-pre...

Is there a way to ingest an entire file as an even...

How do I minimize the stored data of _introspectio...

Re: How do I configure the HF to produce raw data ...

Re: How do I configure the HF to produce raw data ...

Re: How do I configure the HF to produce raw data ...

How do I configure the HF to produce raw data and ...

How can we show events prior to the one that match...

Re: Why is port 8089 not available via the UI?

Why is port 8089 not available via the UI?

Re: Where do I download the syslog-ng open source ...

How do I configure a small installation?

Where do I download the syslog-ng open source inst...

Re: What are the requirements for a minimal Splunk...

What are the requirements for a minimal Splunk ins...

Re: On which version of Ubuntu should we install S...

On which version of Ubuntu should we install Splun...

Is there a difference between HEC ingestion on-pre...

Is there a way to ingest an entire file as an even...

Re: How can we avoid the scaling issues with on-pr...

Re: How do I fix this weird permission case?

Re: How can we avoid the scaling issues with on-pr...

How do we detect fluctuations in data ingestion?

How can we avoid the scaling issues with on-prem H...

How do I fix this weird permission case?

How can I set up a couple of VMs on Azure?

How do I use HTML on multiple panels?