Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About csprice
csprice
Path Finder
Member since:
12-15-2016
06-05-2020
Community Statistics
| Posts | 14 |
| Solutions | 1 |
| Karma Given | 2 |
| Karma Received | 1 |
| Member Since | 12-15-2016 |
Activity Feed
- Karma Re: Using an app generated log file, how to generate a search that will determine and visualize a host's running status? for richgalloway. 06-05-2020 12:48 AM
- Karma Re: Search Head Cluster Error - acceptPush: non-200 status_code=400 for abalogh_splunk. 06-05-2020 12:48 AM
- Got Karma for Is there a concise guide for migrating an ITSI search head to a search head cluster?. 06-05-2020 12:48 AM
- Posted Re: Generate a lookup for EPS on Splunk Search. 01-15-2020 07:14 AM
- Posted Re: Generate a lookup for EPS on Splunk Search. 01-15-2020 05:09 AM
- Posted Re: Generate a lookup for EPS on Splunk Search. 01-14-2020 12:30 PM
- Posted Generate a lookup for EPS on Splunk Search. 01-14-2020 11:44 AM
- Tagged Generate a lookup for EPS on Splunk Search. 01-14-2020 11:44 AM
- Tagged Generate a lookup for EPS on Splunk Search. 01-14-2020 11:44 AM
- Tagged Generate a lookup for EPS on Splunk Search. 01-14-2020 11:44 AM
- Posted Re: Is ITSI license limited on the number of SH's it will authorize? on Installation. 12-06-2017 06:29 AM
- Posted Re: Is ITSI license limited on the number of SH's it will authorize? on Installation. 12-06-2017 05:49 AM
- Posted Is ITSI license limited on the number of SH's it will authorize? on Installation. 12-05-2017 11:53 AM
- Tagged Is ITSI license limited on the number of SH's it will authorize? on Installation. 12-05-2017 11:53 AM
- Tagged Is ITSI license limited on the number of SH's it will authorize? on Installation. 12-05-2017 11:53 AM
- Tagged Is ITSI license limited on the number of SH's it will authorize? on Installation. 12-05-2017 11:53 AM
- Posted Re: Is there a concise guide for migrating an ITSI search head to a search head cluster? on Installation. 04-26-2017 08:34 AM
- Posted Is there a concise guide for migrating an ITSI search head to a search head cluster? on Installation. 04-26-2017 05:49 AM
- Tagged Is there a concise guide for migrating an ITSI search head to a search head cluster? on Installation. 04-26-2017 05:49 AM
- Tagged Is there a concise guide for migrating an ITSI search head to a search head cluster? on Installation. 04-26-2017 05:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
01-15-2020
07:14 AM
Utilizing some suggestions here and a little more digging, what I came up with was the following:
| tstats count as COUNT where index=firewall earliest=-7d by host, _time span=1s
| stats avg(COUNT) as eps by host
| eval eps=round(eps,2)
This produced the table I was after that I could then output to a lookup.
... View more
01-15-2020
05:09 AM
@to4kawa Thank you for your response, but this essentially does the same as my initial search. I'm looking for output similar to the one Rich Galloway put out - just one that looks at the network devices inside the firewall index.
... View more
01-14-2020
12:30 PM
Thank you Rich for your response. However, this isn't quite what I was after. This gave me a list of my splunk infrastructure and max eps.
I'm trying to look at my firewall index and pull out the hosts that are pushing data there. Then just keep track of their EPS. That way I can run a correlation search to check and see when/if their EPS falls off to create a notable in ES.
... View more
01-14-2020
11:44 AM
Hello.
I have an index with traffic from 10 devices. I want to generate a lookup that contains the avg EPS over the course of 7 days utilizing tstats.
my current search - cobbled together from scouring answers:
| tstats count as COUNT where index=firewall earliest=-7d by _time, host span=1s
| timechart span=1h max(COUNT) as eps by host
kind of works, but spits out >50000 rows. What I'd like is a host - xxx eps looking over the past 7 days.
Any pointers would be appreciated
... View more
12-06-2017
06:29 AM
Also, it's not a license violation - it's an invalid license warning on just one instance that hops from shc member to shc member.
