About s2_splunk

s2_splunk · ‎04-02-2018

If you use INDEXED_EXTRACTIONS, you need to make sure you disable any search time field extractions for the same sourcetype. If you specify INDEXED_EXTRACTIONS=json and KV_MODE=auto/json, for example, you will get duplicate values, because the same fields are extracted twice.

s2_splunk · ‎04-02-2018

Can you share your inputs.conf from the Windows system? What index are you sending the data into? Did you specify that index when searching? Have you checked your splunkd.log on the indexer (index=_internal sourcetype=splunkd) for any error messages? Have you looked through the documentation on "Where is my data?" Have you tried running index=* host=DevilMayCry or how are you searching for the data?

s2_splunk · ‎04-02-2018

Do you have Windows firewall active and configured to allow 512/udp traffic to pass through? Do you have a Splunk listener configured to listen on port 512?

s2_splunk · ‎03-26-2018

The short answer is no, buckets will honor the configured retention policy settings and there is no way to force a freeze unless you are (temporarily) reducing the index configuration. I am not aware of any way to safely determine whether a given bucket contains only deleted events. The only way currently to physically delete events (buckets, really), is to run clean eventdata, which will wipe everything for the given index, so you'll have to come up with a plan to export/collect any events you do not want to delete. What's your use case? Compliance? New EU regulations?

s2_splunk · ‎03-26-2018

Assuming your single event contains the data you show above verbatim, i.e. The Events to be distributed are [DefaultEvent: id=3348578, DefaultEvent: id=3704843, DefaultEvent: id=3861592, DefaultEvent: id=5818286, DefaultEvent: id=3913769, DefaultEvent: id=2656002, DefaultEvent: id=8864013, DefaultEvent: id=6864594, DefaultEvent: id=8160335, DefaultEvent: id=3919134, DefaultEvent: id=3675879, DefaultEvent: id=3658778, DefaultEvent: id=9414940, DefaultEvent: id=6878139, DefaultEvent: id=8798087, DefaultEvent: id=8678035] try this: <yoursearch to find data> | rex max_match=0 "id=(?<event_id>\d+)," This should give you a multi-value field called event_id which contains a list of all ids in the event. You can then do whatever you need to do with that.

s2_splunk · ‎03-26-2018

It will stick around until the bucket is frozen. The bucket mover uses the epoch times in the bucket (directory) name and doesn't really inspect the contents of the bucket to determine whether it can be frozen or not.

s2_splunk · ‎11-16-2017

Yes, Splunk really doesn't care about the file type. As long as it is a text file and appended to, the forwarder will pick up on the changes. You may get issues if it is a csv file that is re-written periodically and the beginning of the file has repeating values (like a header row) that would prevent us from detecting whether the file has changed, because we are only looking at the first 256 bytes (by default) to determine whether we have already seen the file before. You may have to play with the initCrcLength setting in inputs.conf. But it's all guesswork on my end until you tell us more about why you think "it's not working". Your forwarder splunkd.log may give you hints as to what may be going on, too.

s2_splunk · ‎11-16-2017

Commands on a single query are executed in the sequence they appear in the SPL. The next processing step in the search is not started until the previous step has completed. So, if you do somesearch | outputlookup blah | someothercommand that uses the lookup , someothercommand will not start until the outputlookup has returned/completed.

s2_splunk · ‎11-12-2017

Your mention of HTTP event collector is throwing me off... 🙂 Port 9997 is the default port for the Splunk-2-Splunk TCP listener and your regular steps to enable forwarding apply. Can you please clarify your use of the HTTP event collector in this context? I suspect it's just a terminology issue and your problem is likely that you did not enable the SplunkForwarder app.

s2_splunk · ‎11-10-2017

You can use loadjob to retrieve your search results, if they haven't been reaped yet.

s2_splunk · ‎11-09-2017

| rest /services/authentication/current-context | table username

s2_splunk · ‎11-07-2017

I see. If the Splunk-provided TraceListener does not work for you, maybe this third-party software gets you closer to what you need.

s2_splunk · ‎11-07-2017

Can you please review Overview of Splunk logging for .NET and let us know what issues specifically you are running into, if any?

s2_splunk · ‎11-03-2017

Yes, do it on every search head that needs to search your production index cluster. For SHC, take a look here.

s2_splunk · ‎11-02-2017

If you want to search an indexer cluster, you have to connect your SH to the corresponding Cluster Master. There is no issue making a SH be search two (or more) separate indexer clusters; just add both cluster masters to your search head configuration. This is documented here.

