About jonathon

jonathon · ‎10-06-2017

It may not be the most elegant solution, but I changed the log level for HttpListener to provide less clutter in my splunkd.log using the splunk set log-level HttpListener -level FATAL -auth admin:admn_pw command

jonathon · ‎04-01-2016

Is there an updated link for innovato? This link is desd.

jonathon · ‎01-28-2016

I saw this issue on a 6.2.3 Search Head Cluster (5 nodes). I originally downloaded and distributed the Cookie.py but it didn't fix the issue, the problem is that the Cookie.py was a 6.3.x version instead of 6.2.3. The fix for me was to apply the manual fix of changing _LegalCharsPatt. After the edit, the diff results were as follows: 529,530c529 < #LegalCharsPatt = r"[\w\d!#%&'~`><@,:/\$*+-.^|)(\?}{=]" < LegalCharsPatt = r"[\w\d!#%&'~`><@,:/\$*+-.^|)(\?[]}{=]" >LegalCharsPatt = r"[\w\d!#%&'~`><@,:/\$*+-.^|)(\?}{=]" distributing this to each cluster member and restarting each (captain last) corrected the issue for our environment.

jonathon · ‎10-14-2015

Yes, I'm not using indexed field extractions, this was just for the UI/search extracting at search time. What worked for us was making sure that we had the following in the props.conf definition: KV_MODE = JSON and also maxcols = 2000 in limits.conf on our search heads. This combination resolved the issue for us.

jonathon · ‎05-18-2015

Is there an indexing performance gain by using one over the other? For instance, JSON formatted events?

jonathon · ‎07-17-2014

I'm getting these too across 64 indexers and am trying to determine what's causing it. I've walked through all of the my search peers and haven't found one with bad keys yet.

jonathon · ‎06-11-2014

We are looking to use ZFS. Is there any update on this or has anyone opened an enhancement request yet?

jonathon · ‎07-31-2013

I just had the same issue on a couple of my light forwarders, but without the "no space" message. I restarted the forwarders that that took care of the issue. I will update once I dig into this a little more.

jonathon · ‎08-06-2012

Thanks Chris, I've glanced at the "What Splunk logs about itself" topic once before. I'll go through it again. I looked it over before installing Splunk on Splunk. I'll also check out the admin guide topic. Thank you very much! Jonathon

jonathon · ‎08-06-2012

I am interested in finding out more about how the splunk processes (splunkweb, splunkd, etc) work together to provide the overall splunk service. This includes the various logfiles, and ports. I've looked through the splunk docs site and see quite a bit of information and manuals there but I'm looking for a bit more of a detailed overview than what I see here: http://www.splunk.com/view/SP-CAAABF9 and here: http://docs.splunk.com/Documentation/Splunk/latest/installation/Splunksarchitectureandwhatgetsinstalled Specifically, I'm looking for a deeper dive into ports, inter-communication and what to look for in truss/struss/strace, etc to determine how healthy the environment, and ultimately splunk service, is. Any help would be greatly appreciated.

jonathon · ‎07-31-2012

Is this still the preferred configuration not to use Big-IPs? Are there future plans to provide the ability to use them between the indexers and UF?

Posts	11
Solutions	0
Karma Given	4
Karma Received	3
Member Since	‎07-23-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Splunk Architecture Documentation

Re: After a clean install of Splunk IT Service Int...

Re: How can i convert SQL query to Splunk search?

Re: After upgrading a search head cluster to Splun...

Re: Field extraction: Is there a limit on the numb...

Re: What is the difference between LINE_BREAKER an...

Re: WARN AdminHandler:AuthenticationHandler - Deni...

Re: Are there plans for splunk to support zfs?

Re: Keep getting this error message on my Light Fo...

Re: Splunk Architecture Documentation

Splunk Architecture Documentation

Re: Using F5 BIG IP to load balance in front of in...