Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About ohoppe
ohoppe
Path Finder
Member since:
03-15-2013
01-23-2023
Community Statistics
| Posts | 12 |
| Solutions | 5 |
| Karma Given | 16 |
| Karma Received | 11 |
| Member Since | 03-15-2013 |
Activity Feed
- Karma Where is the Splunk Forwarder older versions page? for Ant1D. 06-05-2020 12:48 AM
- Karma Re: Where is the Splunk Forwarder older versions page? for Richfez. 06-05-2020 12:48 AM
- Karma Re: Where is the Splunk Forwarder older versions page? for piebob. 06-05-2020 12:48 AM
- Karma Re: Can I connect to Impala (SQL engine on Hadoop) from DB Connect? for rdagan_splunk. 06-05-2020 12:48 AM
- Karma Re: How to create a dynamic drop-down based on field? for somesoni2. 06-05-2020 12:48 AM
- Got Karma for Re: Where is the Splunk Forwarder older versions page?. 06-05-2020 12:48 AM
- Got Karma for Re: Can I download splunkforwarder by using curl ?. 06-05-2020 12:48 AM
- Got Karma for Re: Can I download splunkforwarder by using curl ?. 06-05-2020 12:48 AM
- Got Karma for Re: Can I download splunkforwarder by using curl ?. 06-05-2020 12:48 AM
- Got Karma for Re: Can I download splunkforwarder by using curl ?. 06-05-2020 12:48 AM
- Got Karma for Re: Can I download splunkforwarder by using curl ?. 06-05-2020 12:48 AM
- Got Karma for Re: How to create a dynamic drop-down based on field?. 06-05-2020 12:48 AM
- Karma Re: How to resend lost data between two splunk servers? for marios_kstone. 06-05-2020 12:47 AM
- Got Karma for Re: How to resend lost data between two splunk servers?. 06-05-2020 12:47 AM
- Got Karma for Re: How to resend lost data between two splunk servers?. 06-05-2020 12:47 AM
- Got Karma for Re: How to resend lost data between two splunk servers?. 06-05-2020 12:47 AM
- Got Karma for Re: How to extract a JSON object which is in double quotes?. 06-05-2020 12:47 AM
- Karma How can I find all duplicate bucket id's that are causing conflicts in my index? for jbsplunk. 06-05-2020 12:46 AM
- Karma Re: What are the hardware requirements for a cluster master? for dwaddle. 06-05-2020 12:46 AM
- Karma performance considerations for eventtypes? for Lowell. 06-05-2020 12:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
06-19-2017
09:22 AM
That was actually the solution beside another problem I had with the Impala configuration on the Hadoop Cluster. Thanks rdagan.
... View more
06-09-2017
05:17 AM
Hi,
at the moment i am trying to get the impala jdbc driver working with DB connect 3.0.3.
I applied the above configuration and the driver appears in the listing. Adding a new connection results in an error message when saving it.
There was an error processing your request. It has been logged (ID d148a7f864f1079a).
looking up the id in the dbx server log
2017-06-09 13:13:11.706 +0100 [dw-101 - POST /api/connections/status] ERROR io.dropwizard.jersey.errors.LoggingExceptionMapper - Error handling a request: d148a7f864f1079a
java.lang.NoClassDefFoundError: Could not initialize class com.cloudera.impala.impala.core.ImpalaJDBCDriver
at java.lang.Class.forName0(Native Method)
at java.lang.Class.forName(Class.java:264)
at com.cloudera.impala.dsi.core.impl.DSIDriverFactory.createDriver(DSIDriverFactory.java:52)
at com.cloudera.impala.jdbc.common.AbstractDriver.doInitialize(AbstractDriver.java:471)
at com.cloudera.impala.jdbc.common.AbstractDriver.connect(AbstractDriver.java:207)
at com.splunk.dbx.service.driver.DelegatingDriver.connect(DelegatingDriver.java:23)
at java.sql.DriverManager.getConnection(DriverManager.java:664)
at java.sql.DriverManager.getConnection(DriverManager.java:208)
at com.splunk.dbx.connector.ConnectorFactory.getConnectionWithoutPool(ConnectorFactory.java:260)
at com.splunk.dbx.connector.ConnectorFactory.getConnection(ConnectorFactory.java:233)
at com.splunk.dbx.connector.ConnectorFactory.create(ConnectorFactory.java:141)
at com.splunk.dbx.server.api.service.database.impl.DatabaseMetadataServiceImpl.getStatus(DatabaseMetadataServiceImpl.java:133)
at com.splunk.dbx.server.api.service.database.impl.DatabaseMetadataServiceImpl.getConnectionStatus(DatabaseMetadataServiceImpl.java:111)
at com.splunk.dbx.server.api.resource.ConnectionResource.getConnectionStatusOfEntity(ConnectionResource.java:66)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory$1.invoke(ResourceMethodInvocationHandlerFactory.java:81)
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:144)
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:161)
at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:205)