... View more
12-06-2017
05:49 AM
They are connected to the license master.
... View more
12-05-2017
11:53 AM
We have an ITSI instance with a 4 member SHC and a 4 member indexer cluster.
Every day one of the SHC members complains that it doesn't have a valid ITSI license. Restarting splunk seems to cause this error to go away but move to a different SHC member.
Looking in the itsi_license_checker.log across all 4 instances, you can see the error travel between the server with one and only one instance complaining that the "Splunk instance does not have a valid license for IT Service Intelligence."
Checking the license master - both the Splunk Enterprise and Splunk ITSI Perpetual licenses show up and have an expiration of more than 20 years from now.
Any thoughts on why this is happening?
... View more
Labels
- Labels:
-
indexer
-
license
-
search head
04-26-2017
08:34 AM
Alright, I've had some limited success with regard to this issue.
The steps I've completed are as follows:
- build the SHC (this is the easy part)
- ensured /local configurations were maintained across original and new (authentication, authorization, etc)
- used the process detailed here: http://docs.splunk.com/Documentation/Splunk/6.5.2/DistSearch/Migratefromstandalonesearchheads This got some of the config across, but my KPI's weren't appearing
- finally used: https://docs.splunk.com/Documentation/ITSI/2.6.0/Configure/kvstore_to_json.pyoperations (this, as noted by the name, allows you to backup the kvstore and move it to the new cluster)
I'm still fighting a couple things (glass tables are not showing up on the new cluster) but I'm close. Hopefully this gives someone a point in the right direction.
... View more
04-26-2017
05:49 AM
1 Karma
I looked at the install guide for ITSI into a SHC as well as a doc for migrating from a single search head to a SHC. However, trying to parse together the steps and being successful has been problematic.
I've searched a ton and been unable to find a doc that addresses this specific use case. It doesn't seem like it would be a unique scenario. Can anyone point me to a guide for accomplishing this migration?
Thank you,
Steve
... View more
Labels
- Labels:
-
search head
02-25-2017
06:46 AM
We're running 6.5.1. I'll go deeper in the logs on Monday to verify errors or warnings.
I did as you mentioned. Stopped splunk, ran the rebuild, and restarted splunk. Same issue remains. I also tried the full stop and complete restart of the cluster (it's a dev system) same issue remains.
... View more
02-24-2017
08:33 AM
Thank you for the response.
I saw that post and didn't feel it was applicable as the "bucket is not serviceable" msg had been around for at least a couple days since I noticed it.
In addition we haven't done any data thawing or messing with the data at all.
... View more
02-24-2017
08:13 AM
Hello.
I have a 2 node indexer cluster and all data is searchable. However I cannot get the search factor or replication factor to resolve due to, what appears to be, a single bucket.
When I look at Fixup Tasks - Pending I have a single task in search, replication and generation all complaining their Current State as "cannot fix up as bucket is not serviceable"
Trigger condition for search and rep is: add peer=(bucket-x) commit lone vote
Trigger condition for Generation is: non-streaming failure - src=(bucket-x) tgt=(bucket-y) failing=tgt
I have run Splunk rebuild against the path to the bucket and it seemed to finish without kicking errors. However, obviously, this didn't resolve the issue.
Thanks for any ideas.
... View more
12-15-2016
11:20 AM
Fantastic. Did exactly what I was after. Thank you!
... View more
12-15-2016
09:20 AM
I'll include the "Splunk newb here" disclaimer to start off with...
I have an agent that drops a new event every 50 - 55 seconds to a log file. I'm already pulling a few reports off this log, but what I'd like to do is use this log to tell if the agent is active. So far I have the following query (which I found on Answers):
index=my_index sourcetype=my_sourcetype
| stats latest(_time) as latestTime by host source
| eval latestTime=strftime(latestTime,"%x %X")
This gives me a table that displays host, source, and latest time an event was registered in that file.
What I'd like to do from here is perform an eval of some sort where if the latest time is older than 5m indicate the host that is missing is down. I'd like to display it... somehow. A pie chart was my initial thought.
Any help would be appreciated.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
