Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About kyaparla
kyaparla
Path Finder
Member since:
06-29-2014
03-31-2024
Community Statistics
| Posts | 39 |
| Solutions | 4 |
| Karma Given | 8 |
| Karma Received | 13 |
| Member Since | 06-29-2014 |
Activity Feed
- Tagged Why am I getting partial results on some indexers? on Deployment Architecture. 03-02-2022 09:42 AM
- Posted Why am I getting partial results on some indexers? on Deployment Architecture. 03-02-2022 07:54 AM
- Posted Re: malformedEventIndex, how to troubleshoot and fix logs ending up here on Getting Data In. 09-16-2021 07:01 AM
- Posted High IO on 2/33 indexers brought down whole cluster on Deployment Architecture. 08-26-2021 08:54 AM
- Karma Export PDF option does not work for simpkins1958. 06-05-2020 12:49 AM
- Got Karma for Re: How to subset top N records from the number generated from eventstats. 06-05-2020 12:49 AM
- Got Karma for Re: What am I doing wrong in this regex?. 06-05-2020 12:49 AM
- Got Karma for Re: Count by column with clausule where and fill with 0 if not found. 06-05-2020 12:49 AM
- Got Karma for Re: Export PDF option does not work. 06-05-2020 12:49 AM
- Got Karma for Re: How to pass token during check and uncheck of the checkbox?. 06-05-2020 12:49 AM
- Got Karma for Re: How to pass token during check and uncheck of the checkbox?. 06-05-2020 12:49 AM
- Got Karma for Re: How to pass token during check and uncheck of the checkbox?. 06-05-2020 12:49 AM
- Got Karma for Re: How to pass token during check and uncheck of the checkbox?. 06-05-2020 12:49 AM
- Got Karma for Re: How to pass token during check and uncheck of the checkbox?. 06-05-2020 12:49 AM
- Karma Re: How to access an accelerated data model on Search Head A from Search Head B with the data stored in an indexer cluster? for muebel. 06-05-2020 12:48 AM
- Karma Re: ModularInput Can't connect to Splunk REST API token is invalid or SplunkD has exited HTTP 401 for Damien_Dallimor. 06-05-2020 12:48 AM
- Karma Is it possible to integrate Oracle Enterprise Manager with Splunk? for lightech1. 06-05-2020 12:48 AM
- Karma Re: How to use JavaScript or Cookies to capture values from input fields in a simple xml dashboard? for darrenfuller. 06-05-2020 12:48 AM
- Karma Are there any plans to build Splunk Enterprise for ARM platforms? for martinsegeth. 06-05-2020 12:48 AM
- Got Karma for How to configure HTTP Event Collector (HEC) with _TCP_ROUTING to forward data to a specified outputs group, not default?. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
03-02-2022
07:54 AM
Seeing ERROR message "may have returned partial results" from few indexers". Logs from those indexers are showing following error messages.
WARN CacheManagerHandler - Localization failure has been reported, cache_id="bid|index_name~8264~6A0ED00A-E4AB-4B46-9F69-CD517B4C8965|", sid="remote_*_1646235912.747477_6AFBB424-8451-40A4-A05C-A0337BDBC296", errorMessage='waitFor probe, cache_id="bid|index_name~8264~6A0ED00A-E4AB-4B46-9F69-CD517B4C8965|", did not localize all files before reaching download_status=idle files={"file_types":["tsidx","bloomfilter","deletes"]} local_files={"file_types":["dma_metadata","strings_data","sourcetypes_data","sources_data","hosts_data","lex","tsidx","bloomfilter","journal_gz","other"]} failure_code=0 failure_reason='
Any idea, whats causing this and how to fix it?
... View more
Labels
- Labels:
-
indexer clustering
09-16-2021
07:01 AM
Hi All, Any update on this issue? We were seeing this issue on 8.1.3 version, and continue to see after upgrading to 8.2.2.
... View more
08-26-2021
08:54 AM
So, 2 of our indexers sometime have very high I/O due to a known issue, but this is causing index queueing on all our 31 other indexers in same cluster. When we turn off the 2 indexers that are going to have high I/O, we dont see any issue. We are assuming that replication to these problem indexers are blocking other indexers and causing ripple effect across cluster. Is it expected that the cluster behaves this way? Are there any configuration to optimize or create dedicated threads only for replication with out blocking indexing and searching?
