Activity Feed
- Karma Script Input broken into events for daniel333. 06-05-2020 12:46 AM
- Got Karma for Re: HadoopConnect: How do I reset the HDFS input?. 06-05-2020 12:46 AM
- Got Karma for Re: Script Input broken into events. 06-05-2020 12:46 AM
- Karma Deployment Server listening - but not responding. for cvweiss. 06-05-2020 12:45 AM
- Karma Re: Deployment Server listening - but not responding. for bwooden. 06-05-2020 12:45 AM
- Posted Re: Script Input broken into events on Getting Data In. 10-15-2013 05:50 PM
- Posted Deployment Server not pushing apps to universal forwarder clients after Splunk 6.0 upgrade on Deployment Architecture. 10-15-2013 05:37 PM
- Tagged Deployment Server not pushing apps to universal forwarder clients after Splunk 6.0 upgrade on Deployment Architecture. 10-15-2013 05:37 PM
- Tagged Deployment Server not pushing apps to universal forwarder clients after Splunk 6.0 upgrade on Deployment Architecture. 10-15-2013 05:37 PM
- Posted Re: HadoopConnect: How do I reset the HDFS input? on Getting Data In. 07-09-2013 02:22 PM
- Posted HadoopConnect: How do I reset the HDFS input? on Getting Data In. 07-09-2013 11:55 AM
- Tagged HadoopConnect: How do I reset the HDFS input? on Getting Data In. 07-09-2013 11:55 AM
- Tagged HadoopConnect: How do I reset the HDFS input? on Getting Data In. 07-09-2013 11:55 AM
- Tagged HadoopConnect: How do I reset the HDFS input? on Getting Data In. 07-09-2013 11:55 AM
- Tagged HadoopConnect: How do I reset the HDFS input? on Getting Data In. 07-09-2013 11:55 AM
- Tagged HadoopConnect: How do I reset the HDFS input? on Getting Data In. 07-09-2013 11:55 AM
Topics I've Started
10-15-2013
05:50 PM
1 Karma
Is your input coming in from a universal forwarder? If I'm not wrong, you have to put the props.conf somewhere else (e.g. on the heavy forwarder or the indexer) for its rules to work since universal forwarders have limited props.conf capability.
Another thing you can try is to specify the LINE_BREAKER in the props.conf
... View more
10-15-2013
05:37 PM
I just upgraded the cluster (search head, indexers, heavy forwarders, etc except universal forwarders) to splunk 6.0. I have several new machines to add universal forwarders too, so I install the splunk universal forwarder 6.0 onto these new machines. However, these new machines don't seem to be getting the apps.
Other machines in the same server class continue to have the same apps (although these are universal forwarders v 5.0.4); furthermore, in the new forwarder management UI on my deployment server it says that the apps have been deployed for these new machines, which is clearly not true. Does anyone have any idea? I haven't changed anything except for installing the universal forwarder 6.0 onto the new machines.
EDIT: my deploymentclient.conf was configuered as such on the universal forwarders:
[deployment-client]
phoneHomeIntervalInSecs = 600
[target-broker:deploymentServer]
targetUri = x.x.x.x:8089
When I remove the phoneHomeIntervalSecs = 600, it worked and the apps got pushed. Why is this the case? In the documentation, phoneHomeIntervalSecs is a valid configuration line for the [deployment-client] stanza.
... View more
07-09-2013
02:22 PM
1 Karma
Found it: The state data is in $SPLUNK_HOME/var/lib/splunk/modinputs/hdfs . Deleting the file(s) in this seems to make splunk index everything again.
... View more
07-09-2013
11:55 AM
I have a folder in HDFS that has log files continuously being put into it. I decided to test the HadoopConnect app's import feature and created a test index to store data. Then, I added the folder to the input via the web interface on HadoopConnect. The data imports successfully, and new files are being indexed correctly too.
I decide that I would like to use the app, and delete the test index and input. Then, I add the same input again. However, it seems that there is some persistency in the HDFS file monitoring because only new files are getting indexed. The old ones aren't anymore.
I'd like to know if there is a way to reset this persistent state? I tried deleting $SPLUNK_HOME/var/lib/splunk/persistentstorage/fschangemanager_state because it seemed like a good candidate but to no avail. Please advise, thanks.
... View more
