Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About teunlaan
teunlaan
Contributor
Member since:
07-03-2012
03-10-2023
Community Statistics
| Posts | 110 |
| Solutions | 11 |
| Karma Given | 3 |
| Karma Received | 47 |
| Member Since | 07-03-2012 |
Activity Feed
- Posted How to force delete savedsearch results after x time , disable " AutomIatic lifetime extensions"? on Splunk Search. 02-09-2023 08:41 AM
- Got Karma for Re: Can you update the Splunk manifest so that it will not throw warnings about it being modified?. 11-10-2022 07:31 AM
- Posted Re: How do I find the time events have been sent in for the last 3 days. I want to see the time 53 different events came on Splunk Search. 04-08-2022 01:08 AM
- Got Karma for Re: Why are realtime searches disliked in the Splunk world?. 01-25-2022 10:47 AM
- Posted Re: Universal Forwarder to remove files on Installation. 01-11-2022 04:56 AM
- Posted Re: UF's are disappearing from ForwarderManagement on Deployment Architecture. 01-11-2022 04:30 AM
- Got Karma for Re: UF's are disappearing from ForwarderManagement. 01-11-2022 03:38 AM
- Posted Re: UF's are disappearing from ForwarderManagement on Deployment Architecture. 12-31-2021 03:15 AM
- Got Karma for Re: How do I change the order of apps in the dropdown menubar?. 08-26-2021 09:11 AM
- Posted Re: Adaptive Response Action Send email not sending results on Splunk Enterprise Security. 08-01-2021 08:57 PM
- Got Karma for Re: Adaptive Response Action Send email not sending results. 07-29-2021 05:50 PM
- Posted Re: Adaptive Response Action Send email not sending results on Splunk Enterprise Security. 07-14-2021 02:43 AM
- Got Karma for Re: How do I get large LDAP/AD Groups (>1500 members) to work in Splunk?. 03-02-2021 07:42 AM
- Posted Re: CMMaster - Unable to send scheduled jobs on Splunk Enterprise. 11-30-2020 11:44 PM
- Got Karma for Re: Alert scheduling - cron expression not working as expected. 11-20-2020 05:26 AM
- Posted Re: The TCP output processor has paused the data flow on Getting Data In. 11-20-2020 12:39 AM
- Posted Re: Alert scheduling - cron expression not working as expected on Alerting. 11-20-2020 12:22 AM
- Got Karma for Re: Why are realtime searches disliked in the Splunk world?. 06-05-2020 12:50 AM
- Got Karma for Re: Search failing and not returning all results in Statistics. 06-05-2020 12:50 AM
- Got Karma for Re: DBConnect: OSError: [Errno 2] No such file or directory validate java command: /usr/java/latest/bin/java.. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
02-09-2023
08:41 AM
Is there a setting that stops the "AutomIatic lifetime extensions" (https://docs.splunk.com/Documentation/Splunk/9.0.3/Search/Extendjoblifetimes) of scheduled searches?
We have some dashboard with scheduled searches , refreshed every x time, that are mainly used during business hours. so we scheduled them for only the business hours. Sometime someones need to look at the dash in the night.
To be sure, they see a recent result we changed the dispatch.ttl too 600 (normally its run every 5 minutes) . So if the last schedule would be @6 pm, the results should be gone @6:10 pm . If someone opens the dash @ 8pm, there aren't any results, and the search should run again.
Now the real problem, some people aren't closing the dashboard. So the last run (that was @ 6 pm) keeps getting extended! So if someone else needs to take a look at the dashboard it's displaying the last run!
So is there a setting to force the results to be deleted after x period?
... View more
Labels
- Labels:
-
search job inspector
04-08-2022
01:08 AM
So you want to see WHEN the event arrived at the indexer? So tou need the see the indextime index=your search | rename _indextime as indextime | eval indextime=strftime(indextime,"%Y-%m-%d %H:%M:%S") | table _time indextime _raw This shows: _time = time splunk thinks it is indexertime = time splunk saved thet data to disk _raw = the event
... View more
01-11-2022
04:56 AM
You can use the batch/sinkhole config to delete the file after (succesfully) sending the data. (add ACK to be sure the data is indexed). BUT.... you'll have to be 100% sure the application that is writing to the file (you delete) doens't crash when the file is suddenly "gone". Some appications don't create a new log file, if the original is removed when the appliaction is still running Usually the "data provider" needs to clean up there files.
... View more
01-11-2022
04:30 AM
So what is the internal log of the UF's telling? Do they try connect but it fails, or don't they even try. You state they connect 1 time and than it stops., what is strange. Check if you arn't pushing a deploymentclient.conf. And is the config you're pushing restarting the Forwarder? if yes: try changing your serverclass so it does not restart the UF, see if it keeps the conection (maybe something failes @ the restart)
... View more
12-31-2021
03:15 AM
1 Karma
Please check if your deployment server is not restarting/crashing. The deployment server won't show any UF clients if it just restarted. Only after de UF clients called home it will pop-up.
... View more
08-01-2021
08:57 PM
Made a report to Splunk > Fixed in ES 6.6.0 Workaround: openen your alert in "searches, reports & Alerts" and Save it again. then it should work
... View more
07-14-2021
02:43 AM
1 Karma
Did you get a solution for this? We are seeing the same thing. I did some tests and it looks like the following option in not set in the savedsearches.conf : action.email.sendresults = 1 It always is 0 (and doesnt send anything) whatever you select.