... View more
Labels
- Labels:
-
indexer clustering
12-14-2018
05:25 AM
Thanks for the inputs on this issue @Damien Dallimore
Could you please help with below scenario?
I am having similar issue running the app on splunk universal forwarder, running on s390x linux.
when I enable the app, it sends one set of jmx output and displays following error messages.
ERROR Can't connect to Splunk REST API with the token, either the token is invalid or SplunkD has exited : null
"ERROR It has been determined via the REST API that all inputs have been disabled"
and the PID from SPLUNK4JMX.pid file doesnt exist on running processes and doesnt trigger the modinput again ( I guess the inputs are disabled from the error message). Enabling app through command line triggers another one time jmx output.
... View more
07-02-2018
06:30 AM
Getting this error when using batch_save to update kvstore through Splunk python SDK.
This works fine when posting same content through curl, not sure if some limitation through splunk SDK. Anyone have any idea on quick fix?
File "/opt/splunk/etc/apps/adp_cmdb/bin/splunklib/client.py", line 3724, in batch_save
return json.loads(self._post('batch_save', headers=KVStoreCollectionData.JSON_HEADER, body=data).body.read().decode('utf-8'))
File "/opt/splunk/etc/apps/adp_cmdb/bin/splunklib/client.py", line 3615, in _post
return self.service.post(self.path + url, owner=self.owner, app=self.app, sharing=self.sharing, **kwargs)
File "/opt/splunk/etc/apps/adp_cmdb/bin/splunklib/binding.py", line 289, in wrapper
return request_fun(self, *args, **kwargs)
File "/opt/splunk/etc/apps/adp_cmdb/bin/splunklib/binding.py", line 71, in new_f
val = f(*args, **kwargs)
File "/opt/splunk/etc/apps/adp_cmdb/bin/splunklib/binding.py", line 742, in post
response = self.http.post(path, all_headers, **query)
File "/opt/splunk/etc/apps/adp_cmdb/bin/splunklib/binding.py", line 1208, in post
return self.request(url, message)
File "/opt/splunk/etc/apps/adp_cmdb/bin/splunklib/binding.py", line 1228, in request
raise HTTPError(response)
splunklib.binding.HTTPError: HTTP 400 Bad Request -- The provided query was invalid.
... View more
05-31-2018
06:43 AM
1 Karma
I had similar issue and it looks like all dashboards with <init> tag have this issue, splunk version I am using is 7.0.3. @splunk any defects logged on this?
This seem to be an issue on 7.1 version also.
... View more
05-17-2018
07:49 AM
Hi @outcoldman,
I am just reaching to you, if you are aware of recent updates with splunk logging driver? We are seeing that 4K char limit is not an issue any more when splunk-format is inline, but the raw format still has this issue. Appreciate, if you could share any updates or provide some pointers.
... View more
04-13-2018
10:39 AM
Thanks @ChrisG, any ETA on when this will be resolved.
... View more
04-13-2018
09:16 AM
login.splunk.com is not loading and gives error.
... View more
- Tags:
- splunk-enterprise
03-21-2018
07:47 PM
please try this.
index=juniper-mag host=abc.defg.net "Login succeeded" OR "Closed connection" | eval fields=split(_raw, " ") | eval user=mvindex(fields,14) | eval duration=mvindex(fields,23)| eval srcip=mvindex(fields, 13) | stats latest(_time) as time latest(duration) as duration by user,srcip | convert ctime(time) as time
... View more
03-21-2018
07:24 PM
checkbox is little different, even when its not selected the token is value is still set to something. Token should be unset for this to work. Do unset of token during init of dashboard and test it.
... View more
03-21-2018
04:29 AM
Change the format of the display through UI to click selection as "CELL", and use following tokens to send those name value pairs to destination link.
dirldownlink?$click.name2$=$click.value2$
... View more
03-21-2018
04:11 AM
@MousumiChowdhury, Summary indexing all 300 kpis may be the best option here.
Write 300 KPI search results every hour to same summary index.
If all 300 kpi are already scheduled and want to avoid modifying them all, try running a different scheduled search that scans for all 300 SIDs from internal logs and use map command with loadjob to load all results in single shot into a summary index.
Summary index should have kpiname and its measure value in each result
Run a search on summary index, use streamstats to measure running avg of past 30 days for each kpi and measure current values deviation, filter the results for curent time period and sort by deviation and show top results or results higher than a threshold. (Trellis layout with single value will give same look as ITSI service overview but there is a limit of 20 results)
... View more
03-20-2018
04:14 PM
Try using transforms and extract keys and values into different groups.
