Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About danielsofoulis
danielsofoulis
Path Finder
Member since:
10-28-2016
06-05-2020
Community Statistics
| Posts | 14 |
| Solutions | 2 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 10-28-2016 |
Activity Feed
- Got Karma for How to write a search to identify the total amount of data is being indexed by MB per minute?. 06-05-2020 12:48 AM
- Posted Re: Why do I have so many established TCP connections from one host? on Getting Data In. 05-17-2017 05:20 PM
- Posted Re: Pick up the first occurrence of a word on Splunk Search. 05-02-2017 09:38 PM
- Posted Re: SPL: extract logfile name from source field on Splunk Search. 04-20-2017 05:57 PM
- Posted Re: SPL: extract logfile name from source field on Splunk Search. 04-20-2017 05:40 PM
- Posted Re: SPL: extract logfile name from source field on Splunk Search. 04-20-2017 05:39 PM
- Posted SPL: extract logfile name from source field on Splunk Search. 04-20-2017 04:50 PM
- Tagged SPL: extract logfile name from source field on Splunk Search. 04-20-2017 04:50 PM
- Tagged SPL: extract logfile name from source field on Splunk Search. 04-20-2017 04:50 PM
- Tagged SPL: extract logfile name from source field on Splunk Search. 04-20-2017 04:50 PM
- Tagged SPL: extract logfile name from source field on Splunk Search. 04-20-2017 04:50 PM
- Posted Re: Why does the "splunk rebuild" command require restarting Splunk? on Deployment Architecture. 03-24-2017 02:57 AM
- Posted Re: Splunk is not indexing my text file on Splunk Dev. 03-24-2017 02:44 AM
- Posted Why do I have so many established TCP connections from one host? on Getting Data In. 03-24-2017 02:10 AM
- Tagged Why do I have so many established TCP connections from one host? on Getting Data In. 03-24-2017 02:10 AM
- Tagged Why do I have so many established TCP connections from one host? on Getting Data In. 03-24-2017 02:10 AM
- Tagged Why do I have so many established TCP connections from one host? on Getting Data In. 03-24-2017 02:10 AM
- Tagged Why do I have so many established TCP connections from one host? on Getting Data In. 03-24-2017 02:10 AM
- Tagged Why do I have so many established TCP connections from one host? on Getting Data In. 03-24-2017 02:10 AM
- Posted Re: Why is Perfmon Memory not showing up in Windows Server 2008 R2? on All Apps and Add-ons. 02-06-2017 02:26 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
05-17-2017
05:20 PM
Not sure what caused this issue but I suspect it was related to the OS. Previously I had restarted Splunkd which did not fix the issue. Later after lodging this case I restarted the operating system which resolved the issue.
... View more
05-02-2017
09:38 PM
Try this
index=index1 | rex field=requestURl \w+\/test(?<error>Error) | fields error
... View more
04-20-2017
05:57 PM
I've managed to get it working using
rex field=source "\w+\(?P[\w+]+)_accessLog\S+$"| top 20 site
... View more
04-20-2017
05:40 PM
Hi thanks for you help, but I'm also getting an error when I run your rex:
Error in 'rex' command: Encountered the following error while compiling the regex 'logs(
... View more
04-20-2017
05:39 PM
Thank you for answering. I ran the search with the rex you provided and got the following error:
Error in 'rex' command: Encountered the following error while compiling the regex '(?P[^]+)[^]$': Regex: missing terminating ] for character class
... View more
04-20-2017
04:50 PM
Hi, I am trying to setup a dropdown bar for a dashboard and would like to setup dynamic inputs based on the source log file, as there are many different sites being built and torn down.
example source log name:
D:\Apache\logs\example.com.au_accessLog_2017-04-20-00_00_00.log
I would like to extract "example.com.au" from the above source log file and drop everything else. Then make it a distinct value. This value would then be selectable in the dropdown bar to filter on that site.
This is what I've attempted but is not returning what I need.
index=example sourcetype=test:access | eval baseurl = mvindex(split(source,"/", -1) | top baseurl
Thanks in advance.