... View more
11-30-2020
11:44 PM
Just installed 8.1.0.1 (test environment 7.3.3 > 8.1.0.1) It doesn't fix it. Log is still filling with " WARN Fixup - GenCommitFixup::finish error in scheduler sendQueued= " Did some more testing. Issues evens pops-up, with a clean install. installed 2 machines, just clean install. As soon de indexer connects to the clutser-master the Warning pops-up. firewall is disabled
... View more
11-20-2020
12:39 AM
Did you check firewall's? If your forwarder can't connect the indexer, you get the same message
... View more
It's not a bug, crontab.guru gives the correct explenation. "At 09:00 on every day-of-month from 1 through 7 and on Monday in February, May, August, and November.” the 16th was a Monday
... View more
06-03-2020
04:19 AM
maybe, maybe not.
There is not much information you're giving us. Can your searches be summarized, or is it better to post-process your searches.
Or is the hardware the problem? What is the data volume, how many indexers, ect, ect
... View more
01-22-2020
05:19 AM
14 Karma
To "fix" it:
Use splunk_app_db_connect/bin/dbx2/jre_validator.py form version 3.1.4
OR change the code of the 3.2.0 version line 23:
if isinstance(command, basestring):
... View more
Problem is fixed in Release 7.3.X (tested)
You need to edit the authentication.conf, add enableRangeRetrieval = 1 to your LDAP settings
enableRangeRetrieval = <boolean>
* OPTIONAL
* The maximum number of values that can be retrieved from one attribute in a
single LDAP search request is determined by the LDAP server. If the number of
users in a group exceeds the LDAP server limit, enabling this setting fetches all
users by using the "range retrieval" mechanism.
* Enables result sets for a given attribute that exceed the maximum number of
values defined for the LDAP server.
* If set to false, ldap range retrieval is off.
* Default: false
... View more
07-23-2019
05:58 AM
oh you are renameing an index. So index=bla becomes index=testingbla ?
not sure if a cluster "likes" changing names of an index, and still can find the data
where did you place the "restored" data? did you place it in the thawed directory?
You could thy a rebuild, but you need too do this for every bucket !
... View more
07-19-2019
04:31 AM
We collect HEC on a heavy, and enable it in the following way
1) enable hec on the heavy splunk http-event-collector enable
2) push the rest of the setting By the deployment server.
So it the app isn't pushed, did you configure the serverclass?
Also please use a different app name, like 'splunk_httpinput-custom' so you're 100% sure it won't overwrite the settings on your heavy
... View more
07-19-2019
04:16 AM
1 Karma
dnslookup can be a killer indeed. Please check if your DNS server if it can handle all the request. + check your timeout settings for DNS request.
... View more
07-19-2019
04:00 AM
1) How do you know stuff is missing?
2) are you missing a single index, or a certain time frame?
3) Why do you backup and restore data from 1 machine in your cluster? Wouldn't it be much simpelere too add a new machine and than remove the old one? Then splunk would take care of you repliaction.
Did you add you new server in the cluster pool?
... View more
05-10-2019
05:12 AM
also check the permissions of your files, and check if there there are no "hidden" files
... View more
05-06-2019
04:43 AM
What is "a few weeks ago" ?? the Trail license is for only 60 day's
... View more
05-06-2019
04:30 AM
They fixed some cron issues in v 7.2.3. So it could be your cron's a now behaving in an other way then before
Blockquote 2018-12-21 SPL-164242, SPL-164210 A search scheduled to run monthly or weekly may run daily. "Next Scheduled Time" is incorrect due to cron parsing issue
But it looks like they didn't fix it, or broke something else
Did you file a Bug?
... View more
04-18-2019
04:27 AM
We are running ES with the ess_admin user only, And it works!.
BUT you need to be sure there are no references to admin in de default.meta.
Some config is "owned by admin" and it will fail is tou don't remove is.
We run this to be sure admin is removed:
find . -type f -name default.meta -exec sed -i 's/owner = admin/#owner = admin/g' {} +
and
find . -name *.meta -type f -print | xargs sed -i '/^access/c\access = read : [ * ], write : [ ess_admin ]'
... View more
04-18-2019
03:48 AM
If you're not rolling your buckets every single day, it is hard to get the correct buckets of the system.
What I can think off you could do:
1) export the data (in _raw) and reindex it in your cluster OR
2) user the "|collect " command to move ONLY the data you need to a new index on your standalone server. And compy the complete directory of the new index to one of your cluster systems (data won't be replicated, i I remeber it well)
... View more
04-12-2019
02:11 AM
We have seen it. Did you clear your browser cache? It solved it in our case
... View more
I always ask the customer, that creates dashboard with realtime searches, if they ever : look away from the screen, get something to drink, go too the bathroom, go out for lunch, ect, ect. If it's YES , they don't need realtime 🙂
For customers that creat relatime alerts, with email output. Just aks how often the check the mail. If the say "always", start emailing them in the weekend, and complain why did didn't respond within a few second
... View more
01-24-2019
10:59 PM
have you checked for data in "the past" or "in the furure"? If timestamp recognition goes wrong, data can be indexed at the wrong time
... View more