Enable multi value for the transforms
[keyvaluepairs]
REGEX = \{\"key\"\:\"([^\"]+)\",\"value\"\:\"([^\"]+)
FORMAT=$1::$2
and use above transforms like below in search
search | extract keyvaluepairs
... View more
03-20-2018
03:43 PM
Searches can also take depends token like the panels or rows.
search id="search1" depends="$checkbox$"
... View more
03-18-2018
08:42 PM
Yes, it can be done thru post processing searches.
Please check this link for more info.
http://docs.splunk.com/Documentation/Splunk/7.0.2/Viz/Savedsearches#Post-process_searches
... View more
12-12-2017
06:43 AM
Thanks @outcoldman, This helps a lot, we will wait new version of docker. Will also look at the app, it seems to resolve many of our issues.
Does the app require any docker volumes to be mounted to read log files?
... View more
12-11-2017
12:30 PM
We are using splunk logging driver to send docker container logs and some containers are sending log messages >4K bytes in a single line (like stack traces). We see them getting truncated in Splunk and want to check if any one aware of where the 4K limit is coming from?
Docker sends all logs to stdout and they get picked by logging driver, I saw in some linux forums that stdout pipe buffer limit is 4K, does anyone have more details on this how to resolve it?
... View more
10-28-2017
06:03 AM
5 Karma
This works for check box, it can set 2 different values for check and uncheck of a checkbox.
<input type="checkbox" token="toggle" searchWhenChanged="true">
<label>toggle</label>
<choice value="toggle checked">True</choice>
<default>toggle unchecked</default>
<change>
<condition match="isnull($toggle$)">
<set token="toggle">toggle unchecked</set>
</condition>
</change>
</input>
... View more
10-24-2017
02:36 PM
After lookup, expand you date field, using mvexpand command, and do your strptime & where functions.
|mvexpand date | eval Date=strptime(date,"%m/%d/%Y")
| where Date > relative_time(now(),"-21d@d")
... View more
10-24-2017
02:32 PM
Thats is possible, but you need to convert pubdate from string to time field like below.
| eval pubdate_time=strptime(pubdate, "%Y-%m-%d %H:%M:%S") | bin span=6h pubdate_time
... View more
10-23-2017
05:03 PM
There is no direct way, since its an array of json objects, and each field is multivalue field. You would probably want wNow value along with other values in the same array right?
Need to break each json object as individual json event and following search helps do that.
your search | rex mode=sed "s/^\{\"\w+\"\:\s*\[//g"
| rex mode=sed "s/\]\}$//g"
| rex mode=sed "s/\},\{/}\n{/g"
| multikv noheader=t
first line above removes this text from the event "{"consumption": [
second line removes ]}
third line inserts new line char between each json object in json array.
fourth one breaks each line in to separate event.
... View more
10-14-2017
06:11 AM
you can use earliest(_time) and latest(_time) for each host, all hosts with earliest as today are new added servers and server with latest as yesterday are removed today.
... View more
10-13-2017
06:05 AM
This should work..
\ submissions_wmf(Submission)` detail.isManualChange=true NOT ( detail.changeType=ChangeBank OR detail.changeType=ChangeBIK OR detail.changeType=ChangeOtherIncome OR detail.changeType=ChangeSocialSecurityBenefit OR detail.changeType=HaveBenefitsEnded OR detail.changeType=HavePartnerBenefitsEnded)
| stats count list(detail.changeType) as ChangeType by detail.id | eval ChangeType=mvjoin(ChangeType,"_") | eventstats sum(count) as combinationcount by ChangeType`
... View more
10-11-2017
06:39 PM
This search can dynamically look for data 7 days back same hour and minute,
|makeresults count=2 | streamstats count |eval count=count-1 | addinfo |eval timediff=(24*3600*7*count) | eval latest=info_max_time-timediff| eval earliest=info_min_time-timediff | map search="search earliest=$earliest$ latest=$latest$ index=os sourcetype=cpu | bin span=5m _time | stats avg(cpu) as cpu by _time,host | eval _time=_time+$timediff$ | eval pw_no=$count$" | eval w{pw_no}=cpu | stats values(w*) as w* by _time,host | eval pct_increase=((w0-w1)/w1)*100 | where pct_increase>20
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-31-2024
05:29 PM
|
Karma given to