... View more
03-24-2017
02:57 AM
Archived/Fozen data is not searchable in Splunk as you're probably aware.
When you rebuild the data is loaded to the nominated thawed directory. This process is different from the initial indexing. When Splunk is restarted the search flags are reallocated by splunkd which is why you must restart.
Hope this helps.
... View more
03-24-2017
02:44 AM
When searching select ALL TIME, this has tripped me up before especially if the test logs are old.
I'm not sure if you want to ingest the whole directory or a file named logs.
Try using creating a folder logs and putting your test file inside and then use the following stanza.
[monitor://D:\logs\*]
You could also confirm connectivity by using telnet
telnet SPLUNK_IP 9997
Another thing you could do is a one shot command. This will ingest the file regardless of whether the file has been ingested before.
SPLUNK_HOME\bin\splunk add oneshot D:\logs -index pad -sourcetype shed
http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorfilesanddirectoriesusingtheCLI
... View more
03-24-2017
02:10 AM
I have a Windows host (192.168.2.2) which has a universal forwarder installed and is setup to talk to my single instance Splunk.
I have added the windows app with only 2 perfmon counters being monitored.
The Windows host run hyper-V which runs the Splunk instance.
As you can see below I have normal connections from other hosts, but for some reason the Windows host has established multiple tcp connections to Splunk. The list of connections keep growing, so I have to stop Splunkd service on the windows host.
netstat -aon | grep 9997
tcp 0 0 0.0.0.0:9997 0.0.0.0:* LISTEN off (0.00/0/0)
tcp 0 0 192.168.2.3:9997 192.168.2.2:54228 ESTABLISHED keepalive (6993.74/0/0)
tcp 0 0 192.168.2.3:9997 192.168.2.2:54234 ESTABLISHED keepalive (7073.10/0/0)
tcp 0 0 192.168.2.3:9997 192.168.2.2:54241 ESTABLISHED keepalive (7132.44/0/0)
tcp 0 0 192.168.2.3:9997 192.168.2.2:54216 ESTABLISHED keepalive (6921.62/0/0)
tcp 0 0 192.168.2.3:9997 192.168.2.2:54217 ESTABLISHED keepalive (6940.68/0/0)
tcp 0 0 192.168.2.3:9997 192.168.2.4:34608 ESTABLISHED keepalive (4530.40/0/0)
tcp 0 0 192.168.2.3:9997 192.168.2.102:52379 ESTABLISHED keepalive (4516.28/0/0)
tcp 0 0 192.168.2.3:9997 192.168.2.2:54229 ESTABLISHED keepalive (7015.83/0/0)
tcp 0 0 192.168.2.3:9997 192.168.2.1:53925 ESTABLISHED keepalive (4518.96/0/0)
tcp 0 0 192.168.2.3:9997 192.168.2.2:54251 ESTABLISHED keepalive (7191.76/0/0)
I have tried restarting Splunkforwarder service, uninstalling and reinstalling Splunk forwarder.
The connections finish but once I start or reinstall the forwarder, the TCP connections start again.
There is nothing special in my etc/system/local/outputs.conf
outputs.conf
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
server = serlin001:9997
[tcpout-server://serlin001:9997]
Splunk Free Trial 6.5.2
Splunk Universal Forwarder 6.5.2
... View more
02-06-2017
02:26 PM
I'm having the same issue.
... View more
11-02-2016
09:07 PM
Does this method of deleting indexes only remove the index from searching, but the data in that index is still stored on the servers? is that correct?
... View more
11-02-2016
08:32 PM
I would like to delete an index in Splunk using the following command.
splunk remove index
Just wondering where I should run this command? e.g. only on the Cluster Master (CM)? or on the indexers and CM?
I'm aware that data which is pointed to this index will be lost, any other risks I should be aware of?
... View more
10-28-2016
08:43 PM
Thank up for your help.
... View more
10-28-2016
01:30 AM
1 Karma
I need to identify the total amount of data is being indexed by my indexer cluster, by MB per minute.
I think the best way would be to search against the license.log file but I am having trouble with writing the search.
Any assistance is greatly appreciated.
... View more