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:99)
at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:389)
at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:347)
at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:102)
at org.glassfish.jersey.server.ServerRuntime$2.run(ServerRuntime.java:326)
at org.glassfish.jersey.internal.Errors$1.call(Errors.java:271)
at org.glassfish.jersey.internal.Errors$1.call(Errors.java:267)
at org.glassfish.jersey.internal.Errors.process(Errors.java:315)
at org.glassfish.jersey.internal.Errors.process(Errors.java:297)
at org.glassfish.jersey.internal.Errors.process(Errors.java:267)
at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:317)
at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:305)
at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:1154)
at org.glassfish.jersey.servlet.WebComponent.serviceImpl(WebComponent.java:473)
at org.glassfish.jersey.servlet.WebComponent.service(WebComponent.java:427)
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:388)
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:341)
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:228)
at io.dropwizard.jetty.NonblockingServletHolder.handle(NonblockingServletHolder.java:49)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1689)
at io.dropwizard.servlets.ThreadNameFilter.doFilter(ThreadNameFilter.java:34)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1676)
at io.dropwizard.jersey.filter.AllowedMethodsFilter.handle(AllowedMethodsFilter.java:50)
at io.dropwizard.jersey.filter.AllowedMethodsFilter.doFilter(AllowedMethodsFilter.java:44)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1676)
at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:581)
at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1174)
at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:511)
at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1106)
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:134)
at com.codahale.metrics.jetty9.InstrumentedHandler.handle(InstrumentedHandler.java:240)
at io.dropwizard.jetty.RoutingHandler.handle(RoutingHandler.java:51)
at org.eclipse.jetty.server.handler.gzip.GzipHandler.handle(GzipHandler.java:396)
at io.dropwizard.jetty.BiDiGzipHandler.handle(BiDiGzipHandler.java:68)
at org.eclipse.jetty.server.handler.RequestLogHandler.handle(RequestLogHandler.java:56)
at org.eclipse.jetty.server.handler.StatisticsHandler.handle(StatisticsHandler.java:169)
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:134)
at org.eclipse.jetty.server.Server.handle(Server.java:524)
at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:319)
at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:253)
at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:273)
at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:95)
at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:186)
at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:273)
at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:95)
at org.eclipse.jetty.io.SelectChannelEndPoint$2.run(SelectChannelEndPoint.java:93)
at org.eclipse.jetty.util.thread.strategy.ExecuteProduceConsume.executeProduceConsume(ExecuteProduceConsume.java:303)
at org.eclipse.jetty.util.thread.strategy.ExecuteProduceConsume.produceConsume(ExecuteProduceConsume.java:148)
at org.eclipse.jetty.util.thread.strategy.ExecuteProduceConsume.run(ExecuteProduceConsume.java:136)
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:671)
at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:589)
at java.lang.Thread.run(Thread.java:745)
I checked that the DB Connect itself is working correctly by connecting it via JDBC to an Oracle instance. I checked that impala itself is working correctly by using hue to query the impala interface.
Can you or anyone share how you got the JDBC driver running. I don't understand that there is a java.lang.NoClassDefFoundError. I placed the ImpalaJDBC4.jar in the drivers folder and any additional jars shipped with the zip file under jars and as well tried it under drivers as well.
Thanks for any hint.
Oliver
... View more
03-18-2016
03:02 AM
Hi,
i wanted to adapt my notification settings for answer.splunk.com. Whenever i hit save or disable notifcations i get back a 500 server error. Can someone from the web team please check that issue as i am getting flooded by mails. I tried with two different browser with a fresh sign in token.
Thanks
Oliver
... View more
- Tags:
- account
- notification
03-16-2016
06:22 AM
1 Karma
Hi,
here you go.
