About ialahdal

venkatasri · ‎08-18-2021

@ialahdal If SHC instances are using the self-signed certs they might need to be trusted on F5 VIP. Similarly check if SSL enabled on F5 VIP and having the right cert installed matching https://shc.com etc. There is no action required on Splunk end as long as you are able to reach out individual SH instances via https. --- An upvote would be appreciated if this reply helps!

tzvifriedman · ‎07-15-2021

I've been searching for days for a solution to this. And to anyone else that comes across this, this is a problem for any add-on, not just the one in question. This worked like a charm. As a shortcut to find all your passwords.conf files, you can do sudo find /opt/splunk/etc/apps/ -name passwords.conf and if you want to delete them all, sudo find /opt/splunk/etc/apps/ -name passwords.conf | xargs rm then restart splunk

mhoustonludlam_ · ‎06-10-2020

Ideally you want to have twice the number of input pipelines as you have indexer cluster members. If you are using two HFs for input, then these should be configured for at least 4 parallel ingestion pipelines per HF. Depending on your HF hardware resources, you can run a large number of parallel pipelines (e.g., 8 or more) to get a more even data distribution. Keep in mind like the other comments: if you have only one input stream then this will possibly not help you. Line breaker and event breaker are you friends here too.

ialahdal · ‎02-12-2020

I solved this by using EVAL in props.conf EVAL-url = if(isnull(contact_type),url,url . "/NIN/contactType/" . contact_type) transforms.conf [uri_path_1] REGEX = uri":"(?<url>[\/A-Za-z]+) [uri_path_2] REGEX = uri":"(?<url>[\/A-Za-z]+)\?id=(?<NIN>\w+)&contactType=(?<contact_type>\w+)

niketn · ‎01-14-2020

@ialahdal refer to one of my older answer with two options available in Splunk Enterprise. See if one of them works for you https://answers.splunk.com/answers/607729/dashboard-to-display-varied-graph-types-on-a-singl.html

ialahdal · ‎01-14-2020

Thanks to you and @kamlesh_vaghela, I think isnull is making values null, using isnotnull like you mentioned did get me to the results I needed eventually. Thanks.

to4kawa · ‎01-07-2020

(index=1 client_ip=*) OR (index=2 ip=*) | eval IP=coalesce(ip,client_ip) | stats values(host) as host values(port) as port dc(index) as check by IP | where check > 1 Hi, @ialahdal please try this.

ialahdal · ‎01-14-2020

This helped, thank you.

ialahdal · ‎11-06-2019

I was able to do this simply by adding each service as a dependent on the other one, I'm sure I can figure out their weights on each other once I have the KPIs and thresholds I need, thank you for your answer.

to4kawa · ‎10-23-2019

So that's it. It will be helpful. Thanks.

richgalloway · ‎10-10-2019

I recommend Splunk not share the same file system as the root directory. This is especially important if $SPLUNK_DB is also in the root directory. The goal is to prevent a full Splunk directory from preventing the OS from functioning normally. I've also seen the reverse happen, that is large OS files consumed enough disk space to put Splunk below its minimum free space and so it stopped running searches.

ialahdal · ‎10-13-2019

What I was looking for is closer to index="test" | stats dc(sourcetype) by sourcetype but thanks I was able to find this because of your answer.

Posts	23
Solutions	2
Karma Given	1
Karma Received	6
Member Since	‎10-09-2019

Online Status	Offline
Date Last Visited	‎08-24-2021 12:41 AM

SSL communication between F5 VIP and SHC

BMC Remedy add on in a search head cluster

Regex concatenation in props & transforms

Timechart mouse over

Return value based on missing field

compare two different fields from different indexe...

regex field extraction

Two way dependency ITSI

Compare values from log and lookup

Load balancing intermediate forwarders

Re: SSL communication between F5 VIP and SHC

Re: BMC Remedy add on in a search head cluster

Re: Load balancing intermediate forwarders

Re: Regex concatenation in props & transforms

Re: Timechart mouse over

Re: Return value based on missing field

Re: compare two different fields from different in...

Re: regex field extraction

Re: Two way dependency ITSI

Re: Compare values from log and lookup

Re: Impacts of installing splunk in root vs opt

Re: How to list all sourcetypes