Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About rxdeleon
rxdeleon
Explorer
Member since:
02-16-2011
01-15-2025
Community Statistics
| Posts | 19 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 3 |
| Member Since | 02-16-2011 |
Activity Feed
- Karma Re: Round result of timechart avg() for siddhusaus. 01-14-2025 01:52 PM
- Got Karma for Re: Is the automatic lookup table used by the indexer?. 06-05-2020 12:50 AM
- Got Karma for Can Splunk DB Connect v3.x and TA-OMS_Inputs co-exist?. 06-05-2020 12:49 AM
- Got Karma for What is the default value for maxConcurrentOptimizes?. 06-05-2020 12:46 AM
- Posted Re: Is the automatic lookup table used by the indexer? on Splunk Search. 01-17-2019 05:48 AM
- Posted Re: Is the automatic lookup table used by the indexer? on Splunk Search. 01-16-2019 02:06 PM
- Posted Re: Extremely confused with :: vs = on Knowledge Management. 01-16-2019 01:50 PM
- Posted Re: Is the automatic lookup table used by the indexer? on Splunk Search. 01-10-2019 09:51 AM
- Posted Is the automatic lookup table used by the indexer? on Splunk Search. 01-10-2019 09:21 AM
- Tagged Is the automatic lookup table used by the indexer? on Splunk Search. 01-10-2019 09:21 AM
- Posted Can I configure a Heroku log drain to send data to an on-prem Splunk indexer cluster? on All Apps and Add-ons. 06-20-2018 07:47 AM
- Tagged Can I configure a Heroku log drain to send data to an on-prem Splunk indexer cluster? on All Apps and Add-ons. 06-20-2018 07:47 AM
- Tagged Can I configure a Heroku log drain to send data to an on-prem Splunk indexer cluster? on All Apps and Add-ons. 06-20-2018 07:47 AM
- Posted Re: Do I need to back up the UF fishbucket? on Getting Data In. 06-12-2018 08:41 AM
- Posted Do I need to back up the UF fishbucket? on Getting Data In. 06-11-2018 10:27 AM
- Tagged Do I need to back up the UF fishbucket? on Getting Data In. 06-11-2018 10:27 AM
- Posted Re: Can Splunk DB Connect v3.x and TA-OMS_Inputs co-exist? on All Apps and Add-ons. 03-12-2018 08:49 AM
- Posted Re: Can Splunk DB Connect v3.x and TA-OMS_Inputs co-exist? on All Apps and Add-ons. 03-06-2018 08:38 AM
- Posted Re: Can Splunk DB Connect v3.x and TA-OMS_Inputs co-exist? on All Apps and Add-ons. 03-05-2018 10:57 AM
- Posted Can Splunk DB Connect v3.x and TA-OMS_Inputs co-exist? on All Apps and Add-ons. 02-22-2018 07:43 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
01-17-2019
05:48 AM
1 Karma
Thanks for the Cribl info, @skoelpin. I'll check it out.
... View more
01-16-2019
02:06 PM
@skoelpin, I understand that the automatic lookup logic will be applied at search time. But which component does that? Is it the search head or the indexer? If it's the search head, then that means the search results, no matter how big, would be sent to the search head where the automatic lookup logic would be applied.
I would wish that it's the indexer that does it so that extracted fields could be used to filter out irrelevant events to minimize data being sent back to the search head (for performance reasons).
... View more
01-16-2019
01:50 PM
I'm running into this same issue and have not found a solution. Was Splunk Support able to help you resolve it?
... View more
01-10-2019
09:51 AM
Thanks, skoelpin, for the quick reply. If that's the case, does that mean that the raw data found by the indexer would all be shipped to the search head? And that's where the lookup table would be applied?
... View more
01-10-2019
09:21 AM
When an automatic lookup table is defined, is that used by the indexer to add the new fields or is it the search head that does that?
... View more
- Tags:
- splunk-enterprise
06-20-2018
07:47 AM
I'm trying to get the Heroku logs indexed into our on-prem indexers but the issue is setting up the firewalls to allow the traffic from Heroku in. I asked for Heroku IP addresses that could be whitelisted by the Network team but those, I was told, are not available and cannot be provided.
If that's true, how do we securely allow Heroku traffic through our firewalls?
... View more
06-11-2018
10:27 AM
I would just like to know if it is necessary to back up the UF fishbucket. Is there any reason I would need to restore it other than not indexing log data more than once?
... View more
- Tags:
- splunk-enterprise
03-12-2018
08:49 AM
Hi Michael,
The Splunk DB Connect is now working properly after removing the requests folder.
Thanks for your help.
Rex
... View more
03-06-2018
08:38 AM
Sorry but I'm not sure I understand. Is there another TA or app that I need to install along with TA-OMS_Inputs?
... View more
03-05-2018
10:57 AM
Hello @jkat54. Did you get the chance to look into this issue? Thank you so much for your time.
... View more
02-22-2018
07:43 AM
1 Karma
I've just installed the add-on TA-OMS_Inputs and it appears to be incompatible with Splunk DB Connect. I get the below error when I access the DB Connect app.
Traceback (most recent call last): File "/opt/splunk/bin/rest_handler.py", line 79, in <module> print splunk.rest.dispatch(**params) File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/init.py", line 149, in dispatch module = import('splunk.rest.external.%s' % parts[0], None, None, parts[0]) File "/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxproxy.py", line 4, in <module> import requests File "/opt/splunk/etc/apps/TA-OMS_Inputs/bin/requests/init.py", line 43, in <module> import urllib3 ImportError: No module named urllib3
@jkat54
Splunk DB Connect v3.1.2
TA-OMS_Inputs v1.1
Oracle JRE 1.8_162
... View more
02-27-2014
01:16 PM
Here's a snippet of a long XML file. I would like to extract the keys such as id, status, error_sequence_number, etc. then assign the value as indicated by the string "value=".
... View more
- Tags:
- xml
04-26-2012
12:33 PM
I see almost 300 *.tsidx files but I don't see splunk-optimize running. Is there a log file where splunk-optimize writes to?
... View more
04-25-2012
08:23 AM
1 Karma
If the parameter maxConcurrentOptimizes is not defined for an index in indexes.conf, will Splunk assign a value for it at runtime?
... View more
04-25-2012
07:34 AM
I keep on getting the following message. Which "disk space" is this message referring to? The /var/splunk filesystem currently has 20 GB of free space.
"applying indexing throttle for /var/splunk/mck-app-log/db because bucket has too many tsidx files, is your splunk-optimize working? splunk-optimize may be prevented from running if the minimum disk space usage limit is reached."
... View more
04-19-2012
12:08 PM
I have just upgraded my dev Splunk instance to the latest release (4.3.1, build 119532) and realized that my saved searches are no longer able to run successfully. After much checking, I have come to the conclusion that spaces in my username are causing the saved searches to fail. This is not the case for my other Splunk server running a lower version (4.2.3 build 105575).
Regarding the user accounts, they were added through LDAP integration.
Has anyone experienced this before? If so, how were you able to fix it?
... View more
- Tags:
- savedsearch
- v4.3.1
07-06-2011
01:46 PM
I would like to know the quickest way to count the number of hosts that have sent data to the indexer for the last 7 days.
... View more