<form>
<label>foobar</label>
<fieldset submitButton="false">
<input type="dropdown" token="ip">
<label>IP</label>
<search>
<query>|metasearch source="tcp:4545" | dedup host| stats count by host</query>
</search>
<fieldForLabel>host</fieldForLabel>
<fieldForValue>host</fieldForValue>
</input>
</fieldset>
<row>
<panel>
<event>
<title>foo</title>
<search>
<query>index=_internal source="tcp:4545" host=$ip$</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="count">10</option>
<option name="list.drilldown">full</option>
<option name="list.wrap">1</option>
<option name="maxLines">5</option>
<option name="raw.drilldown">full</option>
<option name="rowNumbers">0</option>
<option name="table.drilldown">all</option>
<option name="table.wrap">1</option>
<option name="type">list</option>
<fields>["host","source","sourcetype"]</fields>
</event>
</panel>
</row>
</form>
BR
Oliver
... View more
03-15-2016
09:11 AM
5 Karma
Hi Hiroshi,
of course you can.
Assuming you want to download splunkforwarder-6.3.3-f44afce176d0-linux-2.6-amd64.deb - you can simply copy paste the wget link that is shown on the download page.
The wget looks like: wget -O splunkforwarder-6.3.3-f44afce176d0-linux-2.6-amd64.deb 'http://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=6.3.3&product=universalforwarder&filename=splunkforwarder-6.3.3-f44afce176d0-linux-2.6-amd64.deb&wget=true'
Just change the wget -O to curl -L -o
The final command should look like
curl -L -o splunkforwarder-6.3.3-f44afce176d0-linux-2.6-amd64.deb 'http://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=6.3.3&product=universalforwarder&filename=splunkforwarder-6.3.3-f44afce176d0-linux-2.6-amd64.deb&wget=true'
That's all.
BR
Oliver
... View more
03-08-2016
04:47 AM
1 Karma
Hi,
the page disappeared. I was downloading older universal forwarders some days ago.
http://www.splunk.com/page/previous_releases just has the full versions available.
Can someone from Splunk please highlight that internally? I need different older forwarder versions as well very soon.
BR
Oliver
... View more
03-04-2016
07:50 AM
3 Karma
Ciao Mario,
best wishes from your Brother Matteo. 🙂
Actually i have something similar in place where certain summary searches are routed to another cluster. In case of a downtime of that second cluster i need to backfill of course.
As you would like to backfill that data gap that resides only on A and should be ingested in B you can simply search the data you would like to backfill by a search command and set some additional meta attributes or overwrite existing ones using the collect command which will write into the correct destination index that does not neccesarly have to reside on A . Using transforms.conf , props.conf and outputs.conf you can route the events to B . I assume this search would be done from a Search Head or Search Head Cluster so the configuration would be even independent from the Indexer A configuration and should not be in conflict.
As an example:
search: index=i1 source=s1 sourcetype=st1 host=h1| fields _raw| collect index=i2 source=s2 sourcetype=st2 host=h2
Additionally you would need to have the correct configurations in place to forward the data.
props.conf
[st2]
TRANSFORMS-routing = route_backfill_to_b
transforms.conf
[route_backfill_to_b]
SOURCE_KEY = MetaData:Sourcetype
REGEX =st2
DEST_KEY = _TCP_ROUTING
FORMAT = cluster_b
outputs.conf
[tcpout:cluster_b]
autoLB = true
disabled = false
server = 1.1.1.1:9997, 2.2.2.2:9997
Of course you should be able to apply any additional transformations on the data if required either by overwriting _raw or by additional transforms.
The above should just give you a direction and has not been tested in that special case.
I hope that helps.
BR
Oliver
... View more
01-27-2016
05:29 AM
1 Karma
Hi,
here you go. The important bit is the line with the rex command. The rest of it I just used to simulate the event and present the result.
|stats count|eval count="2016-01-20 17:40:38,076 INFO org.apache.log4j.Logger transaction_id=\"1234565\"
Json_object = \"{
\"requestId\": \"123\",
\"partnerId\": \"asd\",
\"date\":\"01/01/2015 14:00:00\"
}\"
tmepId =\"123\""|
rex field=count "(?s)\"(?{.*})\""
|table count myjson|spath input=myjson
BR
Oliver
... View more
02-17-2015
04:17 AM
Have you been able to fix the described issue? I am currently facing the same, but it is not an option to extract the files as they are produced directly as gz due to lack of disk space.
Thanks
Oliver
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-23-2023
01:45 PM
|
Karma from