s2_splunk · ‎11-02-2017

OK, assuming you have these settings configured in the right place (indexer or heavy forwarder), this is what you should need to make it right: TIME_PREFIX = ^ TIME_FORMAT = %b %d %H:%M:%S.%3N SHOULD_LINEMERGE = false NO_BINARY_CHECK = true MAX_TIMESTAMP_LOOKAHEAD = 30 If you don't have multi-line events, always set SHOULD_LINEMERGE to false. For single line events, the default event breaking should work just fine.

s2_splunk · ‎11-02-2017

Yes, so you are using %d for the day, which expects two digits, i.e. 01...09 for day of month <10. If you change it to %e things should look better (for newly indexed data only). See here for a reference.

s2_splunk · ‎11-02-2017

Sounds like your TIME_FORMAT specification does not cover single-digit day numbers (%e vs. %d). If you didn't explicitly configure TIME_FORMAT for this sourcetype, I would recommend you do so. It may also be your BREAK_ONLY_BEFORE pattern, hard to say without seeing your props.conf for this sourcetype. But do share your props.conf if it still doesn't make sense, please.

s2_splunk · ‎10-30-2017

Can you share the outputs.conf? Do you have a section that looks like this: [syslog:myRSAservers] type=tcp priority=nn etc. as documented here?

s2_splunk · ‎10-30-2017

Did you read through the documentation? Database Inputs are used to index data from a database. The dbxquery search command is used to execute SQL statements or stored procedures. What is your requirement that you need to execute it from a Python script? I guess it would be possible to execute a query with dbxquery and then use | collect to store the results in an index, but it would help to better understand your use case.

s2_splunk · ‎10-30-2017

There is no native Universal Forwarder for iSeries; you will have to use other means to get the data off of the environment. Options include FTP export or Message Queuing (if you run MQSeries, for example), or reading from a database via the Splunk DBConnect app. Try this, too.

s2_splunk · ‎10-30-2017

Try this: <yoursearch> | rex field=_raw "(?<eventID>\d+)\s(?<STATUS>\w+)$" This assumes that there is nothing in the event after your status value (the RegEx anchors to the end of _raw)

s2_splunk · ‎10-30-2017

I think you will find some good information on how to go about it here. Things are much easier if your "clickable field" is part of a dashboard, because you can just use drilldown functionality. There are examples for how to do that in the Splunk Dashboard Examples App.

s2_splunk · ‎10-26-2017

It sounds like you have an architectural constraint in your intermediary HEC tier. How many Heavy Forwarders do you have receiving HEC traffic and forwarding to your indexers? Ideally, you will need about 100 intermediary forwarding pipelines sending to your 53 indexer peers to prevent these data imbalance opportunities. Also, do you have forceTimeBasedAutoLB enabled on your HEC forwarders' outputs.conf? Are you using the default autoLBFrequency? You could enable forceTimeBasedAutoLB and lower your LB frequency. If you have a high-volume data source, the forwarder may not get an opportunity to switch indexers as frequently as you are expecting. Finally, having an (E)LB between your forwarders and your indexers is not a supported deployment.

s2_splunk · ‎10-26-2017

We do support a site-by-site upgrade for multi-site clusters, but the recommendation is to bring both sites to the same version as quickly as possible. This process and the constraints are documented here.

Posts	859
Solutions	132
Karma Given	2
Karma Received	345
Member Since	‎10-01-2013

Online Status	Offline
Date Last Visited	‎11-03-2021 03:43 PM

What are Splunk Validated Architectures and where ...

Where do I configure my various Splunk settings?

Re: Are there inconsistencies in behavior with the...

Re: Why can't the Splunk server index or show even...

Re: Why am I not getting syslogs on port 512?

Re: What happens to a bucket if all of the data wi...

Re: Splunk field extraction issue

Re: What happens to a bucket if all of the data wi...

Re: Continuous Evaluate File

Re: How to add delay between two commands in searc...

Re: How to forward data from DB Connect 3 to multi...

Re: How do I search within results of a search tha...

Re: How to get login id of current user ?

Re: How to configure Net4Log in .Net to send logs ...

Re: How to configure Net4Log in .Net to send logs ...

Re: Splunk architecture question

Re: Splunk architecture question

Re: Why are separate events combined as a single e...

Re: Why are separate events combined as a single e...

Re: Why are separate events combined as a single e...

Re: What is best process of sending logs from Splu...

Re: Splunk DB Connect: Index data running dbxquery...

Re: How do I install a universal forwarder on an I...

Re: How to extract event_id and STATUS?

Re: Webhooks Input: Can I create a setting so the ...

Re: Index cluster data imbalance with high vol dat...

Re: For multisite cluster indexer environment, Can...

Join the Conversation